@proteinjs/user-server 1.17.0 → 1.18.0

package/dist/test/DevLoginBootstrapAdmin.test.js

@@ -0,0 +1,384 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var __generator = (this && this.__generator) || function (thisArg, body) {
+    var _ = { label: 0, sent: function() { if (t[0] & 1) throw t[1]; return t[1]; }, trys: [], ops: [] }, f, y, t, g;
+    return g = { next: verb(0), "throw": verb(1), "return": verb(2) }, typeof Symbol === "function" && (g[Symbol.iterator] = function() { return this; }), g;
+    function verb(n) { return function (v) { return step([n, v]); }; }
+    function step(op) {
+        if (f) throw new TypeError("Generator is already executing.");
+        while (g && (g = 0, op[0] && (_ = 0)), _) try {
+            if (f = 1, y && (t = op[0] & 2 ? y["return"] : op[0] ? y["throw"] || ((t = y["return"]) && t.call(y), 0) : y.next) && !(t = t.call(y, op[1])).done) return t;
+            if (y = 0, t) op = [op[0] & 2, t.value];
+            switch (op[0]) {
+                case 0: case 1: t = op; break;
+                case 4: _.label++; return { value: op[1], done: false };
+                case 5: _.label++; y = op[1]; op = [0]; continue;
+                case 7: op = _.ops.pop(); _.trys.pop(); continue;
+                default:
+                    if (!(t = _.trys, t = t.length > 0 && t[t.length - 1]) && (op[0] === 6 || op[0] === 2)) { _ = 0; continue; }
+                    if (op[0] === 3 && (!t || (op[1] > t[0] && op[1] < t[3]))) { _.label = op[1]; break; }
+                    if (op[0] === 6 && _.label < t[1]) { _.label = t[1]; t = op; break; }
+                    if (t && _.label < t[2]) { _.label = t[2]; _.ops.push(op); break; }
+                    if (t[2]) _.ops.pop();
+                    _.trys.pop(); continue;
+            }
+            op = body.call(thisArg, _);
+        } catch (e) { op = [6, e]; y = 0; } finally { f = t = 0; }
+        if (op[0] & 5) throw op[1]; return { value: op[0] ? op[1] : void 0, done: true };
+    }
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+var db_1 = require("@proteinjs/db");
+var user_1 = require("@proteinjs/user");
+var devLoginHarness_1 = require("./devLoginHarness");
+var UserServerTestEnvironment_1 = require("./UserServerTestEnvironment");
+var testEnv = new UserServerTestEnvironment_1.UserServerTestEnvironment();
+/**
+ * `DEV_BOOTSTRAP_ADMIN_EMAIL` — the first-admin door INSIDE `/dev/login` (n3xa plans/DEV_ESTATES.md
+ * D3, founder-ruled 2026-09-04). A dev estate on a fresh real database has no privileged account
+ * to grant from, and the no-raw-DB rule forbids the emulator-era seed scripts there — so the ONE
+ * sanctioned account door mints break-glass, once:
+ *  - behind the door's existing two gates (DEVELOPMENT AND DEV_AUTO_LOGIN_EMAIL): closed = 404 as
+ *    before, and the variable changes nothing;
+ *  - only while NO account carries 'admin' (the same membership test the app's admin checks make);
+ *  - only for the request whose resolved address equals the variable exactly (case-normalized
+ *    the way every account email is);
+ *  - once, audited like any grant (a role_grant_event row; actor = the account itself — the door
+ *    acts for nobody else); a later call finds an admin and grants nothing.
+ * Outcomes are asserted on the rows (roles, audit), never on calls.
+ */
+var ENV_EMAIL = 'dev@test.local';
+var BOOTSTRAP_EMAIL = 'owner@test.local';
+var userRow = function (email) { return __awaiter(void 0, void 0, void 0, function () { return __generator(this, function (_a) {
+    switch (_a.label) {
+        case 0: return [4 /*yield*/, (0, db_1.getDbAsSystem)().get(user_1.tables.User, { email: email })];
+        case 1: return [2 /*return*/, _a.sent()];
+    }
+}); }); };
+var auditRows = function () { return __awaiter(void 0, void 0, void 0, function () { return __generator(this, function (_a) {
+    switch (_a.label) {
+        case 0: return [4 /*yield*/, (0, db_1.getDbAsSystem)().query(user_1.tables.RoleGrantEvent, {})];
+        case 1: return [2 /*return*/, _a.sent()];
+    }
+}); }); };
