@proteinjs/user-server 1.22.1 → 1.22.3

package/test/MachineAccounts.integration.test.ts

@@ -6,6 +6,7 @@ import { SourceRepository } from '@proteinjs/reflection';
 import { ServiceAuth } from '@proteinjs/service/dist/src/ServiceAuth';
 import { MachineAccount, RoleCatalogEntry, User, UserRepo, tables } from '@proteinjs/user';
 import { authenticate } from '../src/authentication/authenticate';
+import { SocketIOSessionWatcher } from '../src/authentication/SocketIOSessionWatcher';
 import { UserStatusTableWatcher } from '../src/authentication/UserStatusTableWatcher';
 import { MachineCredentials } from '../src/services/MachineCredentials';
 import { Roles } from '../src/services/Roles';
@@ -48,10 +49,12 @@ const resetTableWatcherMap = () => {
 
 /**
  * Machine accounts as source records, at the user layer: declare-only on the REAL mixed user
- * table, adopt-in-place by email (id + password survive — the old credential still logs in),
- * removed-from-source auto-deactivation with session kill through the categorical
- * UserStatusTableWatcher, the machine/human ledger split (Roles refuses machine targets),
- * declaration validation, and credential minting (hash-only at rest, plaintext shown once).
+ * table, a declared address held by a row the sync does not own (a person's signup, a hand-made
+ * row) REFUSED — never taken over, its credential and sessions never inherited — and said so on
+ * the admin list and the mint; removed-from-source auto-deactivation with session kill through
+ * the categorical UserStatusTableWatcher, completing at boot before any socket server exists;
+ * the machine/human ledger split (Roles refuses machine targets), declaration validation, and
+ * credential minting (hash-only at rest, plaintext shown once).
  */
 describe('Machine accounts as source records', () => {
   const objectCache = () => (SourceRepository.get() as unknown as SourceRepositoryInternals).objectCache;
@@ -90,8 +93,10 @@ describe('Machine accounts as source records', () => {
       '@proteinjs/user-auth/AuthenticatedUserRepo'
     ] = [new UserRepo()];
     objectCache()['@proteinjs/user/RoleCatalogEntry'] = [new OpsRole()];
-    // Exactly the deactivation watcher observes this run, rebuilt from the seeded cache.
-    objectCache()['@proteinjs/db/TableWatcher'] = [new UserStatusTableWatcher()];
+    // The two session watchers a real server registers, rebuilt from the seeded cache — and no
+    // socket server exists in this process: the shape of a boot's sync (and of a migration Job,
+    // which never starts one), where deactivations delete sessions before the server is up.
+    objectCache()['@proteinjs/db/TableWatcher'] = [new UserStatusTableWatcher(), new SocketIOSessionWatcher()];
     resetTableWatcherMap();
   }, 120000);
 
@@ -139,32 +144,102 @@ describe('Machine accounts as source records', () => {
     expect(humanAfter).toMatchObject({ name: 'A human', roles: ['ops'] });
   });
 
