@openora/core 0.4.1-canary.15 → 0.4.1-canary.151

package/dist/pam/identity/__tests__/identity.service.int.test.js

@@ -0,0 +1,915 @@
+import { randomUUID } from 'node:crypto';
+import { describe, it, expect, vi, beforeAll, afterAll, beforeEach } from 'vitest';
+import { eq, sql } from 'drizzle-orm';
+import { ORPCError } from '@orpc/server';
+import { createTestDb, createTestRedis, seedUser as insertUser, } from '@openora/core/testing';
+import { migrate as migrateIdentity } from '@openora/core/pam/migrate/identity';
+import { player } from '@openora/core/pam/schema/profile';
+import { migrate as migrateProfile } from '@openora/core/pam/migrate/profile';
+import { IdentityService, SESSION_DURATION_IN_SECONDS, } from '../service/identity.service.js';
+import { UnsupportedLanguageError } from '../../shared/language.js';
+import { user, session } from '../schema/index.js';
+import { TrustedDeviceService } from '../service/trusted-device.service.js';
+import { SessionService } from '../service/session.service.js';
+import { TwoFactorDeliveryService } from '../service/two-factor-delivery.service.js';
+import { makeIdentityReader, mock, makeEventBus } from '../../../testing/mock.js';
+const { signInEmailMock, verifyTotpMock, verifyBackupCodeMock, generateBackupCodesMock, disableTwoFactorMock, enableTwoFactorMock, verifyTwoFactorOtpMock, getSessionMock, updateUserMock, requestPasswordResetEmailOTPMock, checkVerificationOTPMock, resetPasswordEmailOTPMock, changeEmailMock, capturedAuthOptions, } = vi.hoisted(() => ({
+    signInEmailMock: vi.fn(),
+    verifyTotpMock: vi.fn(),
+    verifyBackupCodeMock: vi.fn(),
+    generateBackupCodesMock: vi.fn(),
+    disableTwoFactorMock: vi.fn(),
+    enableTwoFactorMock: vi.fn(),
+    verifyTwoFactorOtpMock: vi.fn(),
+    getSessionMock: vi.fn().mockResolvedValue(null),
+    updateUserMock: vi.fn(),
+    requestPasswordResetEmailOTPMock: vi.fn(),
+    checkVerificationOTPMock: vi.fn(),
+    resetPasswordEmailOTPMock: vi.fn(),
+    changeEmailMock: vi.fn(),
+    capturedAuthOptions: {
+        current: undefined,
+    },
+}));
+vi.mock('@openora/core/server', async (importOriginal) => ({
+    ...(await importOriginal()),
+    createAuth: vi.fn((options) => {
+        capturedAuthOptions.current = options;
+        return {
+            options: {
+                session: {
+                    expiresIn: SESSION_DURATION_IN_SECONDS,
+                },
+            },
+            api: {
+                getSession: getSessionMock,
+                signUpEmail: vi.fn(),
+                signInEmail: signInEmailMock,
+                verifyTOTP: verifyTotpMock,
+                verifyBackupCode: verifyBackupCodeMock,
+                generateBackupCodes: generateBackupCodesMock,
+                disableTwoFactor: disableTwoFactorMock,
+                enableTwoFactor: enableTwoFactorMock,
+                verifyTwoFactorOTP: verifyTwoFactorOtpMock,
+                signOut: vi.fn(),
+                updateUser: updateUserMock,
+                requestPasswordResetEmailOTP: requestPasswordResetEmailOTPMock,
+                checkVerificationOTP: checkVerificationOTPMock,
+                resetPasswordEmailOTP: resetPasswordEmailOTPMock,
+                changeEmail: changeEmailMock,
+            },
+        };
+    }),
+}));
+const { RedisCache } = await import('@openora/core/server');
+let db;
+let redis;
+const allowLimiter = () => mock({
+    consume: vi.fn().mockResolvedValue({ allowed: true, retryAfterMs: 0 }),
+    reset: vi.fn().mockResolvedValue(undefined),
+});
+function buildService(deps = {}) {
+    return new IdentityService({
+        drizzle: db.drizzle,
+        events: makeEventBus(),
+        identityReader: makeIdentityReader(),
+        twoFactorDelivery: new TwoFactorDeliveryService({
+            drizzle: db.drizzle,
+            sms: mock({ sendOtp: vi.fn() }),
+        }),
+        ...deps,
+    });
+}
+function jsonResponse(body, status) {
+    return new Response(JSON.stringify(body), {
+        status,
+        headers: { 'content-type': 'application/json' },
+    });
+}
+const betterAuthUser = {
+    id: '00000000-0000-4000-8000-000000000001',
+    email: 'a@b.dev',
+    name: 'A',
+    emailVerified: true,
+    createdAt: '2020-01-01T00:00:00.000Z',
+    updatedAt: '2020-01-01T00:00:00.000Z',
+};
+const EMAIL = 'a@b.dev';
+const seedUser = (over = {}) => insertUser(db, { name: 'A', email: EMAIL, ...over });
+async function readUser(userId) {
+    const [row] = await db.drizzle.db.select().from(user).where(eq(user.id, userId));
+    return row;
+}
+const realCache = () => new RedisCache(redis.client);
+const signInSuccess = (userId) => jsonResponse({
+    user: { ...betterAuthUser, id: userId },
+    token: 'tok',
+    session: { expiresAt: '2020-02-01T00:00:00.000Z' },
+}, 200);
+beforeAll(async () => {
+    db = await createTestDb([migrateIdentity, migrateProfile]);
+    redis = await createTestRedis();
+});
+afterAll(async () => {
+    await db.drop();
+    await redis.quit();
+});
+beforeEach(async () => {
+    vi.clearAllMocks();
+    getSessionMock.mockResolvedValue(null);
+    changeEmailMock.mockReset();
+    await db.drizzle.db.execute(sql `TRUNCATE ${user}, ${session}, ${player} RESTART IDENTITY CASCADE`);
+    await redis.flush();
+});
+describe('IdentityService.me', () => {
+    it('returns null when no session exists', async () => {
+        expect(await buildService().me({})).toBeNull();
+    });
+});
+describe('IdentityService - login lockout (real PG + real Redis)', () => {
+    it('locks the account once failed attempts reach the threshold and emits lockout.triggered', async () => {
+        const account = await seedUser({ failedLoginAttempts: 4 });
+        const events = makeEventBus();
+        const limiter = allowLimiter();
+        signInEmailMock.mockResolvedValue(jsonResponse({ message: 'Invalid' }, 401));
+        const svc = buildService({ events, limiter });
+        await expect(svc.login({ email: 'A@B.dev', password: 'wrongpass1' }, {}, new Headers())).rejects.toMatchObject({
+            data: { attemptsRemaining: 0, lockoutUntil: expect.any(String) },
+        });
+        const row = await readUser(account.id);
+        expect(row.failedLoginAttempts).toBe(5);
+        expect(row.lockoutUntil?.getTime()).toBeGreaterThan(Date.now());
+        expect(row.lockoutUntil?.getTime()).toBeLessThanOrEqual(Date.now() + 60_000);
+        expect(row.lockoutCount).toBe(1);
+        expect(events.emit).toHaveBeenCalledTimes(1);
+        expect(events.emit).toHaveBeenCalledWith('identity.user.lockout.triggered', expect.objectContaining({ userId: account.id, email: EMAIL }));
+        expect(limiter.reset).toHaveBeenCalledWith(`login:${EMAIL}`);
+    });
+    it('escalates the lockout duration on a repeat lockout inside the 24h window', async () => {
+        const account = await seedUser({
+            failedLoginAttempts: 4,
