@open-mercato/onboarding 0.7.1-develop.7106.1.53fe9dd1b1 → 0.7.1-develop.7112.1.d486e6f1b2

package/src/__tests__/existing-account-notice-rate-limit.test.ts

@@ -0,0 +1,134 @@
+const sendEmail = jest.fn()
+
+jest.mock('@open-mercato/shared/lib/email/send', () => ({
+  sendEmail: (...args: unknown[]) => sendEmail(...args),
+}))
+
+import { RateLimiterService } from '@open-mercato/shared/lib/ratelimit/service'
+import { hashForLookup } from '@open-mercato/shared/lib/encryption/aes'
+import type { RateLimitConfig } from '@open-mercato/shared/lib/ratelimit/types'
+import { sendExistingAccountNotice } from '../modules/onboarding/lib/existing-account-notice'
+
+const VICTIM_EMAIL = 'victim@example.com'
+
+const copy = {
+  preview: 'preview',
+  heading: 'heading',
+  greeting: 'greeting',
+  body: 'body',
+  cta: 'cta',
+  ignore: 'ignore',
+  footer: 'footer',
+}
+
+function containerFor(limiter: RateLimiterService | null) {
+  return {
+    resolve: (name: string) => {
+      if (name !== 'rateLimiterService') throw new Error(`[internal] unexpected resolve(${name})`)
+      if (!limiter) throw new Error('[internal] rateLimiterService is not registered')
+      return limiter
+    },
+  }
+}
+
+function notice(limiter: RateLimiterService | null, email: string) {
+  return sendExistingAccountNotice({
+    container: containerFor(limiter),
+    email,
+    loginUrl: 'https://app.example.com/login',
+    subject: 'About your Open Mercato account',
+    copy,
+  })
+}
+
+function limiterService(enabled: boolean): RateLimiterService {
+  return new RateLimiterService({
+    enabled,
+    strategy: 'memory',
+    keyPrefix: 'test',
+    trustProxyDepth: 0,
+  })
+}
+
+beforeEach(() => {
+  jest.clearAllMocks()
+  sendEmail.mockResolvedValue(undefined)
+})
+
+/**
+ * The parity suite asserts the notice throttle against a mocked limiter, which cannot observe
+ * what the real `RateLimiterService` does with the config it is handed. These cases exercise the
+ * real service so the window — and the documented hole in it — are pinned by the suite rather
+ * than by a reviewer's manual trace.
+ */
+describe('existing-account notice against the real RateLimiterService', () => {
+  it('sends once per address per window when rate limiting is enabled', async () => {
+    const limiter = limiterService(true)
+
+    await expect(notice(limiter, VICTIM_EMAIL)).resolves.toBe('sent')
+    await expect(notice(limiter, VICTIM_EMAIL)).resolves.toBe('throttled')
+
+    expect(sendEmail).toHaveBeenCalledTimes(1)
+    await limiter.destroy()
+  })
+
+  it('throttles a case-variant address through the same window', async () => {
+    const limiter = limiterService(true)
+
+    await expect(notice(limiter, VICTIM_EMAIL)).resolves.toBe('sent')
+    await expect(notice(limiter, ' VICTIM@Example.COM ')).resolves.toBe('throttled')
+
+    expect(hashForLookup(' VICTIM@Example.COM ')).toBe(hashForLookup(VICTIM_EMAIL))
+    expect(sendEmail).toHaveBeenCalledTimes(1)
+    await limiter.destroy()
+  })
+
+  it('releases the window on a failed send so the next attempt still mails the owner', async () => {
+    const limiter = limiterService(true)
+    sendEmail.mockRejectedValueOnce(new Error('smtp down'))
+
+    await expect(notice(limiter, VICTIM_EMAIL)).rejects.toThrow('smtp down')
+    await expect(notice(limiter, VICTIM_EMAIL)).resolves.toBe('sent')
+
+    expect(sendEmail).toHaveBeenCalledTimes(2)
+    await limiter.destroy()
+  })
+
+  it('does not share a window with the endpoint\'s own per-IP limiter', async () => {
+    const limiter = limiterService(true)
+    const endpointConfig: RateLimitConfig = {
+      points: 10,
+      duration: 60,
+      blockDuration: 60,
+      keyPrefix: 'onboarding',
+    }
+
+    await limiter.consume(hashForLookup(VICTIM_EMAIL), endpointConfig)
+    await expect(notice(limiter, VICTIM_EMAIL)).resolves.toBe('sent')
+
+    expect(sendEmail).toHaveBeenCalledTimes(1)
+    await limiter.destroy()
+  })
+
+  /**
+   * Deliberate, documented gap rather than an oversight: with rate limiting switched off the
+   * window disappears, because failing closed would answer differently from the no-account
+   * branch and re-open the enumeration oracle (#5505). See `existing-account-notice.ts`.
