@proteinjs/user-server 1.22.1 → 1.22.3

package/src/authentication/authenticate.ts

@@ -1,6 +1,7 @@
 import { getDbAsSystem } from '@proteinjs/db';
-import { tables } from '@proteinjs/user';
+import { User, tables } from '@proteinjs/user';
 import { Logger } from '@proteinjs/logger';
+import { RequestDigests } from '@proteinjs/util-node';
 import { DefaultAdminCredentials } from './DefaultAdminCredentials';
 import { PasswordHasher } from './PasswordHasher';
 
@@ -24,15 +25,12 @@ export async function authenticate(email: string, password: string): Promise<tru
     return true;
   }
 
-  // Fetch by EMAIL ONLY and compare in code — never query by password hash. Query-by-hash
-  // forced every stored credential into one deterministic queryable value (unsalted sha256);
-  // in-code comparison is what lets the stored format be salted and per-user.
-  const db = getDbAsSystem();
-  const user = await db.get(tables.User, { email: email.toLowerCase() });
-  const hasher = new PasswordHasher();
-  if (!user || !(await hasher.verify(user.password, password))) {
+  const { user, matches } = await checkPassword(email, password);
+  if (!user || !matches) {
     return 'User name or password incorrect';
   }
+  const db = getDbAsSystem();
+  const hasher = new PasswordHasher();
 
   // Verify-then-rehash: the just-proven password re-hashes a legacy sha256 row into the
   // current format in place — the only moment the plaintext is available to migrate with.
@@ -53,9 +51,38 @@ export async function authenticate(email: string, password: string): Promise<tru
       return true;
     }
 
-    logger.warn({ message: 'Refused login for deactivated account', obj: { email: email.toLowerCase() } });
+    logger.warn({
+      message: 'Refused login for deactivated account',
+      obj: { account: new RequestDigests().account(email) },
+    });
     return 'This account has been deactivated';
   }
 
   return true;
 }
+
+/**
+ * Looks the account up and verifies the password — the cost every refusal pays, whether or not
+ * the address has an account: with none, the password is verified against a stand-in of the
+ * same cost (`PasswordHasher.verifyAgainstNothing`), so a refusal's timing says nothing about
+ * the address; a human row still in the legacy sha256 format (verified in microseconds) pays the
+ * stand-in too, so a refusal's timing says nothing about whether the account has signed in since
+ * the format changed either. The login door also runs it on a throttled try and discards the
+ * verdict, so a throttled answer takes as long as a refused password. No side effects (no
+ * rehash, no log).
+ */
+export async function checkPassword(email: string, password: string): Promise<{ user?: User; matches: boolean }> {
+  // Fetch by EMAIL ONLY and compare in code — never query by password hash. Query-by-hash
+  // forced every stored credential into one deterministic queryable value (unsalted sha256);
+  // in-code comparison is what lets the stored format be salted and per-user.
+  const user = await getDbAsSystem().get(tables.User, { email: email.toLowerCase() });
+  const hasher = new PasswordHasher();
+  if (!user) {
+    return { matches: await hasher.verifyAgainstNothing(password) };
+  }
+  const matches = await hasher.verify(user.password, password);
+  if (hasher.needsRehash(user.password, user.isLoadedFromSource === true ? 'machine' : 'human')) {
+    await hasher.verifyAgainstNothing(password);
+  }
+  return { user, matches };
+}

package/src/authorization/userCache.ts

@@ -2,6 +2,7 @@ import moment from 'moment';
 import { SessionDataCache } from '@proteinjs/server-api';
 import { getDbAsSystem } from '@proteinjs/db';
 import { Logger } from '@proteinjs/logger';
+import { RequestDigests } from '@proteinjs/util-node';
 import { User, tables, guestUser, USER_SESSION_CACHE_KEY } from '@proteinjs/user';
 import { DefaultAdminCredentials } from '../authentication/DefaultAdminCredentials';
 
