@proteinjs/user-server 1.16.1 → 1.18.0

package/dist/test/UpdateUserInfoClearAvatarByAdmin.test.js

@@ -0,0 +1,224 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var __generator = (this && this.__generator) || function (thisArg, body) {
+    var _ = { label: 0, sent: function() { if (t[0] & 1) throw t[1]; return t[1]; }, trys: [], ops: [] }, f, y, t, g;
+    return g = { next: verb(0), "throw": verb(1), "return": verb(2) }, typeof Symbol === "function" && (g[Symbol.iterator] = function() { return this; }), g;
+    function verb(n) { return function (v) { return step([n, v]); }; }
+    function step(op) {
+        if (f) throw new TypeError("Generator is already executing.");
+        while (g && (g = 0, op[0] && (_ = 0)), _) try {
+            if (f = 1, y && (t = op[0] & 2 ? y["return"] : op[0] ? y["throw"] || ((t = y["return"]) && t.call(y), 0) : y.next) && !(t = t.call(y, op[1])).done) return t;
+            if (y = 0, t) op = [op[0] & 2, t.value];
+            switch (op[0]) {
+                case 0: case 1: t = op; break;
+                case 4: _.label++; return { value: op[1], done: false };
+                case 5: _.label++; y = op[1]; op = [0]; continue;
+                case 7: op = _.ops.pop(); _.trys.pop(); continue;
+                default:
+                    if (!(t = _.trys, t = t.length > 0 && t[t.length - 1]) && (op[0] === 6 || op[0] === 2)) { _ = 0; continue; }
+                    if (op[0] === 3 && (!t || (op[1] > t[0] && op[1] < t[3]))) { _.label = op[1]; break; }
+                    if (op[0] === 6 && _.label < t[1]) { _.label = t[1]; t = op; break; }
+                    if (t && _.label < t[2]) { _.label = t[2]; _.ops.push(op); break; }
+                    if (t[2]) _.ops.pop();
+                    _.trys.pop(); continue;
+            }
+            op = body.call(thisArg, _);
+        } catch (e) { op = [6, e]; y = 0; } finally { f = t = 0; }
+        if (op[0] & 5) throw op[1]; return { value: op[0] ? op[1] : void 0, done: true };
+    }
+};
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+var sharp_1 = __importDefault(require("sharp"));
+var db_1 = require("@proteinjs/db");
+var db_file_1 = require("@proteinjs/db-file");
+var reflection_1 = require("@proteinjs/reflection");
+var user_1 = require("@proteinjs/user");
+var UserServerTestEnvironment_1 = require("./UserServerTestEnvironment");
+var UpdateUserInfo_1 = require("../src/services/UpdateUserInfo");
+var testEnv = new UserServerTestEnvironment_1.UserServerTestEnvironment();
+var getFileRow = function (fileId) { return __awaiter(void 0, void 0, void 0, function () { return __generator(this, function (_a) {
+    switch (_a.label) {
+        case 0: return [4 /*yield*/, (0, user_1.getScopedDbAsSystem)().get(db_file_1.tables.File, { id: fileId })];
+        case 1: return [2 /*return*/, _a.sent()];
+    }
+}); }); };
+var userRow = function (id) { return __awaiter(void 0, void 0, void 0, function () { return __generator(this, function (_a) {
+    switch (_a.label) {
+        case 0: return [4 /*yield*/, (0, db_1.getDbAsSystem)().get(user_1.tables.User, { id: id })];
+        case 1: return [2 /*return*/, _a.sent()];
+    }
+}); }); };
+/**
+ * Clearing SOMEONE ELSE'S avatar — the user-manager act behind the admin user surface.
+ *
+ * The service door is `allUsers` (every signed-in user manages their own profile through it), so
+ * the cross-user authorization is in-body and fail-closed: naming another person's id requires
+ * the `users` permission. Two invariants beyond the row write:
+ *  - the ACTOR's session cache is never overwritten with the target's row (the mutation path
+ *    refreshes the caller's cached user, and doing that for another person's row would leave the
+ *    admin browsing as their target);
+ *  - the target's own session cache is NOT refreshed — the write is to their row, and their next
+ *    sign-in reads it.
+ * Outcomes asserted against a real Spanner emulator: rows, files, cached identity.
