@openora/core 0.4.1-canary.66 → 0.4.1-canary.68

package/dist/engagement/social/service/social.service.js

@@ -0,0 +1,251 @@
+import { and, eq, inArray, isNull, or } from 'drizzle-orm';
+import { createDomainError, makeConflictError, makeNotFoundError, serializeRow, } from '@openora/core/server';
+import { chatUserBlock } from '@openora/core/engagement/schema/chat';
+import { player } from '@openora/core/pam/schema/profile';
+import { friendship } from '../schema/index.js';
+// The caller targeted themselves (SendFriendRequestInputSchema.targetUserId === callerId).
+export const SelfFriendRequestError = createDomainError('SelfFriendRequestError', () => 'You cannot send a friend request to yourself');
+// A genuinely nonexistent target only - never thrown for a target that exists but
+// can't be requested (moderated or blocking), so an API consumer can trust that a
+// NOT_FOUND means "no such player" and not have to guess.
+export const FriendRequestTargetNotFoundError = makeNotFoundError('FriendRequestTarget');
+// The target exists but can't receive requests right now - covers BOTH "suspended
+// or closed" and "target has blocked the caller" behind the SAME code/message so
+// callers still cannot distinguish a blocking account from a moderated one (the
+// block itself stays undisclosed); this only stops lying that the account is
+// missing entirely.
+export const FriendRequestUnavailableError = makeConflictError('FRIEND_REQUEST_UNAVAILABLE', 'This player cannot receive friend requests right now');
+// The caller's own chat block is disclosed because it is the caller's state.
+export const BlockedBySelfError = makeConflictError('BLOCKED_BY_SELF', 'You have blocked this player - unblock them first');
+export const AlreadyFriendsError = makeConflictError('ALREADY_FRIENDS', 'You are already friends with this player');
+export const RequestAlreadyPendingError = makeConflictError('REQUEST_ALREADY_PENDING', 'A friend request to this player is already pending');
+export const FriendRequestRefusedError = makeConflictError('FRIEND_REQUEST_REFUSED', 'This friend request was refused');
+// Postgres unique-violation. friendship has exactly one unique index
+// (friendship_pair_key), so any 23505 on an insert into it is unambiguous - no
+// constraint-name check needed. drizzle-orm wraps the driver error in a
+// DrizzleQueryError, so the pg error (and its `.code`) is on `.cause`, not the
+// thrown error itself - checked against a real Postgres unique-index violation
+// in social.service.int.test.ts (a mocked query builder can't catch this).
+function pgErrorCode(e) {
+    if (typeof e !== 'object' || e === null) {
+        return undefined;
+    }
+    if ('code' in e && typeof e.code === 'string') {
+        return e.code;
+    }
+    if ('cause' in e) {
+        return pgErrorCode(e.cause);
+    }
+    return undefined;
+}
+function isUniqueConstraintViolation(e) {
+    return pgErrorCode(e) === '23505';
+}
+function toFriendshipDto(row) {
+    return serializeRow(row, {
+        dateFields: ['createdAt', 'acceptedAt', 'refusedAt'],
+    });
+}
+// Finds the single row for a pair regardless of who is requester/addressee - the
+// canonical-pair unique index guarantees at most one match.
+function pairCondition(userA, userB) {
+    return or(and(eq(friendship.requesterId, userA), eq(friendship.addresseeId, userB)), and(eq(friendship.requesterId, userB), eq(friendship.addresseeId, userA)));
+}
+export class SocialService {
+    drizzle;
+    events;
+    constructor(drizzle, events) {
+        this.drizzle = drizzle;
+        this.events = events;
+    }
+    /**
+     * Sends a friend request from `callerId` to `targetUserId`. The insert is
+     * attempted directly against the canonical-pair unique index (no pre-SELECT,
+     * avoiding a TOCTOU race); a unique-violation means a row for this pair already
+     * exists, which is resolved by re-reading it - including the mutual/simultaneous
+     * case where the existing row was already addressed TO the caller, which
+     * auto-accepts instead of conflicting. Events are emitted strictly after the
+     * mutating statement/transaction has committed.
+     */
+    async sendFriendRequest(callerId, targetUserId) {
+        if (targetUserId === callerId) {
+            throw new SelfFriendRequestError();
+        }
+        // Batched: caller + target resolved in one query rather than two round trips.
+        const players = await this.drizzle.db
+            .select({ userId: player.userId, displayName: player.displayName, status: player.status })
+            .from(player)
+            .where(inArray(player.userId, [callerId, targetUserId]));
+        const targetPlayer = players.find((p) => p.userId === targetUserId);
+        const callerPlayer = players.find((p) => p.userId === callerId);
+        if (!targetPlayer) {
+            throw new FriendRequestTargetNotFoundError(targetUserId);
+        }
+        if (targetPlayer.status === 'suspended' || targetPlayer.status === 'closed') {
+            throw new FriendRequestUnavailableError();
+        }
+        if (!callerPlayer) {
+            // Invariant: an authenticated caller always has a player row. Not a domain
+            // error (nothing the caller can act on) - fail loudly instead of masking it.
+            throw new Error(`Player profile missing for authenticated caller: ${callerId}`);
+        }
+        // Both directions checked in one query: at most the two rows for this pair exist.
+        const blocks = await this.drizzle.db
+            .select({ blockerId: chatUserBlock.blockerId, blockedId: chatUserBlock.blockedId })
+            .from(chatUserBlock)
+            .where(and(isNull(chatUserBlock.removedAt), pairBlockCondition(callerId, targetUserId)));
+        if (blocks.some((b) => b.blockerId === targetUserId && b.blockedId === callerId)) {
+            // Target has blocked the caller - never disclosed, same error as "suspended".