+var adminRows = function () { return __awaiter(void 0, void 0, void 0, function () { return __generator(this, function (_a) {
+    switch (_a.label) {
+        case 0: return [4 /*yield*/, (0, db_1.getDbAsSystem)().query(user_1.tables.User, {})];
+        case 1: return [2 /*return*/, (_a.sent()).filter(function (user) { var _a; return ((_a = user.roles) !== null && _a !== void 0 ? _a : []).includes('admin'); })];
+    }
+}); }); };
+describe('devLogin — the DEV_BOOTSTRAP_ADMIN_EMAIL first-admin door', function () {
+    var originalEnv = {
+        DEVELOPMENT: process.env.DEVELOPMENT,
+        DEV_AUTO_LOGIN_EMAIL: process.env.DEV_AUTO_LOGIN_EMAIL,
+        DEV_BOOTSTRAP_ADMIN_EMAIL: process.env.DEV_BOOTSTRAP_ADMIN_EMAIL,
+    };
+    beforeAll(function () { return __awaiter(void 0, void 0, void 0, function () {
+        return __generator(this, function (_a) {
+            switch (_a.label) {
+                case 0: return [4 /*yield*/, testEnv.beforeAll()];
+                case 1:
+                    _a.sent();
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    afterAll(function () { return __awaiter(void 0, void 0, void 0, function () {
+        return __generator(this, function (_a) {
+            switch (_a.label) {
+                case 0: return [4 /*yield*/, testEnv.afterAll()];
+                case 1:
+                    _a.sent();
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    beforeEach(function () { return __awaiter(void 0, void 0, void 0, function () {
+        var db;
+        return __generator(this, function (_a) {
+            switch (_a.label) {
+                case 0:
+                    process.env.DEVELOPMENT = 'true';
+                    process.env.DEV_AUTO_LOGIN_EMAIL = ENV_EMAIL;
+                    process.env.DEV_BOOTSTRAP_ADMIN_EMAIL = BOOTSTRAP_EMAIL;
+                    db = (0, db_1.getDbAsSystem)();
+                    return [4 /*yield*/, db.delete(user_1.tables.RoleGrantEvent, {})];
+                case 1:
+                    _a.sent();
+                    return [4 /*yield*/, db.delete(user_1.tables.User, {})];
+                case 2:
+                    _a.sent();
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    afterEach(function () {
+        for (var _i = 0, _a = Object.entries(originalEnv); _i < _a.length; _i++) {
+            var _b = _a[_i], key = _b[0], value = _b[1];
+            if (value === undefined) {
+                delete process.env[key];
+            }
+            else {
+                process.env[key] = value;
+            }
+        }
+    });
+    it('a fresh database + the matching address: the account is created carrying admin, audited once, and logged in', function () { return __awaiter(void 0, void 0, void 0, function () {
+        var _a, outcome, owner, events, _b;
+        return __generator(this, function (_c) {
+            switch (_c.label) {
+                case 0:
+                    _a = expect;
+                    return [4 /*yield*/, userRow(BOOTSTRAP_EMAIL)];
+                case 1:
+                    _a.apply(void 0, [_c.sent()]).toBeUndefined();
+                    return [4 /*yield*/, (0, devLoginHarness_1.invokeDevLogin)({ email: BOOTSTRAP_EMAIL })];
+                case 2:
+                    outcome = _c.sent();
+                    expect(outcome.loggedInAs).toBe(BOOTSTRAP_EMAIL);
+                    expect(outcome.sessionSaved).toBe(true);
+                    expect(outcome.redirect).toBe('/');
+                    return [4 /*yield*/, userRow(BOOTSTRAP_EMAIL)];
+                case 3:
+                    owner = _c.sent();
+                    expect(owner.roles).toEqual(['admin']);
+                    return [4 /*yield*/, auditRows()];
+                case 4:
+                    events = _c.sent();
+                    expect(events).toHaveLength(1);
+                    expect(events[0]).toMatchObject({ actor: owner.id, target: owner.id, role: 'admin', action: 'grant' });
+                    _b = expect;
+                    return [4 /*yield*/, adminRows()];
+                case 5:
+                    _b.apply(void 0, [_c.sent()]).toHaveLength(1);
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    it('a second call for the same address changes nothing: still exactly one admin, one grant', function () { return __awaiter(void 0, void 0, void 0, function () {
+        var outcome, _a, _b, _c;
+        return __generator(this, function (_d) {
+            switch (_d.label) {
+                case 0: return [4 /*yield*/, (0, devLoginHarness_1.invokeDevLogin)({ email: BOOTSTRAP_EMAIL })];
+                case 1:
+                    _d.sent();
+                    return [4 /*yield*/, (0, devLoginHarness_1.invokeDevLogin)({ email: BOOTSTRAP_EMAIL })];
+                case 2:
+                    outcome = _d.sent();
+                    expect(outcome.loggedInAs).toBe(BOOTSTRAP_EMAIL);
+                    _a = expect;
+                    return [4 /*yield*/, userRow(BOOTSTRAP_EMAIL)];
+                case 3:
+                    _a.apply(void 0, [(_d.sent()).roles]).toEqual(['admin']);
+                    _b = expect;
+                    return [4 /*yield*/, auditRows()];
+                case 4:
+                    _b.apply(void 0, [_d.sent()]).toHaveLength(1);
+                    _c = expect;
+                    return [4 /*yield*/, adminRows()];
+                case 5:
+                    _c.apply(void 0, [_d.sent()]).toHaveLength(1);
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    it('an existing role-less account at the matching address is granted admin on its next login — the door serves created and loaded accounts alike', function () { return __awaiter(void 0, void 0, void 0, function () {
+        var outcome, _a, _b;
+        return __generator(this, function (_c) {
+            switch (_c.label) {
+                case 0: return [4 /*yield*/, testEnv.createUser({ name: 'Owner', email: BOOTSTRAP_EMAIL })];
+                case 1:
+                    _c.sent();
+                    return [4 /*yield*/, (0, devLoginHarness_1.invokeDevLogin)({ email: BOOTSTRAP_EMAIL })];
+                case 2:
+                    outcome = _c.sent();
+                    expect(outcome.loggedInAs).toBe(BOOTSTRAP_EMAIL);
+                    _a = expect;
+                    return [4 /*yield*/, userRow(BOOTSTRAP_EMAIL)];
+                case 3:
+                    _a.apply(void 0, [(_c.sent()).roles]).toEqual(['admin']);
+                    _b = expect;
+                    return [4 /*yield*/, auditRows()];
+                case 4:
+                    _b.apply(void 0, [_c.sent()]).toHaveLength(1);
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    it('the default path is a request for DEV_AUTO_LOGIN_EMAIL: when that IS the bootstrap address, the default account carries admin', function () { return __awaiter(void 0, void 0, void 0, function () {
+        var outcome, _a, _b;
+        return __generator(this, function (_c) {
+            switch (_c.label) {
+                case 0:
+                    process.env.DEV_BOOTSTRAP_ADMIN_EMAIL = ENV_EMAIL;
+                    return [4 /*yield*/, (0, devLoginHarness_1.invokeDevLogin)()];
+                case 1:
+                    outcome = _c.sent();
+                    expect(outcome.loggedInAs).toBe(ENV_EMAIL);
+                    _a = expect;
+                    return [4 /*yield*/, userRow(ENV_EMAIL)];
+                case 2:
+                    _a.apply(void 0, [(_c.sent()).roles]).toEqual(['admin']);
+                    _b = expect;
+                    return [4 /*yield*/, auditRows()];
+                case 3:
+                    _b.apply(void 0, [_c.sent()]).toHaveLength(1);
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    it('the match is case-normalized like every account email — never a second account for a differently-cased address', function () { return __awaiter(void 0, void 0, void 0, function () {
+        var _a, _b;
+        return __generator(this, function (_c) {
+            switch (_c.label) {
+                case 0:
+                    process.env.DEV_BOOTSTRAP_ADMIN_EMAIL = 'Owner@Test.local';