+            lockoutCount: 1,
+            lastLockoutAt: new Date(Date.now() - 60_000),
+            lastFailedLoginAt: new Date(Date.now() - 60_000),
+        });
+        signInEmailMock.mockResolvedValue(jsonResponse({ message: 'Invalid' }, 401));
+        const svc = buildService();
+        await expect(svc.login({ email: EMAIL, password: 'wrongpass1' }, {}, new Headers())).rejects.toMatchObject({
+            data: { attemptsRemaining: 0, lockoutUntil: expect.any(String) },
+        });
+        const row = await readUser(account.id);
+        expect(row.lockoutCount).toBe(2);
+        expect(row.lockoutUntil?.getTime()).toBeGreaterThan(Date.now() + 60_000);
+    });
+    it('resets the progressive tier after 24 hours without a failed login', async () => {
+        const account = await seedUser({
+            failedLoginAttempts: 4,
+            lockoutCount: 3,
+            lastLockoutAt: new Date(Date.now() - 25 * 60 * 60 * 1000),
+            lastFailedLoginAt: new Date(Date.now() - 25 * 60 * 60 * 1000),
+        });
+        signInEmailMock.mockResolvedValue(jsonResponse({ message: 'Invalid' }, 401));
+        const svc = buildService();
+        for (const attemptsRemaining of [4, 3, 2, 1]) {
+            await expect(svc.login({ email: EMAIL, password: 'wrongpass1' }, {}, new Headers())).rejects.toMatchObject({ data: { attemptsRemaining, lockoutUntil: null } });
+        }
+        await expect(svc.login({ email: EMAIL, password: 'wrongpass1' }, {}, new Headers())).rejects.toMatchObject({
+            data: { attemptsRemaining: 0, lockoutUntil: expect.any(String) },
+        });
+        const row = await readUser(account.id);
+        expect(row.lockoutCount).toBe(1);
+        expect(row.lockoutUntil?.getTime()).toBeLessThanOrEqual(Date.now() + 60_000);
+    });
+    it('emits login.failed (not lockout) while still below the threshold', async () => {
+        const account = await seedUser();
+        const events = makeEventBus();
+        signInEmailMock.mockResolvedValue(jsonResponse({ message: 'Invalid' }, 401));
+        const svc = buildService({ events });
+        await expect(svc.login({ email: EMAIL, password: 'wrongpass1' }, {}, new Headers())).rejects.toThrow();
+        const row = await readUser(account.id);
+        expect(row.failedLoginAttempts).toBe(1);
+        expect(row.lastFailedLoginAt).not.toBeNull();
+        expect(row.lockoutUntil).toBeNull();
+        expect(events.emit).toHaveBeenCalledWith('identity.user.login.failed', expect.objectContaining({ email: EMAIL, reason: 'invalid_credentials' }));
+        expect(events.emit).not.toHaveBeenCalledWith('identity.user.lockout.triggered', expect.anything());
+    });
+    it('returns the post-increment attempts remaining on every failed login', async () => {
+        await seedUser();
+        signInEmailMock.mockResolvedValue(jsonResponse({ message: 'Invalid' }, 401));
+        const svc = buildService();
+        for (const attemptsRemaining of [4, 3, 2, 1]) {
+            await expect(svc.login({ email: EMAIL, password: 'wrongpass1' }, {}, new Headers())).rejects.toMatchObject({ data: { attemptsRemaining, lockoutUntil: null } });
+        }
+        await expect(svc.login({ email: EMAIL, password: 'wrongpass1' }, {}, new Headers())).rejects.toMatchObject({
+            data: { attemptsRemaining: 0, lockoutUntil: expect.any(String) },
+        });
+    });
+    it('counts concurrent credential failures exactly once each (atomic SQL increment)', async () => {
+        const account = await seedUser();
+        signInEmailMock.mockResolvedValue(jsonResponse({ message: 'Invalid' }, 401));
+        const svc = buildService();
+        await Promise.allSettled(Array.from({ length: 3 }, () => svc.login({ email: EMAIL, password: 'wrongpass1' }, {}, new Headers())));
+        expect((await readUser(account.id)).failedLoginAttempts).toBe(3);
+    });
+    it('commits only one first-tier lockout when concurrent failures cross the threshold', async () => {
+        const account = await seedUser({ failedLoginAttempts: 4 });
+        const events = makeEventBus();
+        signInEmailMock.mockResolvedValue(jsonResponse({ message: 'Invalid' }, 401));
+        const svc = buildService({ events });
+        await Promise.allSettled(Array.from({ length: 2 }, () => svc.login({ email: EMAIL, password: 'wrongpass1' }, {}, new Headers())));
+        const row = await readUser(account.id);
+        expect(row.lockoutCount).toBe(1);
+        expect(row.lockoutUntil?.getTime()).toBeLessThanOrEqual(Date.now() + 60_000);
+        expect(events.emit).toHaveBeenCalledTimes(1);
+    });
+    it('rejects a currently-locked account before attempting sign-in', async () => {
+        const future = new Date(Date.now() + 60_000);
+        await seedUser({ failedLoginAttempts: 5, lockoutUntil: future });
+        const svc = buildService();
+        const promise = svc.login({ email: EMAIL, password: 'whatever1' }, {}, new Headers());
+        await expect(promise).rejects.toThrow(ORPCError);
+        await expect(promise).rejects.toMatchObject({
+            code: 'UNAUTHORIZED',
+            message: 'Account is temporarily locked. Please try again later.',
+            data: {
+                code: 'ACCOUNT_LOCKED',
+                lockoutUntil: future.toISOString(),
+            },
+        });
+        expect(signInEmailMock).not.toHaveBeenCalled();
+    });
+    it('clears the counter and emits login on success', async () => {
+        const account = await seedUser({ failedLoginAttempts: 2 });
+        const events = makeEventBus();
+        signInEmailMock.mockResolvedValue(signInSuccess(account.id));
+        const svc = buildService({ events });
+        const result = await svc.login({ email: EMAIL, password: 'rightpass1' }, {}, new Headers());
+        expect(result).toMatchObject({ session: { token: 'tok' } });
+        expect((await readUser(account.id)).failedLoginAttempts).toBe(0);
+        expect(events.emit).toHaveBeenCalledWith('identity.user.login', expect.objectContaining({ userId: account.id }));
+    });
+    it('bypasses lockout for admins if configured with bypassForAdmins: true', async () => {
+        const account = await seedUser({
+            email: 'admin@b.dev',
+            role: 'admin',
+            failedLoginAttempts: 4,
+        });
+        const events = makeEventBus();
+        signInEmailMock.mockResolvedValue(jsonResponse({ message: 'Invalid' }, 401));
+        const svc = buildService({
+            events,
+            options: { lockout: { enabled: true, bypassForAdmins: true } },
+        });
+        await expect(svc.login({ email: 'admin@b.dev', password: 'wrongpass1' }, {}, new Headers())).rejects.toThrow();
+        const row = await readUser(account.id);
+        expect(row.failedLoginAttempts).toBe(4);
+        expect(row.lockoutUntil).toBeNull();