+            throw new FriendRequestUnavailableError();
+        }
+        if (blocks.some((b) => b.blockerId === callerId && b.blockedId === targetUserId)) {
+            throw new BlockedBySelfError();
+        }
+        let inserted;
+        try {
+            const rows = await this.drizzle.db
+                .insert(friendship)
+                .values({ requesterId: callerId, addresseeId: targetUserId })
+                .returning();
+            inserted = rows[0];
+        }
+        catch (error) {
+            if (!isUniqueConstraintViolation(error)) {
+                throw error;
+            }
+        }
+        if (inserted) {
+            this.events.emit('social.friend_request.sent', {
+                friendshipId: inserted.id,
+                requesterId: inserted.requesterId,
+                addresseeId: inserted.addresseeId,
+                requesterDisplayName: callerPlayer.displayName,
+            });
+            return toFriendshipDto(inserted);
+        }
+        const accepted = await this.resolveExistingPair(callerId, targetUserId);
+        this.events.emit('social.friend_request.accepted', {
+            friendshipId: accepted.id,
+            requesterId: accepted.requesterId,
+            addresseeId: accepted.addresseeId,
+            accepterId: callerId,
+            accepterDisplayName: callerPlayer.displayName,
+        });
+        return toFriendshipDto(accepted);
+    }
+    /**
+     * Re-reads the row a unique-violation on `friendship_pair_key` proved already
+     * exists and resolves it: already accepted -> conflict, same-direction duplicate
+     * -> conflict, opposite-direction (mutual/simultaneous request) -> auto-accept.
+     * `FOR UPDATE` serializes this against a concurrent resolution of the same pair.
+     */
+    async resolveExistingPair(callerId, targetUserId) {
+        return this.drizzle.db.transaction(async (tx) => {
+            const rows = await tx
+                .select()
+                .from(friendship)
+                .where(pairCondition(callerId, targetUserId))
+                .for('update')
+                .limit(1);
+            const existing = rows[0];
+            if (!existing) {
+                // The row that caused the violation is gone (eg concurrently removed) -
+                // safe to surface as "no longer pending", the caller can retry.
+                throw new RequestAlreadyPendingError();
+            }
+            if (existing.refusedAt !== null) {
+                throw new FriendRequestRefusedError();
+            }
+            if (existing.acceptedAt !== null) {
+                throw new AlreadyFriendsError();
+            }
+            if (existing.requesterId === callerId) {
+                throw new RequestAlreadyPendingError();
+            }
+            // Mutual/simultaneous case: existing.requesterId === targetUserId - the
+            // pending row was already addressed TO the caller.
+            const updatedRows = await tx
+                .update(friendship)
+                .set({ acceptedAt: new Date(), refusedAt: null })
+                .where(eq(friendship.id, existing.id))
+                .returning();
+            const updated = updatedRows[0];
+            if (!updated) {
+                throw new RequestAlreadyPendingError();
+            }
+            return updated;
+        });
+    }
+    /**
+     * Batch relationship lookup for a set of target users, from the caller's point
+     * of view. Reads are batched (one query per table, `IN (...)` over the target
+     * ids) rather than N+1 per target.
+     */
+    async getRelationships(callerId, targetUserIds) {
+        const uniqueTargetIds = [...new Set(targetUserIds)];
+        const players = await this.drizzle.db
+            .select({ userId: player.userId, status: player.status })
+            .from(player)
+            .where(inArray(player.userId, uniqueTargetIds));
+        const playerByUserId = new Map(players.map((p) => [p.userId, p]));
+        const friendships = await this.drizzle.db
+            .select()
+            .from(friendship)
+            .where(or(and(eq(friendship.requesterId, callerId), inArray(friendship.addresseeId, uniqueTargetIds)), and(inArray(friendship.requesterId, uniqueTargetIds), eq(friendship.addresseeId, callerId))));
+        const friendshipByTargetId = new Map();
+        for (const row of friendships) {
+            const targetId = row.requesterId === callerId ? row.addresseeId : row.requesterId;
+            friendshipByTargetId.set(targetId, row);
+        }
+        const blocks = await this.drizzle.db