+                    return [4 /*yield*/, (0, devLoginHarness_1.invokeDevLogin)({ email: 'owner@test.local' })];
+                case 1:
+                    _c.sent();
+                    _a = expect;
+                    return [4 /*yield*/, userRow(BOOTSTRAP_EMAIL)];
+                case 2:
+                    _a.apply(void 0, [(_c.sent()).roles]).toEqual(['admin']);
+                    _b = expect;
+                    return [4 /*yield*/, adminRows()];
+                case 3:
+                    _b.apply(void 0, [_c.sent()]).toHaveLength(1);
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    it('an admin already exists: the matching address gets an ordinary account — no grant, no audit row', function () { return __awaiter(void 0, void 0, void 0, function () {
+        var outcome, _a, _b, _c;
+        return __generator(this, function (_d) {
+            switch (_d.label) {
+                case 0: return [4 /*yield*/, testEnv.createUser({ name: 'Standing admin', email: 'standing-admin@test.local', roles: ['admin'] })];
+                case 1:
+                    _d.sent();
+                    return [4 /*yield*/, (0, devLoginHarness_1.invokeDevLogin)({ email: BOOTSTRAP_EMAIL })];
+                case 2:
+                    outcome = _d.sent();
+                    expect(outcome.loggedInAs).toBe(BOOTSTRAP_EMAIL);
+                    _a = expect;
+                    return [4 /*yield*/, userRow(BOOTSTRAP_EMAIL)];
+                case 3:
+                    _a.apply(void 0, [(_d.sent()).roles]).toEqual([]);
+                    _b = expect;
+                    return [4 /*yield*/, auditRows()];
+                case 4:
+                    _b.apply(void 0, [_d.sent()]).toHaveLength(0);
+                    _c = expect;
+                    return [4 /*yield*/, adminRows()];
+                case 5:
+                    _c.apply(void 0, [(_d.sent()).map(function (user) { return user.email; })]).toEqual(['standing-admin@test.local']);
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    it('a different same-domain address: an ordinary account, no grant — and the bootstrap address itself stays uncreated', function () { return __awaiter(void 0, void 0, void 0, function () {
+        var outcome, _a, _b, _c, _d;
+        return __generator(this, function (_e) {
+            switch (_e.label) {
+                case 0: return [4 /*yield*/, (0, devLoginHarness_1.invokeDevLogin)({ email: 'agent@test.local' })];
+                case 1:
+                    outcome = _e.sent();
+                    expect(outcome.loggedInAs).toBe('agent@test.local');
+                    _a = expect;
+                    return [4 /*yield*/, userRow('agent@test.local')];
+                case 2:
+                    _a.apply(void 0, [(_e.sent()).roles]).toEqual([]);
+                    _b = expect;
+                    return [4 /*yield*/, auditRows()];
+                case 3:
+                    _b.apply(void 0, [_e.sent()]).toHaveLength(0);
+                    _c = expect;
+                    return [4 /*yield*/, userRow(BOOTSTRAP_EMAIL)];
+                case 4:
+                    _c.apply(void 0, [_e.sent()]).toBeUndefined();
+                    _d = expect;
+                    return [4 /*yield*/, adminRows()];
+                case 5:
+                    _d.apply(void 0, [_e.sent()]).toHaveLength(0);
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    it('the address must match exactly — a plus-suffixed variant is a different account and gets nothing', function () { return __awaiter(void 0, void 0, void 0, function () {
+        var outcome, _a, _b;
+        return __generator(this, function (_c) {
+            switch (_c.label) {
+                case 0: return [4 /*yield*/, (0, devLoginHarness_1.invokeDevLogin)({ email: 'owner+lane@test.local' })];
+                case 1:
+                    outcome = _c.sent();
+                    expect(outcome.loggedInAs).toBe('owner+lane@test.local');
+                    _a = expect;
+                    return [4 /*yield*/, userRow('owner+lane@test.local')];