+   */
+  it('sends unthrottled when rate limiting is disabled', async () => {
+    const limiter = limiterService(false)
+
+    await expect(notice(limiter, VICTIM_EMAIL)).resolves.toBe('sent')
+    await expect(notice(limiter, VICTIM_EMAIL)).resolves.toBe('sent')
+
+    expect(sendEmail).toHaveBeenCalledTimes(2)
+    await limiter.destroy()
+  })
+
+  it('sends unthrottled when no limiter is registered at all', async () => {
+    await expect(notice(null, VICTIM_EMAIL)).resolves.toBe('sent')
+    await expect(notice(null, VICTIM_EMAIL)).resolves.toBe('sent')
+
+    expect(sendEmail).toHaveBeenCalledTimes(2)
+  })
+})

package/src/__tests__/onboarding-start-account-privacy.test.ts

@@ -0,0 +1,277 @@
+const findOneWithDecryption = jest.fn()
+const createOrUpdateRequest = jest.fn()
+const sendEmail = jest.fn()
+const getSecurityEmailBaseUrl = jest.fn()
+const consume = jest.fn()
+const deleteRateLimitKey = jest.fn()
+const resolveRateLimiterService = jest.fn()
+const loadDictionary = jest.fn(async (_locale: string) => ({} as Record<string, string>))
+
+const originalSelfServiceOnboardingEnabled = process.env.SELF_SERVICE_ONBOARDING_ENABLED
+
+jest.mock('@open-mercato/shared/lib/di/container', () => ({
+  createRequestContainer: jest.fn(async () => ({
+    resolve: (name: string) => {
+      if (name === 'em') return { flush: jest.fn() }
+      if (name === 'rateLimiterService') return resolveRateLimiterService()
+      throw new Error(`[internal] unexpected resolve(${name})`)
+    },
+  })),
+}))
+
+jest.mock('@open-mercato/shared/lib/encryption/find', () => ({
+  findOneWithDecryption: (...args: unknown[]) => findOneWithDecryption(...args),
+}))
+
+jest.mock('@open-mercato/shared/lib/encryption/aes', () => ({
+  lookupHashCandidates: (email: string) => [`candidate:${email}`],
+  hashForLookup: (email: string) => `hash:${email}`,
+}))
+
+jest.mock('@open-mercato/shared/lib/url', () => ({
+  getSecurityEmailBaseUrl: (...args: unknown[]) => getSecurityEmailBaseUrl(...args),
+  mapSecurityEmailUrlError: (error: unknown) => {
+    if (error instanceof Error && error.message === 'APP_URL missing') {
+      return { status: 500, body: { error: 'Self-service onboarding is not configured.' } }
+    }
+    return null
+  },
+}))
+
+jest.mock('@open-mercato/shared/lib/email/send', () => ({
+  sendEmail: (...args: unknown[]) => sendEmail(...args),
+}))
+
+jest.mock('@open-mercato/shared/lib/i18n/server', () => ({
+  loadDictionary: (locale: string) => loadDictionary(locale),
+}))
+
+jest.mock('@open-mercato/onboarding/modules/onboarding/lib/service', () => ({
+  OnboardingService: jest.fn().mockImplementation(() => ({ createOrUpdateRequest })),
+}))
+
+jest.mock('@open-mercato/core/modules/auth/data/entities', () => ({
+  User: class User {},
+}))
+
+import { POST } from '../modules/onboarding/api/post/onboarding'
+import type { OnboardingStartInput } from '../modules/onboarding/data/validators'
+
+type UserLookup = { $or?: Array<{ email?: string }> }
+
+const EXISTING_EMAIL = 'has-account@example.com'
+const NEW_EMAIL = 'no-account@example.com'
+const BASE_URL = 'https://app.example.com'
+
+type ProbeResult = { status: number; body: unknown }
+
+function submission(email: string, locale?: string) {
+  return {
+    ...(locale ? { locale } : {}),
+    email,
+    firstName: 'Mallory',
+    lastName: 'Prober',
+    organizationName: 'Probe Industries',
+    password: 'Str0ng!Passw0rd',