+            .select({ blockerId: chatUserBlock.blockerId, blockedId: chatUserBlock.blockedId })
+            .from(chatUserBlock)
+            .where(and(isNull(chatUserBlock.removedAt), or(and(eq(chatUserBlock.blockerId, callerId), inArray(chatUserBlock.blockedId, uniqueTargetIds)), and(inArray(chatUserBlock.blockerId, uniqueTargetIds), eq(chatUserBlock.blockedId, callerId)))));
+        const blockedByMe = new Set(blocks.filter((b) => b.blockerId === callerId).map((b) => b.blockedId));
+        const blockedByTarget = new Set(blocks.filter((b) => b.blockedId === callerId).map((b) => b.blockerId));
+        return targetUserIds.map((userId) => {
+            const targetPlayer = playerByUserId.get(userId);
+            if (!targetPlayer ||
+                targetPlayer.status === 'suspended' ||
+                targetPlayer.status === 'closed' ||
+                blockedByTarget.has(userId)) {
+                return { userId, status: 'unavailable', friendshipId: null, canSendRequest: false };
+            }
+            if (blockedByMe.has(userId)) {
+                return { userId, status: 'blocked_by_me', friendshipId: null, canSendRequest: false };
+            }
+            const existing = friendshipByTargetId.get(userId);
+            if (existing?.refusedAt !== null && existing?.refusedAt !== undefined) {
+                return { userId, status: 'refused', friendshipId: existing.id, canSendRequest: false };
+            }
+            if (existing?.acceptedAt !== null && existing?.acceptedAt !== undefined) {
+                return { userId, status: 'friends', friendshipId: existing.id, canSendRequest: false };
+            }
+            if (existing?.acceptedAt === null &&
+                existing?.refusedAt === null &&
+                existing?.requesterId === callerId) {
+                return {
+                    userId,
+                    status: 'pending_outgoing',
+                    friendshipId: existing.id,
+                    canSendRequest: false,
+                };
+            }
+            if (existing?.acceptedAt === null &&
+                existing?.refusedAt === null &&
+                existing?.requesterId === userId) {
+                return {
+                    userId,
+                    status: 'pending_incoming',
+                    friendshipId: existing.id,
+                    canSendRequest: false,
+                };
+            }
+            return { userId, status: 'none', friendshipId: null, canSendRequest: true };
+        });
+    }
+}
+function pairBlockCondition(callerId, targetUserId) {
+    return or(and(eq(chatUserBlock.blockerId, targetUserId), eq(chatUserBlock.blockedId, callerId)), and(eq(chatUserBlock.blockerId, callerId), eq(chatUserBlock.blockedId, targetUserId)));
+}
+//# sourceMappingURL=social.service.js.map

package/dist/engagement/social/service/social.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"social.service.js","sourceRoot":"","sources":["../../../../src/engagement/social/service/social.service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AAC3D,OAAO,EAGL,iBAAiB,EACjB,iBAAiB,EACjB,iBAAiB,EACjB,YAAY,GACb,MAAM,sBAAsB,CAAC;AAE9B,OAAO,EAAE,aAAa,EAAE,MAAM,sCAAsC,CAAC;AACrE,OAAO,EAAE,MAAM,EAAE,MAAM,kCAAkC,CAAC;AAC1D,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAKhD,2FAA2F;AAC3F,MAAM,CAAC,MAAM,sBAAsB,GAAG,iBAAiB,CACrD,wBAAwB,EACxB,GAAG,EAAE,CAAC,8CAA8C,CACrD,CAAC;AAEF,kFAAkF;AAClF,kFAAkF;AAClF,0DAA0D;AAC1D,MAAM,CAAC,MAAM,gCAAgC,GAAG,iBAAiB,CAAC,qBAAqB,CAAC,CAAC;AAEzF,kFAAkF;AAClF,iFAAiF;AACjF,gFAAgF;AAChF,6EAA6E;AAC7E,oBAAoB;AACpB,MAAM,CAAC,MAAM,6BAA6B,GAAG,iBAAiB,CAC5D,4BAA4B,EAC5B,sDAAsD,CACvD,CAAC;AAEF,6EAA6E;AAC7E,MAAM,CAAC,MAAM,kBAAkB,GAAG,iBAAiB,CACjD,iBAAiB,EACjB,mDAAmD,CACpD,CAAC;AACF,MAAM,CAAC,MAAM,mBAAmB,GAAG,iBAAiB,CAClD,iBAAiB,EACjB,0CAA0C,CAC3C,CAAC;AACF,MAAM,CAAC,MAAM,0BAA0B,GAAG,iBAAiB,CACzD,yBAAyB,EACzB,oDAAoD,CACrD,CAAC;AACF,MAAM,CAAC,MAAM,yBAAyB,GAAG,iBAAiB,CACxD,wBAAwB,EACxB,iCAAiC,CAClC,CAAC;AAEF,qEAAqE;AACrE,+EAA+E;AAC/E,wEAAwE;AACxE,+EAA+E;AAC/E,+EAA+E;AAC/E,2EAA2E;AAC3E,SAAS,WAAW,CAAC,CAAU;IAC7B,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;QACxC,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,MAAM,IAAI,CAAC,IAAI,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC9C,OAAO,CAAC,CAAC,IAAI,CAAC;IAChB,CAAC;IACD,IAAI,OAAO,IAAI,CAAC,EAAE,CAAC;QACjB,OAAO,WAAW,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;IAC9B,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,2BAA2B,CAAC,CAAU;IAC7C,OAAO,WAAW,CAAC,CAAC,CAAC,KAAK,OAAO,CAAC;AACpC,CAAC;AAED,SAAS,eAAe,CAAC,GAAkB;IACzC,OAAO,YAAY,CAAC,GAAG,EAAE;QACvB,UAAU,EAAE,CAAC,WAAW,EAAE,YAAY,EAAE,WAAW,CAAC;KACrD,CAAC,CAAC;AACL,CAAC;AAED,