@proteinjs/user-server 1.11.1 → 1.12.0

package/dist/src/migrations/SweepMalformedAccessGrants.js

@@ -0,0 +1,354 @@
+"use strict";
+var __assign = (this && this.__assign) || function () {
+    __assign = Object.assign || function(t) {
+        for (var s, i = 1, n = arguments.length; i < n; i++) {
+            s = arguments[i];
+            for (var p in s) if (Object.prototype.hasOwnProperty.call(s, p))
+                t[p] = s[p];
+        }
+        return t;
+    };
+    return __assign.apply(this, arguments);
+};
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var __generator = (this && this.__generator) || function (thisArg, body) {
+    var _ = { label: 0, sent: function() { if (t[0] & 1) throw t[1]; return t[1]; }, trys: [], ops: [] }, f, y, t, g;
+    return g = { next: verb(0), "throw": verb(1), "return": verb(2) }, typeof Symbol === "function" && (g[Symbol.iterator] = function() { return this; }), g;
+    function verb(n) { return function (v) { return step([n, v]); }; }
+    function step(op) {
+        if (f) throw new TypeError("Generator is already executing.");
+        while (g && (g = 0, op[0] && (_ = 0)), _) try {
+            if (f = 1, y && (t = op[0] & 2 ? y["return"] : op[0] ? y["throw"] || ((t = y["return"]) && t.call(y), 0) : y.next) && !(t = t.call(y, op[1])).done) return t;
+            if (y = 0, t) op = [op[0] & 2, t.value];
+            switch (op[0]) {
+                case 0: case 1: t = op; break;
+                case 4: _.label++; return { value: op[1], done: false };
+                case 5: _.label++; y = op[1]; op = [0]; continue;
+                case 7: op = _.ops.pop(); _.trys.pop(); continue;
+                default:
+                    if (!(t = _.trys, t = t.length > 0 && t[t.length - 1]) && (op[0] === 6 || op[0] === 2)) { _ = 0; continue; }
+                    if (op[0] === 3 && (!t || (op[1] > t[0] && op[1] < t[3]))) { _.label = op[1]; break; }
+                    if (op[0] === 6 && _.label < t[1]) { _.label = t[1]; t = op; break; }
+                    if (t && _.label < t[2]) { _.label = t[2]; _.ops.push(op); break; }
+                    if (t[2]) _.ops.pop();
+                    _.trys.pop(); continue;
+            }
+            op = body.call(thisArg, _);
+        } catch (e) { op = [6, e]; y = 0; } finally { f = t = 0; }
+        if (op[0] & 5) throw op[1]; return { value: op[0] ? op[1] : void 0, done: true };
+    }
+};
+var __asyncValues = (this && this.__asyncValues) || function (o) {
+    if (!Symbol.asyncIterator) throw new TypeError("Symbol.asyncIterator is not defined.");
+    var m = o[Symbol.asyncIterator], i;
+    return m ? m.call(o) : (o = typeof __values === "function" ? __values(o) : o[Symbol.iterator](), i = {}, verb("next"), verb("throw"), verb("return"), i[Symbol.asyncIterator] = function () { return this; }, i);
+    function verb(n) { i[n] = o[n] && function (v) { return new Promise(function (resolve, reject) { v = o[n](v), settle(resolve, reject, v.done, v.value); }); }; }
+    function settle(resolve, reject, d, v) { Promise.resolve(v).then(function(v) { resolve({ value: v, done: d }); }, reject); }
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SweepMalformedAccessGrants = void 0;
+var db_1 = require("@proteinjs/db");
+var user_1 = require("@proteinjs/user");
+var logger_1 = require("@proteinjs/logger");
+/**
+ * ONE-TIME SWEEP of malformed access_grant residue — rows whose `principal` or `resource`
+ * reference is NULL. The AccessGrant well-formedness invariant (`AccessGrantTable.assertWellFormed`)
+ * now refuses that shape at insert, and the session-less scope-root bootstrap no longer mints it;
+ * this migration clears what the two producers left behind before the fix (the test environment
+ * held one; app Deploy to Test 32614670162 crashed on it).
+ *
+ * The sweep's predicate is the invariant's exact complement (`principal IS NULL OR resource IS
+ * NULL`), and it rides BOTH the find and the delete — a well-formed row cannot be selected by the
+ * statement that deletes, whatever the id list. Deletes go through the system Db by id, so the
+ * registered after-delete watchers fire (a grantee's content_reference cleanup rides
+ * `ContentReferenceAccessGrantTableWatcher`). Idempotent: a re-run finds nothing.
+ *
+ * DANGLING references are a separate class and are NOT deleted here: a well-formed grant whose
+ * principal user or resource row was purged out from under it. Those are REPORTED (log +
+ * migration output) so the purge paths that strand them can be named; a delete would be a
+ * symptom patch on a producer this migration does not own.
+ *
+ * App-service/system-db path only — never raw Spanner.
+ */
+var SweepMalformedAccessGrants = /** @class */ (function () {
+    function SweepMalformedAccessGrants() {
+        var _this = this;
+        this.table = db_1.tables.Migration;
+        this.record = {
+            id: '2b7e4d0c-5f1a-4c3e-9b8d-6a2f1e0c7d45',
+            description: 'Sweep malformed access_grant rows (NULL principal or NULL resource — the well-formedness invariant’s complement); report dangling references, no delete.',
+            run: function () { return __awaiter(_this, void 0, void 0, function () {
+                var logger, dry, real, dangling, output;
+                return __generator(this, function (_a) {
+                    switch (_a.label) {
+                        case 0:
+                            logger = new logger_1.Logger({ name: SweepMalformedAccessGrants.name });
+                            return [4 /*yield*/, this.sweep({ dryRun: true })];
+                        case 1:
+                            dry = _a.sent();
+                            return [4 /*yield*/, this.sweep({ dryRun: false })];
+                        case 2:
+                            real = _a.sent();
+                            return [4 /*yield*/, this.reportDangling()];
+                        case 3:
+                            dangling = _a.sent();
+                            output = {
+                                malformed: real.malformed,
+                                malformedDryRun: dry.malformed,
+                                danglingPrincipal: dangling.danglingPrincipal,
+                                danglingResource: dangling.danglingResource,
+                                malformedRows: real.rows,
+                                danglingRows: dangling.rows,
+                            };
+                            logger.info({ message: 'SweepMalformedAccessGrants completed', obj: output });
+                            return [2 /*return*/, output];
+                    }
+                });
+            }); },
+        };
+    }
+    /** Find (and unless `dryRun`, delete) every malformed grant. Each row is logged either way. */
+    SweepMalformedAccessGrants.prototype.sweep = function (options) {
+        return __awaiter(this, void 0, void 0, function () {
+            var dryRun, logger, db, findQb, malformed, rows, _i, rows_1, row, _a, malformed_1, grant, deleteQb, result;
+            var _this = this;
+            return __generator(this, function (_b) {
+                switch (_b.label) {
+                    case 0:
+                        dryRun = options.dryRun;
+                        logger = new logger_1.Logger({ name: SweepMalformedAccessGrants.name });
+                        db = (0, db_1.getDbAsSystem)();
+                        findQb = this.malformedPredicate(new db_1.QueryBuilderFactory().getQueryBuilder(user_1.tables.AccessGrant)).sort([
+                            { field: 'created' },
+                        ]);
+                        return [4 /*yield*/, db.query(user_1.tables.AccessGrant, findQb)];
+                    case 1:
+                        malformed = _b.sent();
+                        rows = malformed.map(function (grant) { return _this.toRow(grant); });
+                        for (_i = 0, rows_1 = rows; _i < rows_1.length; _i++) {
+                            row = rows_1[_i];
+                            logger.info({
+                                message: dryRun ? 'Malformed access_grant (dry run)' : 'Deleting malformed access_grant',
+                                obj: row,
+                            });
+                        }
+                        if (!!dryRun) return [3 /*break*/, 5];
+                        _a = 0, malformed_1 = malformed;
+                        _b.label = 2;
+                    case 2:
+                        if (!(_a < malformed_1.length)) return [3 /*break*/, 5];
+                        grant = malformed_1[_a];
+                        deleteQb = this.malformedPredicate(new db_1.QueryBuilderFactory().getQueryBuilder(user_1.tables.AccessGrant, { id: grant.id }));
+                        return [4 /*yield*/, db.delete(user_1.tables.AccessGrant, deleteQb)];
+                    case 3:
+                        _b.sent();
+                        _b.label = 4;
+                    case 4:
+                        _a++;
+                        return [3 /*break*/, 2];
+                    case 5:
+                        result = { malformed: rows.length, rows: rows, dryRun: dryRun };
+                        logger.info({ message: dryRun ? 'Sweep dry run' : 'Sweep pass', obj: { malformed: rows.length, dryRun: dryRun } });
+                        return [2 /*return*/, result];
+                }
+            });
+        });
+    };
+    /**
+     * Report-only scan for well-formed grants whose principal or resource row no longer exists —
+     * the purged-user / purged-resource class. Nothing is deleted.
+     */
+    SweepMalformedAccessGrants.prototype.reportDangling = function () {
+        var _a, e_1, _b, _c;
+        var _d, _e, _f, _g;
+        return __awaiter(this, void 0, void 0, function () {
