@proteinjs/user-server 1.16.0 → 1.17.0

package/test/MachineAccounts.integration.test.ts

@@ -203,53 +203,47 @@ describe('Machine accounts as source records', () => {
     expect(await authenticate('machine-ops@test.local', 'bridge-pw')).toBe(true);
   });
 
-  // KNOWN CROSS-TRAIN GAP, RESTORED at the v1.20 early landing (it.failing — flips RED the
-  // moment it starts passing, forcing the marker's removal): this leg needs db's soft-removal
-  // re-adoption (integration/r5-db ba9f4ba7 — the sync currently INSERTs the existing
-  // machine-test-ops row instead of adopting it), which is NOT in the published db line
-  // (verified absent from db main at 1.38.0). The r5-user composition retired main's original
-  // marker BY DESIGN for the composed R5 world (dab44a0); landing the user leg ahead of the
-  // R5 db mint re-opens the gap, so the marker returns until that mint lands and self-flips it.
-  it.failing(
-    're-declared under a renamed email: the soft-removed row is adopted by its stable id — reactivated, re-derived from the declaration, credential preserved',
-    async () => {
-      // The user table SOFT-removes (deactivate, never delete — rows carry grants/history), so a
-      // re-declaration whose email no longer matches the kept row (an account rename, or any
-      // re-declare-after-removal under a changed natural key) must adopt the row by its stable
-      // declared id instead of INSERTing into a PK collision.
-      await boot([new TestOpsMachineAccount()]);
-      // Runtime-owned credential on the row, plus role drift the re-derivation must NOT resurrect.
-      await getDbAsSystem().update(tables.User, {
-        id: 'machine-test-ops',
-        password: sha256('cred').toString(),
-        roles: ['ops', 'stale-role'],
-      });
-      await insertSession('machine-session', 'machine-ops@test.local');
-
-      class RenamedOps extends TestOpsMachineAccount {
-        email = 'machine-ops-renamed@test.local';
-      }
-      await boot([new RenamedOps()]);
-
-      // One row, adopted in place: id kept (references + credential survive), email re-derived,
-      // reactivated, grants exactly the declaration's (no resurrection of stale grants).
-      expect(await getDbAsSystem().query(tables.User, {})).toHaveLength(1);
-      expect(await getDbAsSystem().get(tables.User, { email: 'machine-ops@test.local' })).toBeUndefined();
-      const adopted = await getDbAsSystem().get(tables.User, { email: 'machine-ops-renamed@test.local' });
-      expect(adopted).toMatchObject({
-        id: 'machine-test-ops',
-        name: 'Test ops machine',
-        roles: ['ops'],
-        status: 'active',
-        isLoadedFromSource: true,
-      });
-      expect(adopted.password).toBe(sha256('cred').toString());
-      // The rename transited the removal patch: the categorical watcher killed the old sessions...
-      expect(await sessionEmails()).toEqual([]);
-      // ...and the surviving credential logs in under the new email.
-      expect(await authenticate('machine-ops-renamed@test.local', 'cred')).toBe(true);
+  // Marker retired at the R5 re-merge (2026-08-31, r5asm2): the composed world's db carries the
+  // soft-removal re-adoption (integration/r5-db ba9f4ba7 content), so this leg passes — the
+  // v1.20-era it.failing cross-train marker self-flipped red exactly as designed and comes off
+  // WITH the R5 db mint (TRAIN_MANIFEST_5 §6.1; land this change with the db 1.40-era mint).
+  it('re-declared under a renamed email: the soft-removed row is adopted by its stable id — reactivated, re-derived from the declaration, credential preserved', async () => {
+    // The user table SOFT-removes (deactivate, never delete — rows carry grants/history), so a
+    // re-declaration whose email no longer matches the kept row (an account rename, or any
+    // re-declare-after-removal under a changed natural key) must adopt the row by its stable
+    // declared id instead of INSERTing into a PK collision.
+    await boot([new TestOpsMachineAccount()]);
+    // Runtime-owned credential on the row, plus role drift the re-derivation must NOT resurrect.
+    await getDbAsSystem().update(tables.User, {
+      id: 'machine-test-ops',
+      password: sha256('cred').toString(),
+      roles: ['ops', 'stale-role'],
+    });
+    await insertSession('machine-session', 'machine-ops@test.local');
+
+    class RenamedOps extends TestOpsMachineAccount {
+      email = 'machine-ops-renamed@test.local';
     }
-  );
+    await boot([new RenamedOps()]);
+
+    // One row, adopted in place: id kept (references + credential survive), email re-derived,
+    // reactivated, grants exactly the declaration's (no resurrection of stale grants).
+    expect(await getDbAsSystem().query(tables.User, {})).toHaveLength(1);
+    expect(await getDbAsSystem().get(tables.User, { email: 'machine-ops@test.local' })).toBeUndefined();
+    const adopted = await getDbAsSystem().get(tables.User, { email: 'machine-ops-renamed@test.local' });
+    expect(adopted).toMatchObject({
+      id: 'machine-test-ops',
+      name: 'Test ops machine',
+      roles: ['ops'],
+      status: 'active',
+      isLoadedFromSource: true,
+    });
+    expect(adopted.password).toBe(sha256('cred').toString());
+    // The rename transited the removal patch: the categorical watcher killed the old sessions...
+    expect(await sessionEmails()).toEqual([]);
+    // ...and the surviving credential logs in under the new email.
+    expect(await authenticate('machine-ops-renamed@test.local', 'cred')).toBe(true);
+  });
 
