@openparachute/hub 0.7.4-rc.8 → 0.7.4

package/src/__tests__/api-settings-root-redirect.test.ts

@@ -0,0 +1,302 @@
+/**
+ * Tests for `/api/settings/root-redirect`.
+ *
+ * Covers:
+ *   - `validateRootRedirect` pure validator (null/empty clear, safe path,
+ *     open-redirect rejection).
+ *   - GET response shape (root_redirect + resolved + source).
+ *   - PUT happy path + open-redirect rejection (the highest-stakes part).
+ *   - PUT clear (null) reverts to env/default precedence.
+ *   - Auth gating: 401 missing/empty bearer, 403 wrong scope.
+ *   - "Change takes effect on the next request" — the GET resolved value
+ *     reflects the value just written, without restarting.
+ */
+import { afterEach, beforeEach, describe, expect, test } from "bun:test";
+import { mkdtempSync, rmSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import {
+  API_SETTINGS_ROOT_REDIRECT_REQUIRED_SCOPE,
+  handleApiSettingsRootRedirect,
+  validateRootRedirect,
+} from "../api-settings-root-redirect.ts";
+import { hubDbPath, openHubDb } from "../hub-db.ts";
+import { getRootRedirect, setRootRedirect } from "../hub-settings.ts";
+import { recordTokenMint, signAccessToken } from "../jwt-sign.ts";
+import { rotateSigningKey } from "../signing-keys.ts";
+import { createUser } from "../users.ts";
+
+const ISSUER = "http://127.0.0.1:1939";
+
+interface Harness {
+  dir: string;
+  db: ReturnType<typeof openHubDb>;
+  userId: string;
+  cleanup: () => void;
+}
+
+async function makeHarness(): Promise<Harness> {
+  const dir = mkdtempSync(join(tmpdir(), "phub-api-settings-root-redirect-"));
+  const db = openHubDb(hubDbPath(dir));
+  rotateSigningKey(db);
+  const user = await createUser(db, "owner", "pw");
+  return {
+    dir,
+    db,
+    userId: user.id,
+    cleanup: () => {
+      db.close();
+      rmSync(dir, { recursive: true, force: true });
+    },
+  };
+}
+
+async function mintBearer(h: Harness, scopes: string[]): Promise<string> {
+  const signed = await signAccessToken(h.db, {
+    sub: h.userId,
+    scopes,
+    audience: "parachute-hub",
+    clientId: "parachute-hub",
+    issuer: ISSUER,
+    ttlSeconds: 3600,
+  });
+  recordTokenMint(h.db, {
+    jti: signed.jti,
+    createdVia: "operator_mint",
+    subject: h.userId,
+    clientId: "parachute-hub",
+    scopes,
+    expiresAt: signed.expiresAt,
+  });
+  return signed.token;
+}
+
+function getReq(headers: Record<string, string> = {}): Request {
+  return new Request("http://localhost/api/settings/root-redirect", { method: "GET", headers });
+}
+
+function putReq(body: unknown, headers: Record<string, string> = {}): Request {
+  return new Request("http://localhost/api/settings/root-redirect", {
+    method: "PUT",
+    headers: { "content-type": "application/json", ...headers },
+    body: typeof body === "string" ? body : JSON.stringify(body),
+  });
+}
+
+// Empty env so the resolver's env layer is deterministic (the host's real
+// PARACHUTE_HUB_ROOT_REDIRECT must not leak into GET's resolved/source).