+ */
+describe('UpdateUserInfo — clearing another person avatar', function () {
+    var service = new UpdateUserInfo_1.UpdateUserInfo();
+    var admin;
+    var kevin;
+    beforeAll(function () { return __awaiter(void 0, void 0, void 0, function () {
+        return __generator(this, function (_a) {
+            switch (_a.label) {
+                case 0: return [4 /*yield*/, testEnv.beforeAll()];
+                case 1:
+                    _a.sent();
+                    // The in-body permission check resolves the CALLER through UserAuth — the same session-backed
+                    // repo the services use (the environment seeds session storage but not this registration).
+                    reflection_1.SourceRepository.get().objectCache['@proteinjs/user-auth/AuthenticatedUserRepo'] = [new user_1.UserRepo()];
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    afterAll(function () { return __awaiter(void 0, void 0, void 0, function () {
+        return __generator(this, function (_a) {
+            switch (_a.label) {
+                case 0: return [4 /*yield*/, testEnv.afterAll()];
+                case 1:
+                    _a.sent();
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    beforeEach(function () { return __awaiter(void 0, void 0, void 0, function () {
+        return __generator(this, function (_a) {
+            switch (_a.label) {
+                case 0: return [4 /*yield*/, testEnv.createUser({ name: 'Ada Admin', email: "admin-".concat(Date.now(), "@test.local"), roles: ['admin'] })];
+                case 1:
+                    admin = _a.sent();
+                    return [4 /*yield*/, testEnv.createUser({ name: 'Kevin', email: "kevin-".concat(Date.now(), "@test.local") })];
+                case 2:
+                    kevin = _a.sent();
+                    testEnv.actAs(admin);
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    it("clears the target's avatar, returns the target's row, and leaves the actor's session alone", function () { return __awaiter(void 0, void 0, void 0, function () {
+        var updated, kevinRow;
+        return __generator(this, function (_a) {
+            switch (_a.label) {
+                case 0: return [4 /*yield*/, (0, db_1.getDbAsSystem)().update(user_1.tables.User, { id: kevin.id, avatarEmoji: '🦊' })];
+                case 1:
+                    _a.sent();
+                    return [4 /*yield*/, service.clearAvatar(kevin.id)];
+                case 2:
+                    updated = _a.sent();
+                    return [4 /*yield*/, userRow(kevin.id)];
+                case 3:
+                    kevinRow = _a.sent();
+                    expect(kevinRow.avatarEmoji).toBeFalsy();
+                    expect(kevinRow.avatarFileId).toBeFalsy();
+                    // The returned user is the target's row, password-less.
+                    expect(updated.id).toBe(kevin.id);
+                    expect(updated.name).toBe('Kevin');
+                    expect(updated.password).toBeUndefined();
+                    // The actor is still signed in as themselves — the session cache was not handed the target.
+                    expect(new user_1.UserRepo().getUser().id).toBe(admin.id);
+                    expect(new user_1.UserRepo().getUser().name).toBe('Ada Admin');
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    it("deletes the target's stored avatar photo", function () { return __awaiter(void 0, void 0, void 0, function () {
+        var png, withPhoto, _a, _b, _c;
+        return __generator(this, function (_d) {
+            switch (_d.label) {
+                case 0:
+                    testEnv.actAs(kevin);
+                    return [4 /*yield*/, (0, sharp_1.default)({ create: { width: 64, height: 64, channels: 3, background: { r: 4, g: 5, b: 6 } } })
+                            .png()
+                            .toBuffer()];
