@openora/core 0.4.1-canary.37 → 0.4.1-canary.39

package/dist/iam/__tests__/iam.service.test.js

@@ -1,750 +1,521 @@
-import { describe, it, expect, vi } from 'vitest';
-import { mock, mockDb, readPrivate, NO_CLIENT_META } from '../../testing/mock.js';
-import * as core from '@openora/core/server';
-import { levelToActions, actionsToLevel, statement, findOneOrThrow, } from '@openora/core/server';
-import { InProcessCache } from '@openora/core/testing';
+import { randomUUID } from 'node:crypto';
+import { describe, it, expect, vi, beforeAll, afterAll, beforeEach } from 'vitest';
+import { sql, eq } from 'drizzle-orm';
+import { mock, NO_CLIENT_META, makeEventBus } from '../../testing/mock.js';
+import { statement, findOneOrThrow, RedisCache } from '@openora/core/server';
+import { createTestDb, createTestRedis } from '@openora/core/testing';
+import { migrate as migrateIam } from '@openora/core/iam/migrate';
+import { migrate as migrateIdentity } from '@openora/core/pam/migrate/identity';
+import { user } from '@openora/core/pam/schema/identity';
+import { adminRole, adminRolePermission, adminRoleAssignment, adminInvitation, } from '../schema/index.js';
 import { IamService, DbAdminPermissionResolver, RoleNotFoundError, InvalidGrantError, NotSuperAdminError, ProtectedRoleError, LastSuperAdminError, InvitationConflictError, AdminUserNotFoundError, NotAnAdminUserError, } from '../service/iam.service.js';
-vi.mock('drizzle-orm', async (importOriginal) => {
-    const actual = await importOriginal();
-    return {
-        ...actual,
-        eq: vi.fn((col, val) => {
-            const colName = col?.name;
-            return { __col: colName, val };
-        }),
-        and: vi.fn((...args) => ({ __and: args })),
-    };
-});
-function makeEvents() {
-    return mock({ emit: vi.fn(), on: vi.fn() });
+let db;
+let redis;
+const makeEmail = () => mock({ send: vi.fn().mockResolvedValue(undefined) });
+// Bootstrap super-admin: no DB assignment row + user.role === 'admin' passes the static fallback.
+const ADMIN_CALLER = { userId: randomUUID(), role: 'admin', ...NO_CLIENT_META };
+const SUPPORT_CALLER = { userId: randomUUID(), role: 'support', ...NO_CLIENT_META };
+const TOTAL_GRANTS = Object.keys(statement).reduce((n, r) => n + statement[r].length, 0);
+async function seedRole(overrides = {}) {
+    const [row] = await db.drizzle.db
+        .insert(adminRole)
+        .values({
+        name: overrides.name ?? 'Ops',
+        key: overrides.key ?? null,
+        isSystem: overrides.isSystem ?? false,
+        isSuperAdmin: overrides.isSuperAdmin ?? false,
+    })
+        .returning();
+    return row;
 }
-function makeEmail() {
-    return mock({
-        send: vi.fn().mockResolvedValue(undefined),
-    });
+async function seedUser(role) {
+    const [row] = await db.drizzle.db
+        .insert(user)
+        .values({ name: 'U', email: `${randomUUID()}@x.dev`, role })
+        .returning();
+    return row;
 }
-function inContext(fn) {
-    return core.withRequestContext({ userId: 'caller', traceId: 't' }, fn);
+async function seedAssignment(userId, roleId) {
+    await db.drizzle.db.insert(adminRoleAssignment).values({ userId, roleId });
 }
-const ADMIN_CALLER = { userId: 'admin-1', role: 'admin', ...NO_CLIENT_META };
-function routingDrizzle(byTable) {
-    let table = {};
-    let lastSelect;
-    const chain = {
-        select: vi.fn().mockImplementation((sel) => {
-            lastSelect = sel;
-            return chain;
-        }),
-        from: vi.fn().mockImplementation((tbl) => {
-            table = tbl ?? {};
-            return chain;
-        }),
-        innerJoin: vi.fn().mockReturnThis(),
-        leftJoin: vi.fn().mockReturnThis(),
-        where: vi.fn().mockImplementation(() => {
-            const route = () => {
-                // getGrants' single join (select includes isSuperAdmin). Synthesize the joined
-                // rows from the decomposed byTable so existing test data keeps working: one row
-                // per (role x permission), super roles collapse to a bypass row, empty -> [].
-                if (lastSelect && 'isSuperAdmin' in lastSelect) {
-                    const assignments = (byTable.assignment ?? []);
-                    if (assignments.length === 0) {
-                        return [];
-                    }
-                    const superIds = new Set((byTable.superRole ?? []).map((r) => r.id));
-                    if (assignments.some((a) => superIds.has(a.roleId))) {
-                        return [{ isSuperAdmin: true, resource: null, level: null }];
-                    }
-                    const perms = (byTable.permission ?? []);
-                    if (perms.length === 0) {
-                        return [{ isSuperAdmin: false, resource: null, level: null }];
-                    }
-                    return perms.map((p) => ({ isSuperAdmin: false, resource: p.resource, level: p.level }));
-                }
-                if ('emailVerified' in table) {
-                    return byTable.user ?? [];
-                }
-                if ('level' in table) {
-                    return byTable.permission ?? [];
-                }
-                // adminRoleAssignment has `userId` column. A { roleId }-only select is the
-                // assignment read used by both getGrants and isSuperAdmin(caller); a
-                // full-row select is the dedup existing-check. When a test needs the two
-                // to differ it sets `callerAssignment` (else both share `assignment`).
-                if ('userId' in table) {
-                    if (lastSelect && 'roleId' in lastSelect && Object.keys(lastSelect).length === 1) {
-                        return byTable.callerAssignment ?? byTable.assignment ?? [];
-                    }
-                    return byTable.assignment ?? [];
-                }
-                // adminRole: distinguish the isSuperAdmin probe (selects only id) from the
-                // role-existence read (selects full row) via the select shape.
-                if (lastSelect && 'id' in lastSelect && Object.keys(lastSelect).length === 1) {
-                    return byTable.superRole ?? [];
-                }
-                return byTable.role ?? [];
-            };
-            const rows = route();
-            const thenable = {
-                then: (res) => Promise.resolve(rows).then(res),
-                for: () => thenable,
-                limit: () => thenable,
-                returning: (...args) => chain.returning(...args),
-            };
-            return thenable;
-        }),
-        insert: vi.fn().mockReturnThis(),
-        values: vi.fn().mockResolvedValue(undefined),
-        update: vi.fn().mockReturnThis(),
-        set: vi.fn().mockReturnThis(),
-        delete: vi.fn().mockReturnThis(),
-        returning: vi.fn().mockResolvedValue([]),
-        transaction: vi.fn().mockImplementation((fn) => fn(chain)),
-    };
-    return mockDb(chain);
+async function seedPermission(roleId, resource, level) {
+    await db.drizzle.db.insert(adminRolePermission).values({ roleId, resource, level });
 }
-const ROLE_ROW = {
-    id: 'role-1',
-    key: null,
-    name: 'Ops',
-    isSystem: false,
-    isSuperAdmin: false,
-    createdAt: new Date(),
-};
-describe('level helpers', () => {
-    it('levelToActions/actionsToLevel round-trip for a view-bearing module', () => {
-        // player has 'view' + write actions.