+const noEnv: NodeJS.ProcessEnv = {};
+
+function deps(
+  h: Harness,
+  overrides: Partial<Parameters<typeof handleApiSettingsRootRedirect>[1]> = {},
+) {
+  return {
+    db: h.db,
+    issuer: ISSUER,
+    env: noEnv,
+    ...overrides,
+  };
+}
+
+describe("validateRootRedirect — pure validator", () => {
+  test("null → normalized null (clear)", () => {
+    expect(validateRootRedirect(null)).toEqual({ ok: true, normalized: null });
+  });
+
+  test("empty string → normalized null (clear footgun guard)", () => {
+    expect(validateRootRedirect("")).toEqual({ ok: true, normalized: null });
+  });
+
+  test("safe same-origin path → normalized verbatim", () => {
+    expect(validateRootRedirect("/surface/reading-room")).toEqual({
+      ok: true,
+      normalized: "/surface/reading-room",
+    });
+  });
+
+  test("rejects off-origin + scheme shapes", () => {
+    for (const bad of [
+      "//evil.com",
+      "/\\evil.com",
+      "https://evil.com",
+      "javascript:alert(1)",
+      "admin",
+      "/",
+    ]) {
+      const r = validateRootRedirect(bad);
+      expect(r.ok).toBe(false);
+    }
+  });
+
+  test("rejects non-string non-null", () => {
+    expect(validateRootRedirect(42).ok).toBe(false);
+    expect(validateRootRedirect({}).ok).toBe(false);
+  });
+});
+
+describe("auth gating", () => {
+  let h: Harness;
+  beforeEach(async () => {
+    h = await makeHarness();
+  });
+  afterEach(() => h.cleanup());
+
+  test("405 on non-GET/PUT", async () => {
+    const res = await handleApiSettingsRootRedirect(
+      new Request("http://localhost/api/settings/root-redirect", { method: "POST" }),
+      deps(h),
+    );
+    expect(res.status).toBe(405);
+  });
+
+  test("401 when Authorization header is missing", async () => {
+    const res = await handleApiSettingsRootRedirect(getReq(), deps(h));
+    expect(res.status).toBe(401);
+  });
+
+  test("401 on empty bearer", async () => {
+    const res = await handleApiSettingsRootRedirect(getReq({ authorization: "Bearer " }), deps(h));
+    expect(res.status).toBe(401);
+  });
+
+  test("403 when the bearer lacks the required scope", async () => {
+    const bearer = await mintBearer(h, ["parachute:host:auth"]);
+    const resGet = await handleApiSettingsRootRedirect(
+      getReq({ authorization: `Bearer ${bearer}` }),
+      deps(h),
+    );
+    expect(resGet.status).toBe(403);
+    const resPut = await handleApiSettingsRootRedirect(
+      putReq({ root_redirect: "/surface/x" }, { authorization: `Bearer ${bearer}` }),
+      deps(h),
+    );
+    expect(resPut.status).toBe(403);
+    // Nothing was written.
+    expect(getRootRedirect(h.db)).toBeNull();
+  });
+});
+
+describe("GET /api/settings/root-redirect", () => {
+  let h: Harness;
+  beforeEach(async () => {
+    h = await makeHarness();
+  });
+  afterEach(() => h.cleanup());
+
+  test("default shape when unset: /admin from the default layer", async () => {
+    const bearer = await mintBearer(h, [API_SETTINGS_ROOT_REDIRECT_REQUIRED_SCOPE]);
+    const res = await handleApiSettingsRootRedirect(
+      getReq({ authorization: `Bearer ${bearer}` }),
+      deps(h),
+    );
+    expect(res.status).toBe(200);
+    const body = (await res.json()) as Record<string, unknown>;
+    expect(body).toEqual({ root_redirect: null, resolved: "/admin", source: "default" });
+  });
+
+  test("reflects a stored value with source=db", async () => {
+    setRootRedirect(h.db, "/surface/reading-room");
+    const bearer = await mintBearer(h, [API_SETTINGS_ROOT_REDIRECT_REQUIRED_SCOPE]);
+    const res = await handleApiSettingsRootRedirect(
+      getReq({ authorization: `Bearer ${bearer}` }),
+      deps(h),
+    );
+    const body = (await res.json()) as Record<string, unknown>;
+    expect(body).toEqual({
+      root_redirect: "/surface/reading-room",
+      resolved: "/surface/reading-room",
+      source: "db",
+    });
+  });
+
+  test("surfaces an env-sourced resolved value while the stored row is null", async () => {
+    const bearer = await mintBearer(h, [API_SETTINGS_ROOT_REDIRECT_REQUIRED_SCOPE]);
+    const res = await handleApiSettingsRootRedirect(
+      getReq({ authorization: `Bearer ${bearer}` }),
+      deps(h, { env: { PARACHUTE_HUB_ROOT_REDIRECT: "/surface/from-env" } }),
+    );
