@proteinjs/user-server 1.22.1 → 1.22.3

package/dist/test/NoAddressesInLogs.integration.test.js

@@ -0,0 +1,717 @@
+"use strict";
+var __extends = (this && this.__extends) || (function () {
+    var extendStatics = function (d, b) {
+        extendStatics = Object.setPrototypeOf ||
+            ({ __proto__: [] } instanceof Array && function (d, b) { d.__proto__ = b; }) ||
+            function (d, b) { for (var p in b) if (Object.prototype.hasOwnProperty.call(b, p)) d[p] = b[p]; };
+        return extendStatics(d, b);
+    };
+    return function (d, b) {
+        if (typeof b !== "function" && b !== null)
+            throw new TypeError("Class extends value " + String(b) + " is not a constructor or null");
+        extendStatics(d, b);
+        function __() { this.constructor = d; }
+        d.prototype = b === null ? Object.create(b) : (__.prototype = b.prototype, new __());
+    };
+})();
+var __assign = (this && this.__assign) || function () {
+    __assign = Object.assign || function(t) {
+        for (var s, i = 1, n = arguments.length; i < n; i++) {
+            s = arguments[i];
+            for (var p in s) if (Object.prototype.hasOwnProperty.call(s, p))
+                t[p] = s[p];
+        }
+        return t;
+    };
+    return __assign.apply(this, arguments);
+};
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var __generator = (this && this.__generator) || function (thisArg, body) {
+    var _ = { label: 0, sent: function() { if (t[0] & 1) throw t[1]; return t[1]; }, trys: [], ops: [] }, f, y, t, g;
+    return g = { next: verb(0), "throw": verb(1), "return": verb(2) }, typeof Symbol === "function" && (g[Symbol.iterator] = function() { return this; }), g;
+    function verb(n) { return function (v) { return step([n, v]); }; }
+    function step(op) {
+        if (f) throw new TypeError("Generator is already executing.");
+        while (g && (g = 0, op[0] && (_ = 0)), _) try {
+            if (f = 1, y && (t = op[0] & 2 ? y["return"] : op[0] ? y["throw"] || ((t = y["return"]) && t.call(y), 0) : y.next) && !(t = t.call(y, op[1])).done) return t;
+            if (y = 0, t) op = [op[0] & 2, t.value];
+            switch (op[0]) {
+                case 0: case 1: t = op; break;
+                case 4: _.label++; return { value: op[1], done: false };
+                case 5: _.label++; y = op[1]; op = [0]; continue;
+                case 7: op = _.ops.pop(); _.trys.pop(); continue;
+                default:
+                    if (!(t = _.trys, t = t.length > 0 && t[t.length - 1]) && (op[0] === 6 || op[0] === 2)) { _ = 0; continue; }
+                    if (op[0] === 3 && (!t || (op[1] > t[0] && op[1] < t[3]))) { _.label = op[1]; break; }
+                    if (op[0] === 6 && _.label < t[1]) { _.label = t[1]; t = op; break; }
+                    if (t && _.label < t[2]) { _.label = t[2]; _.ops.push(op); break; }
+                    if (t[2]) _.ops.pop();
+                    _.trys.pop(); continue;
+            }
+            op = body.call(thisArg, _);
+        } catch (e) { op = [6, e]; y = 0; } finally { f = t = 0; }
+        if (op[0] & 5) throw op[1]; return { value: op[0] ? op[1] : void 0, done: true };
+    }
+};
+var __spreadArray = (this && this.__spreadArray) || function (to, from, pack) {
+    if (pack || arguments.length === 2) for (var i = 0, l = from.length, ar; i < l; i++) {
+        if (ar || !(i in from)) {
+            if (!ar) ar = Array.prototype.slice.call(from, 0, i);
+            ar[i] = from[i];
+        }
+    }
+    return to.concat(ar || Array.prototype.slice.call(from));
+};
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+var moment_1 = __importDefault(require("moment"));
+var sha256_1 = __importDefault(require("crypto-js/sha256"));
+var db_1 = require("@proteinjs/db");
+var email_server_1 = require("@proteinjs/email-server");
+var reflection_1 = require("@proteinjs/reflection");
+var user_1 = require("@proteinjs/user");
+var util_node_1 = require("@proteinjs/util-node");
+var authenticate_1 = require("../src/authentication/authenticate");
+var PasswordHasher_1 = require("../src/authentication/PasswordHasher");
+var PasswordResetToken_1 = require("../src/authentication/PasswordResetToken");
+var UserStatusTableWatcher_1 = require("../src/authentication/UserStatusTableWatcher");
+var userCache_1 = require("../src/authorization/userCache");
+var executePasswordReset_1 = require("../src/routes/executePasswordReset");
+var initiatePasswordReset_1 = require("../src/routes/initiatePasswordReset");
+var validateResetPasswordToken_1 = require("../src/routes/validateResetPasswordToken");
+var signup_1 = require("../src/routes/signup");
+var MachineCredentials_1 = require("../src/services/MachineCredentials");
+var Signup_1 = require("../src/services/Signup");
+var devLoginHarness_1 = require("./devLoginHarness");