+            var logger, db, grants, principalIds, resourceIdsByTable, _h, _j, _k, grant, principalId, resourceId, resourceTable, e_1_1, existingPrincipals, existingResourcesByTable, _loop_1, this_1, _i, _l, tableName, report, _m, grants_1, grant, resourceTable, existingResources, reason, row;
+            return __generator(this, function (_o) {
+                switch (_o.label) {
+                    case 0:
+                        logger = new logger_1.Logger({ name: SweepMalformedAccessGrants.name });
+                        db = (0, db_1.getDbAsSystem)();
+                        grants = [];
+                        principalIds = new Set();
+                        resourceIdsByTable = new Map();
+                        _o.label = 1;
+                    case 1:
+                        _o.trys.push([1, 6, 7, 12]);
+                        _h = true, _j = __asyncValues(new db_1.RecordIterator(user_1.tables.AccessGrant, {}, 200, db));
+                        _o.label = 2;
+                    case 2: return [4 /*yield*/, _j.next()];
+                    case 3:
+                        if (!(_k = _o.sent(), _a = _k.done, !_a)) return [3 /*break*/, 5];
+                        _c = _k.value;
+                        _h = false;
+                        grant = _c;
+                        principalId = (_d = grant.principal) === null || _d === void 0 ? void 0 : _d._id;
+                        resourceId = (_e = grant.resource) === null || _e === void 0 ? void 0 : _e._id;
+                        if (!principalId || !resourceId) {
+                            return [3 /*break*/, 4]; // the malformed class — `sweep` owns it
+                        }
+                        grants.push(grant);
+                        principalIds.add(principalId);
+                        resourceTable = (_f = grant.resourceTable) !== null && _f !== void 0 ? _f : grant.resource._table;
+                        if (!resourceIdsByTable.has(resourceTable)) {
+                            resourceIdsByTable.set(resourceTable, new Set());
+                        }
+                        resourceIdsByTable.get(resourceTable).add(resourceId);
+                        _o.label = 4;
+                    case 4:
+                        _h = true;
+                        return [3 /*break*/, 2];
+                    case 5: return [3 /*break*/, 12];
+                    case 6:
+                        e_1_1 = _o.sent();
+                        e_1 = { error: e_1_1 };
+                        return [3 /*break*/, 12];
+                    case 7:
+                        _o.trys.push([7, , 10, 11]);
+                        if (!(!_h && !_a && (_b = _j.return))) return [3 /*break*/, 9];
+                        return [4 /*yield*/, _b.call(_j)];
+                    case 8:
+                        _o.sent();
+                        _o.label = 9;
+                    case 9: return [3 /*break*/, 11];
+                    case 10:
+                        if (e_1) throw e_1.error;
+                        return [7 /*endfinally*/];
+                    case 11: return [7 /*endfinally*/];
+                    case 12: return [4 /*yield*/, this.existingIds(user_1.tables.User, principalIds)];
+                    case 13:
+                        existingPrincipals = _o.sent();
+                        existingResourcesByTable = new Map();
+                        _loop_1 = function (tableName) {
+                            var table, _p, _q, _r, _s;
+                            return __generator(this, function (_t) {
+                                switch (_t.label) {
+                                    case 0:
+                                        table = (0, db_1.getTables)().find(function (candidate) { return candidate.name === tableName; });
+                                        _q = (_p = existingResourcesByTable).set;
+                                        _r = [tableName];
+                                        if (!table) return [3 /*break*/, 2];
+                                        return [4 /*yield*/, this_1.existingIds(table, resourceIdsByTable.get(tableName))];
+                                    case 1:
+                                        _s = _t.sent();
+                                        return [3 /*break*/, 3];
+                                    case 2:
+                                        _s = null;
+                                        _t.label = 3;
+                                    case 3:
+                                        _q.apply(_p, _r.concat([_s]));
+                                        return [2 /*return*/];
+                                }
+                            });
+                        };
+                        this_1 = this;
+                        _i = 0, _l = Array.from(resourceIdsByTable.keys());
+                        _o.label = 14;
+                    case 14:
+                        if (!(_i < _l.length)) return [3 /*break*/, 17];
+                        tableName = _l[_i];
+                        return [5 /*yield**/, _loop_1(tableName)];
+                    case 15:
+                        _o.sent();
+                        _o.label = 16;
+                    case 16:
+                        _i++;
+                        return [3 /*break*/, 14];
+                    case 17:
+                        report = { danglingPrincipal: 0, danglingResource: 0, rows: [] };
+                        for (_m = 0, grants_1 = grants; _m < grants_1.length; _m++) {
+                            grant = grants_1[_m];
+                            resourceTable = (_g = grant.resourceTable) !== null && _g !== void 0 ? _g : grant.resource._table;
+                            existingResources = existingResourcesByTable.get(resourceTable);
+                            reason = void 0;
+                            if (!existingPrincipals.has(grant.principal._id)) {
+                                reason = 'principal missing';
+                                report.danglingPrincipal++;
+                            }
+                            else if (existingResources === null) {
+                                reason = 'resource table not registered';
+                                report.danglingResource++;
+                            }
+                            else if (!existingResources.has(grant.resource._id)) {
+                                reason = 'resource missing';
+                                report.danglingResource++;
+                            }
+                            if (!reason) {
+                                continue;
+                            }
+                            row = __assign(__assign({}, this.toRow(grant)), { principal: grant.principal._id, resource: grant.resource._id, reason: reason });
+                            report.rows.push(row);
+                            logger.warn({ message: 'Dangling access_grant (report only, not deleted)', obj: row });
+                        }
+                        logger.info({
+                            message: 'Dangling access_grant report',
+                            obj: { danglingPrincipal: report.danglingPrincipal, danglingResource: report.danglingResource },
+                        });
+                        return [2 /*return*/, report];
+                }
+            });
+        });
+    };
+    /** The well-formedness invariant's exact complement: a NULL principal or a NULL resource. */
+    SweepMalformedAccessGrants.prototype.malformedPredicate = function (qb) {
+        return qb.or([
+            { field: 'principal', operator: 'IS NULL' },
+            { field: 'resource', operator: 'IS NULL' },
+        ]);
+    };
+    /** Which of `ids` exist in `table`, resolved as system in bounded IN chunks. */
+    SweepMalformedAccessGrants.prototype.existingIds = function (table, ids) {
+        return __awaiter(this, void 0, void 0, function () {
+            var existing, all, chunkSize, start, chunk, qb, found, _i, found_1, record;
+            return __generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0:
+                        existing = new Set();
+                        all = Array.from(ids);
+                        chunkSize = 200;
+                        start = 0;
+                        _a.label = 1;
+                    case 1:
+                        if (!(start < all.length)) return [3 /*break*/, 4];
+                        chunk = all.slice(start, start + chunkSize);
+                        qb = new db_1.QueryBuilderFactory()
+                            .getQueryBuilder(table)
+                            .select({ fields: ['id'] })
+                            .condition({ field: 'id', operator: 'IN', value: chunk });
+                        return [4 /*yield*/, (0, db_1.getDbAsSystem)().query(table, qb)];
+                    case 2:
+                        found = (_a.sent());
+                        for (_i = 0, found_1 = found; _i < found_1.length; _i++) {
+                            record = found_1[_i];
+                            existing.add(record.id);
+                        }
+                        _a.label = 3;
+                    case 3:
+                        start += chunkSize;
+                        return [3 /*break*/, 1];
+                    case 4: return [2 /*return*/, existing];
+                }
+            });
+        });
+    };
+    SweepMalformedAccessGrants.prototype.toRow = function (grant) {
+        var _a;
+        return {
+            id: grant.id,
+            resourceTable: grant.resourceTable,
+            accessLevel: grant.accessLevel,
+            created: (_a = grant.created) === null || _a === void 0 ? void 0 : _a.toISOString(),
+        };
+    };
+    return SweepMalformedAccessGrants;
+}());
+exports.SweepMalformedAccessGrants = SweepMalformedAccessGrants;
+//# sourceMappingURL=SweepMalformedAccessGrants.js.map