-        expect(levelToActions('player', 'no_access')).toEqual([]);
-        expect(levelToActions('player', 'read')).toEqual(['view']);
-        expect([...levelToActions('player', 'read_write')]).toEqual([...statement.player]);
-        expect(actionsToLevel('player', [])).toBe('no_access');
-        expect(actionsToLevel('player', ['view'])).toBe('read');
-        expect(actionsToLevel('player', [...statement.player])).toBe('read_write');
-    });
-    it('content has no read level (no view action) - read expands to empty', () => {
-        expect(levelToActions('content', 'read')).toEqual([]);
-        expect([...levelToActions('content', 'read_write')]).toEqual([...statement.content]);
-        expect(actionsToLevel('content', ['create'])).toBe('no_access');
-        expect(actionsToLevel('content', [...statement.content])).toBe('read_write');
-    });
-    it('expands the two new modules', () => {
-        expect(levelToActions('sportsbook', 'read')).toEqual(['view']);
-        expect([...levelToActions('sportsbook', 'read_write')]).toEqual([...statement.sportsbook]);
-        expect([...levelToActions('affiliate', 'read_write')]).toEqual([...statement.affiliate]);
-    });
+beforeAll(async () => {
+    db = await createTestDb([migrateIam, migrateIdentity]);
+    redis = await createTestRedis();
+});
+afterAll(async () => {
+    await db.drop();
+    await redis.quit();
+});
+beforeEach(async () => {
+    await db.drizzle.db.execute(sql `TRUNCATE ${adminRole}, ${adminRolePermission}, ${adminRoleAssignment}, ${adminInvitation}, ${user} RESTART IDENTITY CASCADE`);
+    await redis.flush();
 });
 describe('IamService.listCatalog', () => {
-    it('omits the admin module from the assignable catalog', async () => {
-        const drizzle = routingDrizzle({});
-        const svc = new IamService(drizzle, makeEvents(), makeEmail());
+    it('omits the admin module from the assignable catalog', () => {
+        const svc = new IamService(db.drizzle, makeEventBus(), makeEmail());
         const catalog = svc.listCatalog();
         expect(catalog.modules.some((m) => m.resource === 'admin')).toBe(false);
         expect(catalog.modules.some((m) => m.resource === 'player')).toBe(true);
     });
 });
-describe('DbAdminPermissionResolver', () => {
-    it('returns null when user has no assignment', async () => {
-        const drizzle = routingDrizzle({ assignment: [] });
-        const resolver = new DbAdminPermissionResolver(drizzle);
-        const result = await resolver.getGrants('user-no-role');
-        expect(result).toBeNull();
+describe('DbAdminPermissionResolver (real PG)', () => {
+    it('returns null when the user has no assignment', async () => {
+        const resolver = new DbAdminPermissionResolver(db.drizzle);
+        expect(await resolver.getGrants(randomUUID())).toBeNull();
     });
     it('super-admin assignment returns ALL grants (bypass)', async () => {
-        const drizzle = routingDrizzle({
-            assignment: [{ roleId: 'role-super' }],
-            superRole: [{ id: 'role-super' }],
-        });
-        const resolver = new DbAdminPermissionResolver(drizzle);
-        const grants = await inContext(() => resolver.getGrants('u'));
-        const expected = Object.keys(statement).reduce((n, r) => n + statement[r].length, 0);
-        expect(grants).not.toBeNull();
-        expect(grants).toHaveLength(expected);
-    });
-    it('expands level rows into action grants', async () => {
-        const drizzle = routingDrizzle({
-            assignment: [{ roleId: 'role-1' }],
-            superRole: [],
-            permission: [
-                { resource: 'player', level: 'read' },
-                { resource: 'withdrawal', level: 'read_write' },
-            ],
-        });
-        const resolver = new DbAdminPermissionResolver(drizzle);
-        const grants = await inContext(() => resolver.getGrants('u'));
+        const role = await seedRole({ isSuperAdmin: true });
+        const userId = randomUUID();
+        await seedAssignment(userId, role.id);
+        const grants = await new DbAdminPermissionResolver(db.drizzle).getGrants(userId);
+        expect(grants).toHaveLength(TOTAL_GRANTS);
+    });
+    it('expands stored level rows into action grants', async () => {
+        const role = await seedRole();
+        await seedPermission(role.id, 'player', 'read');
+        await seedPermission(role.id, 'withdrawal', 'read_write');
+        const userId = randomUUID();
+        await seedAssignment(userId, role.id);
+        const grants = await new DbAdminPermissionResolver(db.drizzle).getGrants(userId);
         expect(grants).toContainEqual({ resource: 'player', action: 'view' });
         expect(grants).toContainEqual({ resource: 'withdrawal', action: 'approve' });
         // read player must NOT yield write actions.
         expect(grants).not.toContainEqual({ resource: 'player', action: 'ban' });
     });
 });
-describe('DbAdminPermissionResolver caching', () => {
-    // Counts only the getGrants join (the query flagged by leftJoin); the un-joined
-    // where() is the invalidateRole holder lookup, which returns `holders`.
-    function grantsDrizzle(holders = []) {
-        const state = { grantsQueries: 0 };
-        let joined = false;
-        const chain = {
-            select: () => chain,
-            from: () => chain,
-            innerJoin: () => chain,
-            leftJoin: () => {
-                joined = true;
-                return chain;
-            },
-            where: () => {
-                if (joined) {
-                    joined = false;
-                    state.grantsQueries += 1;
-                    return Promise.resolve([{ isSuperAdmin: true, resource: null, level: null }]);
-                }
-                return Promise.resolve(holders);
-            },
-        };
-        return { drizzle: mockDb(chain), state };
-    }
-    it('serves a repeat lookup from cache without re-querying', async () => {
-        const { drizzle, state } = grantsDrizzle();
-        const resolver = new DbAdminPermissionResolver(drizzle, new InProcessCache());
-        await resolver.getGrants('u1');
-        await resolver.getGrants('u1');
-        expect(state.grantsQueries).toBe(1);
-    });
-    it('without a cache, every lookup queries', async () => {
-        const { drizzle, state } = grantsDrizzle();
-        const resolver = new DbAdminPermissionResolver(drizzle);
-        await resolver.getGrants('u1');
-        await resolver.getGrants('u1');
-        expect(state.grantsQueries).toBe(2);
-    });
-    it('invalidateUser purges so the next lookup re-queries', async () => {
-        const { drizzle, state } = grantsDrizzle();
-        const resolver = new DbAdminPermissionResolver(drizzle, new InProcessCache());
-        await resolver.getGrants('u1');
-        await resolver.invalidateUser('u1');
-        await resolver.getGrants('u1');
-        expect(state.grantsQueries).toBe(2);
+describe('DbAdminPermissionResolver caching (real Redis read-through)', () => {
+    it('serves a repeat lookup from cache even after the underlying rows change', async () => {
+        const role = await seedRole({ isSuperAdmin: true });
+        const userId = randomUUID();
+        await seedAssignment(userId, role.id);
+        const resolver = new DbAdminPermissionResolver(db.drizzle, new RedisCache(redis.client));
+        expect(await resolver.getGrants(userId)).toHaveLength(TOTAL_GRANTS);
+        // Revoke in the DB behind the cache's back; the cached grants must still be served.
