@open-mercato/onboarding 0.6.7-develop.6860.1.f796b22e80 → 0.6.7

package/generated/entity-fields-registry.ts

@@ -4,7 +4,6 @@ export const entityFieldsRegistry: Record<string, Record<string, string>> = {
     "onboarding_request": {
       "id": "id",
       "email": "email",
-      "email_hash": "email_hash",
       "token_hash": "token_hash",
       "status": "status",
       "first_name": "first_name",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@open-mercato/onboarding",
-  "version": "0.6.7-develop.6860.1.f796b22e80",
+  "version": "0.6.7",
   "license": "MIT",
   "type": "module",
   "main": "./dist/index.js",
@@ -70,13 +70,13 @@
     }
   },
   "peerDependencies": {
-    "@open-mercato/shared": "0.6.7-develop.6860.1.f796b22e80"
+    "@open-mercato/shared": "0.6.7"
   },
   "devDependencies": {
-    "@open-mercato/shared": "0.6.7-develop.6860.1.f796b22e80",
+    "@open-mercato/shared": "0.6.7",
     "@types/jest": "^30.0.0",
     "jest": "^30.4.2",
-    "ts-jest": "^29.4.12",
+    "ts-jest": "^29.4.11",
     "typescript": "7.0.2"
   },
   "publishConfig": {
@@ -86,6 +86,5 @@
     "type": "git",
     "url": "https://github.com/open-mercato/open-mercato",
     "directory": "packages/onboarding"
-  },
-  "stableVersion": "0.6.6"
+  }
 }

package/src/__tests__/service.test.ts

@@ -2,7 +2,6 @@ import { createHash } from 'node:crypto'
 import type { EntityManager } from '@mikro-orm/postgresql'
 import { OnboardingRequest } from '../modules/onboarding/data/entities'
 import { OnboardingService } from '../modules/onboarding/lib/service'
-import { hashForLookup, lookupHashCandidates } from '@open-mercato/shared/lib/encryption/aes'
 
 jest.mock('bcryptjs', () => ({
   hash: jest.fn().mockResolvedValue('hashed_password'),
@@ -128,21 +127,6 @@ describe('OnboardingService', () => {
       const result = await service.createOrUpdateRequest(makeStartInput())
       const createArgs = em.create.mock.calls[0][1]
       expect(createArgs.status).toBe('pending')
-      expect(createArgs.emailHash).toBe(hashForLookup('user@example.com'))
-    })
-
-    it('looks up encrypted and legacy plaintext emails without querying ciphertext as plaintext', async () => {
-      const em = createMockEm()
-      const service = new OnboardingService(em)
-
-      await service.createOrUpdateRequest(makeStartInput())
-
-      expect(em.findOne).toHaveBeenCalledWith(OnboardingRequest, {
-        $or: [
-          { emailHash: { $in: lookupHashCandidates('user@example.com') } },
-          { email: 'user@example.com', emailHash: null },
-        ],
-      }, undefined)
     })
 
     it('throws PENDING_REQUEST when within cooldown', async () => {

package/src/modules/onboarding/__integration__/TC-ONB-001-self-service-consent.spec.ts

@@ -1,7 +1,6 @@
 import { createHash, randomUUID } from 'node:crypto';
 import { expect, test } from '@playwright/test';
 import { withClient } from '@open-mercato/core/helpers/integration/dbFixtures';
-import { lookupHashCandidates } from '@open-mercato/shared/lib/encryption/aes';
 
 export const integrationMeta = {
   dependsOnModules: ['onboarding'],
@@ -27,15 +26,6 @@ type UserConsentRow = {
   granted_at: Date | null;
 };
 
-type PendingRequestAtRest = {
-  email: string;
-  email_hash: string | null;
-  first_name: string;
-  last_name: string;
-  organization_name: string;
-  password_hash: string;
-};
-
 const ONBOARDING_PASSWORD = 'IntegrationPass123!';
 const BASE_URL = process.env.BASE_URL?.trim() || 'http://localhost:3000';
 
@@ -50,32 +40,15 @@ async function replaceVerificationToken(email: string, token: string): Promise<s
          set token_hash = $2,
              expires_at = now() + interval '24 hours',
              updated_at = now()
-       where email_hash = any($1::text[])
+       where email = $1
        returning id`,
-      [lookupHashCandidates(email), hashToken(token)],
+      [email, hashToken(token)],
     );
     expect(result.rowCount, 'onboarding request should exist after submitting the form').toBe(1);
     return result.rows[0].id;
   });
 }
 