   it(`the staff toggle rides the same watcher: SetUserStatus deactivation kills the target's sessions`, async () => {
     const admin = await testEnv.createUser({ name: 'Admin', email: 'admin@test.local', roles: ['admin'] });

package/test/Roles.integration.test.ts

@@ -214,6 +214,47 @@ describe('Roles service — grant/revoke outcomes and audit trail', () => {
     expect(events[0]).toMatchObject({ actor: 'actor-1', target: targetId, role: 'data-access', action: 'grant' });
   }, 60000);
 
+  /**
+   * Nobody edits their own roles. Self-service escalation is the whole reason the 'roles'
+   * permission is separated from 'users', and a self-REVOKE is the mirror hazard: the last
+   * holder locking themselves out of the door they were meant to keep. Both are refused before
+   * the no-change early return, so a self-target is always an error and never a silent no-op,
+   * and before the transaction, so nothing lands in the audit ledger.
+   */
+  describe('self-targeted role changes', () => {
+    const selfEvents = async () =>
+      (await auditRows()).filter((event) => event.actor === actor.id && event.target === actor.id);
+
+    it('refuses a self GRANT — the actor keeps their roles and nothing is audited', async () => {
+      await expect(new Roles().grantRole(actor.id, 'ops')).rejects.toThrow(
+        `You can't grant your own roles — ask another user manager.`
+      );
+
+      const actorRow = await getDbAsSystem().get(tables.User, { id: actor.id });
+      expect(actorRow.roles).toEqual(['admin']);
+      expect(await selfEvents()).toHaveLength(0);
+    }, 60000);
+
+    it('refuses a self REVOKE of a role the actor holds — the role stays, nothing is audited', async () => {
+      await getDbAsSystem().update(tables.User, { id: actor.id, roles: ['admin', 'ops'] });
+
+      await expect(new Roles().revokeRole(actor.id, 'ops')).rejects.toThrow(
+        `You can't revoke your own roles — ask another user manager.`
+      );
+
+      const actorRow = await getDbAsSystem().get(tables.User, { id: actor.id });
+      expect(actorRow.roles).toEqual(['admin', 'ops']);
+      expect(await selfEvents()).toHaveLength(0);
+    }, 60000);
+
+    it('refuses a self target the catalog would otherwise no-op — a self-target is never silent', async () => {
+      // The actor does NOT hold 'ops', so a revoke would have hit the no-change early return and
+      // returned quietly. The refusal comes first: the caller always learns the act was refused.
+      await expect(new Roles().revokeRole(actor.id, 'ops')).rejects.toThrow(/your own roles/);
+      expect(await selfEvents()).toHaveLength(0);
+    }, 60000);
+  });
+
   it('a roles-holder can still REVOKE an admin-grant-only role — de-escalation stays open (the break-glass precedent)', async () => {
     await new Roles().grantRole(targetId, 'data-access');
     new UserRepo().setUser({ ...actor, roles: ['roles'] });