+    confirmPassword: 'Str0ng!Passw0rd',
+    termsAccepted: true,
+    marketingConsent: false,
+  }
+}
+
+async function probe(email: string, locale?: string): Promise<ProbeResult> {
+  const response = await POST(new Request(`${BASE_URL}/api/onboarding/onboarding`, {
+    method: 'POST',
+    headers: { 'content-type': 'application/json' },
+    body: JSON.stringify(submission(email, locale)),
+  }))
+  return { status: response.status, body: await response.json() }
+}
+
+type RenderedNode = { props?: { href?: unknown; children?: unknown } }
+
+function collectStrings(node: unknown, into: string[] = []): string[] {
+  if (node == null || typeof node === 'boolean') return into
+  if (typeof node === 'string' || typeof node === 'number') {
+    into.push(String(node))
+    return into
+  }
+  if (Array.isArray(node)) {
+    for (const child of node) collectStrings(child, into)
+    return into
+  }
+  if (typeof node === 'object') {
+    const props = (node as RenderedNode).props
+    if (!props) return into
+    if (typeof props.href === 'string') into.push(props.href)
+    collectStrings(props.children, into)
+  }
+  return into
+}
+
+function noticeEmailCall() {
+  return sendEmail.mock.calls.find((call) => call[0]?.subject === 'About your Open Mercato account')
+}
+
+function verificationEmailCall() {
+  return sendEmail.mock.calls.find((call) => call[0]?.subject === 'Confirm your email to finish onboarding')
+}
+
+beforeEach(() => {
+  jest.clearAllMocks()
+  loadDictionary.mockImplementation(async () => ({}))
+  process.env.SELF_SERVICE_ONBOARDING_ENABLED = 'true'
+  getSecurityEmailBaseUrl.mockReturnValue(BASE_URL)
+  sendEmail.mockResolvedValue(undefined)
+  consume.mockResolvedValue({ allowed: true, remainingPoints: 0, msBeforeNext: 0, consumedPoints: 1 })
+  deleteRateLimitKey.mockResolvedValue(undefined)
+  resolveRateLimiterService.mockReturnValue({ consume, delete: deleteRateLimitKey })
+  findOneWithDecryption.mockImplementation(async (_em: unknown, _entity: unknown, where: UserLookup) => {
+    const probed = where?.$or?.[0]?.email
+    return probed === EXISTING_EMAIL ? { id: 'user-1', email: EXISTING_EMAIL } : null
+  })
+  createOrUpdateRequest.mockImplementation(async (input: OnboardingStartInput) => ({
+    request: {
+      email: input.email,
+      firstName: input.firstName,
+      lastName: input.lastName,
+      organizationName: input.organizationName,
+      marketingConsent: false,
+      lastEmailSentAt: new Date(),
+    },
+    token: 'verification-token',
+  }))
+})
+
+afterAll(() => {
+  if (originalSelfServiceOnboardingEnabled === undefined) {
+    delete process.env.SELF_SERVICE_ONBOARDING_ENABLED
+  } else {
+    process.env.SELF_SERVICE_ONBOARDING_ENABLED = originalSelfServiceOnboardingEnabled
+  }
+})
+
+describe('onboarding start does not disclose whether an email already has an account', () => {
+  it('answers identically for an address with an account and one without', async () => {
+    const existing = await probe(EXISTING_EMAIL)
+    const fresh = await probe(NEW_EMAIL)
+
+    expect(existing.status).toBe(200)
+    expect(existing.body).toEqual({ ok: true, email: EXISTING_EMAIL })
+    expect(fresh.status).toBe(existing.status)
+    expect(fresh.body).toEqual({ ok: true, email: NEW_EMAIL })
+  })
+
+  it('answers identically inside the pending-verification window', async () => {
+    createOrUpdateRequest.mockRejectedValueOnce(new Error('PENDING_REQUEST:7'))