-async function readPendingRequestAtRest(email: string): Promise<PendingRequestAtRest> {
-  return withClient(async (client) => {
-    const result = await client.query<PendingRequestAtRest>(
-      `select email, email_hash, first_name, last_name, organization_name, password_hash
-         from onboarding_requests
-        where email_hash = any($1::text[])`,
-      [lookupHashCandidates(email)],
-    );
-    expect(result.rowCount, 'onboarding request should be queryable by its lookup hash').toBe(1);
-    return result.rows[0];
-  });
-}
-
-function expectEncryptedPayload(value: string): void {
-  expect(value).toMatch(/^[^:]+:[^:]+:[^:]+:v1$/);
-}
-
 async function readCompletedRequest(requestId: string): Promise<OnboardingRequestRow> {
   return withClient(async (client) => {
     const result = await client.query<OnboardingRequestRow>(
@@ -169,14 +142,6 @@ test.describe('TC-ONB-001: self-service onboarding with marketing consent', () =
     await expect(page.getByRole('status')).toContainText('Check your inbox');
     await expect(page.getByRole('status')).toContainText(email);
 
-    const pendingAtRest = await readPendingRequestAtRest(email);
-    expect(lookupHashCandidates(email)).toContain(pendingAtRest.email_hash);
-    expectEncryptedPayload(pendingAtRest.email);
-    expectEncryptedPayload(pendingAtRest.first_name);
-    expectEncryptedPayload(pendingAtRest.last_name);
-    expectEncryptedPayload(pendingAtRest.organization_name);
-    expectEncryptedPayload(pendingAtRest.password_hash);
-
     const requestId = await replaceVerificationToken(email, token);
     const verifyUrl = `${BASE_URL}/api/onboarding/onboarding/verify?token=${encodeURIComponent(token)}`;
 

package/src/modules/onboarding/__integration__/TC-ONB-002-multi-tenant-parallel-login.spec.ts

@@ -4,7 +4,6 @@
 import { createHash, randomUUID } from 'node:crypto';
 import { expect, test, type APIRequestContext, type Browser, type BrowserContext, type Page } from '@playwright/test';
 import { withClient } from '@open-mercato/core/helpers/integration/dbFixtures';
-import { lookupHashCandidates } from '@open-mercato/shared/lib/encryption/aes';
 
 export const integrationMeta = {
   dependsOnModules: ['onboarding'],
@@ -40,9 +39,9 @@ async function replaceVerificationToken(email: string, token: string): Promise<s
          set token_hash = $2,
              expires_at = now() + interval '24 hours',
              updated_at = now()
-       where email_hash = any($1::text[])
+       where email = $1
        returning id`,
-      [lookupHashCandidates(email), hashToken(token)],
+      [email, hashToken(token)],
     );
     expect(result.rowCount, `onboarding request should exist for ${email}`).toBe(1);
     return result.rows[0].id;

package/src/modules/onboarding/api/post/onboarding.ts

@@ -3,8 +3,6 @@ import { z } from 'zod'
 import type { EntityManager } from '@mikro-orm/postgresql'
 import { createRequestContainer } from '@open-mercato/shared/lib/di/container'
 import { createLogger } from '@open-mercato/shared/lib/logger'
-import { lookupHashCandidates } from '@open-mercato/shared/lib/encryption/aes'
-import { findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'
 import { getSecurityEmailBaseUrl, mapSecurityEmailUrlError } from '@open-mercato/shared/lib/url'
 import { loadDictionary } from '@open-mercato/shared/lib/i18n/server'
 import { defaultLocale, locales, type Locale } from '@open-mercato/shared/lib/i18n/config'
@@ -109,13 +107,7 @@ export async function POST(req: Request) {
     const container = await createRequestContainer()
     const em = (container.resolve('em') as EntityManager)
 
-    const existingUser = await findOneWithDecryption(em, User, {
-      deletedAt: null,
-      $or: [
-        { email: parsed.data.email },
-        { emailHash: { $in: lookupHashCandidates(parsed.data.email) } },
-      ],
-    })
+    const existingUser = await em.findOne(User, { email: parsed.data.email })
     if (existingUser) {
       const message = translate('onboarding.errors.emailExists', 'We already have an account with this email. Try signing in or resetting your password.')
       return NextResponse.json({

package/src/modules/onboarding/data/entities.ts

@@ -4,7 +4,6 @@ type OnboardingStatus = 'pending' | 'processing' | 'completed' | 'expired'
 