@@ -42,7 +43,7 @@ export const userCache: SessionDataCache<User> = {
           // account is deactivated — every request runs as the unauthenticated guest.
           logger.warn({
             message: `Session references a deactivated account; resolving as unauthenticated`,
-            obj: { sessionId, userEmail },
+            obj: { sessionId, account: new RequestDigests().account(userEmail) },
           });
         } else if (accountUser) {
           delete (accountUser as any)['password'];
@@ -54,7 +55,7 @@ export const userCache: SessionDataCache<User> = {
           // build as an unhandled rejection and downs the process.
           logger.warn({
             message: `Session references an account that does not exist; resolving as unauthenticated`,
-            obj: { sessionId, userEmail },
+            obj: { sessionId, account: new RequestDigests().account(userEmail) },
           });
         }
       }

package/src/routes/devLogin.ts

@@ -1,5 +1,6 @@
 import { Route } from '@proteinjs/server-api';
 import { Logger } from '@proteinjs/logger';
+import { RequestDigests } from '@proteinjs/util-node';
 import { emailRegex } from '@proteinjs/util';
 import { establishSession } from '../authentication/establishSession';
 import { Roles } from '../services/Roles';
@@ -88,22 +89,33 @@ export const devLogin: Route = {
       email = requested;
     }
     email = email.toLowerCase();
+    const digests = new RequestDigests();
 
-    const creation = await new Signup().createAccount({
-      name: email.slice(0, email.indexOf('@')),
-      email,
-      password: 'test',
-      emailVerified: false, // same shape an inviteless signup produces
-      invitedBy: null,
-    });
+    let creation: 'created' | 'exists';
+    try {
+      creation = await new Signup().createAccount({
+        name: email.slice(0, email.indexOf('@')),
+        email,
+        password: 'test',
+        emailVerified: false, // same shape an inviteless signup produces
+        invitedBy: null,
+      });
+    } catch (error) {
+      // createAccount refuses in plain words (an address a machine-account declaration owns); the
+      // dev door answers the way its other refusals do — the words, no session, no row.
+      response
+        .status(400)
+        .send(`/dev/login: ${error instanceof Error ? error.message : 'the account could not be created'}`);
+      return;
+    }
     if (creation === 'created') {
-      logger.info({ message: 'Dev auto-login created missing test account', obj: { email } });
+      logger.info({ message: 'Dev auto-login created missing test account', obj: { account: digests.account(email) } });
     }
 
     const bootstrapEmail = (process.env.DEV_BOOTSTRAP_ADMIN_EMAIL ?? '').trim().toLowerCase();
     if (bootstrapEmail && email === bootstrapEmail) {
       const outcome = await new Roles().bootstrapAdmin(email);
-      logger.info({ message: `Dev bootstrap admin door: ${outcome}`, obj: { email } });
+      logger.info({ message: `Dev bootstrap admin door: ${outcome}`, obj: { account: digests.account(email) } });
     }
 
     const bootstrapRoles = DevBootstrapRoles.rolesFor(email);
@@ -115,7 +127,7 @@ export const devLogin: Route = {
     // establishSession commits the session row before the redirect — the redirected GET / must
     // never read the store ahead of the write (observed: first /dev/login load landed on /login).
     await establishSession(request, email);
-    logger.info({ message: 'Dev auto-login session established', obj: { email } });
+    logger.info({ message: 'Dev auto-login session established', obj: { account: digests.account(email) } });
     response.redirect('/');
   },
 };

package/src/routes/executePasswordReset.ts

@@ -1,8 +1,10 @@
 import { Route } from '@proteinjs/server-api';
 import { routes } from '@proteinjs/user';
 import { Logger } from '@proteinjs/logger';
+import { RequestDigests } from '@proteinjs/util-node';
 import { PasswordHasher } from '../authentication/PasswordHasher';
 import { PasswordResetToken } from '../authentication/PasswordResetToken';
+import { signInThrottle } from '../throttle/SignInThrottle';
 