+                case 1:
+                    png = _d.sent();
+                    return [4 /*yield*/, service.updateAvatarPhoto(png.toString('base64'), 'image/png')];
+                case 2:
+                    withPhoto = _d.sent();
+                    _a = expect;
+                    return [4 /*yield*/, getFileRow(withPhoto.avatarFileId)];
+                case 3:
+                    _a.apply(void 0, [_d.sent()]).toBeTruthy();
+                    testEnv.actAs(admin);
+                    return [4 /*yield*/, service.clearAvatar(kevin.id)];
+                case 4:
+                    _d.sent();
+                    _b = expect;
+                    return [4 /*yield*/, getFileRow(withPhoto.avatarFileId)];
+                case 5:
+                    _b.apply(void 0, [_d.sent()]).toBeFalsy();
+                    _c = expect;
+                    return [4 /*yield*/, userRow(kevin.id)];
+                case 6:
+                    _c.apply(void 0, [(_d.sent()).avatarFileId]).toBeFalsy();
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    it("refuses an actor without the users permission, and the target's avatar is untouched", function () { return __awaiter(void 0, void 0, void 0, function () {
+        var bystander, _a;
+        return __generator(this, function (_b) {
+            switch (_b.label) {
+                case 0: return [4 /*yield*/, testEnv.createUser({ name: 'Bystander', email: "bystander-".concat(Date.now(), "@test.local") })];
+                case 1:
+                    bystander = _b.sent();
+                    return [4 /*yield*/, (0, db_1.getDbAsSystem)().update(user_1.tables.User, { id: kevin.id, avatarEmoji: '🦊' })];
+                case 2:
+                    _b.sent();
+                    testEnv.actAs(bystander);
+                    return [4 /*yield*/, expect(service.clearAvatar(kevin.id)).rejects.toThrow("Only a user manager can change another person's avatar.")];
+                case 3:
+                    _b.sent();
+                    _a = expect;
+                    return [4 /*yield*/, userRow(kevin.id)];
+                case 4:
+                    _a.apply(void 0, [(_b.sent()).avatarEmoji]).toBe('🦊');
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    it('with no id it still clears the CALLER own avatar and refreshes their session (the existing contract)', function () { return __awaiter(void 0, void 0, void 0, function () {
+        var updated, _a;
+        return __generator(this, function (_b) {
+            switch (_b.label) {
+                case 0:
+                    testEnv.actAs(kevin);
+                    return [4 /*yield*/, service.updateAvatarEmoji('🦞')];
+                case 1:
+                    _b.sent();
+                    expect(new user_1.UserRepo().getUser().avatarEmoji).toBe('🦞');
+                    return [4 /*yield*/, service.clearAvatar()];
+                case 2:
+                    updated = _b.sent();
+                    expect(updated.id).toBe(kevin.id);
+                    expect(updated.avatarEmoji).toBeFalsy();
+                    _a = expect;
+                    return [4 /*yield*/, userRow(kevin.id)];
+                case 3:
+                    _a.apply(void 0, [(_b.sent()).avatarEmoji]).toBeFalsy();
+                    // Self path: the session cache is refreshed in the same stroke.
+                    expect(new user_1.UserRepo().getUser().avatarEmoji).toBeFalsy();
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+});
+//# sourceMappingURL=UpdateUserInfoClearAvatarByAdmin.test.js.map