 @Entity({ tableName: 'onboarding_requests' })
 @Unique({ properties: ['email'] })
-@Unique({ properties: ['emailHash'] })
 @Unique({ properties: ['tokenHash'] })
 export class OnboardingRequest {
   @PrimaryKey({ type: 'uuid', defaultRaw: 'gen_random_uuid()' })
@@ -13,9 +12,6 @@ export class OnboardingRequest {
   @Property({ type: 'text' })
   email!: string
 
-  @Property({ name: 'email_hash', type: 'text', nullable: true })
-  emailHash?: string | null
-
   @Property({ name: 'token_hash', type: 'text' })
   tokenHash!: string
 

package/src/modules/onboarding/encryption.ts

@@ -3,13 +3,11 @@ import type { ModuleEncryptionMap } from '@open-mercato/shared/modules/encryptio
 export const defaultEncryptionMaps: ModuleEncryptionMap[] = [
   {
     entityId: 'onboarding:onboarding_request',
-    keyScope: 'system',
     fields: [
-      { field: 'email', hashField: 'email_hash' },
+      { field: 'email' },
       { field: 'first_name' },
       { field: 'last_name' },
       { field: 'organization_name' },
-      { field: 'password_hash' },
     ],
   },
 ]

package/src/modules/onboarding/lib/service.ts

@@ -1,8 +1,6 @@
 import { randomBytes, createHash } from 'node:crypto'
 import { hash } from 'bcryptjs'
 import { EntityManager } from '@mikro-orm/postgresql'
-import { hashForLookup, lookupHashCandidates } from '@open-mercato/shared/lib/encryption/aes'
-import { findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'
 import { OnboardingRequest } from '../data/entities'
 import type { OnboardingStartInput } from '../data/validators'
 
@@ -20,14 +18,8 @@ export class OnboardingService {
     const expiresAt = new Date(Date.now() + expiresInHours * 60 * 60 * 1000)
     const now = new Date()
     const passwordHash = await hash(input.password, 10)
-    const emailHash = hashForLookup(input.email)
 
-    const existing = await findOneWithDecryption(this.em, OnboardingRequest, {
-      $or: [
-        { emailHash: { $in: lookupHashCandidates(input.email) } },
-        { email: input.email, emailHash: null },
-      ],
-    })
+    const existing = await this.em.findOne(OnboardingRequest, { email: input.email })
     if (existing) {
       const lastSentAt = existing.lastEmailSentAt ?? existing.updatedAt ?? existing.createdAt
       if (['pending', 'processing'].includes(existing.status) && lastSentAt && lastSentAt.getTime() > Date.now() - 10 * 60 * 1000) {
@@ -44,7 +36,6 @@ export class OnboardingService {
       existing.termsAccepted = true
       existing.marketingConsent = input.marketingConsent ?? false
       existing.passwordHash = passwordHash
-      existing.emailHash = emailHash
       existing.expiresAt = expiresAt
       existing.completedAt = null
       existing.processingStartedAt = null
@@ -61,7 +52,6 @@ export class OnboardingService {
 
     const request = this.em.create(OnboardingRequest, {
       email: input.email,
-      emailHash,
       tokenHash,
       status: 'pending',
       firstName: input.firstName,
@@ -84,7 +74,7 @@ export class OnboardingService {
   async findPendingByToken(token: string) {
     const tokenHash = hashToken(token)
     const now = new Date()
-    return findOneWithDecryption(this.em, OnboardingRequest, {
+    return this.em.findOne(OnboardingRequest, {
       tokenHash,
       status: 'pending',
       expiresAt: { $gt: now } as any,
@@ -93,20 +83,18 @@ export class OnboardingService {
 
   async findByToken(token: string) {
     const tokenHash = hashToken(token)
-    return findOneWithDecryption(this.em, OnboardingRequest, { tokenHash })
+    return this.em.findOne(OnboardingRequest, { tokenHash })
   }
 
   async findById(id: string) {
-    return findOneWithDecryption(this.em, OnboardingRequest, { id })
+    return this.em.findOne(OnboardingRequest, { id })
   }
 
   async findLatestByTenantId(tenantId: string) {
-    return findOneWithDecryption(
-      this.em,
+    return this.em.findOne(
       OnboardingRequest,
       { tenantId, deletedAt: null },
       { orderBy: { updatedAt: 'DESC', createdAt: 'DESC' } },
-      { tenantId, organizationId: null },
     )
   }
 