+        expect(events.emit).toHaveBeenCalledWith('identity.user.login.failed', expect.objectContaining({ email: 'admin@b.dev' }));
+        expect(events.emit).not.toHaveBeenCalledWith('identity.user.lockout.triggered', expect.anything());
+    });
+    it('does not bypass lockout for other backoffice roles if bypassForAdmins is true', async () => {
+        const account = await seedUser({
+            email: 'support@b.dev',
+            role: 'support',
+            failedLoginAttempts: 4,
+        });
+        const events = makeEventBus();
+        signInEmailMock.mockResolvedValue(jsonResponse({ message: 'Invalid' }, 401));
+        const svc = buildService({
+            events,
+            options: { lockout: { enabled: true, bypassForAdmins: true, maxAttempts: 5 } },
+        });
+        await expect(svc.login({ email: 'support@b.dev', password: 'wrongpass1' }, {}, new Headers())).rejects.toThrow();
+        const row = await readUser(account.id);
+        expect(row.failedLoginAttempts).toBe(5);
+        expect(row.lockoutUntil?.getTime()).toBeGreaterThan(Date.now());
+        expect(events.emit).toHaveBeenCalledWith('identity.user.lockout.triggered', expect.objectContaining({ userId: account.id, email: 'support@b.dev' }));
+    });
+    it('anti-enumeration: locks a nonexistent email once failed attempts reach the threshold, mirroring a real account, without emitting lockout.triggered', async () => {
+        const events = makeEventBus();
+        const limiter = allowLimiter();
+        signInEmailMock.mockImplementation(async () => jsonResponse({ message: 'Invalid' }, 401));
+        const svc = buildService({ events, limiter, cache: realCache() });
+        for (let i = 0; i < 4; i++) {
+            await expect(svc.login({ email: 'nobody@b.dev', password: 'wrongpass1' }, {}, new Headers())).rejects.toMatchObject({ code: 'UNAUTHORIZED', message: 'Invalid' });
+        }
+        await expect(svc.login({ email: 'nobody@b.dev', password: 'wrongpass1' }, {}, new Headers())).rejects.toMatchObject({
+            code: 'UNAUTHORIZED',
+            data: { code: 'ACCOUNT_LOCKED' },
+        });
+        expect(limiter.reset).toHaveBeenCalledWith('login:nobody@b.dev');
+        expect(events.emit).not.toHaveBeenCalledWith('identity.user.lockout.triggered', expect.anything());
+    });
+    it('anti-enumeration: the shadow lockout survives a fresh service instance (state lives in Redis, not memory)', async () => {
+        signInEmailMock.mockImplementation(async () => jsonResponse({ message: 'Invalid' }, 401));
+        for (let i = 0; i < 5; i++) {
+            const svc = buildService({ cache: realCache() });
+            await expect(svc.login({ email: 'nobody@b.dev', password: 'wrongpass1' }, {}, new Headers())).rejects.toThrow();
+        }
+        await expect(buildService({ cache: realCache() }).login({ email: 'nobody@b.dev', password: 'wrongpass1' }, {}, new Headers())).rejects.toMatchObject({ data: { code: 'ACCOUNT_LOCKED' } });
+    });
+    it('never locks a nonexistent email when cache is not provided (degrades to the pre-mirroring behavior)', async () => {
+        const events = makeEventBus();
+        signInEmailMock.mockImplementation(async () => jsonResponse({ message: 'Invalid' }, 401));
+        const svc = buildService({ events });
+        for (let i = 0; i < 6; i++) {
+            await expect(svc.login({ email: 'nobody@b.dev', password: 'wrongpass1' }, {}, new Headers())).rejects.toMatchObject({ code: 'UNAUTHORIZED', message: 'Invalid' });
+        }
+        expect(events.emit).not.toHaveBeenCalledWith('identity.user.lockout.triggered', expect.anything());
+    });
+});
+describe('IdentityService - login banned-user 403 (not the RG block)', () => {
+    it('surfaces a banned-user 403 from signInEmail as FORBIDDEN and still emits login.failed', async () => {
+        await seedUser();
+        const events = makeEventBus();
+        signInEmailMock.mockResolvedValue(jsonResponse({ message: 'BANNED_USER' }, 403));
+        const svc = buildService({ events });
+        await expect(svc.login({ email: EMAIL, password: 'whatever1' }, {}, new Headers())).rejects.toMatchObject({ code: 'FORBIDDEN' });
+        expect(events.emit).toHaveBeenCalledWith('identity.user.login.failed', expect.objectContaining({ email: EMAIL, reason: 'error' }));
+        expect(events.emit).not.toHaveBeenCalledWith('rg.exclusion.login_blocked', expect.anything());
+    });
+    it("forwards better-auth's error code so a client can tell an unverified email from bad credentials", async () => {
+        await seedUser();
+        signInEmailMock.mockResolvedValue(jsonResponse({ message: 'Email not verified', code: 'EMAIL_NOT_VERIFIED' }, 403));
+        const svc = buildService();
+        await expect(svc.login({ email: EMAIL, password: 'whatever1' }, {}, new Headers())).rejects.toMatchObject({
+            code: 'FORBIDDEN',
+            data: { code: 'EMAIL_NOT_VERIFIED' },
+        });
+    });
+    it('omits the data code when better-auth sends none', async () => {
+        await seedUser();
+        signInEmailMock.mockResolvedValue(jsonResponse({ message: 'BANNED_USER' }, 403));
+        const svc = buildService();
+        await expect(svc.login({ email: EMAIL, password: 'whatever1' }, {}, new Headers())).rejects.toMatchObject({ code: 'FORBIDDEN', data: undefined });
+    });
+    it('ignores an error body that is not the shape better-auth documents', async () => {
+        await seedUser();
+        signInEmailMock.mockResolvedValue(jsonResponse({ message: 'Denied', code: 42 }, 403));
+        const svc = buildService();
+        await expect(svc.login({ email: EMAIL, password: 'whatever1' }, {}, new Headers())).rejects.toMatchObject({
+            code: 'FORBIDDEN',
+            message: 'Request failed (403)',
+            data: undefined,
+        });
+    });
+    it('falls back to the status message when the error body is not JSON', async () => {
+        await seedUser();
+        signInEmailMock.mockResolvedValue(new Response('<html>gateway timeout</html>', { status: 403 }));
+        const svc = buildService();
+        await expect(svc.login({ email: EMAIL, password: 'whatever1' }, {}, new Headers())).rejects.toMatchObject({
+            code: 'FORBIDDEN',
+            message: 'Request failed (403)',
+            data: undefined,
+        });
+    });
+});
+describe('IdentityService - RG login gate (real PG)', () => {
+    it('blocks a self-excluded login AFTER credentials verify, expires the issued session, and emits rg.exclusion.login_blocked', async () => {
+        const account = await seedUser({ rgBlocked: true, rgBlockedUntil: null });
+        const live = new Date(Date.now() + 24 * 60 * 60 * 1000);
+        await db.drizzle.db
+            .insert(session)
+            .values({ userId: account.id, token: randomUUID(), expiresAt: live });
+        const events = makeEventBus();
+        // Valid credentials (200) - the gate must still block.