package/dist/test/UpdateUserInfoClearAvatarByAdmin.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"UpdateUserInfoClearAvatarByAdmin.test.js","sourceRoot":"","sources":["../../test/UpdateUserInfoClearAvatarByAdmin.test.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,gDAA0B;AAC1B,oCAA8C;AAC9C,8CAAgE;AAChE,oDAAyD;AACzD,wCAAqG;AACrG,yEAAwE;AACxE,iEAAgE;AAEhE,IAAM,OAAO,GAAG,IAAI,qDAAyB,EAAE,CAAC;AAEhD,IAAM,UAAU,GAAG,UAAO,MAAc;;gBAAK,qBAAM,IAAA,0BAAmB,GAAQ,CAAC,GAAG,CAAC,gBAAU,CAAC,IAAI,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,EAAA;gBAAtE,sBAAA,SAAsE,EAAA;;SAAA,CAAC;AACpH,IAAM,OAAO,GAAG,UAAO,EAAU;;gBAAK,qBAAM,IAAA,kBAAa,GAAE,CAAC,GAAG,CAAC,aAAM,CAAC,IAAI,EAAE,EAAE,EAAE,IAAA,EAAE,CAAC,EAAA;gBAA9C,sBAAA,SAA8C,EAAA;;SAAA,CAAC;AAErF;;;;;;;;;;;;GAYG;AACH,QAAQ,CAAC,iDAAiD,EAAE;IAC1D,IAAM,OAAO,GAA0B,IAAI,+BAAc,EAAE,CAAC;IAC5D,IAAI,KAAW,CAAC;IAChB,IAAI,KAAW,CAAC;IAEhB,SAAS,CAAC;;;wBACR,qBAAM,OAAO,CAAC,SAAS,EAAE,EAAA;;oBAAzB,SAAyB,CAAC;oBAC1B,8FAA8F;oBAC9F,2FAA2F;oBAC1F,6BAAgB,CAAC,GAAG,EAAU,CAAC,WAAW,CAAC,4CAA4C,CAAC,GAAG,CAAC,IAAI,eAAQ,EAAE,CAAC,CAAC;;;;SAC9G,CAAC,CAAC;IAEH,QAAQ,CAAC;;;wBACP,qBAAM,OAAO,CAAC,QAAQ,EAAE,EAAA;;oBAAxB,SAAwB,CAAC;;;;SAC1B,CAAC,CAAC;IAEH,UAAU,CAAC;;;wBACD,qBAAM,OAAO,CAAC,UAAU,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,gBAAS,IAAI,CAAC,GAAG,EAAE,gBAAa,EAAE,KAAK,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,EAAA;;oBAAlH,KAAK,GAAG,SAA0G,CAAC;oBAC3G,qBAAM,OAAO,CAAC,UAAU,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,gBAAS,IAAI,CAAC,GAAG,EAAE,gBAAa,EAAE,CAAC,EAAA;;oBAA5F,KAAK,GAAG,SAAoF,CAAC;oBAC7F,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;;;;SACtB,CAAC,CAAC;IAEH,EAAE,CAAC,4FAA4F,EAAE;;;;wBAC/F,qBAAM,IAAA,kBAAa,GAAE,CAAC,MAAM,CAAC,aAAM,CAAC,IAAI,EAAE,EAAE,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,EAAA;;oBAA9E,SAA8E,CAAC;oBAE/D,qBAAM,OAAO,CAAC,WAAW,CAAC,KAAK,CAAC,EAAE,CAAC,EAAA;;oBAA7C,OAAO,GAAG,SAAmC;oBAGlC,qBAAM,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,EAAA;;oBAAlC,QAAQ,GAAG,SAAuB;oBACxC,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,SAAS,EAAE,CAAC;oBACzC,MAAM,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC,SAAS,EAAE,CAAC;oBAE1C,wDAAwD;oBACxD,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;oBAClC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;oBACnC,MAAM,CAAE,OAAe,CAAC,QAAQ,CAAC,CAAC,aAAa,EAAE,CAAC;oBAElD,4FAA4F;oBAC5F,MAAM,CAAC,IAAI,eAAQ,EAAE,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;oBACnD,MAAM,CAAC,IAAI,eAAQ,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;;;;SACzD,CAAC,CAAC;IAEH,EAAE,CAAC,0CAA0C,EAAE;;;;;oBAC7C,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;oBACT,qBAAM,IAAA,eAAK,EAAC,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,QAAQ,EAAE,CAAC,EAAE,UAAU,EAAE,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC;6BAC1G,GAAG,EAAE;6BACL,QAAQ,EAAE,EAAA;;oBAFP,GAAG,GAAG,SAEC;oBACK,qBAAM,OAAO,CAAC,iBAAiB,CAAC,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,WAAW,CAAC,EAAA;;oBAAhF,SAAS,GAAG,SAAoE;oBACtF,KAAA,MAAM,CAAA;oBAAC,qBAAM,UAAU,CAAC,SAAS,CAAC,YAAa,CAAC,EAAA;;oBAAhD,kBAAO,SAAyC,EAAC,CAAC,UAAU,EAAE,CAAC;oBAC/D,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;oBAErB,qBAAM,OAAO,CAAC,WAAW,CAAC,KAAK,CAAC,EAAE,CAAC,EAAA;;oBAAnC,SAAmC,CAAC;oBAEpC,KAAA,MAAM,CAAA;oBAAC,qBAAM,UAAU,CAAC,SAAS,CAAC,YAAa,CAAC,EAAA;;oBAAhD,kBAAO,SAAyC,EAAC,CAAC,SAAS,EAAE,CAAC;oBAC9D,KAAA,MAAM,CAAA;oBAAE,qBAAM,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,EAAA;;oBAA/B,kBAAO,CAAC,SAAuB,CAAC,CAAC,YAAY,EAAC,CAAC,SAAS,EAAE,CAAC;;;;SAC5D,CAAC,CAAC;IAEH,EAAE,CAAC,qFAAqF,EAAE;;;;wBACtE,qBAAM,OAAO,CAAC,UAAU,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,oBAAa,IAAI,CAAC,GAAG,EAAE,gBAAa,EAAE,CAAC,EAAA;;oBAAxG,SAAS,GAAG,SAA4F;oBAC9G,qBAAM,IAAA,kBAAa,GAAE,CAAC,MAAM,CAAC,aAAM,CAAC,IAAI,EAAE,EAAE,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,EAAA;;oBAA9E,SAA8E,CAAC;oBAC/E,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;oBAEzB,qBAAM,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CACzD,yDAAyD,CAC1D,EAAA;;oBAFD,SAEC,CAAC;oBAEF,KAAA,MAAM,CAAA;oBAAE,qBAAM,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,EAAA;;oBAA/B,kBAAO,CAAC,SAAuB,CAAC,CAAC,WAAW,EAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