iFAAiF;AACjF,4DAA4D;AAC5D,SAAS,aAAa,CAAC,KAAW,EAAE,KAAW;IAC7C,OAAO,EAAE,CACP,GAAG,CAAC,EAAE,CAAC,UAAU,CAAC,WAAW,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC,EACzE,GAAG,CAAC,EAAE,CAAC,UAAU,CAAC,WAAW,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC,CAC1E,CAAC;AACJ,CAAC;AAED,MAAM,OAAO,aAAa;IAEL;IACA;IAFnB,YACmB,OAAuB,EACvB,MAAgB;QADhB,YAAO,GAAP,OAAO,CAAgB;QACvB,WAAM,GAAN,MAAM,CAAU;IAChC,CAAC;IAEJ;;;;;;;;OAQG;IACH,KAAK,CAAC,iBAAiB,CAAC,QAAc,EAAE,YAAkB;QACxD,IAAI,YAAY,KAAK,QAAQ,EAAE,CAAC;YAC9B,MAAM,IAAI,sBAAsB,EAAE,CAAC;QACrC,CAAC;QAED,8EAA8E;QAC9E,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,EAAE;aAClC,MAAM,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC;aACzF,IAAI,CAAC,MAAM,CAAC;aACZ,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC,CAAC,CAAC;QAC3D,MAAM,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,YAAY,CAAC,CAAC;QACpE,MAAM,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC;QAEhE,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,MAAM,IAAI,gCAAgC,CAAC,YAAY,CAAC,CAAC;QAC3D,CAAC;QACD,IAAI,YAAY,CAAC,MAAM,KAAK,WAAW,IAAI,YAAY,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;YAC5E,MAAM,IAAI,6BAA6B,EAAE,CAAC;QAC5C,CAAC;QACD,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,2EAA2E;YAC3E,6EAA6E;YAC7E,MAAM,IAAI,KAAK,CAAC,oDAAoD,QAAQ,EAAE,CAAC,CAAC;QAClF,CAAC;QAED,kFAAkF;QAClF,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,EAAE;aACjC,MAAM,CAAC,EAAE,SAAS,EAAE,aAAa,CAAC,SAAS,EAAE,SAAS,EAAE,aAAa,CAAC,SAAS,EAAE,CAAC;aAClF,IAAI,CAAC,aAAa,CAAC;aACnB,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,aAAa,CAAC,SAAS,CAAC,EAAE,kBAAkB,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC,CAAC,CAAC;QAC3F,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,YAAY,IAAI,CAAC,CAAC,SAAS,KAAK,QAAQ,CAAC,EAAE,CAAC;YACjF,8EAA8E;YAC9E,MAAM,IAAI,6BAA6B,EAAE,CAAC;QAC5C,CAAC;QACD,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,QAAQ,IAAI,CAAC,CAAC,SAAS,KAAK,YAAY,CAAC,EAAE,CAAC;YACjF,MAAM,IAAI,kBAAkB,EAAE,CAAC;QACjC,CAAC;QAED,IAAI,QAAmC,CAAC;QACxC,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,EAAE;iBAC/B,MAAM,CAAC,UAAU,CAAC;iBAClB,MAAM,CAAC,EAAE,WAAW,EAAE,QAAQ,EAAE,WAAW,EAAE,YAAY,EAAE,CAAC;iBAC5D,SAAS,EAAE,CAAC;YACf,QAAQ,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QACrB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,2BAA2B,CAAC,KAAK,CAAC,EAAE,CAAC;gBACxC,MAAM,KAAK,CAAC;YACd,CAAC;QACH,CAAC;QAED,IAAI,QAAQ,EAAE,CAAC;YACb,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,4BAA4B,EAAE;gBAC7C,YAAY,EAAE,QAAQ,CAAC,EAAE;gBACzB,WAAW,EAAE,QAAQ,CAAC,WAAW;gBACjC,WAAW,EAAE,QAAQ,CAAC,WAAW;gBACjC,oBAAoB,EAAE,YAAY,CAAC,WAAW;aAC/C,CAAC,CAAC;YACH,OAAO,eAAe,CAAC,QAAQ,CAAC,CAAC;QACnC,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC;QACxE,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,gCAAgC,EAAE;YACjD,YAAY,EAAE,QAAQ,CAAC,EAAE;YACzB,WAAW,EAAE,QAAQ,CAAC,WAAW;YACjC,WAAW,EAAE,QAAQ,CAAC,WAAW;YACjC,UAAU,EAAE,QAAQ;YACpB,mBAAmB,EAAE,YAAY,CAAC,WAAW;SAC9C,CAAC,CAAC;QACH,OAAO,eAAe,CAAC,QAAQ,CAAC,CAAC;IACnC,CAAC;IAED;;;;;OAKG;IACK,KAAK,CAAC,mBAAmB,CAAC,QAAc,EAAE,YAAkB;QAClE,OAAO,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,WAAW,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE;YAC9C,MAAM,IAAI,GAAG,MAAM,EAAE;iBAClB,MAAM,EAAE;iBACR,IAAI,CAAC,UAAU,CAAC;iBAChB,KAAK,CAAC,aAAa,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC;iBAC5C,GAAG,CAAC,QAAQ,CAAC;iBACb,KAAK,CAAC,CAAC,CAAC,CAAC;YACZ,MAAM,QAAQ,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;YACzB,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,wEAAwE;gBACxE,gEAAgE;gBAChE,MAAM,IAAI,0BAA0B,EAAE,CAAC;YACzC,CAAC;YACD,IAAI,QAAQ,CAAC,SAAS,KAAK,IAAI,EAAE,CAAC;gBAChC,MAAM,IAAI,yBAAyB,EAAE,CAAC;YACxC,CAAC;YACD,IAAI,QAAQ,CAAC,UAAU,KAAK,IAAI,EAAE,CAAC;gBACjC,MAAM,IAAI,mBAAmB,EAAE,CAAC;YAClC,CAAC;YACD,IAAI,QAAQ,CAAC,WAAW,KAAK,QAAQ,EAAE,CAAC;gBACtC,MAAM,IAAI,0BAA0B,EAAE,CAAC;YACzC,CAAC;YAED,wEAAwE;YACxE,mDAAmD;YACnD,MAAM,WAAW,GAAG,MAAM,EAAE;iBACzB,MAAM,CAAC,UAAU,CAAC;iBAClB,GAAG,CAAC,EAAE,UAAU,EAAE,IAAI,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;iBAChD,KAAK,CAAC,EAAE,CAAC,UAAU,CAAC,EAAE,EAAE,QAAQ,CAAC,EAAE,CAAC,CAAC;iBACrC,SAAS,EAAE,CAAC;YACf,MAAM,OAAO,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC;YAC/B,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,MAAM,IAAI,0BAA0B,EAAE,CAAC;YACzC,CAAC;YACD,OAAO,OAAO,CAAC;QACjB,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,gBAAgB,CAAC,QAAc,EAAE,aAA8B;QACnE,MAAM,eAAe,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC;QAEpD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,EAAE;aAClC,MAAM,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC;aACxD,IAAI,CAAC,MAAM,CAAC;aACZ,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC,CAAC;QAClD,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QAElE,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,EAAE;aACtC,MAAM,EAAE;aACR,IAAI,CAAC,UAAU,CAAC;aAChB,KAAK,CACJ,EAAE,CACA,GAAG,CACD,EAAE,CAAC,UAAU,CAAC,WAAW,EAAE,QAAQ,CAAC,EACpC,OAAO,CAAC,UAAU,CAAC,WAAW,EAAE,eAAe,CAAC,CACjD,EACD,GAAG,CACD,OAAO,CAAC,UAAU,CAAC,WAAW,EAAE,eAAe,CAAC,EAChD,EAAE,CAAC,UAAU,CAAC,WAAW,EAAE,QAAQ,CAAC,CACrC,CACF,CACF,CAAC;QACJ,MAAM,oBAAoB,GAAG,IAAI,GAAG,EAAyB,CAAC;QAC9D,KAAK,MAAM,GAAG,IAAI,WAAW,EAAE,CAAC;YAC9B,MAAM,QAAQ,GAAG,GAAG,CAAC,WAAW,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC;YAClF,oBAAoB,CAAC,GAAG,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;QAC1C,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,EAAE;aACjC,MAAM,CAAC,EAAE,SAAS,EAAE,aAAa,CAAC,SAAS,EAAE,SAAS,EAAE,aAAa,CAAC,SAAS,EAAE,CAAC;aAClF,IAAI,CAAC,aAAa,CAAC;aACnB,KAAK,CACJ,GAAG,CACD,MAAM,CAAC,aAAa,CAAC,SAAS,CAAC,EAC/B,EAAE,CACA,GAAG,CACD,EAAE,CAAC,aAAa,CAAC,SAAS,EAAE,QAAQ,CAAC,EACrC,OAAO,CAAC,aAAa,CAAC,SAAS,EAAE,eAAe,CAAC,CAClD,EACD,GAAG,CACD,OAAO,CAAC,aAAa,CAAC,SAAS,EAAE,eAAe,CAAC,EACjD,EAAE,CAAC,aAAa,CAAC,SAAS,EAAE,QAAQ,CAAC,CACtC,CACF,CACF,CACF,CAAC;QACJ,MAAM,WAAW,GAAG,IAAI,GAAG,CACzB,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CACvE,CAAC;QACF,MAAM,eAAe,GAAG,IAAI,GAAG,CAC7B,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CACvE,CAAC;QAEF,OAAO,aAAa,CAAC,GAAG,CAAC,CAAC,MAAM,EAAgB,EAAE;YAChD,MAAM,YAAY,GAAG,cAAc,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YAChD,IACE,CAAC,YAAY;gBACb,YAAY,CAAC,MAAM,KAAK,WAAW;gBACnC,YAAY,CAAC,MAAM,KAAK,QAAQ;gBAChC,eAAe,CAAC,GAAG,CAAC,MAAM,CAAC,EAC3B,CAAC;gBACD,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,aAAa,EAAE,YAAY,EAAE,IAAI,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC;YACtF,CAAC;YACD,IAAI,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC5B,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,eAAe,EAAE,YAAY,EAAE,IAAI,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC;YACxF,CAAC;YAED,MAAM,QAAQ,GAAG,oBAAoB,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YAClD,IAAI,QAAQ,EAAE,SAAS,KAAK,IAAI,IAAI,QAAQ,EAAE,SAAS,KAAK,SAAS,EAAE,CAAC;gBACtE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,YAAY,EAAE,QAAQ,CAAC,EAAE,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC;YACzF,CAAC;YACD,IAAI,QAAQ,EAAE,UAAU,KAAK,IAAI,IAAI,QAAQ,EAAE,UAAU,KAAK,SAAS,EAAE,CAAC;gBACxE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,YAAY,EAAE,QAAQ,CAAC,EAAE,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC;YACzF,CAAC;YACD,IACE,QAAQ,EAAE,UAAU,KAAK,IAAI;gBAC7B,QAAQ,EAAE,SAAS,KAAK,IAAI;gBAC5B,QAAQ,EAAE,WAAW,KAAK,QAAQ,EAClC,CAAC;gBACD,OAAO;oBACL,MAAM;oBACN,MAAM,EAAE,kBAAkB;oBAC1B,YAAY,EAAE,QAAQ,CAAC,EAAE;oBACzB,cAAc,EAAE,KAAK;iBACtB,CAAC;YACJ,CAAC;YACD,IACE,QAAQ,EAAE,UAAU,KAAK,IAAI;gBAC7B,QAAQ,EAAE,SAAS,KAAK,IAAI;gBAC5B,QAAQ,EAAE,WAAW,KAAK,MAAM,EAChC,CAAC;gBACD,OAAO;oBACL,MAAM;oBACN,MAAM,EAAE,kBAAkB;oBAC1B,YAAY,EAAE,QAAQ,CAAC,EAAE;oBACzB,cAAc,EAAE,KAAK;iBACtB,CAAC;YACJ,CAAC;YACD,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,YAAY,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC;QAC9E,CAAC,CAAC,CAAC;IACL,CAAC;CACF;AAED,SAAS,kBAAkB,CAAC,QAAc,EAAE,YAAkB;IAC5D,OAAO,EAAE,CACP,GAAG,CAAC,EAAE,CAAC,aAAa,CAAC,SAAS,EAAE,YAAY,CAAC,EAAE,EAAE,CAAC,aAAa,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC,EACrF,GAAG,CAAC,EAAE,CAAC,aAAa,CAAC,SAAS,EAAE,QAAQ,CAAC,EAAE,EAAE,CAAC,aAAa,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC,CACtF,CAAC;AACJ,CAAC"}

package/dist/iam/__tests__/iam.service.int.test.js

@@ -1,7 +1,7 @@
 import { randomUUID } from 'node:crypto';
 import { describe, it, expect, vi, beforeAll, afterAll, beforeEach } from 'vitest';
 import { sql, eq } from 'drizzle-orm';
-import { mock, NO_CLIENT_META, makeEventBus } from '../../testing/mock.js';
+import { makeIdentityReader, mock, NO_CLIENT_META, makeEventBus } from '../../testing/mock.js';
 import { statement, findOneOrThrow, RedisCache, RedisRateLimiter, } from '@openora/core/server';
 import { createTestDb, createTestRedis } from '@openora/core/testing';
 import { migrate as migrateIam } from '@openora/core/iam/migrate';
@@ -12,6 +12,10 @@ import { IamService, DbAdminPermissionResolver, RoleNotFoundError, InvalidGrantE
 let db;
 let redis;
 const makeEmail = () => mock({ send: vi.fn().mockResolvedValue(undefined) });
+const identityReader = makeIdentityReader();
+function makeIamService(drizzle, events, email, sessionCommands, rateLimiter) {
+    return new IamService(drizzle, events, email, identityReader, sessionCommands, rateLimiter);
+}
 // Bootstrap super-admin: no DB assignment row + user.role === 'admin' passes the static fallback.