+        await db.drizzle.db.delete(adminRoleAssignment).where(eq(adminRoleAssignment.userId, userId));
+        expect(await resolver.getGrants(userId)).toHaveLength(TOTAL_GRANTS);
+    });
+    it('without a cache, every lookup re-queries the DB', async () => {
+        const role = await seedRole({ isSuperAdmin: true });
+        const userId = randomUUID();
+        await seedAssignment(userId, role.id);
+        const resolver = new DbAdminPermissionResolver(db.drizzle);
+        expect(await resolver.getGrants(userId)).toHaveLength(TOTAL_GRANTS);
+        await db.drizzle.db.delete(adminRoleAssignment).where(eq(adminRoleAssignment.userId, userId));
+        expect(await resolver.getGrants(userId)).toBeNull();
+    });
+    it('invalidateUser purges so the next lookup reflects the revoke', async () => {
+        const role = await seedRole({ isSuperAdmin: true });
+        const userId = randomUUID();
+        await seedAssignment(userId, role.id);
+        const resolver = new DbAdminPermissionResolver(db.drizzle, new RedisCache(redis.client));
+        await resolver.getGrants(userId);
+        await db.drizzle.db.delete(adminRoleAssignment).where(eq(adminRoleAssignment.userId, userId));
+        await resolver.invalidateUser(userId);
+        expect(await resolver.getGrants(userId)).toBeNull();
     });
     it('invalidateRole purges every current holder of the role', async () => {
-        const { drizzle, state } = grantsDrizzle([{ userId: 'u1' }, { userId: 'u2' }]);
-        const resolver = new DbAdminPermissionResolver(drizzle, new InProcessCache());
-        await resolver.getGrants('u1');
-        await resolver.getGrants('u2');
-        expect(state.grantsQueries).toBe(2);
-        await resolver.invalidateRole('role-1');
-        await resolver.getGrants('u1');
-        await resolver.getGrants('u2');
-        expect(state.grantsQueries).toBe(4);
+        const role = await seedRole();
+        await seedPermission(role.id, 'player', 'read');
+        const u1 = randomUUID();
+        const u2 = randomUUID();
+        await seedAssignment(u1, role.id);
+        await seedAssignment(u2, role.id);
+        const resolver = new DbAdminPermissionResolver(db.drizzle, new RedisCache(redis.client));
+        // Prime both users' caches at the 'read' level (just the view action).
+        expect(await resolver.getGrants(u1)).toEqual([{ resource: 'player', action: 'view' }]);
+        expect(await resolver.getGrants(u2)).toEqual([{ resource: 'player', action: 'view' }]);
+        // Widen the role to read_write, then invalidate every holder.
+        await db.drizzle.db
+            .update(adminRolePermission)
+            .set({ level: 'read_write' })
+            .where(eq(adminRolePermission.roleId, role.id));
+        await resolver.invalidateRole(role.id);
+        for (const uid of [u1, u2]) {
+            const grants = await resolver.getGrants(uid);
+            expect(grants).toContainEqual({ resource: 'player', action: 'ban' });
+        }
     });
 });
 describe('IamService.setRolePermissions', () => {
     it('rejects a non-super-admin caller', async () => {
-        const drizzle = routingDrizzle({
-            role: [ROLE_ROW],
-            assignment: [{ roleId: 'role-x' }],
-            superRole: [],
-        });
-        const svc = new IamService(drizzle, makeEvents(), makeEmail());
-        await expect(inContext(() => svc.setRolePermissions({
-            roleId: 'role-1',
+        const role = await seedRole();
+        const svc = new IamService(db.drizzle, makeEventBus(), makeEmail());
+        await expect(svc.setRolePermissions({
+            roleId: role.id,
             grants: [{ resource: 'player', level: 'read' }],
-            caller: { userId: 'sup-1', role: 'support', ...NO_CLIENT_META },
-        }))).rejects.toBeInstanceOf(NotSuperAdminError);
-    });
-    it('throws RoleNotFoundError when role does not exist', async () => {
-        const drizzle = routingDrizzle({ role: [], assignment: [], superRole: [] });
-        const svc = new IamService(drizzle, makeEvents(), makeEmail());
-        await expect(inContext(() => svc.setRolePermissions({
-            roleId: 'missing',
+            caller: SUPPORT_CALLER,
+        })).rejects.toBeInstanceOf(NotSuperAdminError);
+    });
+    it('throws RoleNotFoundError when the role does not exist', async () => {
+        const svc = new IamService(db.drizzle, makeEventBus(), makeEmail());
+        await expect(svc.setRolePermissions({
+            roleId: randomUUID(),
             grants: [{ resource: 'player', level: 'read' }],
             caller: ADMIN_CALLER,
-        }))).rejects.toBeInstanceOf(RoleNotFoundError);
+        })).rejects.toBeInstanceOf(RoleNotFoundError);
     });
     it('throws InvalidGrantError for an unknown module', async () => {
-        const drizzle = routingDrizzle({ role: [ROLE_ROW], assignment: [], superRole: [] });
-        const svc = new IamService(drizzle, makeEvents(), makeEmail());
-        await expect(inContext(() => svc.setRolePermissions({
-            roleId: 'role-1',
+        const role = await seedRole();
+        const svc = new IamService(db.drizzle, makeEventBus(), makeEmail());
+        await expect(svc.setRolePermissions({
+            roleId: role.id,
             grants: [{ resource: 'nonexistent', level: 'read' }],
             caller: ADMIN_CALLER,
-        }))).rejects.toBeInstanceOf(InvalidGrantError);
+        })).rejects.toBeInstanceOf(InvalidGrantError);
     });
     it('rejects a grant targeting the admin module (super-admin-only, A6)', async () => {
-        const drizzle = routingDrizzle({ role: [ROLE_ROW], assignment: [], superRole: [] });
-        const svc = new IamService(drizzle, makeEvents(), makeEmail());
-        await expect(inContext(() => svc.setRolePermissions({
-            roleId: 'role-1',
+        const role = await seedRole();
+        const svc = new IamService(db.drizzle, makeEventBus(), makeEmail());
+        await expect(svc.setRolePermissions({
+            roleId: role.id,
             grants: [{ resource: 'admin', level: 'read_write' }],
             caller: ADMIN_CALLER,
-        }))).rejects.toBeInstanceOf(InvalidGrantError);
+        })).rejects.toBeInstanceOf(InvalidGrantError);
     });
     it('blocks editing a super-admin role (always full)', async () => {
-        const superRoleRow = { ...ROLE_ROW, id: 'role-super', isSuperAdmin: true, isSystem: true };
-        const drizzle = routingDrizzle({
-            role: [superRoleRow],
-            assignment: [],
-            superRole: [],
-        });
-        const svc = new IamService(drizzle, makeEvents(), makeEmail());
-        await expect(inContext(() => svc.setRolePermissions({
-            roleId: 'role-super',
+        const role = await seedRole({ isSuperAdmin: true, isSystem: true });
+        const svc = new IamService(db.drizzle, makeEventBus(), makeEmail());
+        await expect(svc.setRolePermissions({
+            roleId: role.id,
             grants: [{ resource: 'player', level: 'read' }],
             caller: ADMIN_CALLER,
-        }))).rejects.toBeInstanceOf(ProtectedRoleError);
-    });
-    it('a super caller may grant any level (bypass)', async () => {
-        const drizzle = routingDrizzle({