+var passportSessionHarness_1 = require("./passportSessionHarness");
+var LogCapture_1 = require("./LogCapture");
+var UserServerTestEnvironment_1 = require("./UserServerTestEnvironment");
+var testEnv = new UserServerTestEnvironment_1.UserServerTestEnvironment();
+var invoke = function (route, request) { return __awaiter(void 0, void 0, void 0, function () {
+    var outcome, response;
+    return __generator(this, function (_a) {
+        switch (_a.label) {
+            case 0:
+                outcome = { status: 200 };
+                response = {
+                    status: function (code) {
+                        outcome.status = code;
+                        return this;
+                    },
+                    send: function (body) {
+                        outcome.body = body;
+                    },
+                };
+                return [4 /*yield*/, route.onRequest(request, response)];
+            case 1:
+                _a.sent();
+                return [2 /*return*/, outcome];
+        }
+    });
+}); };
+var objectCache = function () { return reflection_1.SourceRepository.get().objectCache; };
+var namedObjectCache = function () { return reflection_1.SourceRepository.get().namedObjectCache; };
+/** The deactivation watcher map is built once per process from the cache; rebuild it from what is seeded now. */
+var resetTableWatcherMap = function () {
+    var runner = (0, db_1.getDbAsSystem)().tableWatcherRunner;
+    runner.constructor.tableWatcherMap = undefined;
+};
+var OpsRole = /** @class */ (function () {
+    function OpsRole() {
+        this.role = 'ops';
+        this.description = 'Operational machinery';
+    }
+    return OpsRole;
+}());
+var LogsMachineAccount = /** @class */ (function (_super) {
+    __extends(LogsMachineAccount, _super);
+    function LogsMachineAccount() {
+        var _this = _super !== null && _super.apply(this, arguments) || this;
+        _this.id = 'machine-logs-ops';
+        _this.email = 'machine-logs@test.local';
+        _this.accountName = 'Logs ops machine';
+        _this.roles = ['ops'];
+        _this.secretName = 'logs-ops-secret';
+        return _this;
+    }
+    return LogsMachineAccount;
+}(user_1.MachineAccount));
+var DEV_ENV = ['DEVELOPMENT', 'DEV_AUTO_LOGIN_EMAIL', 'DEV_BOOTSTRAP_ADMIN_EMAIL', 'DEV_BOOTSTRAP_ROLES'];
+describe('no e-mail address reaches the server log', function () {
+    var digests = new util_node_1.RequestDigests();
+    var originalEnv = {};
+    beforeAll(function () { return __awaiter(void 0, void 0, void 0, function () {
+        var _i, _a, key, cache;
+        return __generator(this, function (_b) {
+            switch (_b.label) {
+                case 0: return [4 /*yield*/, testEnv.beforeAll()];
+                case 1:
+                    _b.sent();
+                    for (_i = 0, _a = __spreadArray(['EMAIL_TRANSPORT'], DEV_ENV, true); _i < _a.length; _i++) {
+                        key = _a[_i];
+                        originalEnv[key] = process.env[key];
+                    }
+                    process.env.EMAIL_TRANSPORT = 'sink';
+                    cache = objectCache();
+                    cache['@proteinjs/email-server/DefaultEmailConfigFactory'] = [
+                        {
+                            getEmailConfig: function () { return ({
+                                host: 'smtp.test.local',
+                                port: 465,
+                                secure: true,
+                                from: '"Example" <hi@example.com>',
+                            }); },
+                        },
+                    ];
+                    cache['@proteinjs/email-server/DefaultPasswordResetEmailConfigFactory'] = [
+                        { getConfig: function () { return ({ getEmailContent: function (path) { return ({ text: "Reset: https://app.test.local/".concat(path) }); } }); } },
+                    ];
+                    cache['@proteinjs/email-server/DefaultInviteEmailConfigFactory'] = [
+                        {
+                            getConfig: function () { return ({
+                                options: { subject: 'Your invite' },
+                                getEmailContent: function (path) { return ({ text: "Accept: /".concat(path), html: "<a href=\"/".concat(path, "\">Accept</a>") }); },
+                            }); },
+                        },
+                    ];
+                    cache['@proteinjs/email-server/DefaultSignupConfirmationEmailConfigFactory'] = [
+                        { getConfig: function () { return ({ getNewUserEmailContent: function () { return ({ text: 'welcome', html: '<p>welcome</p>' }); } }); } },
+                    ];
+                    // Invite-optional, the library default — the suites load src, never the generated source graph.