package/dist/src/migrations/SweepMalformedAccessGrants.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"SweepMalformedAccessGrants.js","sourceRoot":"","sources":["../../../src/migrations/SweepMalformedAccessGrants.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,oCAWuB;AACvB,wCAAoE;AACpE,4CAA2C;AA8B3C;;;;;;;;;;;;;;;;;;;GAmBG;AACH;IAAA;QAAA,iBAqKC;QApKC,UAAK,GAAG,WAAQ,CAAC,SAAS,CAAC;QAC3B,WAAM,GAAG;YACP,EAAE,EAAE,sCAAsC;YAC1C,WAAW,EACT,0JAA0J;YAC5J,GAAG,EAAE;;;;;4BACG,MAAM,GAAG,IAAI,eAAM,CAAC,EAAE,IAAI,EAAE,0BAA0B,CAAC,IAAI,EAAE,CAAC,CAAC;4BAEzD,qBAAM,IAAI,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,EAAA;;4BAAxC,GAAG,GAAG,SAAkC;4BACjC,qBAAM,IAAI,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,EAAA;;4BAA1C,IAAI,GAAG,SAAmC;4BAC/B,qBAAM,IAAI,CAAC,cAAc,EAAE,EAAA;;4BAAtC,QAAQ,GAAG,SAA2B;4BACtC,MAAM,GAAG;gCACb,SAAS,EAAE,IAAI,CAAC,SAAS;gCACzB,eAAe,EAAE,GAAG,CAAC,SAAS;gCAC9B,iBAAiB,EAAE,QAAQ,CAAC,iBAAiB;gCAC7C,gBAAgB,EAAE,QAAQ,CAAC,gBAAgB;gCAC3C,aAAa,EAAE,IAAI,CAAC,IAAI;gCACxB,YAAY,EAAE,QAAQ,CAAC,IAAI;6BAC5B,CAAC;4BACF,MAAM,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,sCAAsC,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC,CAAC;4BAC9E,sBAAO,MAAM,EAAC;;;iBACf;SACF,CAAC;IA8IJ,CAAC;IA5IC,+FAA+F;IACzF,0CAAK,GAAX,UAAY,OAA4B;;;;;;;wBAC9B,MAAM,GAAK,OAAO,OAAZ,CAAa;wBACrB,MAAM,GAAG,IAAI,eAAM,CAAC,EAAE,IAAI,EAAE,0BAA0B,CAAC,IAAI,EAAE,CAAC,CAAC;wBAC/D,EAAE,GAAG,IAAA,kBAAa,GAAe,CAAC;wBAElC,MAAM,GAAG,IAAI,CAAC,kBAAkB,CAAC,IAAI,wBAAmB,EAAE,CAAC,eAAe,CAAC,aAAU,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC;4BAC7G,EAAE,KAAK,EAAE,SAAS,EAAE;yBACrB,CAAC,CAAC;wBACe,qBAAM,EAAE,CAAC,KAAK,CAAC,aAAU,CAAC,WAAW,EAAE,MAAM,CAAC,EAAA;;wBAA1D,SAAS,GAAG,SAA8C;wBAC1D,IAAI,GAAG,SAAS,CAAC,GAAG,CAAC,UAAC,KAAK,IAAK,OAAA,KAAI,CAAC,KAAK,CAAC,KAAK,CAAC,EAAjB,CAAiB,CAAC,CAAC;wBACzD,WAAsB,EAAJ,aAAI,EAAJ,kBAAI,EAAJ,IAAI,EAAE;4BAAb,GAAG;4BACZ,MAAM,CAAC,IAAI,CAAC;gCACV,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,kCAAkC,CAAC,CAAC,CAAC,iCAAiC;gCACxF,GAAG,EAAE,GAAG;6BACT,CAAC,CAAC;yBACJ;6BAEG,CAAC,MAAM,EAAP,wBAAO;8BACoB,EAAT,uBAAS;;;6BAAT,CAAA,uBAAS,CAAA;wBAAlB,KAAK;wBAER,QAAQ,GAAG,IAAI,CAAC,kBAAkB,CACtC,IAAI,wBAAmB,EAAE,CAAC,eAAe,CAAC,aAAU,CAAC,WAAW,EAAE,EAAE,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CACpF,CAAC;wBACF,qBAAM,EAAE,CAAC,MAAM,CAAC,aAAU,CAAC,WAAW,EAAE,QAAQ,CAAC,EAAA;;wBAAjD,SAAiD,CAAC;;;wBALhC,IAAS,CAAA;;;wBASzB,MAAM,GAAG,EAAE,SAAS,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,MAAA,EAAE,MAAM,QAAA,EAAE,CAAC;wBACxD,MAAM,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,YAAY,EAAE,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC,MAAM,EAAE,MAAM,QAAA,EAAE,EAAE,CAAC,CAAC;wBAC3G,sBAAO,MAAM,EAAC;;;;KACf;IAED;;;OAGG;IACG,mDAAc,GAApB;;;;;;;;wBACQ,MAAM,GAAG,IAAI,eAAM,CAAC,EAAE,IAAI,EAAE,0BAA0B,CAAC,IAAI,EAAE,CAAC,CAAC;wBAC/D,EAAE,GAAG,IAAA,kBAAa,GAAe,CAAC;wBAGlC,MAAM,GAAkB,EAAE,CAAC;wBAC3B,YAAY,GAAG,IAAI,GAAG,EAAU,CAAC;wBACjC,kBAAkB,GAAG,IAAI,GAAG,EAAuB,CAAC;;;;mCAChC,KAAA,cAAA,IAAI,mBAAc,CAAc,aAAU,CAAC,WAAW,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE,CAAC,CAAA;;;;;wBAApE,cAAoE;wBAApE,WAAoE;wBAA7E,KAAK,KAAA,CAAA;wBACd,WAAW,GAAG,MAAA,KAAK,CAAC,SAAS,0CAAE,GAAG,CAAC;wBACnC,UAAU,GAAG,MAAA,KAAK,CAAC,QAAQ,0CAAE,GAAG,CAAC;wBACvC,IAAI,CAAC,WAAW,IAAI,CAAC,UAAU,EAAE;4BAC/B,wBAAS,CAAC,wCAAwC;yBACnD;wBACD,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;wBACnB,YAAY,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;wBACxB,aAAa,GAAG,MAAA,KAAK,CAAC,aAAa,mCAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC;wBACnE,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,aAAa,CAAC,EAAE;4BAC1C,kBAAkB,CAAC,GAAG,CAAC,aAAa,EAAE,IAAI,GAAG,EAAE,CAAC,CAAC;yBAClD;wBACD,kBAAkB,CAAC,GAAG,CAAC,aAAa,CAAE,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;;;;;;;;;;;;;;;;;;;;;;6BAG9B,qBAAM,IAAI,CAAC,WAAW,CAAC,aAAU,CAAC,IAAI,EAAE,YAAY,CAAC,EAAA;;wBAA1E,kBAAkB,GAAG,SAAqD;wBAC1E,wBAAwB,GAAG,IAAI,GAAG,EAA8B,CAAC;4CAC5D,SAAS;;;;;wCACZ,KAAK,GAAG,IAAA,cAAS,GAAE,CAAC,IAAI,CAAC,UAAC,SAAS,IAAK,OAAA,SAAS,CAAC,IAAI,KAAK,SAAS,EAA5B,CAA4B,CAAC,CAAC;wCAC5E,KAAA,CAAA,KAAA,wBAAwB,CAAA,CAAC,GAAG,CAAA;8CAC1B,SAAS;6CACT,KAAK,EAAL,wBAAK;wCAAG,qBAAM,OAAK,WAAW,CAAC,KAAK,EAAE,kBAAkB,CAAC,GAAG,CAAC,SAAS,CAAE,CAAC,EAAA;;wCAAjE,KAAA,SAAiE,CAAA;;;wCAAG,KAAA,IAAI,CAAA;;;wCAFlF,6BAGC,CAAC;;;;;;8BALyD,EAArC,KAAA,KAAK,CAAC,IAAI,CAAC,kBAAkB,CAAC,IAAI,EAAE,CAAC;;;6BAArC,CAAA,cAAqC,CAAA;wBAAlD,SAAS;sDAAT,SAAS;;;;;wBAAI,IAAqC,CAAA;;;wBAQvD,MAAM,GAA+B,EAAE,iBAAiB,EAAE,CAAC,EAAE,gBAAgB,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;wBACnG,WAA0B,EAAN,iBAAM,EAAN,oBAAM,EAAN,IAAM,EAAE;4BAAjB,KAAK;4BACR,aAAa,GAAG,MAAA,KAAK,CAAC,aAAa,mCAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC;4BAC7D,iBAAiB,GAAG,wBAAwB,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;4BAClE,MAAM,SAA8C,CAAC;4BACzD,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,GAAI,CAAC,EAAE;gCACjD,MAAM,GAAG,mBAAmB,CAAC;gCAC7B,MAAM,CAAC,iBAAiB,EAAE,CAAC;6BAC5B;iCAAM,IAAI,iBAAiB,KAAK,IAAI,EAAE;gCACrC,MAAM,GAAG,+BAA+B,CAAC;gCACzC,MAAM,CAAC,gBAAgB,EAAE,CAAC;6BAC3B;iCAAM,IAAI,CAAC,iBAAkB,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAI,CAAC,EAAE;gCACvD,MAAM,GAAG,kBAAkB,CAAC;gCAC5B,MAAM,CAAC,gBAAgB,EAAE,CAAC;6BAC3B;4BACD,IAAI,CAAC,MAAM,EAAE;gCACX,SAAS;6BACV;4BACK,GAAG,yBACJ,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,KACpB,SAAS,EAAE,KAAK,CAAC,SAAS,CAAC,GAAG,EAC9B,QAAQ,EAAE,KAAK,CAAC,QAAQ,CAAC,GAAG,EAC5B,MAAM,QAAA,GACP,CAAC;4BACF,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;4BACtB,MAAM,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,kDAAkD,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC;yBACxF;wBAED,MAAM,CAAC,IAAI,CAAC;4BACV,OAAO,EAAE,8BAA8B;4BACvC,GAAG,EAAE,EAAE,iBAAiB,EAAE,MAAM,CAAC,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,CAAC,gBAAgB,EAAE;yBAChG,CAAC,CAAC;wBACH,sBAAO,MAAM,EAAC;;;;KACf;IAED,6FAA6F;IACrF,uDAAkB,GAA1B,UAA2B,EAA6B;QACtD,OAAO,EAAE,CAAC,EAAE,CAAC;YACX,EAAE,KAAK,EAAE,WAAW,EAAE,QAAQ,EAAE,SAAS,EAAE;YAC3C,EAAE,KAAK,EAAE,UAAU,EAAE,QAAQ,EAAE,SAAS,EAAE;SAC3C,CAAC,CAAC;IACL,CAAC;IAED,gFAAgF;IAClE,gDAAW,GAAzB,UAA0B,KAAiB,EAAE,GAAgB;;;;;;wBACrD,QAAQ,GAAG,IAAI,GAAG,EAAU,CAAC;wBAC7B,GAAG,GAAG,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;wBACtB,SAAS,GAAG,GAAG,CAAC;wBACb,KAAK,GAAG,CAAC;;;6BAAE,CAAA,KAAK,GAAG,GAAG,CAAC,MAAM,CAAA;wBAC9B,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,GAAG,SAAS,CAAC,CAAC;wBAC5C,EAAE,GAAG,IAAI,wBAAmB,EAAE;6BACjC,eAAe,CAAC,KAAK,CAAC;6BACtB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;6BAC1B,SAAS,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;wBAC7C,qBAAM,IAAA,kBAAa,GAAE,CAAC,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC,EAAA;;wBAA/C,KAAK,GAAG,CAAC,SAAsC,CAAa;wBAClE,WAA0B,EAAL,eAAK,EAAL,mBAAK,EAAL,IAAK,EAAE;4BAAjB,MAAM;4BACf,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;yBACzB;;;wBATqC,KAAK,IAAI,SAAS,CAAA;;4BAW1D,sBAAO,QAAQ,EAAC;;;;KACjB;IAEO,0CAAK,GAAb,UAAc,KAAkB;;QAC9B,OAAO;YACL,EAAE,EAAE,KAAK,CAAC,EAAE;YACZ,aAAa,EAAE,KAAK,CAAC,aAAa;YAClC,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,OAAO,EAAE,MAAA,KAAK,CAAC,OAAO,0CAAE,WAAW,EAAE;SACtC,CAAC;IACJ,CAAC;IACH,iCAAC;AAAD,CAAC,AArKD,IAqKC;AArKY,gEAA0B"}