-            role: [ROLE_ROW],
-            assignment: [],
-            superRole: [],
-            permission: [{ resource: 'withdrawal', level: 'read_write' }],
-        });
-        const svc = new IamService(drizzle, makeEvents(), makeEmail());
-        const result = await inContext(() => svc.setRolePermissions({
-            roleId: 'role-1',
+        })).rejects.toBeInstanceOf(ProtectedRoleError);
+    });
+    it('a super caller may grant any level and the rows are persisted', async () => {
+        const role = await seedRole();
+        const svc = new IamService(db.drizzle, makeEventBus(), makeEmail());
+        const result = await svc.setRolePermissions({
+            roleId: role.id,
             grants: [{ resource: 'withdrawal', level: 'read_write' }],
             caller: ADMIN_CALLER,
-        }));
+        });
         expect(result.permissions).toContainEqual({ resource: 'withdrawal', level: 'read_write' });
+        const rows = await db.drizzle.db
+            .select()
+            .from(adminRolePermission)
+            .where(eq(adminRolePermission.roleId, role.id));
+        expect(rows).toHaveLength(1);
+        expect(rows[0]).toMatchObject({ resource: 'withdrawal', level: 'read_write' });
     });
     it('emits iam.role.permissions.changed with actorId', async () => {
-        const drizzle = routingDrizzle({
-            role: [ROLE_ROW],
-            assignment: [],
-            superRole: [],
-            permission: [{ resource: 'player', level: 'read' }],
-        });
-        const events = makeEvents();
-        const svc = new IamService(drizzle, events, makeEmail());
-        await inContext(() => svc.setRolePermissions({
-            roleId: 'role-1',
+        const role = await seedRole();
+        const events = makeEventBus();
+        const svc = new IamService(db.drizzle, events, makeEmail());
+        await svc.setRolePermissions({
+            roleId: role.id,
             grants: [{ resource: 'player', level: 'read' }],
             caller: ADMIN_CALLER,
-        }));
-        expect(events.emit).toHaveBeenCalledWith('iam.role.permissions.changed', expect.objectContaining({ roleId: 'role-1', actorId: 'admin-1' }));
+        });
+        expect(events.emit).toHaveBeenCalledWith('iam.role.permissions.changed', expect.objectContaining({ roleId: role.id, actorId: ADMIN_CALLER.userId }));
     });
 });
 describe('IamService.updateRole', () => {
     it('blocks renaming the super-admin role', async () => {
-        const drizzle = routingDrizzle({
-            role: [{ ...ROLE_ROW, isSuperAdmin: true, isSystem: true }],
-            assignment: [],
-            superRole: [],
-        });
-        const svc = new IamService(drizzle, makeEvents(), makeEmail());
-        await expect(inContext(() => svc.updateRole({ roleId: 'role-1', name: 'Renamed', caller: ADMIN_CALLER }))).rejects.toBeInstanceOf(ProtectedRoleError);
+        const role = await seedRole({ isSuperAdmin: true, isSystem: true });
+        const svc = new IamService(db.drizzle, makeEventBus(), makeEmail());
+        await expect(svc.updateRole({ roleId: role.id, name: 'Renamed', caller: ADMIN_CALLER })).rejects.toBeInstanceOf(ProtectedRoleError);
     });
     it('allows renaming a predefined (isSystem, non-super) role', async () => {
-        const drizzle = routingDrizzle({
-            role: [{ ...ROLE_ROW, isSystem: true, isSuperAdmin: false }],
-            assignment: [],
-            superRole: [],
-        });
-        readPrivate(drizzle.db, 'returning').mockResolvedValue([
-            { ...ROLE_ROW, isSystem: true, name: 'Renamed' },
-        ]);
-        const events = makeEvents();
-        const svc = new IamService(drizzle, events, makeEmail());
-        const result = await inContext(() => svc.updateRole({ roleId: 'role-1', name: 'Renamed', caller: ADMIN_CALLER }));
+        const role = await seedRole({ isSystem: true, isSuperAdmin: false });
+        const events = makeEventBus();
+        const svc = new IamService(db.drizzle, events, makeEmail());
+        const result = await svc.updateRole({ roleId: role.id, name: 'Renamed', caller: ADMIN_CALLER });
         expect(result.name).toBe('Renamed');
-        expect(events.emit).toHaveBeenCalledWith('iam.role.updated', expect.objectContaining({ roleId: 'role-1', actorId: 'admin-1' }));
+        expect(events.emit).toHaveBeenCalledWith('iam.role.updated', expect.objectContaining({ roleId: role.id, actorId: ADMIN_CALLER.userId }));
+        const [row] = await db.drizzle.db.select().from(adminRole).where(eq(adminRole.id, role.id));
+        expect(row.name).toBe('Renamed');
     });
 });
 describe('IamService.deleteRole', () => {
     it('blocks deleting a system role', async () => {
-        const drizzle = routingDrizzle({
-            role: [{ ...ROLE_ROW, isSystem: true }],
-            assignment: [],
-            superRole: [],
-        });
-        const svc = new IamService(drizzle, makeEvents(), makeEmail());
-        await expect(inContext(() => svc.deleteRole({ roleId: 'role-1', caller: ADMIN_CALLER }))).rejects.toBeInstanceOf(ProtectedRoleError);
+        const role = await seedRole({ isSystem: true });
+        const svc = new IamService(db.drizzle, makeEventBus(), makeEmail());
+        await expect(svc.deleteRole({ roleId: role.id, caller: ADMIN_CALLER })).rejects.toBeInstanceOf(ProtectedRoleError);
     });
     it('blocks deleting a super-admin role', async () => {
-        const drizzle = routingDrizzle({
-            role: [{ ...ROLE_ROW, isSuperAdmin: true }],
-            assignment: [],
-            superRole: [],
-        });
-        const svc = new IamService(drizzle, makeEvents(), makeEmail());
-        await expect(inContext(() => svc.deleteRole({ roleId: 'role-1', caller: ADMIN_CALLER }))).rejects.toBeInstanceOf(ProtectedRoleError);
+        const role = await seedRole({ isSuperAdmin: true });
+        const svc = new IamService(db.drizzle, makeEventBus(), makeEmail());
+        await expect(svc.deleteRole({ roleId: role.id, caller: ADMIN_CALLER })).rejects.toBeInstanceOf(ProtectedRoleError);
     });
     it('deletes a custom role with no assignments and emits only iam.role.deleted', async () => {
-        const drizzle = routingDrizzle({ role: [ROLE_ROW], assignment: [], superRole: [] });
-        const events = makeEvents();
-        const svc = new IamService(drizzle, events, makeEmail());
-        const result = await inContext(() => svc.deleteRole({ roleId: 'role-1', caller: ADMIN_CALLER }));
+        const role = await seedRole();
+        const events = makeEventBus();
+        const svc = new IamService(db.drizzle, events, makeEmail());
+        const result = await svc.deleteRole({ roleId: role.id, caller: ADMIN_CALLER });
         expect(result).toEqual({ success: true });
-        expect(events.emit).toHaveBeenCalledWith('iam.role.deleted', expect.objectContaining({ roleId: 'role-1', actorId: 'admin-1' }));
+        expect(events.emit).toHaveBeenCalledWith('iam.role.deleted', expect.objectContaining({ roleId: role.id, actorId: ADMIN_CALLER.userId }));
         expect(events.emit).not.toHaveBeenCalledWith('iam.role.revoked', expect.anything());
-    });
-    it('emits iam.role.revoked once per affected user plus iam.role.deleted', async () => {