 /**
  * Route handler for executing a password reset.
@@ -13,6 +15,10 @@ import { PasswordResetToken } from '../authentication/PasswordResetToken';
  * The token itself never reaches the log. A request that carries no body at all is refused like
  * one that carries a blank password.
  *
+ * A redeemed link also opens the account's sign-in window again (`SignInThrottle`): the person
+ * just proved the mailbox, so a reset made while wrong guesses held the door shut lets the new
+ * password in at once instead of waiting the window out.
+ *
  * @bodyParam {string} token - The password reset token.
  * @bodyParam {string} newPassword - The new password for the user.
  */
@@ -21,6 +27,7 @@ export const executePasswordReset: Route = {
   method: routes.executePasswordReset.method,
   onRequest: async (request, response): Promise<void> => {
     const logger = new Logger({ name: 'executePasswordReset' });
+    const digests = new RequestDigests();
     const { token, newPassword } = request.body ?? {};
     if (typeof newPassword !== 'string' || newPassword.length === 0) {
       response.status(400).send({ error: 'New password cannot be blank' });
@@ -39,7 +46,7 @@ export const executePasswordReset: Route = {
     }
 
     if (resolution.status === 'expired') {
-      logger.info({ message: `Expired reset token used`, obj: { email: resolution.user.email } });
+      logger.info({ message: `Expired reset token used`, obj: { account: digests.account(resolution.user.email) } });
       response.status(400).send({ error: 'Reset token has expired' });
       return;
     }
@@ -47,12 +54,13 @@ export const executePasswordReset: Route = {
     const { user } = resolution;
     const hashedPassword = await new PasswordHasher().hash(newPassword);
     if (!(await resetToken.redeem(user, resolution.token, hashedPassword))) {
-      logger.info({ message: `Reset token already redeemed`, obj: { email: user.email } });
+      logger.info({ message: `Reset token already redeemed`, obj: { account: digests.account(user.email) } });
       response.status(400).send({ error: 'Invalid or expired reset token' });
       return;
     }
 
-    logger.info({ message: `Password successfully reset`, obj: { email: user.email } });
+    signInThrottle.recordSuccess(digests.account(user.email));
+    logger.info({ message: `Password successfully reset`, obj: { account: digests.account(user.email) } });
     response.send({ message: 'Password has been successfully reset' });
   },
 };

package/src/routes/initiatePasswordReset.ts

@@ -2,12 +2,21 @@ import { Route } from '@proteinjs/server-api';
 import { getDbAsSystem } from '@proteinjs/db';
 import { routes, tables, uiRoutes } from '@proteinjs/user';
 import { Logger } from '@proteinjs/logger';
+import { RequestDigests } from '@proteinjs/util-node';
 import moment from 'moment';
 import {
   EmailSender,
   getDefaultPasswordResetEmailConfigFactory as getDefaultConfigFactory,
 } from '@proteinjs/email-server';
 import { PasswordResetToken } from '../authentication/PasswordResetToken';
+import { ClientAddress } from '../throttle/ClientAddress';
+import { passwordResetThrottle } from '../throttle/PasswordResetThrottle';
+
+/**
+ * The door's one answer: the same words for an address with an account or without, inside or
+ * past a window, mailed or not — the page shows exactly this sentence.
+ */
+const ONE_ANSWER = { message: 'If that address has an account, a reset link is on its way.' };
 
 /**
  * Route for initiating a password reset process.
@@ -16,6 +25,13 @@ import { PasswordResetToken } from '../authentication/PasswordResetToken';
  * its expiry on the user row — and mails the token to the account as a reset link. The token is
  * withdrawn again when the mail fails to send.
  *
+ * ONE ANSWER: every request with an address is answered `ONE_ANSWER` — BEFORE the address is
+ * looked up — whether it has an account, is throttled (`PasswordResetThrottle`: per client and
+ * per address), is inside the account's five-minute gap, or its mail fails; so neither the
+ * words, the status nor the timing say whether an address has an account. The work runs after
+ * the answer. Every request is one outcome line carrying the account digest and the coarse IP
+ * hash (`RequestDigests`) — never the address.
+ *
  * Requires an implementation of `DefaultPasswordResetEmailConfigFactory` to build the password reset email with.
  *
  * @bodyParam {string} email - The email address of the user requesting a password reset.
@@ -34,16 +50,20 @@ export const initiatePasswordReset: Route = {
       return;
     }
 