+                case 2:
+                    _a.apply(void 0, [(_c.sent()).roles]).toEqual([]);
+                    _b = expect;
+                    return [4 /*yield*/, auditRows()];
+                case 3:
+                    _b.apply(void 0, [_c.sent()]).toHaveLength(0);
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    it('with the variable unset the matching address is an ordinary account — the omission is the safety (test/prod never set it)', function () { return __awaiter(void 0, void 0, void 0, function () {
+        var _a, _b;
+        return __generator(this, function (_c) {
+            switch (_c.label) {
+                case 0:
+                    delete process.env.DEV_BOOTSTRAP_ADMIN_EMAIL;
+                    return [4 /*yield*/, (0, devLoginHarness_1.invokeDevLogin)({ email: BOOTSTRAP_EMAIL })];
+                case 1:
+                    _c.sent();
+                    _a = expect;
+                    return [4 /*yield*/, userRow(BOOTSTRAP_EMAIL)];
+                case 2:
+                    _a.apply(void 0, [(_c.sent()).roles]).toEqual([]);
+                    _b = expect;
+                    return [4 /*yield*/, auditRows()];
+                case 3:
+                    _b.apply(void 0, [_c.sent()]).toHaveLength(0);
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    it.each([['DEVELOPMENT'], ['DEV_AUTO_LOGIN_EMAIL']])('gate closed (%s unset): 404 exactly as before — no session, no account, no admin; the variable changes nothing', function (gate) { return __awaiter(void 0, void 0, void 0, function () {
+        var outcome, _a, _b, _c;
+        return __generator(this, function (_d) {
+            switch (_d.label) {
+                case 0:
+                    delete process.env[gate];
+                    return [4 /*yield*/, (0, devLoginHarness_1.invokeDevLogin)({ email: BOOTSTRAP_EMAIL })];
+                case 1:
+                    outcome = _d.sent();
+                    expect(outcome.status).toBe(404);
+                    expect(outcome.loggedInAs).toBeUndefined();
+                    expect(outcome.sessionSaved).toBe(false);
+                    _a = expect;
+                    return [4 /*yield*/, userRow(BOOTSTRAP_EMAIL)];
+                case 2:
+                    _a.apply(void 0, [_d.sent()]).toBeUndefined();
+                    _b = expect;
+                    return [4 /*yield*/, auditRows()];
+                case 3:
+                    _b.apply(void 0, [_d.sent()]).toHaveLength(0);
+                    _c = expect;
+                    return [4 /*yield*/, adminRows()];
+                case 4:
+                    _c.apply(void 0, [_d.sent()]).toHaveLength(0);
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+});
+//# sourceMappingURL=DevLoginBootstrapAdmin.test.js.map

package/dist/test/DevLoginBootstrapAdmin.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"DevLoginBootstrapAdmin.test.js","sourceRoot":"","sources":["../../test/DevLoginBootstrapAdmin.test.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,oCAA8C;AAC9C,wCAAyC;AACzC,qDAAmD;AACnD,yEAAwE;AAExE,IAAM,OAAO,GAAG,IAAI,qDAAyB,EAAE,CAAC;AAEhD;;;;;;;;;;;;;GAaG;AAEH,IAAM,SAAS,GAAG,gBAAgB,CAAC;AACnC,IAAM,eAAe,GAAG,kBAAkB,CAAC;AAE3C,IAAM,OAAO,GAAG,UAAO,KAAa;;gBAAK,qBAAM,IAAA,kBAAa,GAAE,CAAC,GAAG,CAAC,aAAM,CAAC,IAAI,EAAE,EAAE,KAAK,OAAA,EAAE,CAAC,EAAA;gBAAjD,sBAAA,SAAiD,EAAA;;SAAA,CAAC;AAC3F,IAAM,SAAS,GAAG;;gBAAY,qBAAM,IAAA,kBAAa,GAAE,CAAC,KAAK,CAAC,aAAM,CAAC,cAAc,EAAE,EAAE,CAAC,EAAA;gBAAtD,sBAAA,SAAsD,EAAA;;SAAA,CAAC;AACrF,IAAM,SAAS,GAAG;;gBACf,qBAAM,IAAA,kBAAa,GAAE,CAAC,KAAK,CAAC,aAAM,CAAC,IAAI,EAAE,EAAE,CAAC,EAAA;gBAA7C,sBAAA,CAAC,SAA4C,CAAC,CAAC,MAAM,CAAC,UAAC,IAAI,YAAK,OAAA,CAAC,MAAA,IAAI,CAAC,KAAK,mCAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAA,EAAA,CAAC,EAAA;;SAAA,CAAC;AAExG,QAAQ,CAAC,2DAA2D,EAAE;IACpE,IAAM,WAAW,GAAG;QAClB,WAAW,EAAE,OAAO,CAAC,GAAG,CAAC,WAAW;QACpC,oBAAoB,EAAE,OAAO,CAAC,GAAG,CAAC,oBAAoB;QACtD,yBAAyB,EAAE,OAAO,CAAC,GAAG,CAAC,yBAAyB;KACjE,CAAC;IAEF,SAAS,CAAC;;;wBACR,qBAAM,OAAO,CAAC,SAAS,EAAE,EAAA;;oBAAzB,SAAyB,CAAC;;;