+        signInEmailMock.mockResolvedValue(signInSuccess(account.id));
+        const svc = buildService({ events });
+        await expect(svc.login({ email: EMAIL, password: 'rightpass1' }, {}, new Headers())).rejects.toMatchObject({ code: 'FORBIDDEN' });
+        expect(signInEmailMock).toHaveBeenCalled();
+        expect(events.emit).toHaveBeenCalledWith('rg.exclusion.login_blocked', expect.objectContaining({ userId: account.id }));
+        expect(events.emit).not.toHaveBeenCalledWith('identity.user.login', expect.anything());
+        expect(events.emit).not.toHaveBeenCalledWith('identity.user.login.failed', expect.anything());
+        const [revoked] = await db.drizzle.db
+            .select()
+            .from(session)
+            .where(eq(session.userId, account.id));
+        expect(revoked.expiresAt.getTime()).toBeLessThanOrEqual(Date.now());
+    });
+    it('allows login once a lapsed cooling-off block has elapsed', async () => {
+        const account = await seedUser({
+            rgBlocked: true,
+            rgBlockedUntil: new Date(Date.now() - 60_000),
+        });
+        const events = makeEventBus();
+        signInEmailMock.mockResolvedValue(signInSuccess(account.id));
+        const svc = buildService({ events });
+        const result = await svc.login({ email: EMAIL, password: 'rightpass1' }, {}, new Headers());
+        expect(result).toMatchObject({ session: { token: 'tok' } });
+        expect(events.emit).toHaveBeenCalledWith('identity.user.login', expect.objectContaining({ userId: account.id }));
+        expect(events.emit).not.toHaveBeenCalledWith('rg.exclusion.login_blocked', expect.anything());
+    });
+});
+describe('IdentityService - player-status login gate (real PG)', () => {
+    async function seedBlockedPlayer(status) {
+        const account = await seedUser();
+        await db.drizzle.db.insert(player).values({ userId: account.id, status });
+        const live = new Date(Date.now() + 24 * 60 * 60 * 1000);
+        await db.drizzle.db
+            .insert(session)
+            .values({ userId: account.id, token: randomUUID(), expiresAt: live });
+        return account;
+    }
+    for (const status of ['suspended', 'closed']) {
+        it(`blocks a ${status} player AFTER credentials verify, expires the issued session, and emits player.login_blocked`, async () => {
+            const account = await seedBlockedPlayer(status);
+            const events = makeEventBus();
+            // Valid credentials (200) - the gate must still block.
+            signInEmailMock.mockResolvedValue(signInSuccess(account.id));
+            const svc = buildService({ events });
+            await expect(svc.login({ email: EMAIL, password: 'rightpass1' }, {}, new Headers())).rejects.toMatchObject({ code: 'FORBIDDEN', data: { code: 'ACCOUNT_SUSPENDED' } });
+            expect(signInEmailMock).toHaveBeenCalled();
+            expect(events.emit).toHaveBeenCalledWith('player.login_blocked', expect.objectContaining({ userId: account.id, status }));
+            expect(events.emit).not.toHaveBeenCalledWith('identity.user.login', expect.anything());
+            expect(events.emit).not.toHaveBeenCalledWith('identity.user.login.failed', expect.anything());
+            const [revoked] = await db.drizzle.db
+                .select()
+                .from(session)
+                .where(eq(session.userId, account.id));
+            expect(revoked.expiresAt.getTime()).toBeLessThanOrEqual(Date.now());
+        });
+    }
+    it('allows login for an active player (no regression)', async () => {
+        const account = await seedUser();
+        await db.drizzle.db.insert(player).values({ userId: account.id, status: 'active' });
+        const events = makeEventBus();
+        signInEmailMock.mockResolvedValue(signInSuccess(account.id));
+        const svc = buildService({ events });
+        const result = await svc.login({ email: EMAIL, password: 'rightpass1' }, {}, new Headers());
+        expect(result).toMatchObject({ session: { token: 'tok' } });
+        expect(events.emit).toHaveBeenCalledWith('identity.user.login', expect.objectContaining({ userId: account.id }));
+        expect(events.emit).not.toHaveBeenCalledWith('player.login_blocked', expect.anything());
+    });
+});
+describe('IdentityService - trusted device login (real PG)', () => {
+    const TRUSTED_UA = 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36';
+    const trustedHeaders = {
+        cookie: 'better-auth.session_token=tok; better-auth.trust_device=signed-trust-value',
+        'user-agent': TRUSTED_UA,
+    };
+    const honourTrustCookie = (userId) => signInEmailMock.mockImplementation(async ({ headers }) => headers.get('cookie')?.includes('.trust_device')
+        ? signInSuccess(userId)
+        : jsonResponse({ twoFactorRedirect: true }, 200));
+    const makeTrustedDevices = () => new TrustedDeviceService({
+        drizzle: db.drizzle,
+        events: makeEventBus(),
+        trustedDeviceDays: 30,
+    });
+    it('signs in without a second factor while the trusted-device row is live', async () => {
+        const account = await seedUser();
+        const trustedDevices = makeTrustedDevices();
+        await trustedDevices.trust(account.id, { ip: null, userAgent: TRUSTED_UA });
+        honourTrustCookie(account.id);
+        const svc = buildService({ trustedDevices });
+        const result = await svc.login({ email: EMAIL, password: 'rightpass1' }, trustedHeaders, new Headers());
+        expect(result).toMatchObject({ session: { token: 'tok' } });
+    });
+    it('challenges again once the trusted device is revoked', async () => {
+        const account = await seedUser();
+        const trustedDevices = makeTrustedDevices();
+        const device = await trustedDevices.trust(account.id, { ip: null, userAgent: TRUSTED_UA });
+        if (!device) {
+            throw new Error('trust() stored no device');
+        }
+        await trustedDevices.revoke(account.id, device.id, account.id);
+        honourTrustCookie(account.id);
+        const svc = buildService({ trustedDevices });
+        const result = await svc.login({ email: EMAIL, password: 'rightpass1' }, trustedHeaders, new Headers());
+        expect(result).toEqual({ twoFactorRedirect: true, twoFactorMethod: 'app' });
+    });
+    it('challenges a device whose cookie was replayed from another browser', async () => {
+        const account = await seedUser();
+        const trustedDevices = makeTrustedDevices();
+        await trustedDevices.trust(account.id, { ip: null, userAgent: TRUSTED_UA });
+        honourTrustCookie(account.id);