-  it('adopt-in-place by email: the hand-made row keeps its id and password; declared fields revert', async () => {
-    // The deployed-env shape: a hand-made machine row with an env-random id, a provisioned
-    // credential, and runtime-granted roles that have drifted from the declaration.
+  it(`a person's row holding a declared address refuses the declaration: no roles, no machine flag, their password and sessions stand; the list and the mint say so`, async () => {
+    // A person registered the address before the declaration shipped (inviteless signup): their
+    // own row, their own password, a live session — never a machine.
+    const person = await testEnv.createUser({ name: 'A person', email: 'machine-ops@test.local' });
+    await insertSession('person-session', 'machine-ops@test.local');
+    class Sibling extends TestOpsMachineAccount {
+      id = 'machine-sibling';
+      email = 'machine-sibling@test.local';
+      accountName = 'Sibling machine';
+      secretName = 'sibling-secret';
+    }
+
+    // The boot completes and the rest of the declarations land.
+    await boot([new TestOpsMachineAccount(), new Sibling()]);
+    expect(await getDbAsSystem().get(tables.User, { email: 'machine-sibling@test.local' })).toMatchObject({
+      roles: ['ops'],
+      isLoadedFromSource: true,
+      machine: true,
+    });
+
+    // The person's row is untouched: none of the declared roles, not a machine, not source-owned.
+    const row = await machineRow();
+    expect(row.id).toBe(person.id);
+    expect(row).toMatchObject({ name: 'A person', roles: [], emailVerified: true });
+    expect(row.machine).toBeFalsy();
+    expect(row.isLoadedFromSource).toBeFalsy();
+    expect(row.password).toBe(person.password);
+    expect(row.updated.valueOf()).toBe(person.updated.valueOf());
+    expect(await sessionEmails()).toEqual(['machine-ops@test.local']);
+
+    // The admin list names the refusal; the mint refuses in the same words and changes nothing.
+    const view = (await new MachineCredentials().listMachineAccounts()).find(
+      (account) => account.email === 'machine-ops@test.local'
+    );
+    expect(view).toMatchObject({
+      status: 'declaration refused',
+      refusal: 'a person holds this address',
+      hasCredential: false,
+    });
+    await expect(new MachineCredentials().mintCredential('machine-ops@test.local')).rejects.toThrow(
+      /declaration for 'machine-ops@test\.local' was refused at boot: a person holds this address/
+    );
+    expect((await machineRow()).password).toBe(person.password);
+    expect(await sessionEmails()).toEqual(['machine-ops@test.local']);
+
+    // Idempotent: the next boot refuses again and still grants nothing.
+    await boot([new TestOpsMachineAccount(), new Sibling()]);
+    const again = await machineRow();
+    expect(again).toMatchObject({ roles: [] });
+    expect(again.isLoadedFromSource).toBeFalsy();
+  });
+
+  it('a hand-made machine row the sync never owned is refused too — no row is taken over by a declaration any more', async () => {
+    // The pre-declaration provisioning shape: a row made by hand and marked machine, with a
+    // provisioned credential and runtime-granted roles.
     const handMade = await testEnv.createUser({
       name: 'Hand-made bridge',
       email: 'machine-ops@test.local',
       roles: ['ops', 'stale-role'],
     });
+    await getDbAsSystem().update(tables.User, { id: handMade.id, machine: true });
 
     await boot([new TestOpsMachineAccount()]);
 
-    const adopted = await machineRow();
-    expect(adopted.id).toBe(handMade.id);
-    expect(adopted).toMatchObject({
-      name: 'Test ops machine',
-      roles: ['ops'],
-      status: 'active',
-      isLoadedFromSource: true,
-      // Adoption stamps the explicit machine column onto the hand-made row (the deployed-env
-      // provisioning shape — e.g. a hand-provisioned deploy account becomes honest on boot).
+    const row = await machineRow();
+    expect(row).toMatchObject({
+      id: handMade.id,
+      name: 'Hand-made bridge',
+      roles: ['ops', 'stale-role'],
       machine: true,
     });
-    // The credential survived adoption: the account still authenticates with its old password
-    // (createUser stores sha256('test')... it stores the raw string; assert equality instead).
-    expect(adopted.password).toBe(handMade.password);
-    expect((await getDbAsSystem().query(tables.User, { email: 'machine-ops@test.local' })).length).toBe(1);
+    expect(row.isLoadedFromSource).toBeFalsy();
+    expect(row.password).toBe(handMade.password);
+    const [view] = await new MachineCredentials().listMachineAccounts();
+    expect(view).toMatchObject({
+      status: 'declaration refused',
+      refusal: 'a hand-made machine row holds this address',
+      hasCredential: false,
+    });
+  });
+
+  it('withdrawing a declaration while its account holds a live session: the boot completes before any socket server exists — the row deactivated, the session gone', async () => {
+    class Keeper extends TestOpsMachineAccount {
+      id = 'machine-keeper';
+      email = 'machine-keeper@test.local';
+      accountName = 'Keeper machine';
+      secretName = 'keeper-secret';
+    }
+    await boot([new TestOpsMachineAccount(), new Keeper()]);
+    await insertSession('machine-live-session', 'machine-ops@test.local');
+
+    // The declaration is withdrawn; the package still boots with its other declaration.
+    await boot([new Keeper()]);
+
+    expect((await machineRow()).status).toBe('deactivated');
+    expect(await sessionEmails()).toEqual([]);
   });
 
   it('removed from source: deactivated (never deleted), sessions killed, login refused; re-declaring reactivates', async () => {