+    const digests = new RequestDigests();
+    const fields = { account: digests.account(requestedEmail), ip: digests.coarseIp(new ClientAddress().of(request)) };
+    const window = passwordResetThrottle.admit(fields.ip, fields.account);
+    response.send(ONE_ANSWER);
+    if (window) {
+      logger.warn({ message: `Password reset throttled`, obj: { ...fields, window } });
+      return;
+    }
+
     const email = requestedEmail.toLowerCase();
     const db = getDbAsSystem();
-
-    const genericResponse = { message: 'If an account with that email exists, we have sent a password reset link.' };
-
     const user = await db.get(tables.User, { email });
     if (!user) {
-      logger.info({ message: `Password reset requested for non-existent user`, obj: { email } });
-      // Don't reveal that the user doesn't exist
-      response.send(genericResponse);
+      logger.info({ message: `Password reset requested for non-existent user`, obj: fields });
       return;
     }
 
@@ -51,8 +71,7 @@ export const initiatePasswordReset: Route = {
     const resetToken = new PasswordResetToken();
     const mintedAt = resetToken.mintedAt(user);
     if (mintedAt && moment().diff(mintedAt, 'minutes') < 5) {
-      logger.info({ message: `Password reset requested too soon for user`, obj: { email } });
-      response.send(genericResponse);
+      logger.info({ message: `Password reset requested too soon for user`, obj: fields });
       return;
     }
 
@@ -81,12 +100,11 @@ export const initiatePasswordReset: Route = {
         ...config.options,
       });
 
-      response.send(genericResponse);
+      logger.info({ message: `Password reset link mailed`, obj: fields });
     } catch (error: any) {
-      logger.error({ message: `Failed to send password reset email`, obj: { email }, error });
+      logger.error({ message: `Failed to send password reset email`, obj: fields, error });
       // The link never reached the account: withdraw the token so asking again is not throttled
       await resetToken.revoke(user, passwordResetToken);
-      response.status(500).send({ error: 'Failed to send password reset email. Please try again later.' });
     }
   },
 };

package/src/routes/login.ts

@@ -1,34 +1,65 @@
 import { Route } from '@proteinjs/server-api';
 import { routes } from '@proteinjs/user';
-import { authenticate } from '../authentication/authenticate';
+import { Logger } from '@proteinjs/logger';
+import { authenticate, checkPassword } from '../authentication/authenticate';
 import { establishSession } from '../authentication/establishSession';
 import { AccountDeletion } from '../services/AccountDeletion';
+import { ClientAddress } from '../throttle/ClientAddress';
+import { RequestDigests } from '../throttle/RequestDigests';
+import { SignInThrottle, signInThrottle } from '../throttle/SignInThrottle';
 
+/**
+ * `POST /user/login`. Throttled per client and per account (`SignInThrottle`): a throttled try
+ * is told "Too many attempts. Try again in a few minutes." whether or not the address has an
+ * account, after the same password check a refusal runs (verdict discarded), so neither the
+ * words nor the timing tell. Every refusal is a "Sign-in refused" line and every throttled try
+ * its own "Sign-in throttled" line, carrying the account digest and the coarse IP hash
+ * (`RequestDigests`) — never the address.
+ */
 export const login: Route = {
   path: routes.login.path,
   method: routes.login.method,
   onRequest: async (request: any, response): Promise<void> => {
-    const credentials: { email: string; password: string } = request.body;
-    if (!credentials.email || !credentials.password) {
+    const logger = new Logger({ name: 'login' });
+    const credentials = request.body ?? {};
+    // A field that is not text is a blank one — never something to call methods on.
+    const email: string = typeof credentials.email === 'string' ? credentials.email : '';
+    const password: string = typeof credentials.password === 'string' ? credentials.password : '';
+    const digests = new RequestDigests();
+    const ip = digests.coarseIp(new ClientAddress().of(request));
+    const account = email ? digests.account(email) : undefined;
+    const fields = account ? { account, ip } : { ip };
+
+    // The account is counted only when a password came with the try: a blank one judges nothing.
+    const window = signInThrottle.admit(ip, password ? account : undefined);
+    if (window) {
+      await checkPassword(email, password);
+      logger.warn({ message: 'Sign-in throttled', obj: { ...fields, window } });
+      response.send({ error: SignInThrottle.ANSWER });
+      return;
+    }
+
+    if (!email || !password || !account) {
       const error = `Email and password cannot be blank`;
-      console.error(error);
+      logger.info({ message: 'Sign-in refused', obj: { ...fields, reason: error } });
       response.send({ error });
       return;
     }
 