package/dist/src/routes/devLogin.d.ts

@@ -13,6 +13,11 @@ import { Route } from '@proteinjs/server-api';
  * Domain rail: `?email` must share `DEV_AUTO_LOGIN_EMAIL`'s domain — even a dev server must not
  * mint sessions (much less accounts) for arbitrary domains; anything else answers 400.
  *
+ * Shape rail: `?email` must be a well-formed address (the house `emailRegex`). The domain rail
+ * alone let `?email=brent+lane-a@…` through when the `+` was left unencoded — a query-string `+`
+ * decodes to a SPACE, so the route minted a stray `brent lane-a@…` account. The 400 names the
+ * remedy (`%2B`) because plus-addressing is the fan-out convention this door exists for.
+ *
  * A missing account is created through the normal signup creation path (`Signup.createAccount`)
  * as a normal test user — password `test`, matching the seeded test-account convention, so
  * interactive login works for the same identity. Composes with userCache's missing-account→guest

package/dist/src/routes/devLogin.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"devLogin.d.ts","sourceRoot":"","sources":["../../../src/routes/devLogin.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,uBAAuB,CAAC;AAW9C;;;;;;;;;;;;;;;;;;;GAmBG;AACH,eAAO,MAAM,QAAQ,EAAE,KAuCtB,CAAC"}
+{"version":3,"file":"devLogin.d.ts","sourceRoot":"","sources":["../../../src/routes/devLogin.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,uBAAuB,CAAC;AAY9C;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,eAAO,MAAM,QAAQ,EAAE,KAgDtB,CAAC"}

package/dist/src/routes/devLogin.js

@@ -38,6 +38,7 @@ var __generator = (this && this.__generator) || function (thisArg, body) {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.devLogin = void 0;
 var logger_1 = require("@proteinjs/logger");
+var util_1 = require("@proteinjs/util");
 var establishSession_1 = require("../authentication/establishSession");
 var Signup_1 = require("../services/Signup");
 var logger = new logger_1.Logger({ name: 'devLogin' });
@@ -58,6 +59,11 @@ var emailDomain = function (address) { return address.slice(address.lastIndexOf(
  * Domain rail: `?email` must share `DEV_AUTO_LOGIN_EMAIL`'s domain — even a dev server must not
  * mint sessions (much less accounts) for arbitrary domains; anything else answers 400.
  *
+ * Shape rail: `?email` must be a well-formed address (the house `emailRegex`). The domain rail
+ * alone let `?email=brent+lane-a@…` through when the `+` was left unencoded — a query-string `+`
+ * decodes to a SPACE, so the route minted a stray `brent lane-a@…` account. The 400 names the
+ * remedy (`%2B`) because plus-addressing is the fan-out convention this door exists for.
+ *
  * A missing account is created through the normal signup creation path (`Signup.createAccount`)
  * as a normal test user — password `test`, matching the seeded test-account convention, so
  * interactive login works for the same identity. Composes with userCache's missing-account→guest
@@ -86,6 +92,13 @@ exports.devLogin = {
                             response.status(400).send("/dev/login only accepts accounts on the @".concat(emailDomain(envEmail), " domain"));
                             return [2 /*return*/];
                         }
+                        if (!util_1.emailRegex.test(requested)) {
+                            response
+                                .status(400)
+                                .send("/dev/login: \"".concat(requested, "\" is not a valid email address \u2014 an unencoded \"+\" in the query ") +
+                                "decodes to a space; write it as %2B (e.g. ?email=name%2Blane@".concat(emailDomain(envEmail), ")"));
+                            return [2 /*return*/];
+                        }
                         email = requested;
                     }
                     email = email.toLowerCase();

package/dist/src/routes/devLogin.js.map

@@ -1 +1 @@
-{"version":3,"file":"devLogin.js","sourceRoot":"","sources":["../../../src/routes/devLogin.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AACA,4CAA2C;AAC3C,uEAAsE;AACtE,6CAA4C;AAE5C,IAAM,MAAM,GAAG,IAAI,eAAM,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC;AAEhD;kFACkF;AAClF,IAAM,WAAW,GAAG,UAAC,OAAe,IAAK,OAAA,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,EAAE,EAAzD,CAAyD,CAAC;AAEnG;;;;;;;;;;;;;;;;;;;GAmBG;AACU,QAAA,QAAQ,GAAU;IAC7B,IAAI,EAAE,YAAY;IAClB,MAAM,EAAE,KAAK;IACb,SAAS,EAAE,UAAO,OAAY,EAAE,QAAQ;;;;;;oBAChC,QAAQ,GAAG,CAAC,MAAA,OAAO,CAAC,GAAG,CAAC,oBAAoB,mCAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;oBACjE,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,WAAW,IAAI,CAAC,QAAQ,EAAE;wBACzC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;wBAC5B,sBAAO;qBACR;oBAEG,KAAK,GAAG,QAAQ,CAAC;oBACf,UAAU,GAAG,MAAA,OAAO,CAAC,KAAK,0CAAE,KAAK,CAAC;oBACxC,IAAI,UAAU,KAAK,SAAS,EAAE;wBACtB,SAAS,GAAG,OAAO,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;wBAC1E,IAAI,WAAW,CAAC,SAAS,CAAC,KAAK,WAAW,CAAC,QAAQ,CAAC,EAAE;4BACpD,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,mDAA4C,WAAW,CAAC,QAAQ,CAAC,YAAS,CAAC,CAAC;4BACtG,sBAAO;yBACR;wBACD,KAAK,GAAG,SAAS,CAAC;qBACnB;oBACD,KAAK,GAAG,KAAK,CAAC,WAAW,EAAE,CAAC;oBAEX,qBAAM,IAAI,eAAM,EAAE,CAAC,aAAa,CAAC;4BAChD,IAAI,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;4BACxC,KAAK,OAAA;4BACL,QAAQ,EAAE,MAAM;4BAChB,aAAa,EAAE,KAAK;4BACpB,SAAS,EAAE,IAAI;yBAChB,CAAC,EAAA;;oBANI,QAAQ,GAAG,SAMf;oBACF,IAAI,QAAQ,KAAK,SAAS,EAAE;wBAC1B,MAAM,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,6CAA6C,EAAE,GAAG,EAAE,EAAE,KAAK,OAAA,EAAE,EAAE,CAAC,CAAC;qBACzF;oBAED,2FAA2F;oBAC3F,8FAA8F;oBAC9F,qBAAM,IAAA,mCAAgB,EAAC,OAAO,EAAE,KAAK,CAAC,EAAA;;oBAFtC,2FAA2F;oBAC3F,8FAA8F;oBAC9F,SAAsC,CAAC;oBACvC,MAAM,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,oCAAoC,EAAE,GAAG,EAAE,EAAE,KAAK,OAAA,EAAE,EAAE,CAAC,CAAC;oBAC/E,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;;;;SACxB;CACF,CAAC"}
+{"version":3,"file":"devLogin.js","sourceRoot":"","sources":["../../../src/routes/devLogin.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AACA,4CAA2C;AAC3C,wCAA6C;AAC7C,uEAAsE;AACtE,6CAA4C;AAE5C,IAAM,MAAM,GAAG,IAAI,eAAM,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC;AAEhD;kFACkF;AAClF,IAAM,WAAW,GAAG,UAAC,OAAe,IAAK,OAAA,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,EAAE,EAAzD,CAAyD,CAAC;AAEnG;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACU,QAAA,QAAQ,GAAU;IAC7B,IAAI,EAAE,YAAY;IAClB,MAAM,EAAE,KAAK;IACb,SAAS,EAAE,UAAO,OAAY,EAAE,QAAQ;;;;;;oBAChC,QAAQ,GAAG,CAAC,MAAA,OAAO,CAAC,GAAG,CAAC,oBAAoB,mCAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;oBACjE,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,WAAW,IAAI,CAAC,QAAQ,EAAE;wBACzC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;wBAC5B,sBAAO;qBACR;oBAEG,KAAK,GAAG,QAAQ,CAAC;oBACf,UAAU,GAAG,MAAA,OAAO,CAAC,KAAK,0CAAE,KAAK,CAAC;oBACxC,IAAI,UAAU,KAAK,SAAS,EAAE;wBACtB,SAAS,GAAG,OAAO,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;wBAC1E,IAAI,WAAW,CAAC,SAAS,CAAC,KAAK,WAAW,CAAC,QAAQ,CAAC,EAAE;4BACpD,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,mDAA4C,WAAW,CAAC,QAAQ,CAAC,YAAS,CAAC,CAAC;4BACtG,sBAAO;yBACR;wBACD,IAAI,CAAC,iBAAU,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE;4BAC/B,QAAQ;iCACL,MAAM,CAAC,GAAG,CAAC;iCACX,IAAI,CACH,wBAAgB,SAAS,4EAAiE;gCACxF,uEAAgE,WAAW,CAAC,QAAQ,CAAC,MAAG,CAC3F,CAAC;4BACJ,sBAAO;yBACR;wBACD,KAAK,GAAG,SAAS,CAAC;qBACnB;oBACD,KAAK,GAAG,KAAK,CAAC,WAAW,EAAE,CAAC;oBAEX,qBAAM,IAAI,eAAM,EAAE,CAAC,aAAa,CAAC;4BAChD,IAAI,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;4BACxC,KAAK,OAAA;4BACL,QAAQ,EAAE,MAAM;4BAChB,aAAa,EAAE,KAAK;4BACpB,SAAS,EAAE,IAAI;yBAChB,CAAC,EAAA;;oBANI,QAAQ,GAAG,SAMf;oBACF,IAAI,QAAQ,KAAK,SAAS,EAAE;wBAC1B,MAAM,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,6CAA6C,EAAE,GAAG,EAAE,EAAE,KAAK,OAAA,EAAE,EAAE,CAAC,CAAC;qBACzF;oBAED,2FAA2F;oBAC3F,8FAA8F;oBAC9F,qBAAM,IAAA,mCAAgB,EAAC,OAAO,EAAE,KAAK,CAAC,EAAA;;oBAFtC,2FAA2F;oBAC3F,8FAA8F;oBAC9F,SAAsC,CAAC;oBACvC,MAAM,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,oCAAoC,EAAE,GAAG,EAAE,EAAE,KAAK,OAAA,EAAE,EAAE,CAAC,CAAC;oBAC/E,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;;;;SACxB;CACF,CAAC"}