+        const svc = buildService({ trustedDevices });
+        const result = await svc.login({ email: EMAIL, password: 'rightpass1' }, { ...trustedHeaders, 'user-agent': 'Mozilla/5.0 (Macintosh) Safari/605.1.15' }, new Headers());
+        expect(result).toEqual({ twoFactorRedirect: true, twoFactorMethod: 'app' });
+    });
+});
+describe('IdentityService.unlockUser (real PG)', () => {
+    it('clears the lockout row and emits unlocked with the prior state', async () => {
+        const lockedUntil = new Date('2020-01-01T00:00:00.000Z');
+        const account = await seedUser({ failedLoginAttempts: 5, lockoutUntil: lockedUntil });
+        const events = makeEventBus();
+        const svc = buildService({ events });
+        const res = await svc.unlockUser(account.id, 'admin1');
+        expect(res).toEqual({ success: true });
+        const row = await readUser(account.id);
+        expect(row.failedLoginAttempts).toBe(0);
+        expect(row.lockoutUntil).toBeNull();
+        expect(events.emit).toHaveBeenCalledWith('identity.user.unlocked', expect.objectContaining({
+            userId: account.id,
+            actorId: 'admin1',
+            previousFailedAttempts: 5,
+            previousLockoutUntil: lockedUntil.toISOString(),
+        }));
+    });
+    it('throws when the user does not exist', async () => {
+        await expect(buildService().unlockUser(randomUUID(), 'admin1')).rejects.toThrow();
+    });
+    it('resets the login rate-limit window for the unlocked user', async () => {
+        const account = await seedUser({
+            failedLoginAttempts: 5,
+            lockoutUntil: new Date('2020-01-01'),
+        });
+        const limiter = allowLimiter();
+        const svc = buildService({ limiter });
+        await svc.unlockUser(account.id, 'admin1');
+        expect(limiter.reset).toHaveBeenCalledWith(`login:${EMAIL}`);
+    });
+});
+describe('IdentityService.adminRequestPasswordReset (real PG)', () => {
+    it('requests an OTP for the user email, sets the admin-marker in cache, and emits the audit event', async () => {
+        requestPasswordResetEmailOTPMock.mockResolvedValue(jsonResponse({ success: true }, 200));
+        const account = await seedUser();
+        const events = makeEventBus();
+        const cache = realCache();
+        const svc = buildService({ events, cache });
+        const res = await svc.adminRequestPasswordReset(account.id, 'admin1', {
+            ip: '1.2.3.4',
+            userAgent: 'ua',
+        });
+        expect(res).toEqual({ success: true });
+        expect(requestPasswordResetEmailOTPMock).toHaveBeenCalledWith(expect.objectContaining({ body: { email: EMAIL } }));
+        expect(await cache.get(`admin-password-reset:${EMAIL}`)).toBe(true);
+        expect(events.emit).toHaveBeenCalledWith('identity.password.admin_reset_requested', expect.objectContaining({
+            userId: account.id,
+            email: EMAIL,
+            actorId: 'admin1',
+            ip: '1.2.3.4',
+            userAgent: 'ua',
+        }));
+    });
+    it('throws NOT_FOUND when the user does not exist', async () => {
+        await expect(buildService().adminRequestPasswordReset(randomUUID(), 'admin1')).rejects.toThrow();
+    });
+    it('swallows an OTP-send failure and still returns SUCCESS', async () => {
+        requestPasswordResetEmailOTPMock.mockRejectedValue(new Error('boom'));
+        const account = await seedUser();
+        await expect(buildService().adminRequestPasswordReset(account.id, 'admin1')).resolves.toEqual({
+            success: true,
+        });
+    });
+    it('consumes the admin marker on the read that sees it, so a later self-reset is not "admin"', async () => {
+        const cache = realCache();
+        buildService({ cache });
+        const email = 'markerconsume@example.com';
+        await cache.set(`admin-password-reset:${email}`, true, { ttlMs: 120_000 });
+        const isAdminPasswordReset = capturedAuthOptions.current?.isAdminPasswordReset;
+        if (!isAdminPasswordReset) {
+            throw new Error('isAdminPasswordReset was not wired into createAuth');
+        }
+        expect(await isAdminPasswordReset(email)).toBe(true);
+        expect(await isAdminPasswordReset(email)).toBe(false);
+        expect(await cache.get(`admin-password-reset:${email}`)).toBeUndefined();
+    });
+});
+describe('IdentityService.requestPasswordReset', () => {
+    it('calls the non-deprecated requestPasswordResetEmailOTP endpoint and returns SUCCESS', async () => {
+        requestPasswordResetEmailOTPMock.mockResolvedValue(jsonResponse({ success: true }, 200));
+        const result = await buildService().requestPasswordReset({ email: EMAIL });
+        expect(result).toEqual({ success: true });
+        expect(requestPasswordResetEmailOTPMock).toHaveBeenCalledWith(expect.objectContaining({ body: { email: EMAIL } }));
+    });
+    it('swallows a failure and still returns SUCCESS (anti-enumeration)', async () => {
+        requestPasswordResetEmailOTPMock.mockRejectedValue(new Error('boom'));
+        await expect(buildService().requestPasswordReset({ email: 'unregistered@x.dev' })).resolves.toEqual({ success: true });
+    });
+});
+describe('IdentityService.verifyPasswordResetOtp', () => {
+    it('calls checkVerificationOTP with type forget-password and returns SUCCESS', async () => {
+        checkVerificationOTPMock.mockResolvedValue(jsonResponse({ success: true }, 200));
+        const result = await buildService().verifyPasswordResetOtp({ email: EMAIL, otp: '123456' });
+        expect(result).toEqual({ success: true });
+        expect(checkVerificationOTPMock).toHaveBeenCalledWith(expect.objectContaining({
+            body: { email: EMAIL, type: 'forget-password', otp: '123456' },
+        }));
+    });
+    it('surfaces an invalid OTP (400) response as ORPCError BAD_REQUEST with a generic message', async () => {
+        checkVerificationOTPMock.mockResolvedValue(jsonResponse({ message: 'INVALID_OTP' }, 400));
+        await expect(buildService().verifyPasswordResetOtp({ email: EMAIL, otp: '000000' })).rejects.toMatchObject({
+            code: 'BAD_REQUEST',
+            message: 'Invalid or expired verification code',
+        });
+    });
+    it('does not leak better-auth USER_NOT_FOUND message - forces the same generic message as a wrong OTP (anti-enumeration)', async () => {
+        // better-auth's checkVerificationOTP checks findUserByEmail BEFORE the OTP row, so an
+        // unregistered email produces a distinct raw message ("User not found") that must never
+        // reach the caller - it would let an unauthenticated caller learn whether an email exists.