-        const drizzle = routingDrizzle({
-            role: [ROLE_ROW],
-            callerAssignment: [], // bootstrap admin caller is super via static role
-            assignment: [{ userId: 'user-a' }, { userId: 'user-b' }],
-            superRole: [],
-        });
-        const events = makeEvents();
-        const svc = new IamService(drizzle, events, makeEmail());
-        const result = await inContext(() => svc.deleteRole({ roleId: 'role-1', caller: ADMIN_CALLER }));
+        expect(await db.drizzle.db.select().from(adminRole).where(eq(adminRole.id, role.id))).toHaveLength(0);
+    });
+    it('emits iam.role.revoked once per affected user plus iam.role.deleted, and cascades assignments', async () => {
+        const role = await seedRole();
+        const userA = randomUUID();
+        const userB = randomUUID();
+        await seedAssignment(userA, role.id);
+        await seedAssignment(userB, role.id);
+        const events = makeEventBus();
+        const svc = new IamService(db.drizzle, events, makeEmail());
+        const result = await svc.deleteRole({ roleId: role.id, caller: ADMIN_CALLER });
         expect(result).toEqual({ success: true });
         expect(events.emit).toHaveBeenCalledWith('iam.role.revoked', {
-            roleId: 'role-1',
-            userId: 'user-a',
-            actorId: 'admin-1',
-            ip: null,
-            userAgent: null,
+            roleId: role.id,
+            userId: userA,
+            actorId: ADMIN_CALLER.userId,
+            ...NO_CLIENT_META,
         });
         expect(events.emit).toHaveBeenCalledWith('iam.role.revoked', {
-            roleId: 'role-1',
-            userId: 'user-b',
-            actorId: 'admin-1',
-            ip: null,
-            userAgent: null,
+            roleId: role.id,
+            userId: userB,
+            actorId: ADMIN_CALLER.userId,
+            ...NO_CLIENT_META,
         });
         const revokeCalls = events.emit.mock.calls.filter((c) => c[0] === 'iam.role.revoked');
         expect(revokeCalls).toHaveLength(2);
-        expect(events.emit).toHaveBeenCalledWith('iam.role.deleted', expect.objectContaining({ roleId: 'role-1', actorId: 'admin-1' }));
+        expect(events.emit).toHaveBeenCalledWith('iam.role.deleted', expect.objectContaining({ roleId: role.id, actorId: ADMIN_CALLER.userId }));
+        // ON DELETE CASCADE removed the assignment rows.
+        expect(await db.drizzle.db.select().from(adminRoleAssignment)).toHaveLength(0);
     });
 });
 describe('IamService.assignRole', () => {
-    it('dedupes an existing assignment without inserting again', async () => {
-        const existingAssignment = {
-            id: 'a1',
-            userId: 'target',
-            roleId: 'role-1',
-            createdAt: new Date(),
-        };
-        const drizzle = routingDrizzle({
-            role: [ROLE_ROW],
-            user: [{ role: 'admin' }],
-            callerAssignment: [],
-            assignment: [existingAssignment],
-            superRole: [],
+    it('dedupes an existing assignment without inserting again (unique index)', async () => {
+        const role = await seedRole();
+        const target = await seedUser('admin');
+        await seedAssignment(target.id, role.id);
+        const events = makeEventBus();
+        const svc = new IamService(db.drizzle, events, makeEmail());
+        const result = await svc.assignRole({
+            userId: target.id,
+            roleId: role.id,
+            caller: ADMIN_CALLER,
         });
-        const events = makeEvents();
-        const svc = new IamService(drizzle, events, makeEmail());
-        const result = await inContext(() => svc.assignRole({ userId: 'target', roleId: 'role-1', caller: ADMIN_CALLER }));
-        expect(result.id).toBe('a1');
         expect(events.emit).not.toHaveBeenCalledWith('iam.role.assigned', expect.anything());
+        // Still exactly one assignment row, and the existing one was returned.
+        const rows = await db.drizzle.db.select().from(adminRoleAssignment);
+        expect(rows).toHaveLength(1);
+        expect(result.id).toBe(rows[0].id);
     });
     it('rejects assigning a role to a non-admin (player) account', async () => {
-        const drizzle = routingDrizzle({
-            role: [ROLE_ROW],
-            user: [{ role: 'player' }],
-            callerAssignment: [],
-            superRole: [],
-        });
-        const svc = new IamService(drizzle, makeEvents(), makeEmail());
-        await expect(inContext(() => svc.assignRole({ userId: 'player-1', roleId: 'role-1', caller: ADMIN_CALLER }))).rejects.toThrow(NotAnAdminUserError);
+        const role = await seedRole();
+        const player = await seedUser('player');
+        const svc = new IamService(db.drizzle, makeEventBus(), makeEmail());
+        await expect(svc.assignRole({ userId: player.id, roleId: role.id, caller: ADMIN_CALLER })).rejects.toThrow(NotAnAdminUserError);
     });
     it('rejects assigning a role to an unknown user', async () => {
-        const drizzle = routingDrizzle({
-            role: [ROLE_ROW],
-            user: [],
-            callerAssignment: [],
-            superRole: [],
-        });
-        const svc = new IamService(drizzle, makeEvents(), makeEmail());
-        await expect(inContext(() => svc.assignRole({ userId: 'ghost', roleId: 'role-1', caller: ADMIN_CALLER }))).rejects.toThrow(AdminUserNotFoundError);
+        const role = await seedRole();
+        const svc = new IamService(db.drizzle, makeEventBus(), makeEmail());
+        await expect(svc.assignRole({ userId: randomUUID(), roleId: role.id, caller: ADMIN_CALLER })).rejects.toThrow(AdminUserNotFoundError);
+    });
+    it('the unique index keeps two concurrent assigns from double-inserting', async () => {
+        const role = await seedRole();
+        const target = await seedUser('admin');
+        const svc = new IamService(db.drizzle, makeEventBus(), makeEmail());
+        await Promise.allSettled([
+            svc.assignRole({ userId: target.id, roleId: role.id, caller: ADMIN_CALLER }),
+            svc.assignRole({ userId: target.id, roleId: role.id, caller: ADMIN_CALLER }),
+        ]);
+        const rows = await db.drizzle.db
+            .select()
+            .from(adminRoleAssignment)
+            .where(eq(adminRoleAssignment.userId, target.id));
+        expect(rows).toHaveLength(1);
     });
 });
 describe('IamService.unassignRole', () => {
     it('rejects removing the last super-admin holder', async () => {
-        const superRole = { ...ROLE_ROW, id: 'role-super', isSuperAdmin: true, isSystem: true };
-        let table = {};
-        let lastSelect;
-        const chain = {
-            select: vi.fn().mockImplementation((sel) => {
-                lastSelect = sel;
-                return chain;
-            }),
-            from: vi.fn().mockImplementation((tbl) => {
-                table = tbl ?? {};
-                return chain;
-            }),
-            where: vi.fn().mockImplementation(() => {
-                const route = () => {
-                    if ('userId' in table) {
-                        // assignment probes: isSuperAdmin(caller) -> caller assignments;
-                        // holders query selects userId+roleId.