package/src/modules/onboarding/migrations/.snapshot-open-mercato.json

@@ -25,15 +25,6 @@
           "nullable": false,
           "mappedType": "text"
         },
-        "email_hash": {
-          "name": "email_hash",
-          "type": "text",
-          "unsigned": false,
-          "autoincrement": false,
-          "primary": false,
-          "nullable": true,
-          "mappedType": "text"
-        },
         "token_hash": {
           "name": "token_hash",
           "type": "text",
@@ -269,16 +260,6 @@
           "primary": false,
           "unique": true
         },
-        {
-          "keyName": "onboarding_requests_email_hash_unique",
-          "columnNames": [
-            "email_hash"
-          ],
-          "composite": false,
-          "constraint": true,
-          "primary": false,
-          "unique": true
-        },
         {
           "keyName": "onboarding_requests_pkey",
           "columnNames": [

package/dist/modules/onboarding/migrations/Migration20260710133207_onboarding.js

@@ -1,15 +0,0 @@
-import { Migration } from "@mikro-orm/migrations";
-class Migration20260710133207_onboarding extends Migration {
-  up() {
-    this.addSql(`alter table "onboarding_requests" add "email_hash" text null;`);
-    this.addSql(`alter table "onboarding_requests" add constraint "onboarding_requests_email_hash_unique" unique ("email_hash");`);
-  }
-  down() {
-    this.addSql(`alter table "onboarding_requests" drop constraint if exists "onboarding_requests_email_hash_unique";`);
-    this.addSql(`alter table "onboarding_requests" drop column "email_hash";`);
-  }
-}
-export {
-  Migration20260710133207_onboarding
-};
-//# sourceMappingURL=Migration20260710133207_onboarding.js.map

package/dist/modules/onboarding/migrations/Migration20260710133207_onboarding.js.map

@@ -1,7 +0,0 @@
-{
-  "version": 3,
-  "sources": ["../../../../src/modules/onboarding/migrations/Migration20260710133207_onboarding.ts"],
-  "sourcesContent": ["import { Migration } from '@mikro-orm/migrations';\n\nexport class Migration20260710133207_onboarding extends Migration {\n\n  override up(): void | Promise<void> {\n    this.addSql(`alter table \"onboarding_requests\" add \"email_hash\" text null;`);\n    this.addSql(`alter table \"onboarding_requests\" add constraint \"onboarding_requests_email_hash_unique\" unique (\"email_hash\");`);\n  }\n\n  override down(): void | Promise<void> {\n    this.addSql(`alter table \"onboarding_requests\" drop constraint if exists \"onboarding_requests_email_hash_unique\";`);\n    this.addSql(`alter table \"onboarding_requests\" drop column \"email_hash\";`);\n  }\n\n}\n"],
-  "mappings": "AAAA,SAAS,iBAAiB;AAEnB,MAAM,2CAA2C,UAAU;AAAA,EAEvD,KAA2B;AAClC,SAAK,OAAO,+DAA+D;AAC3E,SAAK,OAAO,iHAAiH;AAAA,EAC/H;AAAA,EAES,OAA6B;AACpC,SAAK,OAAO,sGAAsG;AAClH,SAAK,OAAO,6DAA6D;AAAA,EAC3E;AAEF;",
-  "names": []
-}