+        checkVerificationOTPMock.mockResolvedValue(jsonResponse({ message: 'User not found' }, 400));
+        await expect(buildService().verifyPasswordResetOtp({ email: 'unregistered@x.dev', otp: '000000' })).rejects.toMatchObject({
+            code: 'BAD_REQUEST',
+            message: 'Invalid or expired verification code',
+        });
+    });
+    it('surfaces a TOO_MANY_ATTEMPTS (403) response as ORPCError BAD_REQUEST (masked)', async () => {
+        checkVerificationOTPMock.mockResolvedValue(jsonResponse({ message: 'TOO_MANY_ATTEMPTS' }, 403));
+        await expect(buildService().verifyPasswordResetOtp({ email: EMAIL, otp: '000000' })).rejects.toMatchObject({ code: 'BAD_REQUEST' });
+    });
+});
+describe('IdentityService.resetPassword', () => {
+    it('calls resetPasswordEmailOTP with the right body and returns SUCCESS', async () => {
+        resetPasswordEmailOTPMock.mockResolvedValue(jsonResponse({ success: true }, 200));
+        const result = await buildService().resetPassword({
+            email: EMAIL,
+            otp: '123456',
+            newPassword: 'newpassword1',
+        });
+        expect(result).toEqual({ success: true });
+        expect(resetPasswordEmailOTPMock).toHaveBeenCalledWith(expect.objectContaining({
+            body: { email: EMAIL, otp: '123456', password: 'newpassword1' },
+        }));
+    });
+    it('surfaces a TOO_MANY_ATTEMPTS (403) response as ORPCError BAD_REQUEST (masked)', async () => {
+        resetPasswordEmailOTPMock.mockResolvedValue(jsonResponse({ message: 'TOO_MANY_ATTEMPTS' }, 403));
+        await expect(buildService().resetPassword({ email: EMAIL, otp: '000000', newPassword: 'newpassword1' })).rejects.toMatchObject({ code: 'BAD_REQUEST' });
+    });
+});
+describe('IdentityService onPasswordReset hook (wired via createAuth)', () => {
+    it('clears the lockout row and emits identity.password.reset when better-auth invokes the hook', async () => {
+        const account = await seedUser({
+            failedLoginAttempts: 5,
+            lockoutUntil: new Date(Date.now() + 60_000),
+        });
+        const events = makeEventBus();
+        buildService({ events });
+        await capturedAuthOptions.current?.onPasswordReset?.({ id: account.id, email: EMAIL });
+        expect(events.emit).toHaveBeenCalledWith('identity.password.reset', expect.objectContaining({ userId: account.id }));
+        const row = await readUser(account.id);
+        expect(row.failedLoginAttempts).toBe(0);
+        expect(row.lockoutUntil).toBeNull();
+    });
+});
+describe('IdentityService.updateProfile language validation', () => {
+    it('rejects an unsupported language before calling updateUser', async () => {
+        const svc = buildService({
+            platformConfig: mock({ supportedLanguages: ['en', 'fr'] }),
+        });
+        await expect(svc.updateProfile({ language: 'de' }, {}, new Headers())).rejects.toThrow(UnsupportedLanguageError);
+        expect(updateUserMock).not.toHaveBeenCalled();
+    });
+    it('accepts a supported language and forwards it to updateUser', async () => {
+        updateUserMock.mockResolvedValue(jsonResponse({ status: true }, 200));
+        getSessionMock.mockResolvedValueOnce({ user: { ...betterAuthUser, language: 'fr' } });
+        const svc = buildService({
+            platformConfig: mock({ supportedLanguages: ['en', 'fr'] }),
+        });
+        const result = await svc.updateProfile({ language: 'fr' }, {}, new Headers());
+        expect(updateUserMock).toHaveBeenCalledWith(expect.objectContaining({ body: expect.objectContaining({ language: 'fr' }) }));
+        expect(result.user.language).toBe('fr');
+    });
+});
+describe('IdentityService.verifyTwoFactor', () => {
+    const okResponse = () => jsonResponse({ status: true }, 200);
+    const pendingChallenge = (userId) => mock({
+        resolvePendingUserId: vi.fn(async () => userId),
+        assertNotLocked: vi.fn(async () => undefined),
+        recordFailure: vi.fn(async () => undefined),
+        reset: vi.fn(async () => undefined),
+    });
+    it('spends a backup code through better-auth instead of the authenticator', async () => {
+        const account = await seedUser();
+        verifyBackupCodeMock.mockResolvedValue(okResponse());
+        const events = makeEventBus();
+        const svc = buildService({ events, twoFactorLockout: pendingChallenge(account.id) });
+        await svc.verifyTwoFactor({ code: 'lH2MN-bvPJb', method: 'backup_code', trustDevice: false }, {}, new Headers());
+        expect(verifyBackupCodeMock).toHaveBeenCalledWith(expect.objectContaining({ body: { code: 'lH2MN-bvPJb', trustDevice: false } }));
+        expect(verifyTotpMock).not.toHaveBeenCalled();
+        expect(events.emit).toHaveBeenCalledWith('identity.2fa.verified', expect.objectContaining({ userId: account.id, method: 'backup_code' }));
+        // A recovery-credential sign-in is a materially different fraud signal than a normal
+        // authenticator login and must be reported as such, not hardcoded to 'totp'.