+                    cache['@proteinjs/user-server/DefaultInviteConfigFactory'] = [{ getConfig: function () { return ({ isInviteOnly: false }); } }];
+                    cache['@proteinjs/user-auth/AuthenticatedUserRepo'] = [new user_1.UserRepo()];
+                    cache['@proteinjs/user/RoleCatalogEntry'] = [new OpsRole()];
+                    cache['@proteinjs/db/TableWatcher'] = [new UserStatusTableWatcher_1.UserStatusTableWatcher()];
+                    resetTableWatcherMap();
+                    return [2 /*return*/];
+            }
+        });
+    }); }, 120000);
+    afterAll(function () { return __awaiter(void 0, void 0, void 0, function () {
+        var cache, _i, _a, key, _b, _c, _d, key, value;
+        return __generator(this, function (_e) {
+            switch (_e.label) {
+                case 0:
+                    cache = objectCache();
+                    for (_i = 0, _a = [
+                        '@proteinjs/email-server/DefaultEmailConfigFactory',
+                        '@proteinjs/email-server/DefaultPasswordResetEmailConfigFactory',
+                        '@proteinjs/email-server/DefaultInviteEmailConfigFactory',
+                        '@proteinjs/email-server/DefaultSignupConfirmationEmailConfigFactory',
+                        '@proteinjs/user-server/DefaultInviteConfigFactory',
+                        '@proteinjs/user-auth/AuthenticatedUserRepo',
+                        '@proteinjs/user/RoleCatalogEntry',
+                        '@proteinjs/db/TableWatcher',
+                        '@proteinjs/db/SourceRecordLoader',
+                    ]; _i < _a.length; _i++) {
+                        key = _a[_i];
+                        delete cache[key];
+                    }
+                    delete namedObjectCache()['@proteinjs/db/SourceRecordLoader'];
+                    resetTableWatcherMap();
+                    for (_b = 0, _c = Object.entries(originalEnv); _b < _c.length; _b++) {
+                        _d = _c[_b], key = _d[0], value = _d[1];
+                        if (value === undefined) {
+                            delete process.env[key];
+                        }
+                        else {
+                            process.env[key] = value;
+                        }
+                    }
+                    return [4 /*yield*/, testEnv.afterAll()];
+                case 1:
+                    _e.sent();
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    beforeEach(function () {
+        email_server_1.MailSink.get().clear();
+    });
+    it('the reset door: an unknown address, a mailed link, a repeat inside five minutes, a failed send', function () { return __awaiter(void 0, void 0, void 0, function () {
+        var log, _i, _a, address;
+        return __generator(this, function (_b) {
+            switch (_b.label) {
+                case 0: return [4 /*yield*/, testEnv.createUser({ name: 'Reset Mailed', email: 'reset-mailed@test.local' })];
+                case 1:
+                    _b.sent();
+                    return [4 /*yield*/, testEnv.createUser({ name: 'Reset Fails', email: 'reset-fails@test.local' })];
+                case 2:
+                    _b.sent();
+                    return [4 /*yield*/, LogCapture_1.LogCapture.during(function () { return __awaiter(void 0, void 0, void 0, function () {
+                            var failing;
+                            return __generator(this, function (_a) {
+                                switch (_a.label) {
+                                    case 0: return [4 /*yield*/, invoke(initiatePasswordReset_1.initiatePasswordReset, { body: { email: 'reset-nobody@test.local' } })];
+                                    case 1:
+                                        _a.sent();
+                                        return [4 /*yield*/, invoke(initiatePasswordReset_1.initiatePasswordReset, { body: { email: 'Reset-Mailed@test.local' } })];
+                                    case 2:
+                                        _a.sent();
+                                        return [4 /*yield*/, invoke(initiatePasswordReset_1.initiatePasswordReset, { body: { email: 'reset-mailed@test.local' } })];
+                                    case 3:
+                                        _a.sent();
+                                        failing = jest
+                                            .spyOn(email_server_1.EmailSender.prototype, 'sendEmail')
+                                            .mockRejectedValueOnce(new Error('Failed to send email'));
+                                        _a.label = 4;
+                                    case 4:
+                                        _a.trys.push([4, , 6, 7]);
+                                        return [4 /*yield*/, invoke(initiatePasswordReset_1.initiatePasswordReset, { body: { email: 'reset-fails@test.local' } })];
+                                    case 5:
+                                        _a.sent();
+                                        return [3 /*break*/, 7];
+                                    case 6:
+                                        failing.mockRestore();
+                                        return [7 /*endfinally*/];
+                                    case 7: return [2 /*return*/];
+                                }
+                            });
+                        }); })];
+                case 3:
+                    log = _b.sent();
+                    expect(email_server_1.MailSink.get().list()).toHaveLength(1);
+                    expect(log.addresses).toEqual([]);
+                    for (_i = 0, _a = ['reset-nobody@test.local', 'reset-mailed@test.local', 'reset-fails@test.local']; _i < _a.length; _i++) {
+                        address = _a[_i];
+                        expect(log.text).toContain(digests.account(address));
+                    }
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    it('the reset link: redeemed, presented again, expired, and an expired link validated', function () { return __awaiter(void 0, void 0, void 0, function () {
+        var redeemer, token, lapsed, lapsedToken, log;
+        return __generator(this, function (_a) {
+            switch (_a.label) {
+                case 0: return [4 /*yield*/, testEnv.createUser({ name: 'Reset Redeemer', email: 'reset-redeem@test.local' })];
+                case 1:
+                    redeemer = _a.sent();
+                    return [4 /*yield*/, new PasswordResetToken_1.PasswordResetToken().mint(redeemer)];
+                case 2:
+                    token = _a.sent();
+                    return [4 /*yield*/, testEnv.createUser({ name: 'Reset Lapsed', email: 'reset-lapsed@test.local' })];
+                case 3:
+                    lapsed = _a.sent();
+                    return [4 /*yield*/, new PasswordResetToken_1.PasswordResetToken().mint(lapsed)];
+                case 4:
+                    lapsedToken = _a.sent();
+                    return [4 /*yield*/, (0, db_1.getDbAsSystem)().update(user_1.tables.User, {
+                            id: lapsed.id,
+                            passwordResetTokenExpiration: (0, moment_1.default)().subtract(1, 'hour'),
+                        })];
+                case 5:
+                    _a.sent();
+                    return [4 /*yield*/, LogCapture_1.LogCapture.during(function () { return __awaiter(void 0, void 0, void 0, function () {
+                            var _a, _b, _c, _d;
+                            return __generator(this, function (_e) {
+                                switch (_e.label) {
+                                    case 0:
+                                        _a = expect;
+                                        return [4 /*yield*/, invoke(executePasswordReset_1.executePasswordReset, { body: { token: token, newPassword: 'fresh-password' } })];
+                                    case 1:
+                                        _a.apply(void 0, [(_e.sent()).status]).toBe(200);
+                                        _b = expect;
+                                        return [4 /*yield*/, invoke(executePasswordReset_1.executePasswordReset, { body: { token: token, newPassword: 'again-password' } })];
+                                    case 2:
+                                        _b.apply(void 0, [(_e.sent()).status]).toBe(400);
+                                        _c = expect;
+                                        return [4 /*yield*/, invoke(executePasswordReset_1.executePasswordReset, { body: { token: lapsedToken, newPassword: 'late-password' } })];
+                                    case 3:
+                                        _c.apply(void 0, [(_e.sent()).status]).toBe(400);
+                                        _d = expect;
+                                        return [4 /*yield*/, invoke(validateResetPasswordToken_1.validateResetPasswordToken, { query: { token: lapsedToken } })];
+                                    case 4:
+                                        _d.apply(void 0, [(_e.sent()).body.isValid]).toBe(false);
+                                        return [2 /*return*/];
+                                }
+                            });
+                        }); })];
+                case 6:
+                    log = _a.sent();
+                    expect(log.addresses).toEqual([]);
+                    expect(log.text).toContain(digests.account('reset-redeem@test.local'));
+                    expect(log.text).toContain(digests.account('reset-lapsed@test.local'));
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    it('an invite: sent, re-sent, a send that fails, a re-send that fails — the invitee by its address digest', function () { return __awaiter(void 0, void 0, void 0, function () {
+        var inviter, log;
+        return __generator(this, function (_a) {
+            switch (_a.label) {
+                case 0: return [4 /*yield*/, testEnv.createUser({ name: 'Inviter', email: 'logs-inviter@test.local', roles: ['admin'] })];
+                case 1:
+                    inviter = _a.sent();
+                    testEnv.actAs(inviter);