+
+    const throttled = await probe(NEW_EMAIL)
+
+    expect(throttled.status).toBe(200)
+    expect(throttled.body).toEqual({ ok: true, email: NEW_EMAIL })
+  })
+
+  it('answers identically when the outbound email fails on either branch', async () => {
+    sendEmail.mockRejectedValue(new Error('smtp down'))
+
+    const existing = await probe(EXISTING_EMAIL)
+    const fresh = await probe(NEW_EMAIL)
+
+    expect(existing.status).toBe(502)
+    expect(fresh.status).toBe(502)
+    expect(existing.body).toEqual(fresh.body)
+  })
+
+  it('answers identically when the base URL is misconfigured on either branch', async () => {
+    getSecurityEmailBaseUrl.mockImplementation(() => {
+      throw new Error('APP_URL missing')
+    })
+
+    const existing = await probe(EXISTING_EMAIL)
+    const fresh = await probe(NEW_EMAIL)
+
+    expect(existing.status).toBe(500)
+    expect(fresh.status).toBe(500)
+    expect(existing.body).toEqual(fresh.body)
+  })
+})
+
+describe('onboarding start handles the existing account out of band', () => {
+  it('emails the address owner a neutral notice instead of a verification link', async () => {
+    await probe(EXISTING_EMAIL)
+
+    expect(verificationEmailCall()).toBeUndefined()
+    expect(createOrUpdateRequest).not.toHaveBeenCalled()
+
+    const notice = noticeEmailCall()
+    expect(notice?.[0].to).toBe(EXISTING_EMAIL)
+
+    const rendered = collectStrings(notice?.[0].react)
+    expect(rendered).toContain(`${BASE_URL}/login`)
+    expect(rendered).toContain('You already have an account')
+    for (const submitterSupplied of ['Mallory', 'Prober', 'Probe Industries']) {
+      expect(rendered.some((text) => text.includes(submitterSupplied))).toBe(false)
+    }
+  })
+
+  it('sends the verification email for an address without an account', async () => {
+    await probe(NEW_EMAIL)
+
+    expect(noticeEmailCall()).toBeUndefined()
+    expect(verificationEmailCall()?.[0].to).toBe(NEW_EMAIL)
+  })
+
+  it('throttles the notice per address and still returns the accepted response', async () => {
+    consume.mockResolvedValueOnce({ allowed: false, remainingPoints: 0, msBeforeNext: 60_000, consumedPoints: 2 })
+
+    const throttled = await probe(EXISTING_EMAIL)
+
+    expect(consume).toHaveBeenCalledWith(`hash:${EXISTING_EMAIL}`, expect.objectContaining({ points: 1, duration: 600 }))
+    expect(noticeEmailCall()).toBeUndefined()
+    expect(throttled.status).toBe(200)
+    expect(throttled.body).toEqual({ ok: true, email: EXISTING_EMAIL })
+  })
+
+  it('releases the notice window when the send fails so a retry behaves like the other branch', async () => {
+    sendEmail.mockRejectedValueOnce(new Error('smtp down'))
+
+    await probe(EXISTING_EMAIL)
+
+    expect(deleteRateLimitKey).toHaveBeenCalledWith(`hash:${EXISTING_EMAIL}`, expect.objectContaining({ points: 1, duration: 600 }))
+  })
+
+  it('writes the notice in the instance default locale, not the one the submitter asked for', async () => {
+    loadDictionary.mockImplementation(async (requested: string) => ({
+      'onboarding.existingAccountEmail.heading': requested === 'en' ? 'Default locale heading' : 'Submitter locale heading',
+      'onboarding.email.heading': requested === 'en' ? 'Default locale welcome' : 'Submitter locale welcome',
+    }))
+
+    await probe(EXISTING_EMAIL, 'pl')
+
+    const rendered = collectStrings(noticeEmailCall()?.[0].react)