+    const body = (await res.json()) as Record<string, unknown>;
+    expect(body).toEqual({
+      root_redirect: null,
+      resolved: "/surface/from-env",
+      source: "env",
+    });
+  });
+});
+
+describe("PUT /api/settings/root-redirect", () => {
+  let h: Harness;
+  beforeEach(async () => {
+    h = await makeHarness();
+  });
+  afterEach(() => h.cleanup());
+
+  test("stores a safe path + GET reflects it on the next request (no restart)", async () => {
+    const bearer = await mintBearer(h, [API_SETTINGS_ROOT_REDIRECT_REQUIRED_SCOPE]);
+    const put = await handleApiSettingsRootRedirect(
+      putReq({ root_redirect: "/surface/reading-room" }, { authorization: `Bearer ${bearer}` }),
+      deps(h),
+    );
+    expect(put.status).toBe(200);
+    expect((await put.json()) as unknown).toEqual({ root_redirect: "/surface/reading-room" });
+    expect(getRootRedirect(h.db)).toBe("/surface/reading-room");
+
+    const get = await handleApiSettingsRootRedirect(
+      getReq({ authorization: `Bearer ${bearer}` }),
+      deps(h),
+    );
+    const body = (await get.json()) as Record<string, unknown>;
+    expect(body.resolved).toBe("/surface/reading-room");
+    expect(body.source).toBe("db");
+  });
+
+  test("null clears the row", async () => {
+    setRootRedirect(h.db, "/surface/x");
+    const bearer = await mintBearer(h, [API_SETTINGS_ROOT_REDIRECT_REQUIRED_SCOPE]);
+    const res = await handleApiSettingsRootRedirect(
+      putReq({ root_redirect: null }, { authorization: `Bearer ${bearer}` }),
+      deps(h),
+    );
+    expect(res.status).toBe(200);
+    expect(getRootRedirect(h.db)).toBeNull();
+  });
+
+  test("rejects open-redirect payloads with 400 and writes nothing", async () => {
+    const bearer = await mintBearer(h, [API_SETTINGS_ROOT_REDIRECT_REQUIRED_SCOPE]);
+    for (const bad of [
+      "//evil.com",
+      "https://evil.com",
+      "javascript:alert(1)",
+      "/\\evil.com",
+      "/",
+    ]) {
+      const res = await handleApiSettingsRootRedirect(
+        putReq({ root_redirect: bad }, { authorization: `Bearer ${bearer}` }),
+        deps(h),
+      );
+      expect(res.status).toBe(400);
+      const body = (await res.json()) as Record<string, unknown>;
+      expect(body.error).toBe("invalid_root_redirect");
+      expect(getRootRedirect(h.db)).toBeNull();
+    }
+  });
+
+  test("400 on a body without a root_redirect field", async () => {
+    const bearer = await mintBearer(h, [API_SETTINGS_ROOT_REDIRECT_REQUIRED_SCOPE]);
+    const res = await handleApiSettingsRootRedirect(
+      putReq({ wrong: "x" }, { authorization: `Bearer ${bearer}` }),
+      deps(h),
+    );
+    expect(res.status).toBe(400);
+  });
+
+  test("400 on non-JSON body", async () => {
+    const bearer = await mintBearer(h, [API_SETTINGS_ROOT_REDIRECT_REQUIRED_SCOPE]);
+    const res = await handleApiSettingsRootRedirect(
+      putReq("not json{", { authorization: `Bearer ${bearer}` }),
+      deps(h),
+    );
+    expect(res.status).toBe(400);
+  });
+});

package/src/__tests__/auth.test.ts

@@ -2,6 +2,7 @@ import { describe, expect, test } from "bun:test";
 import { mkdtempSync, rmSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
+import { issueAuthCode } from "../auth-codes.ts";
 import { registerClient } from "../clients.ts";
 import { type AuthDeps, type Runner, auth, authHelp } from "../commands/auth.ts";
 import { findGrant, recordGrant } from "../grants.ts";
@@ -269,6 +270,16 @@ describe("authHelp", () => {
     expect(h).toContain("parachute auth list-users");
     expect(h).toContain("parachute auth 2fa");
     expect(h).toContain("parachute auth rotate-key");
+    expect(h).toContain("parachute auth reap-clients");
+  });
+
+  test("reap-clients help documents dry-run-by-default + the conservative gate (#640)", () => {
+    expect(h).toContain("reap-clients");
+    expect(h).toContain("Dry-run by DEFAULT");
+    expect(h).toContain("--apply");
+    expect(h).toContain("--older-than");
+    expect(h).toContain("PROVABLY-DEAD");
+    expect(h).toContain("#640");
   });
 
   test("2fa help documents the real hub-login TOTP subcommands (#473)", () => {
@@ -849,6 +860,331 @@ describe("parachute auth pending-clients / approve-client", () => {
   });
 });
 
+// hub#640 — RFC 7592 deregistration from the terminal.