;;;;SAC1D,CAAC,CAAC;IAEH,EAAE,CAAC,sGAAsG,EAAE;;;;;oBACzG,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;oBACrB,qBAAM,OAAO,CAAC,iBAAiB,CAAC,IAAI,CAAC,EAAA;;oBAArC,SAAqC,CAAC;oBACtC,MAAM,CAAC,IAAI,eAAQ,EAAE,CAAC,OAAO,EAAE,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;oBAExC,qBAAM,OAAO,CAAC,WAAW,EAAE,EAAA;;oBAArC,OAAO,GAAG,SAA2B;oBAE3C,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;oBAClC,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,SAAS,EAAE,CAAC;oBACxC,KAAA,MAAM,CAAA;oBAAE,qBAAM,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,EAAA;;oBAA/B,kBAAO,CAAC,SAAuB,CAAC,CAAC,WAAW,EAAC,CAAC,SAAS,EAAE,CAAC;oBAC1D,gEAAgE;oBAChE,MAAM,CAAC,IAAI,eAAQ,EAAE,CAAC,OAAO,EAAE,CAAC,WAAW,CAAC,CAAC,SAAS,EAAE,CAAC;;;;SAC1D,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/test/UpdateUserInfoRefresh.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=UpdateUserInfoRefresh.test.d.ts.map

package/dist/test/UpdateUserInfoRefresh.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"UpdateUserInfoRefresh.test.d.ts","sourceRoot":"","sources":["../../test/UpdateUserInfoRefresh.test.ts"],"names":[],"mappings":""}

package/dist/test/UpdateUserInfoRefresh.test.js

@@ -0,0 +1,99 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var __generator = (this && this.__generator) || function (thisArg, body) {
+    var _ = { label: 0, sent: function() { if (t[0] & 1) throw t[1]; return t[1]; }, trys: [], ops: [] }, f, y, t, g;
+    return g = { next: verb(0), "throw": verb(1), "return": verb(2) }, typeof Symbol === "function" && (g[Symbol.iterator] = function() { return this; }), g;
+    function verb(n) { return function (v) { return step([n, v]); }; }
+    function step(op) {
+        if (f) throw new TypeError("Generator is already executing.");
+        while (g && (g = 0, op[0] && (_ = 0)), _) try {
+            if (f = 1, y && (t = op[0] & 2 ? y["return"] : op[0] ? y["throw"] || ((t = y["return"]) && t.call(y), 0) : y.next) && !(t = t.call(y, op[1])).done) return t;
+            if (y = 0, t) op = [op[0] & 2, t.value];
+            switch (op[0]) {
+                case 0: case 1: t = op; break;
+                case 4: _.label++; return { value: op[1], done: false };
+                case 5: _.label++; y = op[1]; op = [0]; continue;
+                case 7: op = _.ops.pop(); _.trys.pop(); continue;
+                default:
+                    if (!(t = _.trys, t = t.length > 0 && t[t.length - 1]) && (op[0] === 6 || op[0] === 2)) { _ = 0; continue; }
+                    if (op[0] === 3 && (!t || (op[1] > t[0] && op[1] < t[3]))) { _.label = op[1]; break; }
+                    if (op[0] === 6 && _.label < t[1]) { _.label = t[1]; t = op; break; }
+                    if (t && _.label < t[2]) { _.label = t[2]; _.ops.push(op); break; }
+                    if (t[2]) _.ops.pop();
+                    _.trys.pop(); continue;
+            }
+            op = body.call(thisArg, _);
+        } catch (e) { op = [6, e]; y = 0; } finally { f = t = 0; }
+        if (op[0] & 5) throw op[1]; return { value: op[0] ? op[1] : void 0, done: true };
+    }
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+var db_1 = require("@proteinjs/db");
+var user_1 = require("@proteinjs/user");
+var UserServerTestEnvironment_1 = require("./UserServerTestEnvironment");
+var UpdateUserInfo_1 = require("../src/services/UpdateUserInfo");
+var testEnv = new UserServerTestEnvironment_1.UserServerTestEnvironment();
+/**
+ * `refresh()` is the read-only half of the persist-and-refresh helper: no write, just the stored
+ * row pulled back into the session cache. It exists for changes this session did not make — an
+ * avatar set on the phone, a rename from another tab, an admin clearing an avatar — which
+ * otherwise stay invisible here until the next sign-in, because the cached user is only ever
+ * rewritten by this session's OWN mutations.