+        expect(events.emit).toHaveBeenCalledWith('identity.authentication.succeeded', expect.objectContaining({ userId: account.id, method: 'backup_code' }));
+    });
+    it('counts a rejected backup code against the lockout', async () => {
+        const account = await seedUser();
+        verifyBackupCodeMock.mockResolvedValue(jsonResponse({ message: 'Invalid' }, 401));
+        const lockout = pendingChallenge(account.id);
+        const svc = buildService({ twoFactorLockout: lockout });
+        await expect(svc.verifyTwoFactor({ code: 'lH2MN-bvPJb', method: 'backup_code', trustDevice: false }, {}, new Headers())).rejects.toMatchObject({ code: 'UNAUTHORIZED' });
+        expect(lockout.recordFailure).toHaveBeenCalledWith(account.id, expect.anything());
+    });
+    it('announces enrolment only for the challenge answered from a live session', async () => {
+        const account = await seedUser();
+        verifyTotpMock.mockResolvedValue(okResponse());
+        getSessionMock.mockResolvedValue({ user: { ...betterAuthUser, id: account.id } });
+        const enrolment = makeEventBus();
+        await buildService({ events: enrolment }).verifyTwoFactor({ code: '123456', method: 'totp', trustDevice: false }, {}, new Headers());
+        expect(enrolment.emit).toHaveBeenCalledWith('identity.2fa.enabled', expect.objectContaining({ userId: account.id }));
+        getSessionMock.mockResolvedValue(null);
+        const signIn = makeEventBus();
+        await buildService({
+            events: signIn,
+            twoFactorLockout: pendingChallenge(account.id),
+        }).verifyTwoFactor({ code: '123456', method: 'totp', trustDevice: false }, {}, new Headers());
+        expect(signIn.emit).toHaveBeenCalledWith('identity.2fa.verified', expect.objectContaining({ userId: account.id }));
+        expect(signIn.emit).not.toHaveBeenCalledWith('identity.2fa.enabled', expect.anything());
+    });
+});
+describe('IdentityService 2fa step-up teardown', () => {
+    const BROWSER_UA = 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36';
+    const okResponse = () => jsonResponse({ status: true }, 200);
+    const seedSession = (userId) => db.drizzle.db
+        .insert(session)
+        .values({
+        userId,
+        token: randomUUID(),
+        userAgent: BROWSER_UA,
+        expiresAt: new Date(Date.now() + 86_400_000),
+        updatedAt: new Date(),
+    })
+        .returning({ id: session.id })
+        .then(([row]) => row?.id ?? '');
+    const buildTeardownDeps = (userId) => {
+        const events = makeEventBus();
+        const trustedDevices = new TrustedDeviceService({
+            drizzle: db.drizzle,
+            events: makeEventBus(),
+            trustedDeviceDays: 30,
+        });
+        const sessions = new SessionService({
+            drizzle: db.drizzle,
+            events: makeEventBus(),
+            identityReader: makeIdentityReader(),
+        });
+        getSessionMock.mockResolvedValue({ user: { ...betterAuthUser, id: userId } });
+        return { events, trustedDevices, sessions };
+    };
+    it('does not buy the trust window for a spent backup code', async () => {
+        const account = await seedUser();
+        verifyBackupCodeMock.mockResolvedValue(okResponse());
+        const { events, trustedDevices } = buildTeardownDeps(account.id);
+        getSessionMock.mockResolvedValue(null);
+        const lockout = mock({
+            resolvePendingUserId: vi.fn(async () => account.id),
+            assertNotLocked: vi.fn(async () => undefined),
+            recordFailure: vi.fn(async () => undefined),
+            reset: vi.fn(async () => undefined),
+        });
+        await buildService({ events, trustedDevices, twoFactorLockout: lockout }).verifyTwoFactor({ code: 'lH2MN-bvPJb', method: 'backup_code', trustDevice: true }, { 'user-agent': BROWSER_UA }, new Headers());
+        expect(verifyBackupCodeMock).toHaveBeenCalledWith(expect.objectContaining({ body: { code: 'lH2MN-bvPJb', trustDevice: false } }));
+        expect(await trustedDevices.isTrusted(account.id, BROWSER_UA)).toBe(false);
+    });
+    it('disableTwoFactor takes a fresh authenticator code, then drops trust and sessions', async () => {
+        const account = await seedUser({ twoFactorEnabled: true });
+        const { events, trustedDevices, sessions } = buildTeardownDeps(account.id);
+        await trustedDevices.trust(account.id, { ip: null, userAgent: BROWSER_UA });
+        const liveSession = await seedSession(account.id);
+        verifyTotpMock.mockResolvedValue(okResponse());
+        disableTwoFactorMock.mockResolvedValue(okResponse());
+        const svc = buildService({ events, trustedDevices, sessions });
+        await svc.disableTwoFactor({ password: 'rightpass1', code: '123456' }, { cookie: 'better-auth.session_token=live', 'user-agent': BROWSER_UA }, new Headers());
+        expect(verifyTotpMock).toHaveBeenCalledWith(expect.objectContaining({ body: { code: '123456', trustDevice: false } }));
+        expect(await trustedDevices.isTrusted(account.id, BROWSER_UA)).toBe(false);
+        const [row] = await db.drizzle.db
+            .select({ live: sql `${session.expiresAt} > now()` })
+            .from(session)
+            .where(eq(session.id, liveSession));
+        expect(row?.live).toBe(false);
+        expect(events.emit).toHaveBeenCalledWith('identity.2fa.disabled', expect.anything());
+    });
+    it('rejects disableTwoFactor when the authenticator code is wrong, before better-auth is called', async () => {
+        const account = await seedUser({ twoFactorEnabled: true });
+        const { events, trustedDevices, sessions } = buildTeardownDeps(account.id);
+        verifyTotpMock.mockResolvedValue(jsonResponse({ message: 'Invalid' }, 401));
+        const svc = buildService({ events, trustedDevices, sessions });
+        await expect(svc.disableTwoFactor({ password: 'rightpass1', code: '000000' }, { cookie: 'better-auth.session_token=live' }, new Headers())).rejects.toMatchObject({ code: 'UNAUTHORIZED' });
+        expect(disableTwoFactorMock).not.toHaveBeenCalled();
+    });
+    it('refuses to re-enrol an account that already has a live second factor', async () => {
+        const account = await seedUser({ twoFactorEnabled: true, twoFactorMethod: 'app' });
+        const { events, trustedDevices, sessions } = buildTeardownDeps(account.id);
+        const svc = buildService({ events, trustedDevices, sessions });
+        await expect(svc.enableTwoFactor({ password: 'rightpass1', method: 'email' }, { cookie: 'better-auth.session_token=live' }, new Headers())).rejects.toMatchObject({ code: 'CONFLICT' });
+        // better-auth's enable leg would have destroyed the working secret and backup
+        // codes before the player ever confirmed the new method.