 const ADMIN_CALLER = { userId: randomUUID(), role: 'admin', ...NO_CLIENT_META };
 const SUPPORT_CALLER = { userId: randomUUID(), role: 'support', ...NO_CLIENT_META };
@@ -55,7 +59,7 @@ beforeEach(async () => {
 });
 describe('IamService.listCatalog', () => {
     it('omits the admin module from the assignable catalog', () => {
-        const svc = new IamService(db.drizzle, makeEventBus(), makeEmail());
+        const svc = makeIamService(db.drizzle, makeEventBus(), makeEmail());
         const catalog = svc.listCatalog();
         expect(catalog.modules.some((m) => m.resource === 'admin')).toBe(false);
         expect(catalog.modules.some((m) => m.resource === 'player')).toBe(true);
@@ -143,7 +147,7 @@ describe('IamService.setRolePermissions', () => {
     it('rejects a non-super-admin caller and audits the denial', async () => {
         const role = await seedRole();
         const events = makeEventBus();
-        const svc = new IamService(db.drizzle, events, makeEmail());
+        const svc = makeIamService(db.drizzle, events, makeEmail());
         await expect(svc.setRolePermissions({
             roleId: role.id,
             grants: [{ resource: 'player', level: 'read' }],
@@ -157,7 +161,7 @@ describe('IamService.setRolePermissions', () => {
         }));
     });
     it('throws RoleNotFoundError when the role does not exist', async () => {
-        const svc = new IamService(db.drizzle, makeEventBus(), makeEmail());
+        const svc = makeIamService(db.drizzle, makeEventBus(), makeEmail());
         await expect(svc.setRolePermissions({
             roleId: randomUUID(),
             grants: [{ resource: 'player', level: 'read' }],
@@ -166,7 +170,7 @@ describe('IamService.setRolePermissions', () => {
     });
     it('throws InvalidGrantError for an unknown module', async () => {
         const role = await seedRole();
-        const svc = new IamService(db.drizzle, makeEventBus(), makeEmail());
+        const svc = makeIamService(db.drizzle, makeEventBus(), makeEmail());
         await expect(svc.setRolePermissions({
             roleId: role.id,
             grants: [{ resource: 'nonexistent', level: 'read' }],
@@ -175,7 +179,7 @@ describe('IamService.setRolePermissions', () => {
     });
     it('rejects a grant targeting the admin module (super-admin-only, A6)', async () => {
         const role = await seedRole();
-        const svc = new IamService(db.drizzle, makeEventBus(), makeEmail());
+        const svc = makeIamService(db.drizzle, makeEventBus(), makeEmail());
         await expect(svc.setRolePermissions({
             roleId: role.id,
             grants: [{ resource: 'admin', level: 'read_write' }],
@@ -184,7 +188,7 @@ describe('IamService.setRolePermissions', () => {
     });
     it('blocks editing a super-admin role (always full)', async () => {
         const role = await seedRole({ isSuperAdmin: true, isSystem: true });
-        const svc = new IamService(db.drizzle, makeEventBus(), makeEmail());
+        const svc = makeIamService(db.drizzle, makeEventBus(), makeEmail());
         await expect(svc.setRolePermissions({
             roleId: role.id,
             grants: [{ resource: 'player', level: 'read' }],
@@ -193,7 +197,7 @@ describe('IamService.setRolePermissions', () => {
     });
     it('a super caller may grant any level and the rows are persisted', async () => {
         const role = await seedRole();
-        const svc = new IamService(db.drizzle, makeEventBus(), makeEmail());
+        const svc = makeIamService(db.drizzle, makeEventBus(), makeEmail());
         const result = await svc.setRolePermissions({
             roleId: role.id,
             grants: [{ resource: 'withdrawal', level: 'read_write' }],
@@ -210,7 +214,7 @@ describe('IamService.setRolePermissions', () => {
     it('emits iam.role.permissions.changed with actorId', async () => {
         const role = await seedRole();
         const events = makeEventBus();
-        const svc = new IamService(db.drizzle, events, makeEmail());
+        const svc = makeIamService(db.drizzle, events, makeEmail());
         await svc.setRolePermissions({
             roleId: role.id,
             grants: [{ resource: 'player', level: 'read' }],
@@ -222,13 +226,13 @@ describe('IamService.setRolePermissions', () => {
 describe('IamService.updateRole', () => {
     it('blocks renaming the super-admin role', async () => {
         const role = await seedRole({ isSuperAdmin: true, isSystem: true });
-        const svc = new IamService(db.drizzle, makeEventBus(), makeEmail());
+        const svc = makeIamService(db.drizzle, makeEventBus(), makeEmail());
         await expect(svc.updateRole({ roleId: role.id, name: 'Renamed', caller: ADMIN_CALLER })).rejects.toBeInstanceOf(ProtectedRoleError);
     });
     it('allows renaming a predefined (isSystem, non-super) role', async () => {
         const role = await seedRole({ isSystem: true, isSuperAdmin: false });
         const events = makeEventBus();
-        const svc = new IamService(db.drizzle, events, makeEmail());
+        const svc = makeIamService(db.drizzle, events, makeEmail());
         const result = await svc.updateRole({ roleId: role.id, name: 'Renamed', caller: ADMIN_CALLER });
         expect(result.name).toBe('Renamed');
         expect(events.emit).toHaveBeenCalledWith('iam.role.updated', expect.objectContaining({ roleId: role.id, actorId: ADMIN_CALLER.userId }));
@@ -239,18 +243,18 @@ describe('IamService.updateRole', () => {
 describe('IamService.deleteRole', () => {
     it('blocks deleting a system role', async () => {
         const role = await seedRole({ isSystem: true });
-        const svc = new IamService(db.drizzle, makeEventBus(), makeEmail());
+        const svc = makeIamService(db.drizzle, makeEventBus(), makeEmail());
         await expect(svc.deleteRole({ roleId: role.id, caller: ADMIN_CALLER })).rejects.toBeInstanceOf(ProtectedRoleError);
     });
     it('blocks deleting a super-admin role', async () => {
         const role = await seedRole({ isSuperAdmin: true });
-        const svc = new IamService(db.drizzle, makeEventBus(), makeEmail());
+        const svc = makeIamService(db.drizzle, makeEventBus(), makeEmail());
         await expect(svc.deleteRole({ roleId: role.id, caller: ADMIN_CALLER })).rejects.toBeInstanceOf(ProtectedRoleError);
     });
     it('deletes a custom role with no assignments and emits only iam.role.deleted', async () => {
         const role = await seedRole();
         const events = makeEventBus();
-        const svc = new IamService(db.drizzle, events, makeEmail());
+        const svc = makeIamService(db.drizzle, events, makeEmail());
         const result = await svc.deleteRole({ roleId: role.id, caller: ADMIN_CALLER });
         expect(result).toEqual({ success: true });