+ */
+describe('UpdateUserInfo.refresh — re-reads the stored row into the session cache', function () {
+    beforeAll(function () { return __awaiter(void 0, void 0, void 0, function () {
+        return __generator(this, function (_a) {
+            switch (_a.label) {
+                case 0: return [4 /*yield*/, testEnv.beforeAll()];
+                case 1:
+                    _a.sent();
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    afterAll(function () { return __awaiter(void 0, void 0, void 0, function () {
+        return __generator(this, function (_a) {
+            switch (_a.label) {
+                case 0: return [4 /*yield*/, testEnv.afterAll()];
+                case 1:
+                    _a.sent();
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    it('picks up a change made outside this session, and returns the row password-less', function () { return __awaiter(void 0, void 0, void 0, function () {
+        var user, updated;
+        return __generator(this, function (_a) {
+            switch (_a.label) {
+                case 0: return [4 /*yield*/, testEnv.createUser({ name: 'Two Devices', email: 'refresh@test.local' })];
+                case 1:
+                    user = _a.sent();
+                    testEnv.actAs(user);
+                    // The other device's write: the row moves, this session's cached user does not.
+                    return [4 /*yield*/, (0, db_1.getDbAsSystem)().update(user_1.tables.User, { avatarEmoji: '🦊' }, { id: user.id })];
+                case 2:
+                    // The other device's write: the row moves, this session's cached user does not.
+                    _a.sent();
+                    expect(new user_1.UserRepo().getUser().avatarEmoji).toBeFalsy();
+                    return [4 /*yield*/, new UpdateUserInfo_1.UpdateUserInfo().refresh()];
+                case 3:
+                    updated = _a.sent();
+                    expect(updated.id).toBe(user.id);
+                    expect(updated.avatarEmoji).toBe('🦊');
+                    expect(updated.password).toBeUndefined();
+                    // The point of the call: the cached user carries it now, with no re-login.