-    const result = await authenticate(credentials.email, credentials.password);
+    const result = await authenticate(email, password);
     if (result !== true) {
-      console.error(result);
+      logger.info({ message: 'Sign-in refused', obj: { ...fields, reason: result } });
       response.send({ error: result });
       return;
     }
+    signInThrottle.recordSuccess(account, ip);
 
     // Cancel-by-login: a pending-deletion account's successful authentication IS the cancel
     // signal. The restore runs synchronously here, BEFORE request.login, so the first
     // authenticated paint sees the fully restored account (no transient).
     let outcome: Awaited<ReturnType<AccountDeletion['cancelPendingDeletion']>>;
     try {
-      outcome = await new AccountDeletion().cancelPendingDeletion(credentials.email);
+      outcome = await new AccountDeletion().cancelPendingDeletion(email);
     } catch (error) {
       // Security boundary: the login response never carries internal error detail — an
       // attacker probing emails must learn nothing from failure shapes (founder ruling
@@ -45,7 +76,7 @@ export const login: Route = {
       return;
     }
 
-    await establishSession(request, credentials.email);
+    await establishSession(request, email);
     response.send({});
   },
 };

package/src/routes/signup.ts

@@ -1,5 +1,6 @@
 import { Route } from '@proteinjs/server-api';
 import { Logger } from '@proteinjs/logger';
+import { RequestDigests } from '@proteinjs/util-node';
 import { UserSignup, routes } from '@proteinjs/user';
 import { establishSession } from '../authentication/establishSession';
 import { Signup } from '../services/Signup';
@@ -40,8 +41,10 @@ export const signup: Route = {
       );
     } catch (error: any) {
       // createUser throws plain-words errors deliberately (invite expired / invite required /
-      // email missing); the message is the user-facing contract, same as the RPC layer's.
-      logger.error({ message: 'Signup failed', error });
+      // email missing); the message is the user-facing contract, same as the RPC layer's. The log
+      // gets the error through the digest door: a concurrent double sign-up's unique-index refusal
+      // names the address in the database's own words.
+      logger.error({ message: 'Signup failed', error: new RequestDigests().redactError(error) });
       response.send({ error: error instanceof Error ? error.message : 'Sign up failed.' });
       return;
     }

package/src/routes/validateResetPasswordToken.ts

@@ -1,6 +1,7 @@
 import { Route } from '@proteinjs/server-api';
 import { routes } from '@proteinjs/user';
 import { Logger } from '@proteinjs/logger';
+import { RequestDigests } from '@proteinjs/util-node';
 import { PasswordResetToken } from '../authentication/PasswordResetToken';
 
 export const validateResetPasswordToken: Route = {
@@ -26,7 +27,10 @@ export const validateResetPasswordToken: Route = {
     }
 
     if (resolution.status === 'expired') {
-      logger.info({ message: `Expired reset token used`, obj: { email: resolution.user.email } });
+      logger.info({
+        message: `Expired reset token used`,
+        obj: { account: new RequestDigests().account(resolution.user.email) },
+      });
       response.status(200).send({ isValid: false, message: 'Token has expired' });
       return;
     }

package/src/services/MachineCredentials.ts

@@ -1,14 +1,17 @@
 import { randomBytes } from 'crypto';
 import { getDbAsSystem } from '@proteinjs/db';
 import {
+  MachineAccountRefusal,
   MachineAccountView,
   MachineCredentialsService,
   MintedMachineCredential,
   USER_PERMISSIONS,
+  User,
   getMachineAccounts,
   tables,
 } from '@proteinjs/user';
 import { Logger } from '@proteinjs/logger';
+import { RequestDigests } from '@proteinjs/util-node';
 import { Service } from '@proteinjs/service';
 import { PasswordHasher } from '../authentication/PasswordHasher';
 