;SAC3B,CAAC,CAAC;IAEH,QAAQ,CAAC;;;wBACP,qBAAM,OAAO,CAAC,QAAQ,EAAE,EAAA;;oBAAxB,SAAwB,CAAC;;;;SAC1B,CAAC,CAAC;IAEH,UAAU,CAAC;;;;;oBACT,OAAO,CAAC,GAAG,CAAC,WAAW,GAAG,MAAM,CAAC;oBACjC,OAAO,CAAC,GAAG,CAAC,oBAAoB,GAAG,SAAS,CAAC;oBAC7C,OAAO,CAAC,GAAG,CAAC,yBAAyB,GAAG,eAAe,CAAC;oBAElD,EAAE,GAAG,IAAA,kBAAa,GAAE,CAAC;oBAC3B,qBAAM,EAAE,CAAC,MAAM,CAAC,aAAM,CAAC,cAAc,EAAE,EAAE,CAAC,EAAA;;oBAA1C,SAA0C,CAAC;oBAC3C,qBAAM,EAAE,CAAC,MAAM,CAAC,aAAM,CAAC,IAAI,EAAE,EAAE,CAAC,EAAA;;oBAAhC,SAAgC,CAAC;;;;SAClC,CAAC,CAAC;IAEH,SAAS,CAAC;QACR,KAA2B,UAA2B,EAA3B,KAAA,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,EAA3B,cAA2B,EAA3B,IAA2B,EAAE;YAA7C,IAAA,WAAY,EAAX,GAAG,QAAA,EAAE,KAAK,QAAA;YACpB,IAAI,KAAK,KAAK,SAAS,EAAE;gBACvB,OAAO,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;aACzB;iBAAM;gBACL,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;aAC1B;SACF;IACH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6GAA6G,EAAE;;;;;oBAChH,KAAA,MAAM,CAAA;oBAAC,qBAAM,OAAO,CAAC,eAAe,CAAC,EAAA;;oBAArC,kBAAO,SAA8B,EAAC,CAAC,aAAa,EAAE,CAAC;oBAEvC,qBAAM,IAAA,gCAAc,EAAC,EAAE,KAAK,EAAE,eAAe,EAAE,CAAC,EAAA;;oBAA1D,OAAO,GAAG,SAAgD;oBAEhE,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;oBACjD,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;oBACxC,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;oBACrB,qBAAM,OAAO,CAAC,eAAe,CAAC,EAAA;;oBAAtC,KAAK,GAAG,SAA8B;oBAC5C,MAAM,CAAC,KAAM,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;oBACzB,qBAAM,SAAS,EAAE,EAAA;;oBAA1B,MAAM,GAAG,SAAiB;oBAChC,MAAM,CAAC,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;oBAC/B,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,EAAE,KAAK,EAAE,KAAM,CAAC,EAAE,EAAE,MAAM,EAAE,KAAM,CAAC,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;oBACzG,KAAA,MAAM,CAAA;oBAAC,qBAAM,SAAS,EAAE,EAAA;;oBAAxB,kBAAO,SAAiB,EAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;;;;SAC3C,CAAC,CAAC;IAEH,EAAE,CAAC,wFAAwF,EAAE;;;;wBAC3F,qBAAM,IAAA,gCAAc,EAAC,EAAE,KAAK,EAAE,eAAe,EAAE,CAAC,EAAA;;oBAAhD,SAAgD,CAAC;oBAEjC,qBAAM,IAAA,gCAAc,EAAC,EAAE,KAAK,EAAE,eAAe,EAAE,CAAC,EAAA;;oBAA1D,OAAO,GAAG,SAAgD;oBAEhE,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;oBACjD,KAAA,MAAM,CAAA;oBAAE,qBAAM,OAAO,CAAC,eAAe,CAAC,EAAA;;oBAAtC,kBAAO,CAAC,SAA8B,CAAE,CAAC,KAAK,EAAC,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;oBACnE,KAAA,MAAM,CAAA;oBAAC,qBAAM,SAAS,EAAE,EAAA;;oBAAxB,kBAAO,SAAiB,EAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;oBAC1C,KAAA,MAAM,CAAA;oBAAC,qBAAM,SAAS,EAAE,EAAA;;oBAAxB,kBAAO,SAAiB,EAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;;;;SAC3C,CAAC,CAAC;IAEH,EAAE,CAAC,8IAA8I,EAAE;;;;wBACjJ,qBAAM,OAAO,CAAC,UAAU,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,eAAe,EAAE,CAAC,EAAA;;oBAAnE,SAAmE,CAAC;oBAEpD,qBAAM,IAAA,gCAAc,EAAC,EAAE,KAAK,EAAE,eAAe,EAAE,CAAC,EAAA;;oBAA1D,OAAO,GAAG,SAAgD;oBAEhE,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;oBACjD,KAAA,MAAM,CAAA;oBAAE,qBAAM,OAAO,CAAC,eAAe,CAAC,EAAA;;oBAAtC,kBAAO,CAAC,SAA8B,CAAE,CAAC,KAAK,EAAC,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;oBACnE,KAAA,MAAM,CAAA;oBAAC,qBAAM,SAAS,EAAE,EAAA;;oBAAxB,kBAAO,SAAiB,EAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;;;;SAC3C,CAAC,CAAC;IAEH,EAAE,CAAC,+HAA+H,EAAE;;;;;oBAClI,OAAO,CAAC,GAAG,CAAC,yBAAyB,GAAG,SAAS,CAAC;oBAElC,qBAAM,IAAA,gCAAc,GAAE,EAAA;;oBAAhC,OAAO,GAAG,SAAsB;oBAEtC,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;oBAC3C,KAAA,MAAM,CAAA;oBAAE,qBAAM,OAAO,CAAC,SAAS,CAAC,EAAA;;oBAAhC,kBAAO,CAAC,SAAwB,CAAE,CAAC,KAAK,EAAC,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;oBAC7D,KAAA,MAAM,CAAA;oBAAC,qBAAM,SAAS,EAAE,EAAA;;oBAAxB,kBAAO,SAAiB,EAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;;;;SAC3C,CAAC,CAAC;IAEH,EAAE,CAAC,gHAAgH,EAAE;;;;;oBACnH,OAAO,CAAC,GAAG,CAAC,yBAAyB,GAAG,kBAAkB,CAAC;oBAE3D,qBAAM,IAAA,gCAAc,EAAC,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC,EAAA;;oBAAnD,SAAmD,CAAC;oBAEpD,KAAA,MAAM,CAAA;oBAAE,qBAAM,OAAO,CAAC,eAAe,CAAC,EAAA;;oBAAtC,kBAAO,CAAC,SAA8B,CAAE,CAAC,KAAK,EAAC,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;oBACnE,KAAA,MAAM,CAAA;oBAAC,qBAAM,SAAS,EAAE,EAAA;;oBAAxB,kBAAO,SAAiB,EAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;;;;SAC3C,CAAC,CAAC;IAEH,EAAE,CAAC,iGAAiG,EAAE;;;;wBACpG,qBAAM,OAAO,CAAC,UAAU,CAAC,EAAE,IAAI,EAAE,gBAAgB,EAAE,KAAK,EAAE,2BAA2B,EAAE,KAAK,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,EAAA;;oBAA1G,SAA0G,CAAC;oBAE3F,qBAAM,IAAA,gCAAc,EAAC,EAAE,KAAK,EAAE,eAAe,EAAE,CAAC,EAAA;;oBAA1D,OAAO,GAAG,SAAgD;oBAEhE,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;oBACjD,KAAA,MAAM,CAAA;oBAAE,qBAAM,OAAO,CAAC,eAAe,CAAC,EAAA;;oBAAtC,kBAAO,CAAC,SAA8B,CAAE,CAAC,KAAK,EAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;oBAC5D,KAAA,MAAM,CAAA;oBAAC,qBAAM,SAAS,EAAE,EAAA;;oBAAxB,kBAAO,SAAiB,EAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;oBAC1C,KAAA,MAAM,CAAA;oBAAE,qBAAM,SAAS,EAAE,EAAA;;oBAAzB,kBAAO,CAAC,SAAiB,CAAC,CAAC,GAAG,CAAC,UAAC,IAAI,IAAK,OAAA,IAAI,CAAC,KAAK,EAAV,CAAU,CAAC,EAAC,CAAC,OAAO,CAAC,CAAC,2BAA2B,CAAC,CAAC,CAAC;;;;SAC9F,CAAC,CAAC;IAEH,EAAE,CAAC,mHAAmH,EAAE;;;;wBACtG,qBAAM,IAAA,gCAAc,EAAC,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC,EAAA;;oBAA7D,OAAO,GAAG,SAAmD;oBAEnE,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;oBACpD,KAAA,MAAM,CAAA;oBAAE,qBAAM,OAAO,CAAC,kBAAkB,CAAC,EAAA;;oBAAzC,kBAAO,CAAC,SAAiC,CAAE,CAAC,KAAK,EAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;oBAC/D,KAAA,MAAM,CAAA;oBAAC,qBAAM,SAAS,EAAE,EAAA;;oBAAxB,kBAAO,SAAiB,EAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;oBAC1C,KAAA,MAAM,CAAA;oBAAC,qBAAM,OAAO,CAAC,eAAe,CAAC,EAAA;;oBAArC,kBAAO,SAA8B,EAAC,CAAC,aAAa,EAAE,CAAC;oBACvD,KAAA,MAAM,CAAA;oBAAC,qBAAM,SAAS,EAAE,EAAA;;oBAAxB,kBAAO,SAAiB,EAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;;;;SAC3C,CAAC,CAAC;IAEH,EAAE,CAAC,kGAAkG,EAAE;;;;wBACrF,qBAAM,IAAA,gCAAc,EAAC,EAAE,KAAK,EAAE,uBAAuB,EAAE,CAAC,EAAA;;oBAAlE,OAAO,GAAG,SAAwD;oBAExE,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC;oBACzD,KAAA,MAAM,CAAA;oBAAE,qBAAM,OAAO,CAAC,uBAAuB,CAAC,EAAA;;oBAA9C,kBAAO,CAAC,SAAsC,CAAE,CAAC,KAAK,EAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;oBACpE,KAAA,MAAM,CAAA;oBAAC,qBAAM,SAAS,EAAE,EAAA;;oBAAxB,kBAAO,SAAiB,EAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;;;;SAC3C,CAAC,CAAC;IAEH,EAAE,CAAC,2HAA2H,EAAE;;;;;oBAC9H,OAAO,OAAO,CAAC,GAAG,CAAC,yBAAyB,CAAC;oBAE7C,qBAAM,IAAA,gCAAc,EAAC,EAAE,KAAK,EAAE,eAAe,EAAE,CAAC,EAAA;;oBAAhD,SAAgD,CAAC;oBAEjD,KAAA,MAAM,CAAA;oBAAE,qBAAM,OAAO,CAAC,eAAe,CAAC,EAAA;;oBAAtC,kBAAO,CAAC,SAA8B,CAAE,CAAC,KAAK,EAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;oBAC5D,KAAA,MAAM,CAAA;oBAAC,qBAAM,SAAS,EAAE,EAAA;;oBAAxB,kBAAO,SAAiB,EAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;;;;SAC3C,CAAC,CAAC;IAEH,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,aAAa,CAAC,EAAE,CAAC,sBAAsB,CAAC,CAAC,CAAC,CAClD,gHAAgH,EAChH,UAAO,IAAI;;;;;oBACT,OAAO,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;oBAET,qBAAM,IAAA,gCAAc,EAAC,EAAE,KAAK,EAAE,eAAe,EAAE,CAAC,EAAA;;oBAA1D,OAAO,GAAG,SAAgD;oBAEhE,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;oBACjC,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,aAAa,EAAE,CAAC;oBAC3C,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;oBACzC,KAAA,MAAM,CAAA;oBAAC,qBAAM,OAAO,CAAC,eAAe,CAAC,EAAA;;oBAArC,kBAAO,SAA8B,EAAC,CAAC,aAAa,EAAE,CAAC;oBACvD,KAAA,MAAM,CAAA;oBAAC,qBAAM,SAAS,EAAE,EAAA;;oBAAxB,kBAAO,SAAiB,EAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;oBAC1C,KAAA,MAAM,CAAA;oBAAC,qBAAM,SAAS,EAAE,EAAA;;oBAAxB,kBAAO,SAAiB,EAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;;;;SAC3C,CACF,CAAC;AACJ,CAAC,CAAC,CAAC"}

package/dist/test/devLoginHarness.d.ts

@@ -0,0 +1,16 @@
+/** What one `GET /dev/login` did, seen from outside: the session it minted (or not) and the response it sent. */
+export type DevLoginOutcome = {
+    loggedInAs?: string;
+    sessionRegenerated: boolean;
+    sessionSaved: boolean;
+    status?: number;
+    body?: unknown;
+    redirect?: string;
+};
+/**
+ * Drives the devLogin route once over the REAL passport login machinery (see
+ * passportSessionHarness): the full session-establishment contract (regenerate → login → save)
+ * is pinned by SignupRoute.test.ts — the dev-door suites assert the door INHERITS it.