+                    expect(new user_1.UserRepo().getUser().avatarEmoji).toBe('🦊');
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+});
+//# sourceMappingURL=UpdateUserInfoRefresh.test.js.map

package/dist/test/UpdateUserInfoRefresh.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"UpdateUserInfoRefresh.test.js","sourceRoot":"","sources":["../../test/UpdateUserInfoRefresh.test.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,oCAA8C;AAC9C,wCAAmD;AACnD,yEAAwE;AACxE,iEAAgE;AAEhE,IAAM,OAAO,GAAG,IAAI,qDAAyB,EAAE,CAAC;AAEhD;;;;;;GAMG;AACH,QAAQ,CAAC,yEAAyE,EAAE;IAClF,SAAS,CAAC;;;wBACR,qBAAM,OAAO,CAAC,SAAS,EAAE,EAAA;;oBAAzB,SAAyB,CAAC;;;;SAC3B,CAAC,CAAC;IAEH,QAAQ,CAAC;;;wBACP,qBAAM,OAAO,CAAC,QAAQ,EAAE,EAAA;;oBAAxB,SAAwB,CAAC;;;;SAC1B,CAAC,CAAC;IAEH,EAAE,CAAC,gFAAgF,EAAE;;;;wBACtE,qBAAM,OAAO,CAAC,UAAU,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC,EAAA;;oBAArF,IAAI,GAAG,SAA8E;oBAC3F,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;oBAEpB,gFAAgF;oBAChF,qBAAM,IAAA,kBAAa,GAAE,CAAC,MAAM,CAAC,aAAM,CAAC,IAAI,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,EAAA;;oBADjF,gFAAgF;oBAChF,SAAiF,CAAC;oBAClF,MAAM,CAAC,IAAI,eAAQ,EAAE,CAAC,OAAO,EAAE,CAAC,WAAW,CAAC,CAAC,SAAS,EAAE,CAAC;oBAEzC,qBAAM,IAAI,+BAAc,EAAE,CAAC,OAAO,EAAE,EAAA;;oBAA9C,OAAO,GAAG,SAAoC;oBAEpD,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;oBACjC,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;oBACvC,MAAM,CAAE,OAAe,CAAC,QAAQ,CAAC,CAAC,aAAa,EAAE,CAAC;oBAClD,2EAA2E;oBAC3E,MAAM,CAAC,IAAI,eAAQ,EAAE,CAAC,OAAO,EAAE,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;;;;SACzD,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/test/devLoginHarness.d.ts

@@ -0,0 +1,16 @@
+/** What one `GET /dev/login` did, seen from outside: the session it minted (or not) and the response it sent. */
+export type DevLoginOutcome = {
+    loggedInAs?: string;
+    sessionRegenerated: boolean;
+    sessionSaved: boolean;
+    status?: number;
+    body?: unknown;
+    redirect?: string;
+};
+/**
+ * Drives the devLogin route once over the REAL passport login machinery (see
+ * passportSessionHarness): the full session-establishment contract (regenerate → login → save)
+ * is pinned by SignupRoute.test.ts — the dev-door suites assert the door INHERITS it.
+ */
+export declare const invokeDevLogin: (query?: Record<string, unknown>) => Promise<DevLoginOutcome>;
+//# sourceMappingURL=devLoginHarness.d.ts.map

package/dist/test/devLoginHarness.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"devLoginHarness.d.ts","sourceRoot":"","sources":["../../test/devLoginHarness.ts"],"names":[],"mappings":"AAGA,iHAAiH;AACjH,MAAM,MAAM,eAAe,GAAG;IAC5B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,kBAAkB,EAAE,OAAO,CAAC;IAC5B,YAAY,EAAE,OAAO,CAAC;IACtB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,cAAc,WAAkB,OAAO,MAAM,EAAE,OAAO,CAAC,KAAG,QAAQ,eAAe,CAoB7F,CAAC"}

package/dist/test/devLoginHarness.js

@@ -0,0 +1,79 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var __generator = (this && this.__generator) || function (thisArg, body) {
+    var _ = { label: 0, sent: function() { if (t[0] & 1) throw t[1]; return t[1]; }, trys: [], ops: [] }, f, y, t, g;
+    return g = { next: verb(0), "throw": verb(1), "return": verb(2) }, typeof Symbol === "function" && (g[Symbol.iterator] = function() { return this; }), g;
+    function verb(n) { return function (v) { return step([n, v]); }; }
+    function step(op) {
+        if (f) throw new TypeError("Generator is already executing.");
+        while (g && (g = 0, op[0] && (_ = 0)), _) try {
+            if (f = 1, y && (t = op[0] & 2 ? y["return"] : op[0] ? y["throw"] || ((t = y["return"]) && t.call(y), 0) : y.next) && !(t = t.call(y, op[1])).done) return t;
+            if (y = 0, t) op = [op[0] & 2, t.value];
+            switch (op[0]) {
+                case 0: case 1: t = op; break;
+                case 4: _.label++; return { value: op[1], done: false };
+                case 5: _.label++; y = op[1]; op = [0]; continue;
+                case 7: op = _.ops.pop(); _.trys.pop(); continue;
+                default:
+                    if (!(t = _.trys, t = t.length > 0 && t[t.length - 1]) && (op[0] === 6 || op[0] === 2)) { _ = 0; continue; }
+                    if (op[0] === 3 && (!t || (op[1] > t[0] && op[1] < t[3]))) { _.label = op[1]; break; }
+                    if (op[0] === 6 && _.label < t[1]) { _.label = t[1]; t = op; break; }
+                    if (t && _.label < t[2]) { _.label = t[2]; _.ops.push(op); break; }
+                    if (t[2]) _.ops.pop();
+                    _.trys.pop(); continue;
+            }
+            op = body.call(thisArg, _);
+        } catch (e) { op = [6, e]; y = 0; } finally { f = t = 0; }
+        if (op[0] & 5) throw op[1]; return { value: op[0] ? op[1] : void 0, done: true };
+    }
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.invokeDevLogin = void 0;
+var devLogin_1 = require("../src/routes/devLogin");
+var passportSessionHarness_1 = require("./passportSessionHarness");
+/**
+ * Drives the devLogin route once over the REAL passport login machinery (see
+ * passportSessionHarness): the full session-establishment contract (regenerate → login → save)
+ * is pinned by SignupRoute.test.ts — the dev-door suites assert the door INHERITS it.