+                    return [4 /*yield*/, LogCapture_1.LogCapture.during(function () { return __awaiter(void 0, void 0, void 0, function () {
+                            var _a, _b, failing, _c, _d;
+                            return __generator(this, function (_e) {
+                                switch (_e.label) {
+                                    case 0:
+                                        _a = expect;
+                                        return [4 /*yield*/, new Signup_1.Signup().sendInvite('Invitee@Example.invalid')];
+                                    case 1:
+                                        _a.apply(void 0, [_e.sent()]).toEqual({ sent: true });
+                                        _b = expect;
+                                        return [4 /*yield*/, new Signup_1.Signup().resendInvite('invitee@example.invalid')];
+                                    case 2:
+                                        _b.apply(void 0, [_e.sent()]).toEqual({ sent: true });
+                                        failing = jest
+                                            .spyOn(email_server_1.EmailSender.prototype, 'sendEmail')
+                                            .mockRejectedValue(new Error('Failed to send email'));
+                                        _e.label = 3;
+                                    case 3:
+                                        _e.trys.push([3, , 6, 7]);
+                                        _c = expect;
+                                        return [4 /*yield*/, new Signup_1.Signup().sendInvite('invitee-fails@example.invalid')];
+                                    case 4:
+                                        _c.apply(void 0, [(_e.sent()).sent]).toBe(false);
+                                        _d = expect;
+                                        return [4 /*yield*/, new Signup_1.Signup().resendInvite('invitee@example.invalid')];
+                                    case 5:
+                                        _d.apply(void 0, [(_e.sent()).sent]).toBe(false);
+                                        return [3 /*break*/, 7];
+                                    case 6:
+                                        failing.mockRestore();
+                                        return [7 /*endfinally*/];
+                                    case 7: return [2 /*return*/];
+                                }
+                            });
+                        }); })];
+                case 2:
+                    log = _a.sent();
+                    expect(email_server_1.MailSink.get().list()).toHaveLength(2);
+                    expect(log.addresses).toEqual([]);
+                    expect(log.text).toContain(digests.address('invitee-fails@example.invalid'));
+                    expect(log.text).toContain(digests.address('invitee@example.invalid'));
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    it('signup: an account created, then the same address again', function () { return __awaiter(void 0, void 0, void 0, function () {
+        var log;
+        return __generator(this, function (_a) {
+            switch (_a.label) {
+                case 0: return [4 /*yield*/, LogCapture_1.LogCapture.during(function () { return __awaiter(void 0, void 0, void 0, function () {
+                        var user, _a, _b;
+                        return __generator(this, function (_c) {
+                            switch (_c.label) {
+                                case 0:
+                                    user = { name: 'Signer', email: 'Logs-Signup@test.local', password: 'a-password' };
+                                    _a = expect;
+                                    return [4 /*yield*/, new Signup_1.Signup().createUser(user)];
+                                case 1:
+                                    _a.apply(void 0, [(_c.sent()).outcome]).toBe('created');
+                                    _b = expect;
+                                    return [4 /*yield*/, new Signup_1.Signup().createUser(user)];
+                                case 2:
+                                    _b.apply(void 0, [(_c.sent()).outcome]).toBe('exists');
+                                    return [2 /*return*/];
+                            }
+                        });
+                    }); })];
+                case 1:
+                    log = _a.sent();
+                    expect(log.addresses).toEqual([]);
+                    expect(log.text).toContain(digests.account('logs-signup@test.local'));
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    it("a double sign-up race: the database's refusal names the address — the log carries its digest instead", function () { return __awaiter(void 0, void 0, void 0, function () {
+        var hash, arrived, bothArrived, both, held, body, outcomes, log, _a, refusal;
+        return __generator(this, function (_b) {
+            switch (_b.label) {
+                case 0:
+                    hash = PasswordHasher_1.PasswordHasher.prototype.hash;
+                    arrived = 0;