+        expect(enableTwoFactorMock).not.toHaveBeenCalled();
+        expect((await readUser(account.id))?.twoFactorMethod).toBe('app');
+    });
+    it('enrols an account that has no second factor yet', async () => {
+        const account = await seedUser({ twoFactorEnabled: false });
+        const { events, trustedDevices, sessions } = buildTeardownDeps(account.id);
+        enableTwoFactorMock.mockResolvedValue(jsonResponse({ totpURI: 'otpauth://totp/x', backupCodes: ['aaaaa-bbbbb'] }, 200));
+        const svc = buildService({ events, trustedDevices, sessions });
+        const result = await svc.enableTwoFactor({ password: 'rightpass1', method: 'app' }, { cookie: 'better-auth.session_token=live' }, new Headers());
+        expect(result.totpUri).toBe('otpauth://totp/x');
+        expect((await readUser(account.id))?.twoFactorMethod).toBe('app');
+    });
+    it('regenerateBackupCodes takes a fresh authenticator code and revokes old trust', async () => {
+        const account = await seedUser({ twoFactorEnabled: true });
+        const { events, trustedDevices, sessions } = buildTeardownDeps(account.id);
+        await trustedDevices.trust(account.id, { ip: null, userAgent: BROWSER_UA });
+        verifyTotpMock.mockResolvedValue(okResponse());
+        generateBackupCodesMock.mockResolvedValue(jsonResponse({ backupCodes: ['aaaaa-bbbbb'] }, 200));
+        const svc = buildService({ events, trustedDevices, sessions });
+        const result = await svc.regenerateBackupCodes({ password: 'rightpass1', code: '123456' }, { cookie: 'better-auth.session_token=live', 'user-agent': BROWSER_UA }, new Headers());
+        expect(result.backupCodes).toEqual(['aaaaa-bbbbb']);
+        expect(verifyTotpMock).toHaveBeenCalled();
+        expect(await trustedDevices.isTrusted(account.id, BROWSER_UA)).toBe(false);
+    });
+});
+describe('IdentityService.trustCurrentDevice', () => {
+    const BROWSER_UA = 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36';
+    const challengeResponse = () => {
+        const res = jsonResponse({ twoFactorRedirect: true }, 200);
+        res.headers.append('set-cookie', 'better-auth.two_factor=pending-value; Path=/; HttpOnly');
+        return res;
+    };
+    const makeTrustedDevices = () => new TrustedDeviceService({
+        drizzle: db.drizzle,
+        events: makeEventBus(),
+        trustedDeviceDays: 30,
+    });
+    it('replays the sign-in leg so better-auth issues its trust cookie', async () => {
+        const account = await seedUser();
+        getSessionMock.mockResolvedValue({ user: { ...betterAuthUser, id: account.id } });
+        signInEmailMock.mockResolvedValue(challengeResponse());
+        const trusted = jsonResponse({ status: true }, 200);
+        trusted.headers.append('set-cookie', 'better-auth.trust_device=granted; Path=/; HttpOnly');
+        verifyTotpMock.mockResolvedValue(trusted);
+        const trustedDevices = makeTrustedDevices();
+        const events = makeEventBus();
+        const resHeaders = new Headers();
+        await buildService({ trustedDevices, events }).trustCurrentDevice({ password: 'rightpass1', code: '123456' }, { cookie: 'better-auth.session_token=live', 'user-agent': BROWSER_UA }, resHeaders);
+        const [call] = verifyTotpMock.mock.calls;
+        expect(call?.[0].body).toEqual({ code: '123456', trustDevice: true });
+        expect(call?.[0].headers.get('cookie')).toBe('better-auth.two_factor=pending-value');
+        expect(resHeaders.getSetCookie().join(';')).toContain('trust_device=granted');
+        expect(await trustedDevices.isTrusted(account.id, BROWSER_UA)).toBe(true);
+        // The event carries the method that was actually spent, not a literal - a
+        // reader (security alerts, audit) must see `totp` for the reason it is `totp`
+        // here: this route rejects every other method before it ever gets this far.
+        expect(events.emit).toHaveBeenCalledWith('identity.2fa.verified', expect.objectContaining({ method: 'totp', trustedDevice: true }));
+        expect(events.emit).toHaveBeenCalledWith('identity.authentication.succeeded', expect.objectContaining({ method: 'totp' }));
+    });
+    it('refuses an account that has no second factor to trust', async () => {
+        const account = await seedUser();
+        getSessionMock.mockResolvedValue({ user: { ...betterAuthUser, id: account.id } });
+        signInEmailMock.mockResolvedValue(signInSuccess(account.id));
+        const trustedDevices = makeTrustedDevices();
+        await expect(buildService({ trustedDevices }).trustCurrentDevice({ password: 'rightpass1', code: '123456' }, { 'user-agent': BROWSER_UA }, new Headers())).rejects.toMatchObject({ code: 'BAD_REQUEST' });
+        expect(verifyTotpMock).not.toHaveBeenCalled();
+        expect(await trustedDevices.isTrusted(account.id, BROWSER_UA)).toBe(false);
+    });
+});
+describe('IdentityService security controls', () => {
+    it('refuses to set the preference for a non-player (admin) account', async () => {
+        const account = await seedUser({
+            role: 'admin',
+            emailVerified: true,
+            loginWithdrawalAlertsEnabled: false,
+        });
+        getSessionMock.mockResolvedValue({ user: { ...betterAuthUser, id: account.id } });
+        await expect(buildService().setLoginWithdrawalAlerts({ enabled: true }, {})).rejects.toMatchObject({ code: 'FORBIDDEN' });
+        expect((await readUser(account.id))?.loginWithdrawalAlertsEnabled).toBe(false);
+    });
+    it('refuses alerts until the account email is verified', async () => {
+        const account = await seedUser({ emailVerified: false });
+        getSessionMock.mockResolvedValue({ user: { ...betterAuthUser, id: account.id } });
+        await expect(buildService().setLoginWithdrawalAlerts({ enabled: true }, {})).rejects.toMatchObject({ code: 'UNPROCESSABLE_CONTENT' });
+        expect((await readUser(account.id))?.loginWithdrawalAlertsEnabled).toBe(false);
+    });
+    it('auditable alert preference is reset when the player changes email', async () => {
+        const account = await seedUser({
+            emailVerified: true,
+            loginWithdrawalAlertsEnabled: true,
+        });
+        getSessionMock.mockResolvedValue({ user: { ...betterAuthUser, id: account.id } });
+        // better-auth's `/change-email` returns the same `{ status: true }` shape whether or
+        // not it actually touched the row (see the identity.service.ts `changeEmail` comment),
+        // so the service keys the alert-disable off the row's own email column - update it the
+        // way the real endpoint's synchronous-update branch would, before the mock resolves.
+        changeEmailMock.mockImplementation(async () => {
+            await db.drizzle.db
+                .update(user)
+                .set({ email: 'new-address@test.dev' })
+                .where(eq(user.id, account.id));
+            return jsonResponse({ status: true }, 200);
+        });
+        const events = makeEventBus();
+        const svc = buildService({ events });
+        await svc.changeEmail({ newEmail: 'new-address@test.dev' }, {}, new Headers());
+        expect((await readUser(account.id))?.loginWithdrawalAlertsEnabled).toBe(false);
+        expect(events.emit).toHaveBeenCalledWith('identity.security.login_withdrawal_alerts.updated', expect.objectContaining({
+            userId: account.id,
+            previousEnabled: true,
+            enabled: false,
+        }));
+    });
+    it('leaves the alert preference untouched when change-email does not actually update the row', async () => {
+        // Covers better-auth's anti-enumeration no-op and its deferred confirmation-email
+        // branch: both return `{ status: true }` without touching `user.email`.
+        const account = await seedUser({
+            emailVerified: true,
+            loginWithdrawalAlertsEnabled: true,
+        });
+        getSessionMock.mockResolvedValue({ user: { ...betterAuthUser, id: account.id } });
+        changeEmailMock.mockResolvedValue(jsonResponse({ status: true }, 200));
+        const events = makeEventBus();
+        const svc = buildService({ events });
+        await svc.changeEmail({ newEmail: 'new-address@test.dev' }, {}, new Headers());
+        expect((await readUser(account.id))?.loginWithdrawalAlertsEnabled).toBe(true);
+        expect(events.emit).not.toHaveBeenCalledWith('identity.security.login_withdrawal_alerts.updated', expect.anything());
+    });
+});
+//# sourceMappingURL=identity.service.int.test.js.map