package/test/NoAddressesInLogs.integration.test.ts

@@ -0,0 +1,409 @@
+import moment from 'moment';
+import sha256 from 'crypto-js/sha256';
+import { SourceRecordSyncRunner, getDbAsSystem } from '@proteinjs/db';
+import { EmailSender, MailSink } from '@proteinjs/email-server';
+import { SourceRepository } from '@proteinjs/reflection';
+import { MachineAccount, RoleCatalogEntry, UserRepo, tables } from '@proteinjs/user';
+import { RequestDigests } from '@proteinjs/util-node';
+import { authenticate } from '../src/authentication/authenticate';
+import { PasswordHasher } from '../src/authentication/PasswordHasher';
+import { PasswordResetToken } from '../src/authentication/PasswordResetToken';
+import { UserStatusTableWatcher } from '../src/authentication/UserStatusTableWatcher';
+import { userCache } from '../src/authorization/userCache';
+import { executePasswordReset } from '../src/routes/executePasswordReset';
+import { initiatePasswordReset } from '../src/routes/initiatePasswordReset';
+import { validateResetPasswordToken } from '../src/routes/validateResetPasswordToken';
+import { signup } from '../src/routes/signup';
+import { MachineCredentials } from '../src/services/MachineCredentials';
+import { Signup } from '../src/services/Signup';
+import { invokeDevLogin } from './devLoginHarness';
+import { createPassportRequest } from './passportSessionHarness';
+import { LogCapture } from './LogCapture';
+import { UserServerTestEnvironment } from './UserServerTestEnvironment';
+
+const testEnv = new UserServerTestEnvironment();
+
+/**
+ * No e-mail address reaches the server log from the doors that handle one — every line that names
+ * a person names them by a keyed digest (`RequestDigests`, from `@proteinjs/util-node`): the
+ * account digest for an account (or the address a sign-in or reset door was asked about), the
+ * address digest for a bare address (an invitee); the mail lines beside them (the email server's)
+ * add the recipient's domain. Driven end to end against the Spanner emulator and the mail sink, the log captured as
+ * the default writer emits it (every console level, every logger), on every path through:
+ * - the reset door: an unknown address, a mailed link, a repeat inside five minutes, a failed send;
+ * - the reset link: redeemed, presented again, expired, and an expired link validated;
+ * - an invite: sent, re-sent, a send that fails, a re-send that fails;
+ * - signup: an account created, then the same address again;
+ * - sign-in and sessions: a deactivated account refused, a session on a deactivated account, a
+ *   session on a missing account;
+ * - the sessions a deactivation kills, and a minted machine credential;
+ * - the dev doors: a missing test account created, the first-admin grant, a session established;
+ * - a caught error whose words name an address: a double sign-up's unique-index refusal (the
+ *   database's own words), an invite whose send or write fails with the address in its error.
+ *
+ * The one line that keeps an address is the dev role-bootstrap door's `[dev-bootstrap]` marker —
+ * development only, and read back by address by the development tooling — so it is closed here.
+ */
+
+type RouteOutcome = { status: number; body?: any };
+
+const invoke = async (
+  route: { onRequest: (request: never, response: never) => Promise<void> },
+  request: Record<string, unknown>
+): Promise<RouteOutcome> => {
+  const outcome: RouteOutcome = { status: 200 };
+  const response = {
+    status(code: number) {
+      outcome.status = code;
+      return this;
+    },
+    send(body?: unknown) {
+      outcome.body = body;
+    },
+  };
+  await route.onRequest(request as never, response as never);
+  return outcome;
+};
+
+type SourceRepositoryInternals = {
+  objectCache: Record<string, unknown[]>;
+  namedObjectCache: Record<string, { qualifiedName: string; packageName: string; object: unknown }[]>;
+};
+
+const objectCache = () => (SourceRepository.get() as unknown as SourceRepositoryInternals).objectCache;
+const namedObjectCache = () => (SourceRepository.get() as unknown as SourceRepositoryInternals).namedObjectCache;
+
+/** The deactivation watcher map is built once per process from the cache; rebuild it from what is seeded now. */
+const resetTableWatcherMap = () => {
+  const runner = (getDbAsSystem() as unknown as { tableWatcherRunner: object }).tableWatcherRunner;
+  (runner.constructor as { tableWatcherMap?: unknown }).tableWatcherMap = undefined;
+};
+
+class OpsRole implements RoleCatalogEntry {
+  role = 'ops';