-                        if (lastSelect && 'roleId' in lastSelect && 'userId' in lastSelect) {
-                            return [{ userId: 'target', roleId: 'role-super' }];
-                        }
-                        return [{ roleId: 'role-super' }]; // caller is super
-                    }
-                    if (lastSelect && 'id' in lastSelect && Object.keys(lastSelect).length === 1) {
-                        return [{ id: 'role-super' }]; // super-admin probe / list
-                    }
-                    return [superRole]; // role existence
-                };
-                const rows = route();
-                const thenable = {
-                    then: (res) => Promise.resolve(rows).then(res),
-                    for: () => thenable,
-                    returning: () => Promise.resolve([{ id: 'a1' }]),
-                };
-                return thenable;
-            }),
-            delete: vi.fn().mockReturnThis(),
-            transaction: vi.fn().mockImplementation((fn) => fn(chain)),
-        };
-        const drizzle = mockDb(chain);
-        const svc = new IamService(drizzle, makeEvents(), makeEmail());
-        await expect(inContext(() => svc.unassignRole({ userId: 'target', roleId: 'role-super', caller: ADMIN_CALLER }))).rejects.toBeInstanceOf(LastSuperAdminError);
+        const superRole = await seedRole({ isSuperAdmin: true, isSystem: true });
+        const target = randomUUID();
+        await seedAssignment(target, superRole.id);
+        const svc = new IamService(db.drizzle, makeEventBus(), makeEmail());
+        await expect(svc.unassignRole({ userId: target, roleId: superRole.id, caller: ADMIN_CALLER })).rejects.toBeInstanceOf(LastSuperAdminError);
+        // The holder survives the rejected unassign.
+        expect(await db.drizzle.db.select().from(adminRoleAssignment)).toHaveLength(1);
     });
     it('returns success but emits no revoked event when nothing was deleted', async () => {
-        const drizzle = routingDrizzle({
-            role: [ROLE_ROW],
-            callerAssignment: [],
-            assignment: [],
-            superRole: [],
+        const role = await seedRole();
+        const events = makeEventBus();
+        const svc = new IamService(db.drizzle, events, makeEmail());
+        const result = await svc.unassignRole({
+            userId: randomUUID(),
+            roleId: role.id,
+            caller: ADMIN_CALLER,
         });
-        readPrivate(drizzle.db, 'returning').mockResolvedValue([]);
-        const events = makeEvents();
-        const svc = new IamService(drizzle, events, makeEmail());
-        const result = await inContext(() => svc.unassignRole({ userId: 'ghost', roleId: 'role-1', caller: ADMIN_CALLER }));
         expect(result).toEqual({ success: true });
         expect(events.emit).not.toHaveBeenCalledWith('iam.role.revoked', expect.anything());
     });
     it('emits iam.role.revoked when a row was actually deleted', async () => {
-        const drizzle = routingDrizzle({
-            role: [ROLE_ROW],
-            callerAssignment: [],
-            assignment: [],
-            superRole: [],
-        });
-        readPrivate(drizzle.db, 'returning').mockResolvedValue([
-            { id: 'a1' },
+        const role = await seedRole();
+        const target = randomUUID();
+        await seedAssignment(target, role.id);
+        const events = makeEventBus();
+        const svc = new IamService(db.drizzle, events, makeEmail());
+        await svc.unassignRole({ userId: target, roleId: role.id, caller: ADMIN_CALLER });
+        expect(events.emit).toHaveBeenCalledWith('iam.role.revoked', expect.objectContaining({ roleId: role.id, userId: target, actorId: ADMIN_CALLER.userId }));
+        expect(await db.drizzle.db.select().from(adminRoleAssignment)).toHaveLength(0);
+    });
+    it('under two concurrent unassigns of a two-holder super role, exactly one wins (FOR UPDATE guard)', async () => {
+        const superRole = await seedRole({ isSuperAdmin: true, isSystem: true });
+        const userA = randomUUID();
+        const userB = randomUUID();
+        await seedAssignment(userA, superRole.id);
+        await seedAssignment(userB, superRole.id);
+        const svc = new IamService(db.drizzle, makeEventBus(), makeEmail());
+        const results = await Promise.allSettled([
+            svc.unassignRole({ userId: userA, roleId: superRole.id, caller: ADMIN_CALLER }),
+            svc.unassignRole({ userId: userB, roleId: superRole.id, caller: ADMIN_CALLER }),
         ]);
-        const events = makeEvents();
-        const svc = new IamService(drizzle, events, makeEmail());
-        await inContext(() => svc.unassignRole({ userId: 'target', roleId: 'role-1', caller: ADMIN_CALLER }));
-        expect(events.emit).toHaveBeenCalledWith('iam.role.revoked', expect.objectContaining({ roleId: 'role-1', userId: 'target', actorId: 'admin-1' }));
+        const rejected = results.filter((r) => r.status === 'rejected');
+        expect(rejected).toHaveLength(1);
+        expect(rejected[0].reason).toBeInstanceOf(LastSuperAdminError);
+        // Exactly one super-admin holder survives - the guard never let both strip it.