+                    both = new Promise(function (resolve) { return (bothArrived = resolve); });
+                    held = jest.spyOn(PasswordHasher_1.PasswordHasher.prototype, 'hash').mockImplementation(function (password) {
+                        return __awaiter(this, void 0, void 0, function () {
+                            var hashed;
+                            return __generator(this, function (_a) {
+                                switch (_a.label) {
+                                    case 0: return [4 /*yield*/, hash.call(this, password)];
+                                    case 1:
+                                        hashed = _a.sent();
+                                        if (++arrived === 2) {
+                                            bothArrived();
+                                        }
+                                        return [4 /*yield*/, both];
+                                    case 2:
+                                        _a.sent();
+                                        return [2 /*return*/, hashed];
+                                }
+                            });
+                        });
+                    });
+                    body = { name: 'Racer', email: 'Logs-Race@test.local', password: 'a-password' };
+                    outcomes = [];
+                    return [4 /*yield*/, LogCapture_1.LogCapture.during(function () { return __awaiter(void 0, void 0, void 0, function () {
+                            return __generator(this, function (_a) {
+                                switch (_a.label) {
+                                    case 0:
+                                        _a.trys.push([0, , 2, 3]);
+                                        return [4 /*yield*/, Promise.all([0, 1].map(function () { return __awaiter(void 0, void 0, void 0, function () {
+                                                var request, outcome;
+                                                var _a;
+                                                return __generator(this, function (_b) {
+                                                    switch (_b.label) {
+                                                        case 0: return [4 /*yield*/, (0, passportSessionHarness_1.createPassportRequest)({ body: body })];
+                                                        case 1:
+                                                            request = (_b.sent()).request;
+                                                            return [4 /*yield*/, invoke(signup_1.signup, request)];
+                                                        case 2:
+                                                            outcome = _b.sent();
+                                                            return [2 /*return*/, __assign(__assign({}, outcome), { loggedInAs: (_a = request.session.passport) === null || _a === void 0 ? void 0 : _a.user })];
+                                                    }
+                                                });
+                                            }); }))];
+                                    case 1:
+                                        outcomes = _a.sent();
+                                        return [3 /*break*/, 3];
+                                    case 2:
+                                        held.mockRestore();
+                                        return [7 /*endfinally*/];
+                                    case 3: return [2 /*return*/];
+                                }
+                            });
+                        }); })];
+                case 1:
+                    log = _b.sent();
+                    // One account, one session; the loser was refused by the index and logged it — the refusal
+                    // naming the index, the address in its words replaced by the address's digest.
+                    _a = expect;
+                    return [4 /*yield*/, (0, db_1.getDbAsSystem)().query(user_1.tables.User, { email: 'logs-race@test.local' })];
+                case 2:
+                    // One account, one session; the loser was refused by the index and logged it — the refusal
+                    // naming the index, the address in its words replaced by the address's digest.
+                    _a.apply(void 0, [(_b.sent()).length]).toBe(1);
+                    expect(outcomes.filter(function (outcome) { return outcome.loggedInAs === 'logs-race@test.local'; })).toHaveLength(1);
+                    refusal = log.linesContaining('Signup failed');
+                    expect(refusal.lines).toHaveLength(1);
+                    expect(refusal.text).toContain('user_email_unique');
+                    expect(refusal.addresses).toEqual([]);
+                    expect(refusal.text).toContain(digests.address('logs-race@test.local'));
+                    // The database driver's own line for the refused statement is the driver's (the version a
+                    // package lock pins decides whether it prints bound values); this door's lines are the ones above.