package/dist/src/services/Roles.d.ts

@@ -5,6 +5,8 @@ import { Service } from '@proteinjs/service';
  * record writes cannot touch it). Grants and revokes are validated against the roles catalog and
  * audited: the role update and its `role_grant_event` row (actor, target, role, action; `created`
  * is the timestamp) commit in one transaction, so the trail cannot diverge from the grants.
+ *
+ * Break-glass roles are never granted here — see `changeRole`; revoking one stays allowed.
  */
 export declare class Roles implements RolesService {
     serviceMetadata: Service['serviceMetadata'];

package/dist/src/services/Roles.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"Roles.d.ts","sourceRoot":"","sources":["../../../src/services/Roles.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,YAAY,EAAoD,MAAM,iBAAiB,CAAC;AAEjG,OAAO,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAE7C;;;;;GAKG;AACH,qBAAa,KAAM,YAAW,YAAY;IACjC,eAAe,EAAE,OAAO,CAAC,iBAAiB,CAAC,CAIhD;IAEI,SAAS,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAItD,UAAU,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;YAI/C,UAAU;CA4CzB"}
+{"version":3,"file":"Roles.d.ts","sourceRoot":"","sources":["../../../src/services/Roles.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,YAAY,EAA8D,MAAM,iBAAiB,CAAC;AAE3G,OAAO,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAE7C;;;;;;;GAOG;AACH,qBAAa,KAAM,YAAW,YAAY;IACjC,eAAe,EAAE,OAAO,CAAC,iBAAiB,CAAC,CAIhD;IAEI,SAAS,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAItD,UAAU,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;YAI/C,UAAU;CAoEzB"}

package/dist/src/services/Roles.js

@@ -54,6 +54,8 @@ var logger_1 = require("@proteinjs/logger");
  * record writes cannot touch it). Grants and revokes are validated against the roles catalog and
  * audited: the role update and its `role_grant_event` row (actor, target, role, action; `created`
  * is the timestamp) commit in one transaction, so the trail cannot diverge from the grants.
+ *
+ * Break-glass roles are never granted here — see `changeRole`; revoking one stays allowed.
  */
 var Roles = /** @class */ (function () {
     function Roles() {
@@ -90,15 +92,33 @@ var Roles = /** @class */ (function () {
     Roles.prototype.changeRole = function (userId, role, action) {
         var _a;
         return __awaiter(this, void 0, void 0, function () {
-            var logger, db, user, roles, newRoles, actor;
+            var logger, entry, db, user, roles, newRoles, actor;
             var _this = this;
             return __generator(this, function (_b) {
                 switch (_b.label) {
                     case 0:
                         logger = new logger_1.Logger({ name: "Roles.".concat(action, "Role") });
-                        if (!user_1.RolesCatalog.isKnownRole(role)) {
+                        entry = user_1.RolesCatalog.getEntry(role);
+                        if (!entry) {
                             throw new Error("'".concat(role, "' is not a known role. Pick one from the roles catalog."));
                         }
+                        // Break-glass passes every permission check, so no permission-mapped role — including
+                        // 'roles' — may mint it: the only path to break-glass is a manual UPDATE on the user row
+                        // in Spanner Studio, by a human, on purpose. Revoke stays open: de-escalation toward
+                        // "held by nobody day-to-day" should ride the audited path, not require database access.
+                        if (entry.breakGlass && action === 'grant') {
+                            throw new Error("'".concat(role, "' is a break-glass role \u2014 this service refuses to grant it. The only path to ") +
+                                "break-glass is a manual UPDATE on the user row in Spanner Studio. (Revoking it here " +
+                                "stays allowed.)");
+                        }
+                        // Admin-grant-only roles (catalog `adminGrantOnly`) exceed the people-management trust the
+                        // 'roles' permission carries — only an admin may hand them out. Server-side and fail-closed:
+                        // the service door admits 'roles' holders, so this check is what keeps a user-admin from
+                        // granting such a role. Revoke stays open — the break-glass de-escalation precedent above.
+                        if (entry.adminGrantOnly && action === 'grant' && !user_1.UserAuth.hasRole('admin')) {
+                            throw new Error("'".concat(role, "' can only be granted by an admin \u2014 the 'roles' grant does not cover it. ") +
+                                "(Revoking it here stays allowed.)");
+                        }
                         db = (0, db_1.getDbAsSystem)();
                         return [4 /*yield*/, db.get(user_1.tables.User, { id: userId })];
                     case 1:

package/dist/src/services/Roles.js.map

@@ -1 +1 @@
-{"version":3,"file":"Roles.js","sourceRoot":"","sources":["../../../src/services/Roles.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,oCAA8C;AAC9C,wCAAiG;AACjG,4CAA2C;AAG3C;;;;;GAKG;AACH;IAAA;QACS,oBAAe,GAA+B;YACnD,IAAI,EAAE;gBACJ,UAAU,EAAE,uBAAgB,CAAC,KAAK;aACnC;SACF,CAAC;IAsDJ,CAAC;IApDO,yBAAS,GAAf,UAAgB,MAAc,EAAE,IAAY;;;;4BAC1C,qBAAM,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,IAAI,EAAE,OAAO,CAAC,EAAA;;wBAA5C,SAA4C,CAAC;;;;;KAC9C;IAEK,0BAAU,GAAhB,UAAiB,MAAc,EAAE,IAAY;;;;4BAC3C,qBAAM,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,IAAI,EAAE,QAAQ,CAAC,EAAA;;wBAA7C,SAA6C,CAAC;;;;;KAC/C;IAEa,0BAAU,GAAxB,UAAyB,MAAc,EAAE,IAAY,EAAE,MAA0B;;;;;;;;wBACzE,MAAM,GAAG,IAAI,eAAM,CAAC,EAAE,IAAI,EAAE,gBAAS,MAAM,SAAM,EAAE,CAAC,CAAC;wBAC3D,IAAI,CAAC,mBAAY,CAAC,WAAW,CAAC,IAAI,CAAC,EAAE;4BACnC,MAAM,IAAI,KAAK,CAAC,WAAI,IAAI,4DAAyD,CAAC,CAAC;yBACpF;wBAEK,EAAE,GAAG,IAAA,kBAAa,GAAE,CAAC;wBACd,qBAAM,EAAE,CAAC,GAAG,CAAC,aAAM,CAAC,IAAI,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,EAAA;;wBAAhD,IAAI,GAAG,SAAyC;wBACtD,IAAI,CAAC,IAAI,EAAE;4BACT,MAAM,IAAI,KAAK,CAAC,gCAAyB,MAAM,CAAE,CAAC,CAAC;yBACpD;wBAED,4FAA4F;wBAC5F,4FAA4F;wBAC5F,iFAAiF;wBACjF,IAAI,IAAI,CAAC,kBAAkB,KAAK,IAAI,EAAE;4BACpC,MAAM,IAAI,KAAK,CACb,WAAI,IAAI,CAAC,KAAK,gFAA6E;gCACzF,6FAA6F,CAChG,CAAC;yBACH;wBAEK,KAAK,GAAG,MAAA,IAAI,CAAC,KAAK,mCAAI,EAAE,CAAC;wBAC/B,IAAI,MAAM,KAAK,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE;4BACrE,mFAAmF;4BACnF,sBAAO;yBACR;wBAEK,QAAQ,GAAG,MAAM,KAAK,OAAO,CAAC,CAAC,iCAAK,KAAK,UAAE,IAAI,UAAE,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,UAAC,QAAQ,IAAK,OAAA,QAAQ,KAAK,IAAI,EAAjB,CAAiB,CAAC,CAAC;wBACjG,KAAK,GAAG,IAAI,eAAQ,EAAE,CAAC,OAAO,EAAE,CAAC;wBACvC,qBAAM,EAAE,CAAC,cAAc,CAAC;;;gDACtB,qBAAM,EAAE,CAAC,MAAM,CAAC,aAAM,CAAC,IAAI,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,EAAA;;4CAA7D,SAA6D,CAAC;4CAC9D,qBAAM,EAAE,CAAC,MAAM,CAAC,aAAM,CAAC,cAAc,EAAE;oDACrC,KAAK,EAAE,KAAK,CAAC,EAAE;oDACf,MAAM,EAAE,MAAM;oDACd,IAAI,MAAA;oDACJ,MAAM,QAAA;iDACP,CAAC,EAAA;;4CALF,SAKE,CAAC;;;;iCACJ,CAAC,EAAA;;wBARF,SAQE,CAAC;wBACH,MAAM,CAAC,IAAI,CAAC;4BACV,OAAO,EAAE,eAAQ,MAAM,KAAK,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAE;4BAC7D,GAAG,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,MAAA,EAAE;yBAC/C,CAAC,CAAC;;;;;KACJ;IACH,YAAC;AAAD,CAAC,AA3DD,IA2DC;AA3DY,sBAAK"}
+{"version":3,"file":"Roles.js","sourceRoot":"","sources":["../../../src/services/Roles.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,oCAA8C;AAC9C,wCAA2G;AAC3G,4CAA2C;AAG3C;;;;;;;GAOG;AACH;IAAA;QACS,oBAAe,GAA+B;YACnD,IAAI,EAAE;gBACJ,UAAU,EAAE,uBAAgB,CAAC,KAAK;aACnC;SACF,CAAC;IA8EJ,CAAC;IA5EO,yBAAS,GAAf,UAAgB,MAAc,EAAE,IAAY;;;;4BAC1C,qBAAM,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,IAAI,EAAE,OAAO,CAAC,EAAA;;wBAA5C,SAA4C,CAAC;;;;;KAC9C;IAEK,0BAAU,GAAhB,UAAiB,MAAc,EAAE,IAAY;;;;4BAC3C,qBAAM,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,IAAI,EAAE,QAAQ,CAAC,EAAA;;wBAA7C,SAA6C,CAAC;;;;;KAC/C;IAEa,0BAAU,GAAxB,UAAyB,MAAc,EAAE,IAAY,EAAE,MAA0B;;;;;;;;wBACzE,MAAM,GAAG,IAAI,eAAM,CAAC,EAAE,IAAI,EAAE,gBAAS,MAAM,SAAM,EAAE,CAAC,CAAC;wBACrD,KAAK,GAAG,mBAAY,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;wBAC1C,IAAI,CAAC,KAAK,EAAE;4BACV,MAAM,IAAI,KAAK,CAAC,WAAI,IAAI,4DAAyD,CAAC,CAAC;yBACpF;wBAED,sFAAsF;wBACtF,yFAAyF;wBACzF,qFAAqF;wBACrF,yFAAyF;wBACzF,IAAI,KAAK,CAAC,UAAU,IAAI,MAAM,KAAK,OAAO,EAAE;4BAC1C,MAAM,IAAI,KAAK,CACb,WAAI,IAAI,uFAA+E;gCACrF,sFAAsF;gCACtF,iBAAiB,CACpB,CAAC;yBACH;wBAED,2FAA2F;wBAC3F,6FAA6F;wBAC7F,yFAAyF;wBACzF,2FAA2F;wBAC3F,IAAI,KAAK,CAAC,cAAc,IAAI,MAAM,KAAK,OAAO,IAAI,CAAC,eAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE;4BAC5E,MAAM,IAAI,KAAK,CACb,WAAI,IAAI,mFAA2E;gCACjF,mCAAmC,CACtC,CAAC;yBACH;wBAEK,EAAE,GAAG,IAAA,kBAAa,GAAE,CAAC;wBACd,qBAAM,EAAE,CAAC,GAAG,CAAC,aAAM,CAAC,IAAI,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,EAAA;;wBAAhD,IAAI,GAAG,SAAyC;wBACtD,IAAI,CAAC,IAAI,EAAE;4BACT,MAAM,IAAI,KAAK,CAAC,gCAAyB,MAAM,CAAE,CAAC,CAAC;yBACpD;wBAED,4FAA4F;wBAC5F,4FAA4F;wBAC5F,iFAAiF;wBACjF,IAAI,IAAI,CAAC,kBAAkB,KAAK,IAAI,EAAE;4BACpC,MAAM,IAAI,KAAK,CACb,WAAI,IAAI,CAAC,KAAK,gFAA6E;gCACzF,6FAA6F,CAChG,CAAC;yBACH;wBAEK,KAAK,GAAG,MAAA,IAAI,CAAC,KAAK,mCAAI,EAAE,CAAC;wBAC/B,IAAI,MAAM,KAAK,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE;4BACrE,mFAAmF;4BACnF,sBAAO;yBACR;wBAEK,QAAQ,GAAG,MAAM,KAAK,OAAO,CAAC,CAAC,iCAAK,KAAK,UAAE,IAAI,UAAE,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,UAAC,QAAQ,IAAK,OAAA,QAAQ,KAAK,IAAI,EAAjB,CAAiB,CAAC,CAAC;wBACjG,KAAK,GAAG,IAAI,eAAQ,EAAE,CAAC,OAAO,EAAE,CAAC;wBACvC,qBAAM,EAAE,CAAC,cAAc,CAAC;;;gDACtB,qBAAM,EAAE,CAAC,MAAM,CAAC,aAAM,CAAC,IAAI,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,EAAA;;4CAA7D,SAA6D,CAAC;4CAC9D,qBAAM,EAAE,CAAC,MAAM,CAAC,aAAM,CAAC,cAAc,EAAE;oDACrC,KAAK,EAAE,KAAK,CAAC,EAAE;oDACf,MAAM,EAAE,MAAM;oDACd,IAAI,MAAA;oDACJ,MAAM,QAAA;iDACP,CAAC,EAAA;;4CALF,SAKE,CAAC;;;;iCACJ,CAAC,EAAA;;wBARF,SAQE,CAAC;wBACH,MAAM,CAAC,IAAI,CAAC;4BACV,OAAO,EAAE,eAAQ,MAAM,KAAK,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAE;4BAC7D,GAAG,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,MAAA,EAAE;yBAC/C,CAAC,CAAC;;;;;KACJ;IACH,YAAC;AAAD,CAAC,AAnFD,IAmFC;AAnFY,sBAAK"}

package/dist/test/DevLogin.test.js

@@ -215,6 +215,47 @@ describe('devLogin route', function () {
             }
         });
     }); });
+    it('rejects a malformed same-domain ?email with 400 — no session, no stray account', function () { return __awaiter(void 0, void 0, void 0, function () {
+        var malformed, outcome, _a;
+        return __generator(this, function (_b) {
+            switch (_b.label) {
+                case 0:
+                    malformed = 'brent shareproof-a@test.local';
+                    return [4 /*yield*/, invokeDevLogin({ email: malformed })];
+                case 1:
+                    outcome = _b.sent();
+                    expect(outcome.status).toBe(400);
+                    expect(String(outcome.body)).toMatch(/not a valid email/i);
+                    expect(String(outcome.body)).toMatch(/%2B/); // the remedy: percent-encode the `+`
+                    expect(outcome.loggedInAs).toBeUndefined();
+                    expect(outcome.sessionSaved).toBe(false);
+                    expect(outcome.redirect).toBeUndefined();
+                    _a = expect;
+                    return [4 /*yield*/, getUserRow(malformed)];
+                case 2:
+                    _a.apply(void 0, [_b.sent()]).toBeUndefined();
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    it('still accepts a plus-addressed ?email once it is encoded (the fan-out convention)', function () { return __awaiter(void 0, void 0, void 0, function () {
+        var outcome, _a;
+        return __generator(this, function (_b) {
+            switch (_b.label) {
+                case 0: return [4 /*yield*/, invokeDevLogin({ email: 'agent6+lane-a@test.local' })];
+                case 1:
+                    outcome = _b.sent();
+                    expect(outcome.loggedInAs).toBe('agent6+lane-a@test.local');
+                    expect(outcome.sessionSaved).toBe(true);
+                    expect(outcome.redirect).toBe('/');
+                    _a = expect;
+                    return [4 /*yield*/, getUserRow('agent6+lane-a@test.local')];
+                case 2:
+                    _a.apply(void 0, [_b.sent()]).toBeDefined();
+                    return [2 /*return*/];
+            }
+        });
+    }); });
     it('404s when DEVELOPMENT is unset, even with a ?email', function () { return __awaiter(void 0, void 0, void 0, function () {
         var outcome, _a;
         return __generator(this, function (_b) {