@@ -23,7 +26,9 @@ import { PasswordHasher } from '../authentication/PasswordHasher';
  * account's existing sessions (the old
  * credential dies with them), and returns the plaintext ONCE for pasting into the declaration's
  * Secret Manager secret. The same call rotates. Machine rows only (`is_loaded_from_source`);
- * human credentials go through the password-reset flow.
+ * human credentials go through the password-reset flow. A declared address held by a row the
+ * boot sync does not own (a person's signup, a hand-made row) has no machine account at all —
+ * the sync refused the declaration — and both the list and the mint say so.
  */
 export class MachineCredentials implements MachineCredentialsService {
   public serviceMetadata: Service['serviceMetadata'] = {
@@ -36,15 +41,22 @@ export class MachineCredentials implements MachineCredentialsService {
     const db = getDbAsSystem();
     const views: MachineAccountView[] = [];
     for (const declaration of getMachineAccounts()) {
-      const row = await db.get(tables.User, { email: declaration.email });
-      const booted = !!row && row.isLoadedFromSource === true;
+      const row: User | undefined = await db.get(tables.User, { email: declaration.email });
+      const refusal = row && this.refusal(row);
       views.push({
         email: declaration.email,
         accountName: declaration.accountName,
         roles: [...declaration.roles],
         secretName: declaration.secretName,
-        status: booted ? (row.status === 'deactivated' ? 'deactivated' : 'active') : 'pending first boot',
-        hasCredential: booted && !!row.password,
+        status: !row
+          ? 'pending first boot'
+          : refusal
+            ? 'declaration refused'
+            : row.status === 'deactivated'
+              ? 'deactivated'
+              : 'active',
+        ...(refusal ? { refusal } : {}),
+        hasCredential: !!row && !refusal && !!row.password,
       });
     }
 
@@ -63,11 +75,20 @@ export class MachineCredentials implements MachineCredentialsService {
     }
 
     const db = getDbAsSystem();
-    const user = await db.get(tables.User, { email: normalizedEmail });
-    if (!user || user.isLoadedFromSource !== true) {
+    const user: User | undefined = await db.get(tables.User, { email: normalizedEmail });
+    if (!user) {
       throw new Error(
         `The machine account row for '${normalizedEmail}' has not been loaded from source yet — ` +
-          `the boot sync creates (or adopts) it. Boot the server with the declaration, then mint.`
+          `the boot sync creates it. Boot the server with the declaration, then mint.`
+      );
+    }
+
+    const refusal = this.refusal(user);
+    if (refusal) {
+      throw new Error(
+        `The declaration for '${normalizedEmail}' was refused at boot: ${refusal} — the boot sync ` +
+          `never takes over a row it does not own, so there is no machine account to mint for. The ` +
+          `first boot after that row is gone creates it.`
       );
     }
 
@@ -79,7 +100,7 @@ export class MachineCredentials implements MachineCredentialsService {
     await db.delete(tables.Session, { userEmail: normalizedEmail });
     logger.info({
       message: `Minted machine credential`,
-      obj: { email: normalizedEmail, secretName: declaration.secretName },
+      obj: { account: new RequestDigests().account(normalizedEmail), secretName: declaration.secretName },
     });
 
     return {
@@ -91,4 +112,18 @@ export class MachineCredentials implements MachineCredentialsService {
         `secret, then restart the service that reads it — the previous credential is already invalid.`,
     };
   }
+
+  /**
+   * Why the boot sync refused a declaration whose address this row holds — undefined for the
+   * account's own row. The sync owns a row only when it created it (`isLoadedFromSource`); any
+   * other row under a declared address is never taken over (@proteinjs/db's natural-key refusal),
+   * and the one machine marker says whose row it is.
+   */
+  private refusal(row: User): MachineAccountRefusal | undefined {
+    if (row.isLoadedFromSource === true) {
+      return undefined;
+    }
+
+    return row.machine === true ? 'a hand-made machine row holds this address' : 'a person holds this address';
+  }
 }

package/src/services/Roles.ts

@@ -1,6 +1,7 @@
 import { getDbAsSystem, QueryBuilderFactory } from '@proteinjs/db';
 import { RolesService, RolesCatalog, UserAuth, UserRepo, tables, USER_PERMISSIONS } from '@proteinjs/user';
 import { Logger } from '@proteinjs/logger';
+import { RequestDigests } from '@proteinjs/util-node';
 import { Service } from '@proteinjs/service';
 
 /**
@@ -67,7 +68,10 @@ export class Roles implements RolesService {
       await db.update(tables.User, { id: user.id, roles: [...roles, 'admin'] });
       await db.insert(tables.RoleGrantEvent, { actor: user.id, target: user.id, role: 'admin', action: 'grant' });
     });
-    logger.info({ message: 'Break-glass admin granted by the dev first-admin door', obj: { target: user.id, email } });
+    logger.info({
+      message: 'Break-glass admin granted by the dev first-admin door',
+      obj: { target: user.id, account: new RequestDigests().account(email) },
+    });
     return 'granted';
   }
 