+describe("parachute auth revoke-client", () => {
+  test("revoke-client without an arg is a usage error", async () => {
+    const tmp = makeTmp();
+    try {
+      const deps: AuthDeps = { dbPath: tmp.dbPath };
+      const { code, stderr } = await captureOutput(() => auth(["revoke-client"], deps));
+      expect(code).toBe(1);
+      expect(stderr).toContain("missing client_id");
+    } finally {
+      tmp.cleanup();
+    }
+  });
+
+  test("revoke-client <unknown> exits 1 with a friendly message", async () => {
+    const tmp = makeTmp();
+    try {
+      const deps: AuthDeps = { dbPath: tmp.dbPath };
+      const { code, stderr } = await captureOutput(() => auth(["revoke-client", "no-such"], deps));
+      expect(code).toBe(1);
+      expect(stderr).toContain("no OAuth client");
+    } finally {
+      tmp.cleanup();
+    }
+  });
+
+  test("revoke-client deletes the client + cascades its grant + emits audit line", async () => {
+    const tmp = makeTmp();
+    try {
+      const db = openHubDb(tmp.dbPath);
+      let userId: string;
+      let clientId: string;
+      try {
+        const user = await createUser(db, "owner", "pw");
+        userId = user.id;
+        clientId = registerClient(db, {
+          redirectUris: ["https://app.example/cb"],
+          clientName: "MyApp",
+        }).client.clientId;
+        recordGrant(db, userId, clientId, ["vault:work:read"]);
+        expect(findGrant(db, userId, clientId)).not.toBeNull();
+      } finally {
+        db.close();
+      }
+      const deps: AuthDeps = { dbPath: tmp.dbPath };
+      const { code, stdout } = await captureOutput(() => auth(["revoke-client", clientId], deps));
+      expect(code).toBe(0);
+      expect(stdout).toContain("Deregistered OAuth client");
+      // Audit line for greppability (matches the route's shape, remover_sub=cli).
+      expect(stdout).toContain(`client deleted: client_id=${clientId}`);
+      expect(stdout).toContain("client_name=MyApp");
+      expect(stdout).toContain("remover_sub=cli");
+
+      // Verify the cascade actually landed in the db.
+      const db2 = openHubDb(tmp.dbPath);
+      try {
+        expect(
+          db2.query("SELECT client_id FROM clients WHERE client_id = ?").get(clientId),
+        ).toBeNull();
+        expect(findGrant(db2, userId, clientId)).toBeNull();
+      } finally {
+        db2.close();
+      }
+    } finally {
+      tmp.cleanup();
+    }
+  });
+});
+
+// closes #640 — OAuth client GC reaper. Dry-run by default; only provably-dead
+// clients are reapable. The deep gate coverage lives in clients.test.ts; these
+// exercise the CLI surface (dry-run safety, --apply, --json, empty case).
+describe("parachute auth reap-clients", () => {
+  const DAY_MS = 24 * 60 * 60 * 1000;
+
+  /** Register a client `daysAgo` days before now (relative to wall clock). */
+  function oldClient(db: ReturnType<typeof openHubDb>, daysAgo: number, name?: string): string {
+    const when = new Date(Date.now() - daysAgo * DAY_MS);
+    return registerClient(db, {
+      redirectUris: ["https://app.example/cb"],
+      ...(name !== undefined ? { clientName: name } : {}),
+      now: () => when,
+    }).client.clientId;
+  }
+
+  test("empty case: clean message, exit 0, no false alarm", async () => {
+    const tmp = makeTmp();
+    try {
+      const deps: AuthDeps = { dbPath: tmp.dbPath };
+      const { code, stdout } = await captureOutput(() => auth(["reap-clients"], deps));
+      expect(code).toBe(0);
+      expect(stdout).toContain("No abandoned clients to reap.");
+    } finally {
+      tmp.cleanup();
+    }
+  });
+
+  test("dry-run by DEFAULT lists candidates but deletes NOTHING", async () => {
+    const tmp = makeTmp();
+    let deadId: string;
+    try {
+      const db = openHubDb(tmp.dbPath);
+      try {
+        deadId = oldClient(db, 60, "DeadApp");
+      } finally {
+        db.close();
+      }
+      const deps: AuthDeps = { dbPath: tmp.dbPath };
+      const { code, stdout } = await captureOutput(() => auth(["reap-clients"], deps));
+      expect(code).toBe(0);
+      expect(stdout).toContain(deadId);
+      expect(stdout).toContain("DeadApp");
+      expect(stdout).toContain("--apply");
+      expect(stdout).toContain("nothing deleted");
+
+      // Count unchanged: the client is still there.