package/dist/test/DevLogin.test.js.map

@@ -1 +1 @@
-{"version":3,"file":"DevLogin.test.js","sourceRoot":"","sources":["../../test/DevLogin.test.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,oCAA8C;AAC9C,wCAAyC;AACzC,uEAAsE;AACtE,mDAAkD;AAClD,mEAAiE;AACjE,yEAAwE;AAExE,IAAM,OAAO,GAAG,IAAI,qDAAyB,EAAE,CAAC;AAEhD;;;;;;;;GAQG;AAEH,IAAM,SAAS,GAAG,gBAAgB,CAAC;AAWnC,IAAM,cAAc,GAAG,UAAO,KAA+B;;;;;oBAI/B,qBAAM,IAAA,8CAAqB,EAAC,EAAE,KAAK,OAAA,EAAE,CAAC,EAAA;;gBAA5D,KAAsB,SAAsC,EAA1D,OAAO,aAAA,EAAE,MAAM,YAAA;gBACjB,OAAO,GAAiB,EAAE,kBAAkB,EAAE,KAAK,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC;gBAC3E,QAAQ,GAAG;oBACf,MAAM,YAAC,IAAY;wBACjB,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;wBACtB,OAAO,IAAI,CAAC;oBACd,CAAC;oBACD,IAAI,YAAC,IAAc;wBACjB,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC;oBACtB,CAAC;oBACD,QAAQ,YAAC,IAAY;wBACnB,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC;oBAC1B,CAAC;iBACF,CAAC;gBACF,qBAAM,mBAAQ,CAAC,SAAS,CAAC,OAAgB,EAAE,QAAiB,CAAC,EAAA;;gBAA7D,SAA6D,CAAC;gBAC9D,OAAO,CAAC,UAAU,GAAG,MAAA,OAAO,CAAC,OAAO,CAAC,QAAQ,0CAAE,IAAI,CAAC;gBACpD,OAAO,CAAC,kBAAkB,GAAG,MAAM,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;gBAC3D,OAAO,CAAC,YAAY,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;gBAC/C,sBAAO,OAAO,EAAC;;;KAChB,CAAC;AAEF,IAAM,UAAU,GAAG,UAAO,KAAa;;gBAAK,qBAAM,IAAA,kBAAa,GAAE,CAAC,GAAG,CAAC,aAAM,CAAC,IAAI,EAAE,EAAE,KAAK,OAAA,EAAE,CAAC,EAAA;gBAAjD,sBAAA,SAAiD,EAAA;;SAAA,CAAC;AAE9F,QAAQ,CAAC,gBAAgB,EAAE;IACzB,IAAM,WAAW,GAAG;QAClB,WAAW,EAAE,OAAO,CAAC,GAAG,CAAC,WAAW;QACpC,oBAAoB,EAAE,OAAO,CAAC,GAAG,CAAC,oBAAoB;KACvD,CAAC;IAEF,SAAS,CAAC;;;wBACR,qBAAM,OAAO,CAAC,SAAS,EAAE,EAAA;;oBAAzB,SAAyB,CAAC;;;;SAC3B,CAAC,CAAC;IAEH,QAAQ,CAAC;;;wBACP,qBAAM,OAAO,CAAC,QAAQ,EAAE,EAAA;;oBAAxB,SAAwB,CAAC;;;;SAC1B,CAAC,CAAC;IAEH,UAAU,CAAC;QACT,OAAO,CAAC,GAAG,CAAC,WAAW,GAAG,MAAM,CAAC;QACjC,OAAO,CAAC,GAAG,CAAC,oBAAoB,GAAG,SAAS,CAAC;IAC/C,CAAC,CAAC,CAAC;IAEH,SAAS,CAAC;QACR,KAA2B,UAA2B,EAA3B,KAAA,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,EAA3B,cAA2B,EAA3B,IAA2B,EAAE;YAA7C,IAAA,WAAY,EAAX,GAAG,QAAA,EAAE,KAAK,QAAA;YACpB,IAAI,KAAK,KAAK,SAAS,EAAE;gBACvB,OAAO,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;aACzB;iBAAM;gBACL,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;aAC1B;SACF;IACH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oFAAoF,EAAE;;;;wBACvF,qBAAM,OAAO,CAAC,UAAU,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,EAAA;;oBAAnE,SAAmE,CAAC;oBAEpD,qBAAM,cAAc,EAAE,EAAA;;oBAAhC,OAAO,GAAG,SAAsB;oBAEtC,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;oBAC3C,MAAM,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,0CAA0C;oBACzF,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;oBACxC,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;oBACnC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,aAAa,EAAE,CAAC;;;;SACxC,CAAC,CAAC;IAEH,EAAE,CAAC,gEAAgE,EAAE;;;;wBACnE,qBAAM,OAAO,CAAC,UAAU,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC,EAAA;;oBAA3E,SAA2E,CAAC;oBAE5D,qBAAM,cAAc,CAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC,EAAA;;oBAA9D,OAAO,GAAG,SAAoD;oBAEpE,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;oBACrD,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;oBACxC,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;;;;SACpC,CAAC,CAAC;IAEH,EAAE,CAAC,6FAA6F,EAAE;;;;;oBAChG,KAAA,MAAM,CAAA;oBAAC,qBAAM,UAAU,CAAC,mBAAmB,CAAC,EAAA;;oBAA5C,kBAAO,SAAqC,EAAC,CAAC,aAAa,EAAE,CAAC;oBAE9C,qBAAM,cAAc,CAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC,EAAA;;oBAA9D,OAAO,GAAG,SAAoD;oBAEpE,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;oBACrD,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;oBACxC,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;oBAInB,qBAAM,UAAU,CAAC,mBAAmB,CAAC,EAAA;;oBAA/C,OAAO,GAAG,SAAqC;oBACrD,MAAM,CAAC,OAAO,CAAC,CAAC,WAAW,EAAE,CAAC;oBAC9B,MAAM,CAAC,OAAQ,CAAC,QAAQ,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;oBAC9D,KAAA,MAAM,CAAA;oBAAC,qBAAM,IAAI,+BAAc,EAAE,CAAC,MAAM,CAAC,OAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,EAAA;;oBAAnE,kBAAO,SAA4D,EAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;oBAChF,MAAM,CAAC,OAAQ,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;oBACnC,MAAM,CAAC,OAAQ,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,CAAC;;;;SACpC,CAAC,CAAC;IAEH,EAAE,CAAC,4FAA4F,EAAE;;;;wBAC/E,qBAAM,cAAc,CAAC,EAAE,KAAK,EAAE,uBAAuB,EAAE,CAAC,EAAA;;oBAAlE,OAAO,GAAG,SAAwD;oBAExE,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;oBACjC,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,aAAa,EAAE,CAAC;oBAC3C,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;oBACzC,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,aAAa,EAAE,CAAC;oBACzC,KAAA,MAAM,CAAA;oBAAC,qBAAM,UAAU,CAAC,uBAAuB,CAAC,EAAA;;oBAAhD,kBAAO,SAAyC,EAAC,CAAC,aAAa,EAAE,CAAC;;;;SACnE,CAAC,CAAC;IAEH,EAAE,CAAC,oDAAoD,EAAE;;;;;oBACvD,OAAO,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC;oBAEf,qBAAM,cAAc,CAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC,EAAA;;oBAA9D,OAAO,GAAG,SAAoD;oBAEpE,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;oBACjC,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,aAAa,EAAE,CAAC;oBAC3C,KAAA,MAAM,CAAA;oBAAC,qBAAM,UAAU,CAAC,mBAAmB,CAAC,EAAA;;oBAA5C,kBAAO,SAAqC,EAAC,CAAC,aAAa,EAAE,CAAC;;;;SAC/D,CAAC,CAAC;IAEH,EAAE,CAAC,6DAA6D,EAAE;;;;;oBAChE,OAAO,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC;oBAExB,qBAAM,cAAc,CAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC,EAAA;;oBAA9D,OAAO,GAAG,SAAoD;oBAEpE,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;oBACjC,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,aAAa,EAAE,CAAC;oBAC3C,KAAA,MAAM,CAAA;oBAAC,qBAAM,UAAU,CAAC,mBAAmB,CAAC,EAAA;;oBAA5C,kBAAO,SAAqC,EAAC,CAAC,aAAa,EAAE,CAAC;;;;SAC/D,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}