+        expect(await db.drizzle.db.select().from(adminRoleAssignment)).toHaveLength(1);
     });
 });
 describe('IamService.previewEffectivePermissions', () => {
     it('returns the max level per module across roles (union)', async () => {
-        const drizzle = routingDrizzle({
-            superRole: [],
-            permission: [
-                { resource: 'player', level: 'read' },
-                { resource: 'player', level: 'read_write' },
-                { resource: 'withdrawal', level: 'read' },
-            ],
-        });
-        const svc = new IamService(drizzle, makeEvents(), makeEmail());
-        const result = await inContext(() => svc.previewEffectivePermissions({ roleIds: ['r1', 'r2'] }));
+        const roleA = await seedRole();
+        const roleB = await seedRole();
+        await seedPermission(roleA.id, 'player', 'read');
+        await seedPermission(roleA.id, 'withdrawal', 'read');
+        await seedPermission(roleB.id, 'player', 'read_write');
+        const svc = new IamService(db.drizzle, makeEventBus(), makeEmail());
+        const result = await svc.previewEffectivePermissions({ roleIds: [roleA.id, roleB.id] });
         expect(result.permissions).toContainEqual({ resource: 'player', level: 'read_write' });
         expect(result.permissions).toContainEqual({ resource: 'withdrawal', level: 'read' });
         expect(result.permissions.filter((p) => p.resource === 'player')).toHaveLength(1);
     });
     it('super-admin role in the set yields all modules read_write', async () => {
-        const drizzle = routingDrizzle({ superRole: [{ id: 'role-super' }] });
-        const svc = new IamService(drizzle, makeEvents(), makeEmail());
-        const result = await inContext(() => svc.previewEffectivePermissions({ roleIds: ['role-super'] }));
+        const superRole = await seedRole({ isSuperAdmin: true });
+        const svc = new IamService(db.drizzle, makeEventBus(), makeEmail());
+        const result = await svc.previewEffectivePermissions({ roleIds: [superRole.id] });
         expect(result.permissions).toHaveLength(Object.keys(statement).length);
         expect(result.permissions.every((p) => p.level === 'read_write')).toBe(true);
     });
-    it('falls back to static role permissions if the user has no dynamic role assignments', async () => {
-        const drizzle = routingDrizzle({
-            assignment: [], // no dynamic assignments
-            user: [{ role: 'support' }], // static role is 'support'
-        });
-        const svc = new IamService(drizzle, makeEvents(), makeEmail());
-        const result = await inContext(() => svc.previewEffectivePermissions({ userId: 'u1' }));
-        // Support has non-empty permissions
+    it('falls back to static role permissions when the user has no dynamic role assignments', async () => {
+        const u = await seedUser('support');
+        const svc = new IamService(db.drizzle, makeEventBus(), makeEmail());
+        const result = await svc.previewEffectivePermissions({ userId: u.id });
         expect(result.permissions).not.toHaveLength(0);
-        // For support role, player access is read (view)
         expect(result.permissions).toContainEqual({ resource: 'player', level: 'read' });
     });
 });
 describe('IamService.acceptInvitation', () => {
-    it('accepts once and emits exactly one event', async () => {
-        const invRow = {
-            id: 'inv-1',
+    async function seedInvitation() {
+        const role = await seedRole();
+        const token = randomUUID();
+        await db.drizzle.db.insert(adminInvitation).values({
             email: 'who@admin.com',
-            roleId: 'role-1',
-            token: 'tok',
-            status: 'accepted',
-            expiresAt: new Date(Date.now() + 1000),
-            acceptedAt: new Date(),
-            createdAt: new Date(),
-        };
-        const returning = vi.fn().mockResolvedValueOnce([invRow]).mockResolvedValueOnce([]);
-        const chain = {
-            update: vi.fn().mockReturnThis(),
-            set: vi.fn().mockReturnThis(),
-            where: vi.fn().mockReturnThis(),
-            returning,
-        };
-        const drizzle = mockDb(chain);
-        const events = makeEvents();
-        const svc = new IamService(drizzle, events, makeEmail());
-        const first = await svc.acceptInvitation('tok');
+            roleId: role.id,
+            token,
+            status: 'pending',
+            expiresAt: new Date(Date.now() + 60_000),
+        });
+        return token;
+    }
+    it('accepts once and emits exactly one event; a replay conflicts and emits nothing more', async () => {
+        const token = await seedInvitation();
+        const events = makeEventBus();
+        const svc = new IamService(db.drizzle, events, makeEmail());
+        const first = await svc.acceptInvitation(token);
         expect(first).toEqual({ success: true, email: 'who@admin.com' });
-        await expect(svc.acceptInvitation('tok')).rejects.toBeInstanceOf(InvitationConflictError);
+        await expect(svc.acceptInvitation(token)).rejects.toBeInstanceOf(InvitationConflictError);
+        expect(events.emit).toHaveBeenCalledTimes(1);
+    });
+    it('two concurrent accepts: exactly one succeeds, one event (atomic conditional UPDATE)', async () => {
+        const token = await seedInvitation();
+        const events = makeEventBus();
+        const svc = new IamService(db.drizzle, events, makeEmail());
+        const results = await Promise.allSettled([
+            svc.acceptInvitation(token),
+            svc.acceptInvitation(token),
+        ]);
+        const fulfilled = results.filter((r) => r.status === 'fulfilled');
+        const rejected = results.filter((r) => r.status === 'rejected');
+        expect(fulfilled).toHaveLength(1);
+        expect(rejected).toHaveLength(1);
+        expect(rejected[0].reason).toBeInstanceOf(InvitationConflictError);
         expect(events.emit).toHaveBeenCalledTimes(1);
     });
 });
 describe('IamService.inviteAdmin', () => {
-    const invitationRow = {
-        id: 'inv-1',
-        email: 'new@admin.com',
-        roleId: 'role-1',
-        token: 'tok-abc',
-        status: 'pending',
-        expiresAt: new Date(Date.now() + 86400000),
-        acceptedAt: null,
-        createdAt: new Date(),
-    };
     it('creates a pending invitation and calls SEND_EMAIL when caller is super-admin', async () => {
-        let table = {};
-        let lastSelect;
-        const chain = {
-            select: vi.fn().mockImplementation((sel) => {
-                lastSelect = sel;
-                return chain;
-            }),
-            from: vi.fn().mockImplementation((tbl) => {
-                table = tbl ?? {};
-                return chain;
-            }),
-            where: vi.fn().mockImplementation(() => {
-                // adminRoleAssignment (has userId col): caller's assignment for isSuperAdmin.
-                if ('userId' in table) {
-                    return Promise.resolve([{ roleId: 'role-super' }]);
-                }
-                // adminRole id-only probe: the super-admin check.
-                if (lastSelect && 'id' in lastSelect && Object.keys(lastSelect).length === 1) {
-                    return Promise.resolve([{ id: 'role-super' }]);
-                }
-                // adminRole full row: role-existence lookup.