+                    expect(log.linesContaining('[signup]').addresses).toEqual([]);
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    it('an invite whose send or write fails with the address in its error: the invitee by its digest, the error too', function () { return __awaiter(void 0, void 0, void 0, function () {
+        var inviter, naming, log;
+        return __generator(this, function (_a) {
+            switch (_a.label) {
+                case 0: return [4 /*yield*/, testEnv.createUser({ name: 'Inviter', email: 'logs-inviter-2@test.local', roles: ['admin'] })];
+                case 1:
+                    inviter = _a.sent();
+                    testEnv.actAs(inviter);
+                    return [4 /*yield*/, new Signup_1.Signup().sendInvite('invitee-standing@example.invalid')];
+                case 2:
+                    _a.sent();
+                    naming = function (address) {
+                        return Object.assign(new Error("6 ALREADY_EXISTS: Row [".concat(address, "] in table Invite already exists")), {
+                            code: 6,
+                            details: "Row [".concat(address, "] in table Invite already exists"),
+                        });
+                    };
+                    return [4 /*yield*/, LogCapture_1.LogCapture.during(function () { return __awaiter(void 0, void 0, void 0, function () {
+                            var failing, _a, _b;
+                            return __generator(this, function (_c) {
+                                switch (_c.label) {
+                                    case 0:
+                                        failing = jest
+                                            .spyOn(email_server_1.EmailSender.prototype, 'sendEmail')
+                                            .mockImplementation(function (options) { return __awaiter(void 0, void 0, void 0, function () { return __generator(this, function (_a) {
+                                            return [2 /*return*/, Promise.reject(naming(String(options.to)))];
+                                        }); }); });
+                                        _c.label = 1;
+                                    case 1:
+                                        _c.trys.push([1, , 4, 5]);
+                                        _a = expect;
+                                        return [4 /*yield*/, new Signup_1.Signup().sendInvite('Invitee-Named@Example.invalid')];
+                                    case 2:
+                                        _a.apply(void 0, [(_c.sent()).sent]).toBe(false);
+                                        _b = expect;
+                                        return [4 /*yield*/, new Signup_1.Signup().resendInvite('invitee-standing@example.invalid')];
+                                    case 3:
+                                        _b.apply(void 0, [(_c.sent()).sent]).toBe(false);
+                                        return [3 /*break*/, 5];
+                                    case 4:
+                                        failing.mockRestore();
+                                        return [7 /*endfinally*/];
+                                    case 5: return [2 /*return*/];
+                                }
+                            });
+                        }); })];
+                case 3:
+                    log = _a.sent();
+                    expect(log.text).toContain('Error sending invite');
+                    expect(log.text).toContain('Error re-sending invite');
+                    expect(log.text).toContain('in table Invite already exists');
+                    expect(log.addresses).toEqual([]);
+                    expect(log.text).toContain(digests.address('invitee-named@example.invalid'));
+                    expect(log.text).toContain(digests.address('invitee-standing@example.invalid'));
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    it('sign-in and sessions: a deactivated account refused, a session on a deactivated account, a session on a missing account', function () { return __awaiter(void 0, void 0, void 0, function () {
+        var log;
+        return __generator(this, function (_a) {
+            switch (_a.label) {
+                case 0: return [4 /*yield*/, (0, db_1.getDbAsSystem)().insert(user_1.tables.User, {
+                        name: 'Deactivated',
+                        email: 'logs-deactivated@test.local',
+                        password: (0, sha256_1.default)('correct-password').toString(),
+                        emailVerified: true,
+                        roles: [],
+                        status: 'deactivated',
+                    })];
+                case 1:
+                    _a.sent();
+                    return [4 /*yield*/, LogCapture_1.LogCapture.during(function () { return __awaiter(void 0, void 0, void 0, function () {
+                            var _a, _b, _c;
+                            return __generator(this, function (_d) {
+                                switch (_d.label) {
+                                    case 0:
+                                        _a = expect;
+                                        return [4 /*yield*/, (0, authenticate_1.authenticate)('Logs-Deactivated@test.local', 'correct-password')];
+                                    case 1:
+                                        _a.apply(void 0, [_d.sent()]).toBe('This account has been deactivated');
+                                        _b = expect;
+                                        return [4 /*yield*/, userCache_1.userCache.create('logs-session-1', 'logs-deactivated@test.local')];
+                                    case 2:
+                                        _b.apply(void 0, [(_d.sent()).id]).toBe('guest');
+                                        _c = expect;
+                                        return [4 /*yield*/, userCache_1.userCache.create('logs-session-2', 'logs-missing@test.local')];
+                                    case 3:
+                                        _c.apply(void 0, [(_d.sent()).id]).toBe('guest');
+                                        return [2 /*return*/];
+                                }
+                            });