+ */
+var invokeDevLogin = function (query) { return __awaiter(void 0, void 0, void 0, function () {
+    var _a, request, events, outcome, response;
+    var _b;
+    return __generator(this, function (_c) {
+        switch (_c.label) {
+            case 0: return [4 /*yield*/, (0, passportSessionHarness_1.createPassportRequest)({ query: query })];
+            case 1:
+                _a = _c.sent(), request = _a.request, events = _a.events;
+                outcome = { sessionRegenerated: false, sessionSaved: false };
+                response = {
+                    status: function (code) {
+                        outcome.status = code;
+                        return this;
+                    },
+                    send: function (body) {
+                        outcome.body = body;
+                    },
+                    redirect: function (path) {
+                        outcome.redirect = path;
+                    },
+                };
+                return [4 /*yield*/, devLogin_1.devLogin.onRequest(request, response)];
+            case 2:
+                _c.sent();
+                outcome.loggedInAs = (_b = request.session.passport) === null || _b === void 0 ? void 0 : _b.user;
+                outcome.sessionRegenerated = events.includes('regenerate');
+                outcome.sessionSaved = events.includes('save');
+                return [2 /*return*/, outcome];
+        }
+    });
+}); };
+exports.invokeDevLogin = invokeDevLogin;
+//# sourceMappingURL=devLoginHarness.js.map

package/dist/test/devLoginHarness.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"devLoginHarness.js","sourceRoot":"","sources":["../../test/devLoginHarness.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,mDAAkD;AAClD,mEAAiE;AAYjE;;;;GAIG;AACI,IAAM,cAAc,GAAG,UAAO,KAA+B;;;;;oBACtC,qBAAM,IAAA,8CAAqB,EAAC,EAAE,KAAK,OAAA,EAAE,CAAC,EAAA;;gBAA5D,KAAsB,SAAsC,EAA1D,OAAO,aAAA,EAAE,MAAM,YAAA;gBACjB,OAAO,GAAoB,EAAE,kBAAkB,EAAE,KAAK,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC;gBAC9E,QAAQ,GAAG;oBACf,MAAM,YAAC,IAAY;wBACjB,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;wBACtB,OAAO,IAAI,CAAC;oBACd,CAAC;oBACD,IAAI,YAAC,IAAc;wBACjB,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC;oBACtB,CAAC;oBACD,QAAQ,YAAC,IAAY;wBACnB,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC;oBAC1B,CAAC;iBACF,CAAC;gBACF,qBAAM,mBAAQ,CAAC,SAAS,CAAC,OAAgB,EAAE,QAAiB,CAAC,EAAA;;gBAA7D,SAA6D,CAAC;gBAC9D,OAAO,CAAC,UAAU,GAAG,MAAA,OAAO,CAAC,OAAO,CAAC,QAAQ,0CAAE,IAAI,CAAC;gBACpD,OAAO,CAAC,kBAAkB,GAAG,MAAM,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;gBAC3D,OAAO,CAAC,YAAY,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;gBAC/C,sBAAO,OAAO,EAAC;;;KAChB,CAAC;AApBW,QAAA,cAAc,kBAoBzB"}