-                return Promise.resolve([ROLE_ROW]);
-            }),
-            insert: vi.fn().mockReturnThis(),
-            values: vi.fn().mockReturnThis(),
-            returning: vi.fn().mockResolvedValue([invitationRow]),
-        };
-        const drizzle = mockDb(chain);
+        const role = await seedRole();
         const email = makeEmail();
-        const svc = new IamService(drizzle, makeEvents(), email);
-        const result = await inContext(() => svc.inviteAdmin({ email: 'new@admin.com', roleId: 'role-1', caller: ADMIN_CALLER }));
+        const svc = new IamService(db.drizzle, makeEventBus(), email);
+        const result = await svc.inviteAdmin({
+            email: 'new@admin.com',
+            roleId: role.id,
+            caller: ADMIN_CALLER,
+        });
         expect(result.status).toBe('pending');
         expect(result.email).toBe('new@admin.com');
         expect(email.send).toHaveBeenCalledOnce();
         expect(email.send).toHaveBeenCalledWith(expect.objectContaining({ to: 'new@admin.com' }));
+        const rows = await db.drizzle.db.select().from(adminInvitation);
+        expect(rows).toHaveLength(1);
+        expect(rows[0]).toMatchObject({ email: 'new@admin.com', status: 'pending' });
     });
     it('rejects a non-super-admin caller', async () => {
-        const drizzle = routingDrizzle({
-            role: [ROLE_ROW],
-            callerAssignment: [{ roleId: 'role-x' }],
-            superRole: [],
-        });
+        const role = await seedRole();
         const email = makeEmail();
-        const svc = new IamService(drizzle, makeEvents(), email);
-        await expect(inContext(() => svc.inviteAdmin({
-            email: 'new@admin.com',
-            roleId: 'role-1',
-            caller: { userId: 'sup-1', role: 'support', ...NO_CLIENT_META },
-        }))).rejects.toBeInstanceOf(NotSuperAdminError);
+        const svc = new IamService(db.drizzle, makeEventBus(), email);
+        await expect(svc.inviteAdmin({ email: 'new@admin.com', roleId: role.id, caller: SUPPORT_CALLER })).rejects.toBeInstanceOf(NotSuperAdminError);
         expect(email.send).not.toHaveBeenCalled();
     });
 });
-function paginatedDrizzle(rows, total) {
-    const db = {
-        select: vi.fn().mockImplementation((sel) => {
-            const result = sel && 'count' in sel ? [{ count: total }] : rows;
-            const chain = {
-                then: (res) => Promise.resolve(result).then(res),
-                from: vi.fn(() => chain),
-                innerJoin: vi.fn(() => chain),
-                where: vi.fn(() => chain),
-                orderBy: vi.fn(() => chain),
-                limit: vi.fn(() => chain),
-                offset: vi.fn(() => chain),
-            };
-            return chain;
-        }),
-    };
-    return mockDb(db);
-}
 describe('IamService paginated lists', () => {
     it('listRoles returns { items, total, page, limit }', async () => {
-        const drizzle = paginatedDrizzle([{ ...ROLE_ROW }], 1);
-        const svc = new IamService(drizzle, makeEvents(), makeEmail());
-        const result = await svc.listRoles({ page: 2, limit: 10 });
+        const role = await seedRole();
+        const svc = new IamService(db.drizzle, makeEventBus(), makeEmail());
+        const result = await svc.listRoles({ page: 1, limit: 10 });
         expect(result.total).toBe(1);
-        expect(result.page).toBe(2);
+        expect(result.page).toBe(1);
         expect(result.limit).toBe(10);
         expect(result.items).toHaveLength(1);
-        expect(findOneOrThrow(result.items, new Error('expected an item')).id).toBe(ROLE_ROW.id);
+        expect(findOneOrThrow(result.items, new Error('expected an item')).id).toBe(role.id);
     });
     it('listInvitations returns the paginated wrapper', async () => {
-        const invRow = {
-            id: 'inv-1',
+        const role = await seedRole();
+        await db.drizzle.db.insert(adminInvitation).values({
             email: 'a@b.com',
-            roleId: 'role-1',
-            token: 'tok',
+            roleId: role.id,
+            token: randomUUID(),
             status: 'pending',
-            expiresAt: new Date(),
-            acceptedAt: null,
-            createdAt: new Date(),
-        };
-        const drizzle = paginatedDrizzle([invRow], 5);
-        const svc = new IamService(drizzle, makeEvents(), makeEmail());
+            expiresAt: new Date(Date.now() + 60_000),
+        });
+        const svc = new IamService(db.drizzle, makeEventBus(), makeEmail());
         const result = await svc.listInvitations({ page: 1, limit: 20 });
-        expect(result.total).toBe(5);
+        expect(result.total).toBe(1);
         expect(result.items).toHaveLength(1);
         expect(findOneOrThrow(result.items, new Error('expected an item')).email).toBe('a@b.com');
     });
     it('listAssignments returns the paginated wrapper with joined role fields', async () => {
-        const assignmentRow = {
-            id: 'a1',
-            userId: 'u1',
-            roleId: 'role-1',
-            createdAt: new Date(),
-            roleName: 'Ops',
-            roleKey: null,
-        };
-        const drizzle = paginatedDrizzle([assignmentRow], 3);
-        const svc = new IamService(drizzle, makeEvents(), makeEmail());
+        const role = await seedRole({ name: 'Ops' });
+        await seedAssignment(randomUUID(), role.id);
+        const svc = new IamService(db.drizzle, makeEventBus(), makeEmail());
         const result = await svc.listAssignments({ page: 1, limit: 20 });
-        expect(result.total).toBe(3);
+        expect(result.total).toBe(1);
         expect(result.items).toHaveLength(1);
         expect(findOneOrThrow(result.items, new Error('expected an item')).roleName).toBe('Ops');
     });
 });
 describe('IamService.forceLogout', () => {
     it('rejects a non-super-admin caller', async () => {
-        const drizzle = routingDrizzle({
-            role: [ROLE_ROW],
-            assignment: [],
-            superRole: [],
-        });
-        const svc = new IamService(drizzle, makeEvents(), makeEmail());
-        await expect(inContext(() => svc.forceLogout({
-            userId: 'target-user',
-            caller: { userId: 'sup-1', role: 'support', ...NO_CLIENT_META },
-        }))).rejects.toBeInstanceOf(NotSuperAdminError);
-    });
-    it('allows a super-admin caller to delete sessions for a user and emits identity.sessions.revoked_all', async () => {
-        const drizzle = routingDrizzle({
-            role: [ROLE_ROW],
-            assignment: [],
-            superRole: [],
-        });
-        const events = makeEvents();
-        const sessionCommands = {
+        const svc = new IamService(db.drizzle, makeEventBus(), makeEmail());
+        await expect(svc.forceLogout({ userId: randomUUID(), caller: SUPPORT_CALLER })).rejects.toBeInstanceOf(NotSuperAdminError);
+    });
+    it('allows a super-admin caller to delete sessions for a user via SessionCommands', async () => {
+        const events = makeEventBus();
+        const sessionCommands = mock({
             revokeAll: vi.fn().mockResolvedValue({ success: true }),
-        };
-        const svc = new IamService(drizzle, events, makeEmail(), sessionCommands);
-        const result = await inContext(() => svc.forceLogout({
-            userId: 'target-user',
-            caller: ADMIN_CALLER,
-        }));
+        });
+        const svc = new IamService(db.drizzle, events, makeEmail(), sessionCommands);
+        const targetUserId = randomUUID();
+        const result = await svc.forceLogout({ userId: targetUserId, caller: ADMIN_CALLER });
         expect(result).toEqual({ success: true });
-        expect(sessionCommands.revokeAll).toHaveBeenCalledWith('target-user', ADMIN_CALLER.userId);
+        expect(sessionCommands.revokeAll).toHaveBeenCalledWith(targetUserId, ADMIN_CALLER.userId);
     });
 });
 //# sourceMappingURL=iam.service.test.js.map