package/test/UpdateUserInfoClearAvatarByAdmin.test.ts

@@ -0,0 +1,109 @@
+import sharp from 'sharp';
+import { getDbAsSystem } from '@proteinjs/db';
+import { File, tables as fileTables } from '@proteinjs/db-file';
+import { SourceRepository } from '@proteinjs/reflection';
+import { tables, UpdateUserInfoService, User, UserRepo, getScopedDbAsSystem } from '@proteinjs/user';
+import { UserServerTestEnvironment } from './UserServerTestEnvironment';
+import { UpdateUserInfo } from '../src/services/UpdateUserInfo';
+
+const testEnv = new UserServerTestEnvironment();
+
+const getFileRow = async (fileId: string) => await getScopedDbAsSystem<File>().get(fileTables.File, { id: fileId });
+const userRow = async (id: string) => await getDbAsSystem().get(tables.User, { id });
+
+/**
+ * Clearing SOMEONE ELSE'S avatar — the user-manager act behind the admin user surface.
+ *
+ * The service door is `allUsers` (every signed-in user manages their own profile through it), so
+ * the cross-user authorization is in-body and fail-closed: naming another person's id requires
+ * the `users` permission. Two invariants beyond the row write:
+ *  - the ACTOR's session cache is never overwritten with the target's row (the mutation path
+ *    refreshes the caller's cached user, and doing that for another person's row would leave the
+ *    admin browsing as their target);
+ *  - the target's own session cache is NOT refreshed — the write is to their row, and their next
+ *    sign-in reads it.
+ * Outcomes asserted against a real Spanner emulator: rows, files, cached identity.
+ */
+describe('UpdateUserInfo — clearing another person avatar', () => {
+  const service: UpdateUserInfoService = new UpdateUserInfo();
+  let admin: User;
+  let kevin: User;
+
+  beforeAll(async () => {
+    await testEnv.beforeAll();
+    // The in-body permission check resolves the CALLER through UserAuth — the same session-backed
+    // repo the services use (the environment seeds session storage but not this registration).
+    (SourceRepository.get() as any).objectCache['@proteinjs/user-auth/AuthenticatedUserRepo'] = [new UserRepo()];
+  });
+
+  afterAll(async () => {
+    await testEnv.afterAll();
+  });
+
+  beforeEach(async () => {
+    admin = await testEnv.createUser({ name: 'Ada Admin', email: `admin-${Date.now()}@test.local`, roles: ['admin'] });
+    kevin = await testEnv.createUser({ name: 'Kevin', email: `kevin-${Date.now()}@test.local` });
+    testEnv.actAs(admin);
+  });
+
+  it("clears the target's avatar, returns the target's row, and leaves the actor's session alone", async () => {
+    await getDbAsSystem().update(tables.User, { id: kevin.id, avatarEmoji: '🦊' });
+
+    const updated = await service.clearAvatar(kevin.id);
+
+    // The TARGET's row moved.
+    const kevinRow = await userRow(kevin.id);
+    expect(kevinRow.avatarEmoji).toBeFalsy();
+    expect(kevinRow.avatarFileId).toBeFalsy();
+
+    // The returned user is the target's row, password-less.
+    expect(updated.id).toBe(kevin.id);
+    expect(updated.name).toBe('Kevin');
+    expect((updated as any).password).toBeUndefined();
+
+    // The actor is still signed in as themselves — the session cache was not handed the target.
+    expect(new UserRepo().getUser().id).toBe(admin.id);
+    expect(new UserRepo().getUser().name).toBe('Ada Admin');
+  });
+
+  it("deletes the target's stored avatar photo", async () => {
+    testEnv.actAs(kevin);
+    const png = await sharp({ create: { width: 64, height: 64, channels: 3, background: { r: 4, g: 5, b: 6 } } })
+      .png()
+      .toBuffer();
+    const withPhoto = await service.updateAvatarPhoto(png.toString('base64'), 'image/png');
+    expect(await getFileRow(withPhoto.avatarFileId!)).toBeTruthy();
+    testEnv.actAs(admin);
+
+    await service.clearAvatar(kevin.id);
+
+    expect(await getFileRow(withPhoto.avatarFileId!)).toBeFalsy();
+    expect((await userRow(kevin.id)).avatarFileId).toBeFalsy();
+  });
+
+  it("refuses an actor without the users permission, and the target's avatar is untouched", async () => {
+    const bystander = await testEnv.createUser({ name: 'Bystander', email: `bystander-${Date.now()}@test.local` });
+    await getDbAsSystem().update(tables.User, { id: kevin.id, avatarEmoji: '🦊' });
+    testEnv.actAs(bystander);
+
+    await expect(service.clearAvatar(kevin.id)).rejects.toThrow(
+      `Only a user manager can change another person's avatar.`
+    );
+
+    expect((await userRow(kevin.id)).avatarEmoji).toBe('🦊');
+  });
+
+  it('with no id it still clears the CALLER own avatar and refreshes their session (the existing contract)', async () => {
+    testEnv.actAs(kevin);
+    await service.updateAvatarEmoji('🦞');
+    expect(new UserRepo().getUser().avatarEmoji).toBe('🦞');
+
+    const updated = await service.clearAvatar();
+
+    expect(updated.id).toBe(kevin.id);
+    expect(updated.avatarEmoji).toBeFalsy();
+    expect((await userRow(kevin.id)).avatarEmoji).toBeFalsy();
+    // Self path: the session cache is refreshed in the same stroke.
+    expect(new UserRepo().getUser().avatarEmoji).toBeFalsy();
+  });
+});