+      const db2 = openHubDb(tmp.dbPath);
+      try {
+        const n = db2.query<{ n: number }, []>("SELECT COUNT(*) AS n FROM clients").get()?.n;
+        expect(n).toBe(1);
+      } finally {
+        db2.close();
+      }
+    } finally {
+      tmp.cleanup();
+    }
+  });
+
+  test("--apply actually reaps + emits an audit line, dry-run is a no-op before it", async () => {
+    const tmp = makeTmp();
+    let deadId: string;
+    try {
+      const db = openHubDb(tmp.dbPath);
+      try {
+        deadId = oldClient(db, 60, "DeadApp");
+      } finally {
+        db.close();
+      }
+      const deps: AuthDeps = { dbPath: tmp.dbPath };
+
+      // Dry-run first: count before == count after.
+      await captureOutput(() => auth(["reap-clients"], deps));
+      const db2 = openHubDb(tmp.dbPath);
+      try {
+        expect(db2.query<{ n: number }, []>("SELECT COUNT(*) AS n FROM clients").get()?.n).toBe(1);
+      } finally {
+        db2.close();
+      }
+
+      // --apply deletes.
+      const { code, stdout } = await captureOutput(() => auth(["reap-clients", "--apply"], deps));
+      expect(code).toBe(0);
+      expect(stdout).toContain("Reaped 1 abandoned OAuth client");
+      expect(stdout).toContain(`client reaped: client_id=${deadId}`);
+      expect(stdout).toContain("client_name=DeadApp");
+
+      const db3 = openHubDb(tmp.dbPath);
+      try {
+        expect(db3.query<{ n: number }, []>("SELECT COUNT(*) AS n FROM clients").get()?.n).toBe(0);
+      } finally {
+        db3.close();
+      }
+    } finally {
+      tmp.cleanup();
+    }
+  });
+
+  test("NEVER reaps a client with a live grant (--apply leaves it intact)", async () => {
+    const tmp = makeTmp();
+    let liveId: string;
+    let userId: string;
+    try {
+      const db = openHubDb(tmp.dbPath);
+      try {
+        const user = await createUser(db, "owner", "pw");
+        userId = user.id;
+        liveId = oldClient(db, 60, "GrantedApp");
+        recordGrant(db, userId, liveId, ["vault:work:read"]);
+      } finally {
+        db.close();
+      }
+      const deps: AuthDeps = { dbPath: tmp.dbPath };
+      const { code, stdout } = await captureOutput(() => auth(["reap-clients", "--apply"], deps));
+      expect(code).toBe(0);
+      expect(stdout).toContain("No abandoned clients to reap.");
+
+      const db2 = openHubDb(tmp.dbPath);
+      try {
+        expect(
+          db2.query("SELECT client_id FROM clients WHERE client_id = ?").get(liveId),
+        ).not.toBeNull();
+        expect(findGrant(db2, userId, liveId)).not.toBeNull();
+      } finally {
+        db2.close();
+      }
+    } finally {
+      tmp.cleanup();
+    }
+  });
+
+  test("NEVER reaps a freshly-registered client (inside the 30d floor)", async () => {
+    const tmp = makeTmp();
+    try {
+      const db = openHubDb(tmp.dbPath);
+      try {
+        oldClient(db, 5); // 5 days old
+      } finally {
+        db.close();
+      }
+      const deps: AuthDeps = { dbPath: tmp.dbPath };
+      const { code, stdout } = await captureOutput(() => auth(["reap-clients"], deps));
+      expect(code).toBe(0);
+      expect(stdout).toContain("No abandoned clients to reap.");
+    } finally {
+      tmp.cleanup();
+    }
+  });
+
+  test("--older-than tunes the age floor", async () => {
+    const tmp = makeTmp();
+    let id: string;
+    try {
+      const db = openHubDb(tmp.dbPath);
+      try {
+        id = oldClient(db, 15); // 15 days old
+      } finally {
+        db.close();
+      }
+      const deps: AuthDeps = { dbPath: tmp.dbPath };
+      // Default 30d → not reapable.