+    expect(rendered).toContain('Default locale heading')
+    expect(rendered).not.toContain('Submitter locale heading')
+  })
+
+  it('still writes the verification email in the locale the submitter asked for', async () => {
+    loadDictionary.mockImplementation(async (requested: string) => ({
+      'onboarding.email.heading': requested === 'en' ? 'Default locale welcome' : 'Submitter locale welcome',
+    }))
+
+    await probe(NEW_EMAIL, 'pl')
+
+    const rendered = collectStrings(verificationEmailCall()?.[0].react)
+    expect(rendered).toContain('Submitter locale welcome')
+  })
+
+  it('sends the notice when no rate limiter is registered', async () => {
+    resolveRateLimiterService.mockImplementation(() => {
+      throw new Error('[internal] rateLimiterService is not registered')
+    })
+
+    const existing = await probe(EXISTING_EMAIL)
+
+    expect(noticeEmailCall()?.[0].to).toBe(EXISTING_EMAIL)
+    expect(existing.status).toBe(200)
+  })
+})

package/src/modules/onboarding/__integration__/TC-ONB-003-signup-account-privacy.spec.ts

@@ -0,0 +1,176 @@
+import { randomUUID } from 'node:crypto';
+import { readFile } from 'node:fs/promises';
+import { join } from 'node:path';
+import { expect, test, type APIRequestContext } from '@playwright/test';
+import { getAuthToken } from '@open-mercato/core/helpers/integration/api';
+import { getTokenContext } from '@open-mercato/core/helpers/integration/generalFixtures';
+import { createUserFixture, deleteUserIfExists } from '@open-mercato/core/helpers/integration/authFixtures';
+import { withClient } from '@open-mercato/core/helpers/integration/dbFixtures';
+import { lookupHashCandidates } from '@open-mercato/shared/lib/encryption/aes';
+
+export const integrationMeta = {
+  description: 'Public signup answers identically whether or not the address already has an account',
+  dependsOnModules: ['onboarding', 'auth'],
+  requiredEnvVars: ['SELF_SERVICE_ONBOARDING_ENABLED'],
+};
+
+const BASE_URL = process.env.BASE_URL?.trim() || 'http://localhost:3000';
+const EMAIL_CAPTURE_PATH = process.env.OM_TEST_EMAIL_CAPTURE_PATH?.trim() || join(process.cwd(), '.ai', 'qa', 'email-capture.jsonl');
+const EXISTING_ACCOUNT_PASSWORD = 'Valid1!Pass';
+const SUBMITTED_PASSWORD = 'Str0ng!Passw0rd';
+const SUBMITTER_FIRST_NAME = 'Mallory';
+const SUBMITTER_ORGANIZATION = 'Probe Industries';
+
+type CapturedEmail = {
+  to?: string;
+  subject?: string;
+  links?: string[];
+  text?: string;
+};
+
+type Probe = {
+  status: number;
+  rawBody: string;
+};
+
+function submission(email: string) {
+  return {
+    email,
+    firstName: SUBMITTER_FIRST_NAME,
+    lastName: 'Prober',
+    organizationName: SUBMITTER_ORGANIZATION,
+    password: SUBMITTED_PASSWORD,
+    confirmPassword: SUBMITTED_PASSWORD,
+    termsAccepted: true,
+    marketingConsent: false,
+  };
+}
+
+async function probeSignup(request: APIRequestContext, baseUrl: string, email: string): Promise<Probe> {
+  const response = await request.post(`${baseUrl}/api/onboarding/onboarding`, {
+    headers: { 'content-type': 'application/json' },
+    data: submission(email),
+  });
+  return { status: response.status(), rawBody: await response.text() };
+}
+
+/**
+ * The submitted address is the one field the two branches may legitimately differ on, because the
+ * caller supplied it. Masking it turns "same shape" into a byte comparison of everything else.