         expect(events.emit).toHaveBeenCalledWith('iam.role.deleted', expect.objectContaining({ roleId: role.id, actorId: ADMIN_CALLER.userId }));
@@ -264,7 +268,7 @@ describe('IamService.deleteRole', () => {
         await seedAssignment(userA, role.id);
         await seedAssignment(userB, role.id);
         const events = makeEventBus();
-        const svc = new IamService(db.drizzle, events, makeEmail());
+        const svc = makeIamService(db.drizzle, events, makeEmail());
         const result = await svc.deleteRole({ roleId: role.id, caller: ADMIN_CALLER });
         expect(result).toEqual({ success: true });
         expect(events.emit).toHaveBeenCalledWith('iam.role.revoked', {
@@ -292,7 +296,7 @@ describe('IamService.assignRole', () => {
         const target = await seedUser('admin');
         await seedAssignment(target.id, role.id);
         const events = makeEventBus();
-        const svc = new IamService(db.drizzle, events, makeEmail());
+        const svc = makeIamService(db.drizzle, events, makeEmail());
         const result = await svc.assignRole({
             userId: target.id,
             roleId: role.id,
@@ -307,18 +311,18 @@ describe('IamService.assignRole', () => {
     it('rejects assigning a role to a non-admin (player) account', async () => {
         const role = await seedRole();
         const player = await seedUser('player');
-        const svc = new IamService(db.drizzle, makeEventBus(), makeEmail());
+        const svc = makeIamService(db.drizzle, makeEventBus(), makeEmail());
         await expect(svc.assignRole({ userId: player.id, roleId: role.id, caller: ADMIN_CALLER })).rejects.toThrow(NotAnAdminUserError);
     });
     it('rejects assigning a role to an unknown user', async () => {
         const role = await seedRole();
-        const svc = new IamService(db.drizzle, makeEventBus(), makeEmail());
+        const svc = makeIamService(db.drizzle, makeEventBus(), makeEmail());
         await expect(svc.assignRole({ userId: randomUUID(), roleId: role.id, caller: ADMIN_CALLER })).rejects.toThrow(AdminUserNotFoundError);
     });
     it('the unique index keeps two concurrent assigns from double-inserting', async () => {
         const role = await seedRole();
         const target = await seedUser('admin');
-        const svc = new IamService(db.drizzle, makeEventBus(), makeEmail());
+        const svc = makeIamService(db.drizzle, makeEventBus(), makeEmail());
         await Promise.allSettled([
             svc.assignRole({ userId: target.id, roleId: role.id, caller: ADMIN_CALLER }),
             svc.assignRole({ userId: target.id, roleId: role.id, caller: ADMIN_CALLER }),
@@ -335,7 +339,7 @@ describe('IamService.unassignRole', () => {
         const superRole = await seedRole({ isSuperAdmin: true, isSystem: true });
         const target = randomUUID();
         await seedAssignment(target, superRole.id);
-        const svc = new IamService(db.drizzle, makeEventBus(), makeEmail());
+        const svc = makeIamService(db.drizzle, makeEventBus(), makeEmail());
         await expect(svc.unassignRole({ userId: target, roleId: superRole.id, caller: ADMIN_CALLER })).rejects.toBeInstanceOf(LastSuperAdminError);
         // The holder survives the rejected unassign.
         expect(await db.drizzle.db.select().from(adminRoleAssignment)).toHaveLength(1);
@@ -343,7 +347,7 @@ describe('IamService.unassignRole', () => {
     it('returns success but emits no revoked event when nothing was deleted', async () => {
         const role = await seedRole();
         const events = makeEventBus();
-        const svc = new IamService(db.drizzle, events, makeEmail());
+        const svc = makeIamService(db.drizzle, events, makeEmail());
         const result = await svc.unassignRole({
             userId: randomUUID(),
             roleId: role.id,
@@ -357,7 +361,7 @@ describe('IamService.unassignRole', () => {
         const target = randomUUID();
         await seedAssignment(target, role.id);
         const events = makeEventBus();
-        const svc = new IamService(db.drizzle, events, makeEmail());
+        const svc = makeIamService(db.drizzle, events, makeEmail());
         await svc.unassignRole({ userId: target, roleId: role.id, caller: ADMIN_CALLER });
         expect(events.emit).toHaveBeenCalledWith('iam.role.revoked', expect.objectContaining({ roleId: role.id, userId: target, actorId: ADMIN_CALLER.userId }));
         expect(await db.drizzle.db.select().from(adminRoleAssignment)).toHaveLength(0);
@@ -368,7 +372,7 @@ describe('IamService.unassignRole', () => {
         const userB = randomUUID();
         await seedAssignment(userA, superRole.id);
         await seedAssignment(userB, superRole.id);
-        const svc = new IamService(db.drizzle, makeEventBus(), makeEmail());
+        const svc = makeIamService(db.drizzle, makeEventBus(), makeEmail());
         const results = await Promise.allSettled([
             svc.unassignRole({ userId: userA, roleId: superRole.id, caller: ADMIN_CALLER }),
             svc.unassignRole({ userId: userB, roleId: superRole.id, caller: ADMIN_CALLER }),
@@ -387,7 +391,7 @@ describe('IamService.previewEffectivePermissions', () => {
         await seedPermission(roleA.id, 'player', 'read');
         await seedPermission(roleA.id, 'withdrawal', 'read');
         await seedPermission(roleB.id, 'player', 'read_write');
-        const svc = new IamService(db.drizzle, makeEventBus(), makeEmail());
+        const svc = makeIamService(db.drizzle, makeEventBus(), makeEmail());
         const result = await svc.previewEffectivePermissions({ roleIds: [roleA.id, roleB.id] });
         expect(result.permissions).toContainEqual({ resource: 'player', level: 'read_write' });
         expect(result.permissions).toContainEqual({ resource: 'withdrawal', level: 'read' });
@@ -395,14 +399,14 @@ describe('IamService.previewEffectivePermissions', () => {
     });
     it('super-admin role in the set yields all modules read_write', async () => {
         const superRole = await seedRole({ isSuperAdmin: true });
-        const svc = new IamService(db.drizzle, makeEventBus(), makeEmail());
+        const svc = makeIamService(db.drizzle, makeEventBus(), makeEmail());
         const result = await svc.previewEffectivePermissions({ roleIds: [superRole.id] });
         expect(result.permissions).toHaveLength(Object.keys(statement).length);
         expect(result.permissions.every((p) => p.level === 'read_write')).toBe(true);
     });
     it('falls back to static role permissions when the user has no dynamic role assignments', async () => {
         const u = await seedUser('support');
-        const svc = new IamService(db.drizzle, makeEventBus(), makeEmail());
+        const svc = makeIamService(db.drizzle, makeEventBus(), makeEmail());