+  description = 'Operational machinery';
+}
+
+class LogsMachineAccount extends MachineAccount {
+  id = 'machine-logs-ops';
+  email = 'machine-logs@test.local';
+  accountName = 'Logs ops machine';
+  roles = ['ops'];
+  secretName = 'logs-ops-secret';
+}
+
+const DEV_ENV = ['DEVELOPMENT', 'DEV_AUTO_LOGIN_EMAIL', 'DEV_BOOTSTRAP_ADMIN_EMAIL', 'DEV_BOOTSTRAP_ROLES'] as const;
+
+describe('no e-mail address reaches the server log', () => {
+  const digests = new RequestDigests();
+  const originalEnv: Record<string, string | undefined> = {};
+
+  beforeAll(async () => {
+    await testEnv.beforeAll();
+    for (const key of ['EMAIL_TRANSPORT', ...DEV_ENV]) {
+      originalEnv[key] = process.env[key];
+    }
+    process.env.EMAIL_TRANSPORT = 'sink';
+    const cache = objectCache();
+    cache['@proteinjs/email-server/DefaultEmailConfigFactory'] = [
+      {
+        getEmailConfig: () => ({
+          host: 'smtp.test.local',
+          port: 465,
+          secure: true,
+          from: '"Example" <hi@example.com>',
+        }),
+      },
+    ];
+    cache['@proteinjs/email-server/DefaultPasswordResetEmailConfigFactory'] = [
+      { getConfig: () => ({ getEmailContent: (path: string) => ({ text: `Reset: https://app.test.local/${path}` }) }) },
+    ];
+    cache['@proteinjs/email-server/DefaultInviteEmailConfigFactory'] = [
+      {
+        getConfig: () => ({
+          options: { subject: 'Your invite' },
+          getEmailContent: (path: string) => ({ text: `Accept: /${path}`, html: `<a href="/${path}">Accept</a>` }),
+        }),
+      },
+    ];
+    cache['@proteinjs/email-server/DefaultSignupConfirmationEmailConfigFactory'] = [
+      { getConfig: () => ({ getNewUserEmailContent: () => ({ text: 'welcome', html: '<p>welcome</p>' }) }) },
+    ];
+    // Invite-optional, the library default — the suites load src, never the generated source graph.
+    cache['@proteinjs/user-server/DefaultInviteConfigFactory'] = [{ getConfig: () => ({ isInviteOnly: false }) }];
+    cache['@proteinjs/user-auth/AuthenticatedUserRepo'] = [new UserRepo()];
+    cache['@proteinjs/user/RoleCatalogEntry'] = [new OpsRole()];
+    cache['@proteinjs/db/TableWatcher'] = [new UserStatusTableWatcher()];
+    resetTableWatcherMap();
+  }, 120000);
+
+  afterAll(async () => {
+    const cache = objectCache();
+    for (const key of [
+      '@proteinjs/email-server/DefaultEmailConfigFactory',
+      '@proteinjs/email-server/DefaultPasswordResetEmailConfigFactory',
+      '@proteinjs/email-server/DefaultInviteEmailConfigFactory',
+      '@proteinjs/email-server/DefaultSignupConfirmationEmailConfigFactory',
+      '@proteinjs/user-server/DefaultInviteConfigFactory',
+      '@proteinjs/user-auth/AuthenticatedUserRepo',
+      '@proteinjs/user/RoleCatalogEntry',
+      '@proteinjs/db/TableWatcher',
+      '@proteinjs/db/SourceRecordLoader',
+    ]) {
+      delete cache[key];
+    }
+    delete namedObjectCache()['@proteinjs/db/SourceRecordLoader'];
+    resetTableWatcherMap();
+    for (const [key, value] of Object.entries(originalEnv)) {
+      if (value === undefined) {
+        delete process.env[key];
+      } else {
+        process.env[key] = value;
+      }
+    }
+    await testEnv.afterAll();
+  });
+
+  beforeEach(() => {
+    MailSink.get().clear();
+  });
+
+  it('the reset door: an unknown address, a mailed link, a repeat inside five minutes, a failed send', async () => {
+    await testEnv.createUser({ name: 'Reset Mailed', email: 'reset-mailed@test.local' });
+    await testEnv.createUser({ name: 'Reset Fails', email: 'reset-fails@test.local' });
+
+    const log = await LogCapture.during(async () => {
+      await invoke(initiatePasswordReset, { body: { email: 'reset-nobody@test.local' } });
+      await invoke(initiatePasswordReset, { body: { email: 'Reset-Mailed@test.local' } });
+      await invoke(initiatePasswordReset, { body: { email: 'reset-mailed@test.local' } });
+      const failing = jest
+        .spyOn(EmailSender.prototype, 'sendEmail')
+        .mockRejectedValueOnce(new Error('Failed to send email'));
+      try {
+        await invoke(initiatePasswordReset, { body: { email: 'reset-fails@test.local' } });
+      } finally {
+        failing.mockRestore();
+      }
+    });
+
+    expect(MailSink.get().list()).toHaveLength(1);
+    expect(log.addresses).toEqual([]);
+    for (const address of ['reset-nobody@test.local', 'reset-mailed@test.local', 'reset-fails@test.local']) {
+      expect(log.text).toContain(digests.account(address));
+    }
+  });
+