package/src/__tests__/backfill-legacy-request.test.ts

@@ -1,213 +0,0 @@
-import { createHash, randomBytes } from 'node:crypto'
-import type { EntityManager } from '@mikro-orm/postgresql'
-import { TenantDataEncryptionService } from '@open-mercato/shared/lib/encryption/tenantDataEncryptionService'
-import { lookupHashCandidates } from '@open-mercato/shared/lib/encryption/aes'
-import type { TenantDek } from '@open-mercato/shared/lib/encryption/kms'
-import { OnboardingRequest } from '../modules/onboarding/data/entities'
-import { OnboardingService } from '../modules/onboarding/lib/service'
-import { defaultEncryptionMaps } from '../modules/onboarding/encryption'
-
-jest.mock('bcryptjs', () => ({
-  hash: jest.fn().mockResolvedValue('freshly_hashed_password'),
-}))
-
-const LEGACY_EMAIL = 'legacy.signup@example.com'
-const SYSTEM_KEY = randomBytes(32).toString('base64')
-
-function hashToken(token: string) {
-  return createHash('sha256').update(token).digest('hex')
-}
-
-function makeLegacyPlaintextRow(): OnboardingRequest {
-  return Object.assign(new OnboardingRequest(), {
-    id: 'legacy-row',
-    email: LEGACY_EMAIL,
-    emailHash: null,
-    tokenHash: hashToken('legacy-token'),
-    status: 'pending',
-    firstName: 'Ada',
-    lastName: 'Lovelace',
-    organizationName: 'Analytical Engines',
-    locale: 'en',
-    termsAccepted: true,
-    marketingConsent: false,
-    passwordHash: 'legacy_bcrypt_hash',
-    expiresAt: new Date(Date.now() + 86_400_000),
-    completedAt: null,
-    processingStartedAt: null,
-    tenantId: null,
-    organizationId: null,
-    userId: null,
-    lastEmailSentAt: new Date(Date.now() - 60 * 60 * 1000),
-    preparationStartedAt: null,
-    preparationCompletedAt: null,
-    readyEmailSentAt: null,
-    createdAt: new Date(Date.now() - 7 * 86_400_000),
-    updatedAt: new Date(Date.now() - 7 * 86_400_000),
-    deletedAt: null,
-  })
-}
-
-function matchesCondition(actual: unknown, condition: unknown): boolean {
-  if (condition !== null && typeof condition === 'object' && !(condition instanceof Date)) {
-    const operators = condition as Record<string, unknown>
-    if ('$in' in operators) return (operators.$in as unknown[]).includes(actual)
-    if ('$gt' in operators) return (actual as Date) > (operators.$gt as Date)
-    if ('$ne' in operators) return actual !== operators.$ne
-    return false
-  }
-  return actual === condition
-}
-
-function matchesFilter(row: Record<string, unknown>, filter: Record<string, unknown>): boolean {
-  return Object.entries(filter).every(([key, condition]) => {
-    if (key === '$or') return (condition as Record<string, unknown>[]).some((branch) => matchesFilter(row, branch))
-    return matchesCondition(row[key], condition)
-  })
-}
-
-/**
- * Minimal filter-evaluating EntityManager stand-in. The point of this suite is that a
- * backfilled row is still *found* by the service's real lookup, so the fake has to
- * actually evaluate the `$or` the service builds rather than record the call.
- */
-function makeEm(rows: OnboardingRequest[]) {
-  const created: OnboardingRequest[] = []
-  return {
-    findOne: jest.fn(async (_entity: unknown, where: Record<string, unknown>) =>
-      rows.find((row) => matchesFilter(row as unknown as Record<string, unknown>, where)) ?? null),
-    create: jest.fn((_entity: unknown, data: Record<string, unknown>) => {
-      const row = Object.assign(new OnboardingRequest(), data)
-      created.push(row)
-      return row
-    }),
-    persist: jest.fn(() => ({ flush: jest.fn(async () => {}) })),
-    flush: jest.fn(async () => {}),
-    created,
-  } as unknown as EntityManager & { created: OnboardingRequest[]; findOne: jest.Mock; create: jest.Mock }
-}
-
-function makeEncryptionService(em: EntityManager) {
-  const kms = {
-    isHealthy: () => true,
-    async getTenantDek(tenantId: string): Promise<TenantDek | null> {
-      return { tenantId, key: SYSTEM_KEY, fetchedAt: Date.now() }
-    },
-    async createTenantDek(tenantId: string): Promise<TenantDek | null> {
-      return this.getTenantDek(tenantId)
-    },
-  }
-  return new TenantDataEncryptionService(em, { kms, defaultEncryptionMaps })
-}
-
-/**
- * Applies exactly what `mercato entities backfill-system-encryption` applies to one row:
- * the mapped fields go through `encryptEntityPayload` under the system key, and the
- * resulting ciphertext plus lookup hash are written back to the record.
- */
-async function backfillRow(service: TenantDataEncryptionService, row: OnboardingRequest): Promise<void> {