@@ -122,7 +126,7 @@ export class Roles implements RolesService {
     });
     logger.info({
       message: 'Roles granted by the dev role-bootstrap door',
-      obj: { target: user.id, email, granted: outcome.granted },
+      obj: { target: user.id, account: new RequestDigests().account(email), granted: outcome.granted },
     });
     return outcome;
   }

package/src/services/Signup.ts

@@ -11,10 +11,12 @@ import {
   User,
   UserSignup,
   USER_PERMISSIONS,
+  getMachineAccounts,
 } from '@proteinjs/user';
 import moment from 'moment';
 import { lib } from 'crypto-js';
 import { Logger } from '@proteinjs/logger';
+import { RequestDigests } from '@proteinjs/util-node';
 import {
   EmailSender,
   getDefaultInviteEmailConfigFactory,
@@ -124,7 +126,10 @@ export class Signup implements SignupService {
       invitedBy: invite ? invite.invitedBy : null,
     });
     if (creation === 'exists') {
-      logger.error({ message: `User with this email already exists`, obj: { email } });
+      logger.error({
+        message: `User with this email already exists`,
+        obj: { account: new RequestDigests().account(email) },
+      });
       if (config.getExistingUserEmailContent) {
         const { text, html } = config.getExistingUserEmailContent();
         await emailSender.sendEmail({
@@ -146,7 +151,7 @@ export class Signup implements SignupService {
       html,
       ...config.options,
     });
-    logger.info({ message: `Created user`, obj: { email } });
+    logger.info({ message: `Created user`, obj: { account: new RequestDigests().account(email) } });
     return { outcome: 'created', email };
   }
 
@@ -183,7 +188,14 @@ export class Signup implements SignupService {
       await this.emailInvite(caseInsensitiveEmail, token, config);
       return { sent: true };
     } catch (error: any) {
-      logger.error({ message: 'Error sending invite', obj: { email: caseInsensitiveEmail }, error });
+      // The try block covers the Invite row's write and the mail: a refusal's own words may name
+      // the address, so the error reaches the log through the digest door too.
+      const digests = new RequestDigests();
+      logger.error({
+        message: 'Error sending invite',
+        obj: { invitee: digests.address(caseInsensitiveEmail) },
+        error: digests.redactError(error),
+      });
       return {
         sent: false,
         error: 'Error occurred.',
@@ -218,7 +230,12 @@ export class Signup implements SignupService {
       await this.emailInvite(caseInsensitiveEmail, token, config);
       return { sent: true };
     } catch (error: any) {
-      logger.error({ message: 'Error re-sending invite', obj: { email: caseInsensitiveEmail }, error });
+      const digests = new RequestDigests();
+      logger.error({
+        message: 'Error re-sending invite',
+        obj: { invitee: digests.address(caseInsensitiveEmail) },
+        error: digests.redactError(error),
+      });
       return {
         sent: false,
         error: 'Error occurred.',
@@ -300,6 +317,11 @@ export class Signup implements SignupService {
    * (`devLogin`, which auto-creates missing same-domain test accounts). Not exposed as an RPC:
    * the service surface is the `SignupService` INTERFACE (ServiceRouter walks its declared
    * methods), so extra class methods stay server-internal.
+   *
+   * An address a `MachineAccount` declaration owns is never registered, whatever its row state:
+   * a person's row under it would make the boot sync refuse the declaration (it never takes over
+   * a row it does not own), so the address is refused here in plain words — the declared machine
+   * accounts of this build are the list, nothing else.
    */
   async createAccount(account: {
     name: string;
@@ -310,6 +332,10 @@ export class Signup implements SignupService {
   }): Promise<'created' | 'exists'> {
     const db = getDbAsSystem();
     const email = account.email.toLowerCase();
+    if (getMachineAccounts().some((machineAccount) => machineAccount.email === email)) {
+      throw new Error(`This address can't be registered.`);
+    }
+
     const existingUser = await db.get(tables.User, { email });
     if (existingUser) {
       return 'exists';