+{"version":3,"file":"DevLogin.test.js","sourceRoot":"","sources":["../../test/DevLogin.test.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,oCAA8C;AAC9C,wCAAyC;AACzC,uEAAsE;AACtE,mDAAkD;AAClD,mEAAiE;AACjE,yEAAwE;AAExE,IAAM,OAAO,GAAG,IAAI,qDAAyB,EAAE,CAAC;AAEhD;;;;;;;;GAQG;AAEH,IAAM,SAAS,GAAG,gBAAgB,CAAC;AAWnC,IAAM,cAAc,GAAG,UAAO,KAA+B;;;;;oBAI/B,qBAAM,IAAA,8CAAqB,EAAC,EAAE,KAAK,OAAA,EAAE,CAAC,EAAA;;gBAA5D,KAAsB,SAAsC,EAA1D,OAAO,aAAA,EAAE,MAAM,YAAA;gBACjB,OAAO,GAAiB,EAAE,kBAAkB,EAAE,KAAK,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC;gBAC3E,QAAQ,GAAG;oBACf,MAAM,YAAC,IAAY;wBACjB,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;wBACtB,OAAO,IAAI,CAAC;oBACd,CAAC;oBACD,IAAI,YAAC,IAAc;wBACjB,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC;oBACtB,CAAC;oBACD,QAAQ,YAAC,IAAY;wBACnB,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC;oBAC1B,CAAC;iBACF,CAAC;gBACF,qBAAM,mBAAQ,CAAC,SAAS,CAAC,OAAgB,EAAE,QAAiB,CAAC,EAAA;;gBAA7D,SAA6D,CAAC;gBAC9D,OAAO,CAAC,UAAU,GAAG,MAAA,OAAO,CAAC,OAAO,CAAC,QAAQ,0CAAE,IAAI,CAAC;gBACpD,OAAO,CAAC,kBAAkB,GAAG,MAAM,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;gBAC3D,OAAO,CAAC,YAAY,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;gBAC/C,sBAAO,OAAO,EAAC;;;KAChB,CAAC;AAEF,IAAM,UAAU,GAAG,UAAO,KAAa;;gBAAK,qBAAM,IAAA,kBAAa,GAAE,CAAC,GAAG,CAAC,aAAM,CAAC,IAAI,EAAE,EAAE,KAAK,OAAA,EAAE,CAAC,EAAA;gBAAjD,sBAAA,SAAiD,EAAA;;SAAA,CAAC;AAE9F,QAAQ,CAAC,gBAAgB,EAAE;IACzB,IAAM,WAAW,GAAG;QAClB,WAAW,EAAE,OAAO,CAAC,GAAG,CAAC,WAAW;QACpC,oBAAoB,EAAE,OAAO,CAAC,GAAG,CAAC,oBAAoB;KACvD,CAAC;IAEF,SAAS,CAAC;;;wBACR,qBAAM,OAAO,CAAC,SAAS,EAAE,EAAA;;oBAAzB,SAAyB,CAAC;;;;SAC3B,CAAC,CAAC;IAEH,QAAQ,CAAC;;;wBACP,qBAAM,OAAO,CAAC,QAAQ,EAAE,EAAA;;oBAAxB,SAAwB,CAAC;;;;SAC1B,CAAC,CAAC;IAEH,UAAU,CAAC;QACT,OAAO,CAAC,GAAG,CAAC,WAAW,GAAG,MAAM,CAAC;QACjC,OAAO,CAAC,GAAG,CAAC,oBAAoB,GAAG,SAAS,CAAC;IAC/C,CAAC,CAAC,CAAC;IAEH,SAAS,CAAC;QACR,KAA2B,UAA2B,EAA3B,KAAA,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,EAA3B,cAA2B,EAA3B,IAA2B,EAAE;YAA7C,IAAA,WAAY,EAAX,GAAG,QAAA,EAAE,KAAK,QAAA;YACpB,IAAI,KAAK,KAAK,SAAS,EAAE;gBACvB,OAAO,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;aACzB;iBAAM;gBACL,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;aAC1B;SACF;IACH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oFAAoF,EAAE;;;;wBACvF,qBAAM,OAAO,CAAC,UAAU,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,EAAA;;oBAAnE,SAAmE,CAAC;oBAEpD,qBAAM,cAAc,EAAE,EAAA;;oBAAhC,OAAO,GAAG,SAAsB;oBAEtC,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;oBAC3C,MAAM,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,0CAA0C;oBACzF,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;oBACxC,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;oBACnC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,aAAa,EAAE,CAAC;;;;SACxC,CAAC,CAAC;IAEH,EAAE,CAAC,gEAAgE,EAAE;;;;wBACnE,qBAAM,OAAO,CAAC,UAAU,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC,EAAA;;oBAA3E,SAA2E,CAAC;oBAE5D,qBAAM,cAAc,CAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC,EAAA;;oBAA9D,OAAO,GAAG,SAAoD;oBAEpE,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;oBACrD,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;oBACxC,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;;;;SACpC,CAAC,CAAC;IAEH,EAAE,CAAC,6FAA6F,EAAE;;;;;oBAChG,KAAA,MAAM,CAAA;oBAAC,qBAAM,UAAU,CAAC,mBAAmB,CAAC,EAAA;;oBAA5C,kBAAO,SAAqC,EAAC,CAAC,aAAa,EAAE,CAAC;oBAE9C,qBAAM,cAAc,CAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC,EAAA;;oBAA9D,OAAO,GAAG,SAAoD;oBAEpE,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;oBACrD,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;oBACxC,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;oBAInB,qBAAM,UAAU,CAAC,mBAAmB,CAAC,EAAA;;oBAA/C,OAAO,GAAG,SAAqC;oBACrD,MAAM,CAAC,OAAO,CAAC,CAAC,WAAW,EAAE,CAAC;oBAC9B,MAAM,CAAC,OAAQ,CAAC,QAAQ,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;oBAC9D,KAAA,MAAM,CAAA;oBAAC,qBAAM,IAAI,+BAAc,EAAE,CAAC,MAAM,CAAC,OAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,EAAA;;oBAAnE,kBAAO,SAA4D,EAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;oBAChF,MAAM,CAAC,OAAQ,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;oBACnC,MAAM,CAAC,OAAQ,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,CAAC;;;;SACpC,CAAC,CAAC;IAEH,EAAE,CAAC,4FAA4F,EAAE;;;;wBAC/E,qBAAM,cAAc,CAAC,EAAE,KAAK,EAAE,uBAAuB,EAAE,CAAC,EAAA;;oBAAlE,OAAO,GAAG,SAAwD;oBAExE,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;oBACjC,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,aAAa,EAAE,CAAC;oBAC3C,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;oBACzC,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,aAAa,EAAE,CAAC;oBACzC,KAAA,MAAM,CAAA;oBAAC,qBAAM,UAAU,CAAC,uBAAuB,CAAC,EAAA;;oBAAhD,kBAAO,SAAyC,EAAC,CAAC,aAAa,EAAE,CAAC;;;;SACnE,CAAC,CAAC;IAEH,EAAE,CAAC,gFAAgF,EAAE;;;;;oBAI7E,SAAS,GAAG,+BAA+B,CAAC;oBAElC,qBAAM,cAAc,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,EAAA;;oBAApD,OAAO,GAAG,SAA0C;oBAE1D,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;oBACjC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,oBAAoB,CAAC,CAAC;oBAC3D,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,qCAAqC;oBAClF,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,aAAa,EAAE,CAAC;oBAC3C,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;oBACzC,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,aAAa,EAAE,CAAC;oBACzC,KAAA,MAAM,CAAA;oBAAC,qBAAM,UAAU,CAAC,SAAS,CAAC,EAAA;;oBAAlC,kBAAO,SAA2B,EAAC,CAAC,aAAa,EAAE,CAAC;;;;SACrD,CAAC,CAAC;IAEH,EAAE,CAAC,mFAAmF,EAAE;;;;wBACtE,qBAAM,cAAc,CAAC,EAAE,KAAK,EAAE,0BAA0B,EAAE,CAAC,EAAA;;oBAArE,OAAO,GAAG,SAA2D;oBAE3E,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC;oBAC5D,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;oBACxC,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;oBACnC,KAAA,MAAM,CAAA;oBAAC,qBAAM,UAAU,CAAC,0BAA0B,CAAC,EAAA;;oBAAnD,kBAAO,SAA4C,EAAC,CAAC,WAAW,EAAE,CAAC;;;;SACpE,CAAC,CAAC;IAEH,EAAE,CAAC,oDAAoD,EAAE;;;;;oBACvD,OAAO,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC;oBAEf,qBAAM,cAAc,CAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC,EAAA;;oBAA9D,OAAO,GAAG,SAAoD;oBAEpE,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;oBACjC,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,aAAa,EAAE,CAAC;oBAC3C,KAAA,MAAM,CAAA;oBAAC,qBAAM,UAAU,CAAC,mBAAmB,CAAC,EAAA;;oBAA5C,kBAAO,SAAqC,EAAC,CAAC,aAAa,EAAE,CAAC;;;;SAC/D,CAAC,CAAC;IAEH,EAAE,CAAC,6DAA6D,EAAE;;;;;oBAChE,OAAO,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC;oBAExB,qBAAM,cAAc,CAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC,EAAA;;oBAA9D,OAAO,GAAG,SAAoD;oBAEpE,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;oBACjC,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,aAAa,EAAE,CAAC;oBAC3C,KAAA,MAAM,CAAA;oBAAC,qBAAM,UAAU,CAAC,mBAAmB,CAAC,EAAA;;oBAA5C,kBAAO,SAAqC,EAAC,CAAC,aAAa,EAAE,CAAC;;;;SAC/D,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}