+      const def = await captureOutput(() => auth(["reap-clients"], deps));
+      expect(def.stdout).toContain("No abandoned clients to reap.");
+      // 10d floor → reapable.
+      const tuned = await captureOutput(() => auth(["reap-clients", "--older-than", "10"], deps));
+      expect(tuned.stdout).toContain(id);
+    } finally {
+      tmp.cleanup();
+    }
+  });
+
+  test("--json emits machine output; applied=false in dry-run, true with --apply", async () => {
+    const tmp = makeTmp();
+    let deadId: string;
+    try {
+      const db = openHubDb(tmp.dbPath);
+      try {
+        deadId = oldClient(db, 60, "JsonApp");
+      } finally {
+        db.close();
+      }
+      const deps: AuthDeps = { dbPath: tmp.dbPath };
+      const dry = await captureOutput(() => auth(["reap-clients", "--json"], deps));
+      expect(dry.code).toBe(0);
+      const parsed = JSON.parse(dry.stdout) as {
+        applied: boolean;
+        count: number;
+        clients: Array<{ clientId: string }>;
+      };
+      expect(parsed.applied).toBe(false);
+      expect(parsed.count).toBe(1);
+      expect(parsed.clients[0]?.clientId).toBe(deadId);
+      // dry-run JSON deleted nothing.
+      const db2 = openHubDb(tmp.dbPath);
+      try {
+        expect(db2.query<{ n: number }, []>("SELECT COUNT(*) AS n FROM clients").get()?.n).toBe(1);
+      } finally {
+        db2.close();
+      }
+
+      const wet = await captureOutput(() => auth(["reap-clients", "--json", "--apply"], deps));
+      const wetParsed = JSON.parse(wet.stdout) as {
+        applied: boolean;
+        clients: Array<{ reaped?: boolean }>;
+      };
+      expect(wetParsed.applied).toBe(true);
+      expect(wetParsed.clients[0]?.reaped).toBe(true);
+    } finally {
+      tmp.cleanup();
+    }
+  });
+
+  test("a client with only an in-flight auth_code is NEVER reaped", async () => {
+    const tmp = makeTmp();
+    let id: string;
+    try {
+      const db = openHubDb(tmp.dbPath);
+      try {
+        const user = await createUser(db, "owner", "pw");
+        id = oldClient(db, 60);
+        issueAuthCode(db, {
+          clientId: id,
+          userId: user.id,
+          redirectUri: "https://app.example/cb",
+          scopes: ["vault:work:read"],
+          codeChallenge: "x".repeat(43),
+          codeChallengeMethod: "S256",
+        });
+      } finally {
+        db.close();
+      }
+      const deps: AuthDeps = { dbPath: tmp.dbPath };
+      const { stdout } = await captureOutput(() => auth(["reap-clients"], deps));
+      expect(stdout).toContain("No abandoned clients to reap.");
+    } finally {
+      tmp.cleanup();
+    }
+  });
+
+  test("rejects --older-than 0 / negative / non-integer", async () => {
+    const tmp = makeTmp();
+    try {
+      const deps: AuthDeps = { dbPath: tmp.dbPath };
+      for (const bad of ["0", "-5", "abc"]) {
+        const { code, stderr } = await captureOutput(() =>
+          auth(["reap-clients", "--older-than", bad], deps),
+        );
+        expect(code).toBe(1);
+        expect(stderr).toContain("--older-than");
+      }
+    } finally {
+      tmp.cleanup();
+    }
+  });
+});
+
 // closes #75 — operator-facing controls for the OAuth consent skip-list.
 describe("parachute auth list-grants / revoke-grant", () => {
   test("list-grants shows the seeding hint when no users exist", async () => {