+ */
+export declare const invokeDevLogin: (query?: Record<string, unknown>) => Promise<DevLoginOutcome>;
+//# sourceMappingURL=devLoginHarness.d.ts.map

package/dist/test/devLoginHarness.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"devLoginHarness.d.ts","sourceRoot":"","sources":["../../test/devLoginHarness.ts"],"names":[],"mappings":"AAGA,iHAAiH;AACjH,MAAM,MAAM,eAAe,GAAG;IAC5B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,kBAAkB,EAAE,OAAO,CAAC;IAC5B,YAAY,EAAE,OAAO,CAAC;IACtB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,cAAc,WAAkB,OAAO,MAAM,EAAE,OAAO,CAAC,KAAG,QAAQ,eAAe,CAoB7F,CAAC"}

package/dist/test/devLoginHarness.js

@@ -0,0 +1,79 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var __generator = (this && this.__generator) || function (thisArg, body) {
+    var _ = { label: 0, sent: function() { if (t[0] & 1) throw t[1]; return t[1]; }, trys: [], ops: [] }, f, y, t, g;
+    return g = { next: verb(0), "throw": verb(1), "return": verb(2) }, typeof Symbol === "function" && (g[Symbol.iterator] = function() { return this; }), g;
+    function verb(n) { return function (v) { return step([n, v]); }; }
+    function step(op) {
+        if (f) throw new TypeError("Generator is already executing.");
+        while (g && (g = 0, op[0] && (_ = 0)), _) try {
+            if (f = 1, y && (t = op[0] & 2 ? y["return"] : op[0] ? y["throw"] || ((t = y["return"]) && t.call(y), 0) : y.next) && !(t = t.call(y, op[1])).done) return t;
+            if (y = 0, t) op = [op[0] & 2, t.value];
+            switch (op[0]) {
+                case 0: case 1: t = op; break;
+                case 4: _.label++; return { value: op[1], done: false };
+                case 5: _.label++; y = op[1]; op = [0]; continue;
+                case 7: op = _.ops.pop(); _.trys.pop(); continue;
+                default:
+                    if (!(t = _.trys, t = t.length > 0 && t[t.length - 1]) && (op[0] === 6 || op[0] === 2)) { _ = 0; continue; }
+                    if (op[0] === 3 && (!t || (op[1] > t[0] && op[1] < t[3]))) { _.label = op[1]; break; }
+                    if (op[0] === 6 && _.label < t[1]) { _.label = t[1]; t = op; break; }
+                    if (t && _.label < t[2]) { _.label = t[2]; _.ops.push(op); break; }
+                    if (t[2]) _.ops.pop();
+                    _.trys.pop(); continue;
+            }
+            op = body.call(thisArg, _);
+        } catch (e) { op = [6, e]; y = 0; } finally { f = t = 0; }
+        if (op[0] & 5) throw op[1]; return { value: op[0] ? op[1] : void 0, done: true };
+    }
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.invokeDevLogin = void 0;
+var devLogin_1 = require("../src/routes/devLogin");
+var passportSessionHarness_1 = require("./passportSessionHarness");
+/**
+ * Drives the devLogin route once over the REAL passport login machinery (see
+ * passportSessionHarness): the full session-establishment contract (regenerate → login → save)
+ * is pinned by SignupRoute.test.ts — the dev-door suites assert the door INHERITS it.
+ */
+var invokeDevLogin = function (query) { return __awaiter(void 0, void 0, void 0, function () {
+    var _a, request, events, outcome, response;
+    var _b;
+    return __generator(this, function (_c) {
+        switch (_c.label) {
+            case 0: return [4 /*yield*/, (0, passportSessionHarness_1.createPassportRequest)({ query: query })];
+            case 1:
+                _a = _c.sent(), request = _a.request, events = _a.events;
+                outcome = { sessionRegenerated: false, sessionSaved: false };
+                response = {
+                    status: function (code) {
+                        outcome.status = code;
+                        return this;
+                    },
+                    send: function (body) {
+                        outcome.body = body;
+                    },
+                    redirect: function (path) {
+                        outcome.redirect = path;
+                    },
+                };
+                return [4 /*yield*/, devLogin_1.devLogin.onRequest(request, response)];
+            case 2:
+                _c.sent();
+                outcome.loggedInAs = (_b = request.session.passport) === null || _b === void 0 ? void 0 : _b.user;
+                outcome.sessionRegenerated = events.includes('regenerate');
+                outcome.sessionSaved = events.includes('save');
+                return [2 /*return*/, outcome];
+        }
+    });
+}); };
+exports.invokeDevLogin = invokeDevLogin;
+//# sourceMappingURL=devLoginHarness.js.map

package/dist/test/devLoginHarness.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"devLoginHarness.js","sourceRoot":"","sources":["../../test/devLoginHarness.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,mDAAkD;AAClD,mEAAiE;AAYjE;;;;GAIG;AACI,IAAM,cAAc,GAAG,UAAO,KAA+B;;;;;oBACtC,qBAAM,IAAA,8CAAqB,EAAC,EAAE,KAAK,OAAA,EAAE,CAAC,EAAA;;gBAA5D,KAAsB,SAAsC,EAA1D,OAAO,aAAA,EAAE,MAAM,YAAA;gBACjB,OAAO,GAAoB,EAAE,kBAAkB,EAAE,KAAK,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC;gBAC9E,QAAQ,GAAG;oBACf,MAAM,YAAC,IAAY;wBACjB,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;wBACtB,OAAO,IAAI,CAAC;oBACd,CAAC;oBACD,IAAI,YAAC,IAAc;wBACjB,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC;oBACtB,CAAC;oBACD,QAAQ,YAAC,IAAY;wBACnB,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC;oBAC1B,CAAC;iBACF,CAAC;gBACF,qBAAM,mBAAQ,CAAC,SAAS,CAAC,OAAgB,EAAE,QAAiB,CAAC,EAAA;;gBAA7D,SAA6D,CAAC;gBAC9D,OAAO,CAAC,UAAU,GAAG,MAAA,OAAO,CAAC,OAAO,CAAC,QAAQ,0CAAE,IAAI,CAAC;gBACpD,OAAO,CAAC,kBAAkB,GAAG,MAAM,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;gBAC3D,OAAO,CAAC,YAAY,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;gBAC/C,sBAAO,OAAO,EAAC;;;KAChB,CAAC;AApBW,QAAA,cAAc,kBAoBzB"}