+ */
+function maskSubmittedAddress(rawBody: string, email: string): string {
+  return rawBody.split(email).join('<submitted-address>');
+}
+
+async function readCapturedEmails(): Promise<CapturedEmail[]> {
+  try {
+    const raw = await readFile(EMAIL_CAPTURE_PATH, 'utf8');
+    return raw.split('\n').filter(Boolean).map((line) => JSON.parse(line) as CapturedEmail);
+  } catch {
+    return [];
+  }
+}
+
+async function waitForCapturedEmails(to: string): Promise<CapturedEmail[]> {
+  const deadline = Date.now() + 10_000;
+  let captured: CapturedEmail[] = [];
+  while (Date.now() < deadline) {
+    captured = (await readCapturedEmails()).filter((entry) => entry.to?.toLowerCase() === to.toLowerCase());
+    if (captured.length > 0) return captured;
+    await new Promise((resolve) => setTimeout(resolve, 250));
+  }
+  return captured;
+}
+
+async function deleteOnboardingRequest(email: string): Promise<void> {
+  await withClient(async (client) => {
+    await client.query('delete from onboarding_requests where email_hash = any($1::text[])', [lookupHashCandidates(email)]);
+  }).catch(() => undefined);
+}
+
+/**
+ * TC-ONB-003: public signup does not disclose whether an address already has an account
+ * Source: GitHub issue #5505, PR #5677
+ * Surface: POST /api/onboarding/onboarding (requireAuth: false)
+ *
+ * The unit suite pins the property at the handler level with every collaborator mocked. This one
+ * proves it against a real instance: a real user row created in setup, the real encryption/lookup
+ * path that finds it, the real OnboardingService pending-request window, and the real outbound
+ * mail (captured on disk) that carries the out-of-band notice.
+ */
+test.describe('TC-ONB-003: signup does not reveal whether an email already has an account', () => {
+  test('answers identically for a registered and an unregistered address, and notifies the owner out of band', async ({ request, baseURL }) => {
+    const resolvedBaseUrl = baseURL ?? BASE_URL;
+    const unique = randomUUID().slice(0, 8);
+    const registeredEmail = `qa-onb-003-registered-${unique}@example.test`;
+    const unregisteredEmail = `qa-onb-003-fresh-${unique}@example.test`;
+
+    const adminToken = await getAuthToken(request, 'admin');
+    const { organizationId } = getTokenContext(adminToken);
+    let registeredUserId: string | null = null;
+
+    try {
+      registeredUserId = await createUserFixture(request, adminToken, {
+        email: registeredEmail,
+        password: EXISTING_ACCOUNT_PASSWORD,
+        organizationId,
+        roles: [],
+      });
+
+      // (a) First probe of each address: same status, and the same body once the caller's own
+      // address is masked out.