package/test/UpdateUserInfoRefresh.test.ts

@@ -0,0 +1,40 @@
+import { getDbAsSystem } from '@proteinjs/db';
+import { tables, UserRepo } from '@proteinjs/user';
+import { UserServerTestEnvironment } from './UserServerTestEnvironment';
+import { UpdateUserInfo } from '../src/services/UpdateUserInfo';
+
+const testEnv = new UserServerTestEnvironment();
+
+/**
+ * `refresh()` is the read-only half of the persist-and-refresh helper: no write, just the stored
+ * row pulled back into the session cache. It exists for changes this session did not make — an
+ * avatar set on the phone, a rename from another tab, an admin clearing an avatar — which
+ * otherwise stay invisible here until the next sign-in, because the cached user is only ever
+ * rewritten by this session's OWN mutations.
+ */
+describe('UpdateUserInfo.refresh — re-reads the stored row into the session cache', () => {
+  beforeAll(async () => {
+    await testEnv.beforeAll();
+  });
+
+  afterAll(async () => {
+    await testEnv.afterAll();
+  });
+
+  it('picks up a change made outside this session, and returns the row password-less', async () => {
+    const user = await testEnv.createUser({ name: 'Two Devices', email: 'refresh@test.local' });
+    testEnv.actAs(user);
+
+    // The other device's write: the row moves, this session's cached user does not.
+    await getDbAsSystem().update(tables.User, { avatarEmoji: '🦊' }, { id: user.id });
+    expect(new UserRepo().getUser().avatarEmoji).toBeFalsy();
+
+    const updated = await new UpdateUserInfo().refresh();
+
+    expect(updated.id).toBe(user.id);
+    expect(updated.avatarEmoji).toBe('🦊');
+    expect((updated as any).password).toBeUndefined();
+    // The point of the call: the cached user carries it now, with no re-login.
+    expect(new UserRepo().getUser().avatarEmoji).toBe('🦊');
+  });
+});