-  const encrypted = await service.encryptEntityPayload('onboarding:onboarding_request', {
-    email: row.email,
-    email_hash: row.emailHash ?? null,
-    first_name: row.firstName,
-    last_name: row.lastName,
-    organization_name: row.organizationName,
-    password_hash: row.passwordHash ?? null,
-  }, null, null)
-  row.email = encrypted.email as string
-  row.emailHash = encrypted.email_hash as string
-  row.firstName = encrypted.first_name as string
-  row.lastName = encrypted.last_name as string
-  row.organizationName = encrypted.organization_name as string
-  row.passwordHash = encrypted.password_hash as string
-}
-
-describe('backfilled legacy onboarding request (#3876)', () => {
-  const originalToggle = process.env.TENANT_DATA_ENCRYPTION
-
-  beforeEach(() => {
-    process.env.TENANT_DATA_ENCRYPTION = 'yes'
-  })
-
-  afterEach(() => {
-    if (originalToggle === undefined) delete process.env.TENANT_DATA_ENCRYPTION
-    else process.env.TENANT_DATA_ENCRYPTION = originalToggle
-  })
-
-  it('encrypts every mapped field and populates the lookup hash', async () => {
-    const row = makeLegacyPlaintextRow()
-    const em = makeEm([row])
-
-    await backfillRow(makeEncryptionService(em), row)
-
-    for (const value of [row.email, row.firstName, row.lastName, row.organizationName, row.passwordHash]) {
-      expect(value).toMatch(/^[^:]+:[^:]+:[^:]+:v1$/)
-    }
-    expect(lookupHashCandidates(LEGACY_EMAIL)).toContain(row.emailHash)
-  })
-
-  it('still resolves the row on resubmit instead of creating a duplicate', async () => {
-    const row = makeLegacyPlaintextRow()
-    const em = makeEm([row])
-    await backfillRow(makeEncryptionService(em), row)
-
-    const service = new OnboardingService(em)
-    const { request } = await service.createOrUpdateRequest({
-      email: LEGACY_EMAIL,
-      firstName: 'Ada',
-      lastName: 'Lovelace',
-      organizationName: 'Analytical Engines',
-      password: 'Secret1!',
-      confirmPassword: 'Secret1!',
-      termsAccepted: true,
-      marketingConsent: false,
-    } as never)
-
-    expect(request.id).toBe('legacy-row')
-    expect(em.created).toHaveLength(0)
-    expect(em.create).not.toHaveBeenCalled()
-  })
-
-  it('still resolves the row by verification token after the backfill', async () => {
-    const row = makeLegacyPlaintextRow()
-    const em = makeEm([row])
-    await backfillRow(makeEncryptionService(em), row)
-
-    const found = await new OnboardingService(em).findPendingByToken('legacy-token')
-
-    expect(found?.id).toBe('legacy-row')
-  })
-
-  it('leaves a row the backfill already processed unchanged on a second pass', async () => {
-    const row = makeLegacyPlaintextRow()
-    const em = makeEm([row])
-    const service = makeEncryptionService(em)
-
-    await backfillRow(service, row)
-    const afterFirstPass = { email: row.email, emailHash: row.emailHash, passwordHash: row.passwordHash }
-    await backfillRow(service, row)
-
-    expect(row.email).toBe(afterFirstPass.email)
-    expect(row.emailHash).toBe(afterFirstPass.emailHash)
-    expect(row.passwordHash).toBe(afterFirstPass.passwordHash)
-  })
-
-  it('still finds a row that was never backfilled, through the legacy plaintext branch', async () => {
-    const row = makeLegacyPlaintextRow()
-    const em = makeEm([row])
-
-    const found = await new OnboardingService(em).createOrUpdateRequest({
-      email: LEGACY_EMAIL,
-      firstName: 'Ada',
-      lastName: 'Lovelace',
-      organizationName: 'Analytical Engines',
-      password: 'Secret1!',
-      confirmPassword: 'Secret1!',
-      termsAccepted: true,
-      marketingConsent: false,
-    } as never)
-
-    expect(found.request.id).toBe('legacy-row')
-    expect(em.create).not.toHaveBeenCalled()
-  })
-})

package/src/__tests__/encryption.test.ts

@@ -1,19 +0,0 @@
-import { defaultEncryptionMaps } from '../modules/onboarding/encryption'
-
-describe('onboarding encryption map', () => {
-  it('protects pre-tenant PII and the transient password hash with a system key', () => {
-    expect(defaultEncryptionMaps).toEqual([
-      {
-        entityId: 'onboarding:onboarding_request',
-        keyScope: 'system',
-        fields: [
-          { field: 'email', hashField: 'email_hash' },
-          { field: 'first_name' },
-          { field: 'last_name' },
-          { field: 'organization_name' },
-          { field: 'password_hash' },
-        ],
-      },
-    ])
-  })
-})