+                        }); })];
+                case 2:
+                    log = _a.sent();
+                    expect(log.addresses).toEqual([]);
+                    expect(log.text).toContain(digests.account('logs-deactivated@test.local'));
+                    expect(log.text).toContain(digests.account('logs-missing@test.local'));
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    it('the sessions a deactivation kills, and a minted machine credential', function () { return __awaiter(void 0, void 0, void 0, function () {
+        var human, expires, declarations, log, _a;
+        return __generator(this, function (_b) {
+            switch (_b.label) {
+                case 0: return [4 /*yield*/, testEnv.createUser({ name: 'Soon Deactivated', email: 'logs-kill@test.local' })];
+                case 1:
+                    human = _b.sent();
+                    expires = new Date(Date.now() + 60 * 60 * 1000);
+                    return [4 /*yield*/, (0, db_1.getDbAsSystem)().insert(user_1.tables.Session, {
+                            sessionId: 'logs-kill',
+                            session: '{}',
+                            expires: expires,
+                            userEmail: human.email,
+                        })];
+                case 2:
+                    _b.sent();
+                    declarations = [new LogsMachineAccount()];
+                    objectCache()['@proteinjs/db/SourceRecordLoader'] = declarations;
+                    namedObjectCache()['@proteinjs/db/SourceRecordLoader'] = declarations.map(function (object) { return ({
+                        qualifiedName: '@proteinjs/user-server-test/LogsMachineAccount',
+                        packageName: '@proteinjs/user-server',
+                        object: object,
+                    }); });
+                    return [4 /*yield*/, new db_1.SourceRecordSyncRunner().load()];
+                case 3:
+                    _b.sent();
+                    return [4 /*yield*/, LogCapture_1.LogCapture.during(function () { return __awaiter(void 0, void 0, void 0, function () {
+                            var _a;
+                            return __generator(this, function (_b) {
+                                switch (_b.label) {
+                                    case 0: return [4 /*yield*/, (0, db_1.getDbAsSystem)().update(user_1.tables.User, { id: human.id, status: 'deactivated' })];
+                                    case 1:
+                                        _b.sent();
+                                        _a = expect;
+                                        return [4 /*yield*/, new MachineCredentials_1.MachineCredentials().mintCredential('machine-logs@test.local')];
+                                    case 2:
+                                        _a.apply(void 0, [(_b.sent()).secretName]).toBe('logs-ops-secret');
+                                        return [2 /*return*/];
+                                }
+                            });
+                        }); })];
+                case 4:
+                    log = _b.sent();
+                    _a = expect;
+                    return [4 /*yield*/, (0, db_1.getDbAsSystem)().query(user_1.tables.Session, { sessionId: 'logs-kill' })];
+                case 5:
+                    _a.apply(void 0, [_b.sent()]).toEqual([]);
+                    expect(log.addresses).toEqual([]);
+                    expect(log.text).toContain(digests.account('logs-kill@test.local'));
+                    expect(log.text).toContain(digests.account('machine-logs@test.local'));
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    it('the dev doors: a missing test account created, the first-admin grant, a session established', function () { return __awaiter(void 0, void 0, void 0, function () {
+        var admins, _i, _a, admin, log;
+        return __generator(this, function (_b) {
+            switch (_b.label) {
+                case 0:
+                    process.env.DEVELOPMENT = 'true';
+                    process.env.DEV_AUTO_LOGIN_EMAIL = 'logs-dev@test.local';
+                    process.env.DEV_BOOTSTRAP_ADMIN_EMAIL = 'logs-dev@test.local';
+                    delete process.env.DEV_BOOTSTRAP_ROLES;
+                    return [4 /*yield*/, (0, db_1.getDbAsSystem)().query(user_1.tables.User, {})];
+                case 1:
+                    admins = _b.sent();
+                    _i = 0, _a = admins.filter(function (user) { var _a; return ((_a = user.roles) !== null && _a !== void 0 ? _a : []).includes('admin'); });
+                    _b.label = 2;
+                case 2:
+                    if (!(_i < _a.length)) return [3 /*break*/, 5];
+                    admin = _a[_i];
+                    return [4 /*yield*/, (0, db_1.getDbAsSystem)().update(user_1.tables.User, { id: admin.id, roles: [] })];
+                case 3:
+                    _b.sent();
+                    _b.label = 4;
+                case 4:
+                    _i++;
+                    return [3 /*break*/, 2];
+                case 5: return [4 /*yield*/, LogCapture_1.LogCapture.during(function () { return __awaiter(void 0, void 0, void 0, function () {
+                        var _a;
+                        return __generator(this, function (_b) {
+                            switch (_b.label) {
+                                case 0:
+                                    _a = expect;
+                                    return [4 /*yield*/, (0, devLoginHarness_1.invokeDevLogin)()];
+                                case 1:
+                                    _a.apply(void 0, [(_b.sent()).loggedInAs]).toBe('logs-dev@test.local');
+                                    return [2 /*return*/];
+                            }
+                        });
+                    }); })];
+                case 6:
+                    log = _b.sent();
+                    expect(log.text).toContain('Dev bootstrap admin door: granted');
+                    expect(log.addresses).toEqual([]);
+                    expect(log.text).toContain(digests.account('logs-dev@test.local'));
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+});
+//# sourceMappingURL=NoAddressesInLogs.integration.test.js.map