         const result = await svc.previewEffectivePermissions({ userId: u.id });
         expect(result.permissions).not.toHaveLength(0);
         expect(result.permissions).toContainEqual({ resource: 'player', level: 'read' });
@@ -424,7 +428,7 @@ describe('IamService.acceptInvitation', () => {
     it('accepts once and emits exactly one event; a replay conflicts and emits nothing more', async () => {
         const token = await seedInvitation();
         const events = makeEventBus();
-        const svc = new IamService(db.drizzle, events, makeEmail());
+        const svc = makeIamService(db.drizzle, events, makeEmail());
         const first = await svc.acceptInvitation(token);
         expect(first).toEqual({ success: true, email: 'who@admin.com' });
         await expect(svc.acceptInvitation(token)).rejects.toBeInstanceOf(InvitationConflictError);
@@ -433,7 +437,7 @@ describe('IamService.acceptInvitation', () => {
     it('two concurrent accepts: exactly one succeeds, one event (atomic conditional UPDATE)', async () => {
         const token = await seedInvitation();
         const events = makeEventBus();
-        const svc = new IamService(db.drizzle, events, makeEmail());
+        const svc = makeIamService(db.drizzle, events, makeEmail());
         const results = await Promise.allSettled([
             svc.acceptInvitation(token),
             svc.acceptInvitation(token),
@@ -450,7 +454,7 @@ describe('IamService.inviteAdmin', () => {
     it('creates a pending invitation and calls SEND_EMAIL when caller is super-admin', async () => {
         const role = await seedRole();
         const email = makeEmail();
-        const svc = new IamService(db.drizzle, makeEventBus(), email);
+        const svc = makeIamService(db.drizzle, makeEventBus(), email);
         const result = await svc.inviteAdmin({
             email: 'new@admin.com',
             roleId: role.id,
@@ -467,7 +471,7 @@ describe('IamService.inviteAdmin', () => {
     it('rejects a non-super-admin caller', async () => {
         const role = await seedRole();
         const email = makeEmail();
-        const svc = new IamService(db.drizzle, makeEventBus(), email);
+        const svc = makeIamService(db.drizzle, makeEventBus(), email);
         await expect(svc.inviteAdmin({ email: 'new@admin.com', roleId: role.id, caller: SUPPORT_CALLER })).rejects.toBeInstanceOf(NotSuperAdminError);
         expect(email.send).not.toHaveBeenCalled();
     });
@@ -475,7 +479,7 @@ describe('IamService.inviteAdmin', () => {
 describe('IamService paginated lists', () => {
     it('listRoles returns { items, total, page, limit }', async () => {
         const role = await seedRole();
-        const svc = new IamService(db.drizzle, makeEventBus(), makeEmail());
+        const svc = makeIamService(db.drizzle, makeEventBus(), makeEmail());
         const result = await svc.listRoles({ page: 1, limit: 10 });
         expect(result.total).toBe(1);
         expect(result.page).toBe(1);
@@ -492,7 +496,7 @@ describe('IamService paginated lists', () => {
             status: 'pending',
             expiresAt: new Date(Date.now() + 60_000),
         });
-        const svc = new IamService(db.drizzle, makeEventBus(), makeEmail());
+        const svc = makeIamService(db.drizzle, makeEventBus(), makeEmail());
         const result = await svc.listInvitations({ page: 1, limit: 20 });
         expect(result.total).toBe(1);
         expect(result.items).toHaveLength(1);
@@ -501,7 +505,7 @@ describe('IamService paginated lists', () => {
     it('listAssignments returns the paginated wrapper with joined role fields', async () => {
         const role = await seedRole({ name: 'Ops' });
         await seedAssignment(randomUUID(), role.id);
-        const svc = new IamService(db.drizzle, makeEventBus(), makeEmail());
+        const svc = makeIamService(db.drizzle, makeEventBus(), makeEmail());
         const result = await svc.listAssignments({ page: 1, limit: 20 });
         expect(result.total).toBe(1);
         expect(result.items).toHaveLength(1);
@@ -511,7 +515,7 @@ describe('IamService paginated lists', () => {
 describe('IamService.reportAccessDenied', () => {
     it('records and audits a genuine denial (caller lacks the resource/level)', async () => {
         const events = makeEventBus();
-        const svc = new IamService(db.drizzle, events, makeEmail());
+        const svc = makeIamService(db.drizzle, events, makeEmail());
         const result = await svc.reportAccessDenied({
             resource: 'withdrawal',
             level: 'read',
@@ -527,7 +531,7 @@ describe('IamService.reportAccessDenied', () => {
     });
     it('does not record or emit when the caller genuinely holds the permission', async () => {
         const events = makeEventBus();
-        const svc = new IamService(db.drizzle, events, makeEmail());
+        const svc = makeIamService(db.drizzle, events, makeEmail());
         const result = await svc.reportAccessDenied({
             resource: 'player',
             level: 'read_write',
@@ -539,7 +543,7 @@ describe('IamService.reportAccessDenied', () => {
     it('with a rate limiter wired, a repeat report within the window is throttled and not recorded again', async () => {
         const events = makeEventBus();
         const limiter = new RedisRateLimiter(redis.client);
-        const svc = new IamService(db.drizzle, events, makeEmail(), undefined, limiter);
+        const svc = makeIamService(db.drizzle, events, makeEmail(), undefined, limiter);
         const first = await svc.reportAccessDenied({
             resource: 'withdrawal',
             level: 'read',
@@ -558,7 +562,7 @@ describe('IamService.reportAccessDenied', () => {
 });
 describe('IamService.forceLogout', () => {
     it('rejects a non-super-admin caller', async () => {
-        const svc = new IamService(db.drizzle, makeEventBus(), makeEmail());
+        const svc = makeIamService(db.drizzle, makeEventBus(), makeEmail());
         await expect(svc.forceLogout({ userId: randomUUID(), caller: SUPPORT_CALLER })).rejects.toBeInstanceOf(NotSuperAdminError);
     });
     it('allows a super-admin caller to delete sessions for a user via SessionCommands', async () => {
@@ -566,7 +570,7 @@ describe('IamService.forceLogout', () => {
         const sessionCommands = mock({
             revokeAll: vi.fn().mockResolvedValue({ success: true }),
         });
-        const svc = new IamService(db.drizzle, events, makeEmail(), sessionCommands);
+        const svc = makeIamService(db.drizzle, events, makeEmail(), sessionCommands);
         const targetUserId = randomUUID();
         const result = await svc.forceLogout({ userId: targetUserId, caller: ADMIN_CALLER });
         expect(result).toEqual({ success: true });