+      const registeredFirst = await probeSignup(request, resolvedBaseUrl, registeredEmail);
+      const unregisteredFirst = await probeSignup(request, resolvedBaseUrl, unregisteredEmail);
+
+      expect(registeredFirst.status, 'a submission for a registered address should be accepted').toBe(200);
+      expect(unregisteredFirst.status, 'both branches should answer with the same status').toBe(registeredFirst.status);
+      expect(maskSubmittedAddress(unregisteredFirst.rawBody, unregisteredEmail))
+        .toBe(maskSubmittedAddress(registeredFirst.rawBody, registeredEmail));
+
+      // (c) The registered address is told out of band: a notice, never a verification link.
+      const registeredMail = await waitForCapturedEmails(registeredEmail);
+      expect(registeredMail.length, 'the account owner should be notified out of band').toBeGreaterThan(0);
+      const noticeLinks = registeredMail.flatMap((entry) => entry.links ?? []);
+      expect(noticeLinks.some((link) => link.includes('/login')), 'the notice should link to sign-in').toBeTruthy();
+      expect(noticeLinks.some((link) => link.includes('/api/onboarding/onboarding/verify?token=')), 'the account owner must never receive a verification link').toBeFalsy();
+      const noticeText = registeredMail.map((entry) => entry.text ?? '').join(' ');
+      expect(noticeText, 'the notice must not carry the submitter-supplied name').not.toContain(SUBMITTER_FIRST_NAME);
+      expect(noticeText, 'the notice must not carry the submitter-supplied organization').not.toContain(SUBMITTER_ORGANIZATION);
+
+      // (c) The unregistered address gets the verification mail and no notice.
+      const unregisteredMail = await waitForCapturedEmails(unregisteredEmail);
+      expect(unregisteredMail.length, 'a new address should receive the verification email').toBeGreaterThan(0);
+      const verificationLinks = unregisteredMail.flatMap((entry) => entry.links ?? []);
+      expect(verificationLinks.some((link) => link.includes('/api/onboarding/onboarding/verify?token=')), 'a new address should receive a verification link').toBeTruthy();
+      const unregisteredSubjects = unregisteredMail.map((entry) => entry.subject ?? '').join(' ');
+      expect(unregisteredSubjects, 'a new address must not receive the existing-account notice').not.toContain('About your Open Mercato account');
+
+      // (b) Second probe of each, inside the ten-minute windows: the registered address is inside
+      // the notice throttle and the new one is inside the pending-verification window, and those
+      // two throttles must not become a way to tell the branches apart across probes.
+      const registeredSecond = await probeSignup(request, resolvedBaseUrl, registeredEmail);
+      const unregisteredSecond = await probeSignup(request, resolvedBaseUrl, unregisteredEmail);
+
+      expect(registeredSecond.status, 'a repeated probe should stay accepted').toBe(200);
+      expect(unregisteredSecond.status, 'both throttled branches should answer with the same status').toBe(registeredSecond.status);
+      expect(maskSubmittedAddress(unregisteredSecond.rawBody, unregisteredEmail))
+        .toBe(maskSubmittedAddress(registeredSecond.rawBody, registeredEmail));
+      expect(maskSubmittedAddress(registeredSecond.rawBody, registeredEmail), 'a repeated probe should look like a first one')
+        .toBe(maskSubmittedAddress(registeredFirst.rawBody, registeredEmail));
+
+      // No onboarding request may be created for an address that already has an account: the
+      // submitter's strings must never reach a row that belongs to the account owner's address.
+      const rowsForRegistered = await withClient(async (client) => {
+        const result = await client.query<{ id: string }>(
+          'select id from onboarding_requests where email_hash = any($1::text[])',
+          [lookupHashCandidates(registeredEmail)],
+        );
+        return result.rowCount ?? 0;
+      });
+      expect(rowsForRegistered, 'no onboarding request should exist for a registered address').toBe(0);
+    } finally {
+      await deleteOnboardingRequest(unregisteredEmail);
+      await deleteUserIfExists(request, adminToken, registeredUserId);
+    }
+  });
+});