+  it('the reset link: redeemed, presented again, expired, and an expired link validated', async () => {
+    const redeemer = await testEnv.createUser({ name: 'Reset Redeemer', email: 'reset-redeem@test.local' });
+    const token = await new PasswordResetToken().mint(redeemer);
+    const lapsed = await testEnv.createUser({ name: 'Reset Lapsed', email: 'reset-lapsed@test.local' });
+    const lapsedToken = await new PasswordResetToken().mint(lapsed);
+    await getDbAsSystem().update(tables.User, {
+      id: lapsed.id,
+      passwordResetTokenExpiration: moment().subtract(1, 'hour'),
+    });
+
+    const log = await LogCapture.during(async () => {
+      expect((await invoke(executePasswordReset, { body: { token, newPassword: 'fresh-password' } })).status).toBe(200);
+      expect((await invoke(executePasswordReset, { body: { token, newPassword: 'again-password' } })).status).toBe(400);
+      expect(
+        (await invoke(executePasswordReset, { body: { token: lapsedToken, newPassword: 'late-password' } })).status
+      ).toBe(400);
+      expect((await invoke(validateResetPasswordToken, { query: { token: lapsedToken } })).body.isValid).toBe(false);
+    });
+
+    expect(log.addresses).toEqual([]);
+    expect(log.text).toContain(digests.account('reset-redeem@test.local'));
+    expect(log.text).toContain(digests.account('reset-lapsed@test.local'));
+  });
+
+  it('an invite: sent, re-sent, a send that fails, a re-send that fails — the invitee by its address digest', async () => {
+    const inviter = await testEnv.createUser({ name: 'Inviter', email: 'logs-inviter@test.local', roles: ['admin'] });
+    testEnv.actAs(inviter);
+
+    const log = await LogCapture.during(async () => {
+      expect(await new Signup().sendInvite('Invitee@Example.invalid')).toEqual({ sent: true });
+      expect(await new Signup().resendInvite('invitee@example.invalid')).toEqual({ sent: true });
+      const failing = jest
+        .spyOn(EmailSender.prototype, 'sendEmail')
+        .mockRejectedValue(new Error('Failed to send email'));
+      try {
+        expect((await new Signup().sendInvite('invitee-fails@example.invalid')).sent).toBe(false);
+        expect((await new Signup().resendInvite('invitee@example.invalid')).sent).toBe(false);
+      } finally {
+        failing.mockRestore();
+      }
+    });
+
+    expect(MailSink.get().list()).toHaveLength(2);
+    expect(log.addresses).toEqual([]);
+    expect(log.text).toContain(digests.address('invitee-fails@example.invalid'));
+    expect(log.text).toContain(digests.address('invitee@example.invalid'));
+  });
+
+  it('signup: an account created, then the same address again', async () => {
+    const log = await LogCapture.during(async () => {
+      const user = { name: 'Signer', email: 'Logs-Signup@test.local', password: 'a-password' };
+      expect((await new Signup().createUser(user)).outcome).toBe('created');
+      expect((await new Signup().createUser(user)).outcome).toBe('exists');
+    });
+
+    expect(log.addresses).toEqual([]);
+    expect(log.text).toContain(digests.account('logs-signup@test.local'));
+  });
+
+  it("a double sign-up race: the database's refusal names the address — the log carries its digest instead", async () => {
+    // Both requests pass the existence check before either writes: each one's password hash is held
+    // until both have arrived, so both inserts race and the unique index on the address refuses one —
+    // the refusal's own words name the address it refused.
+    const hash = PasswordHasher.prototype.hash;
+    let arrived = 0;
+    let bothArrived!: () => void;
+    const both = new Promise<void>((resolve) => (bothArrived = resolve));
+    const held = jest.spyOn(PasswordHasher.prototype, 'hash').mockImplementation(async function (
+      this: PasswordHasher,
+      password: string
+    ) {
+      const hashed = await hash.call(this, password);
+      if (++arrived === 2) {
+        bothArrived();
+      }
+      await both;
+      return hashed;
+    });
+    const body = { name: 'Racer', email: 'Logs-Race@test.local', password: 'a-password' };
+
+    let outcomes: (RouteOutcome & { loggedInAs?: string })[] = [];
+    const log = await LogCapture.during(async () => {
+      try {
+        outcomes = await Promise.all(
+          [0, 1].map(async () => {
+            const { request } = await createPassportRequest({ body });
+            const outcome = await invoke(signup, request);
+            return { ...outcome, loggedInAs: request.session.passport?.user };
+          })
+        );
+      } finally {
+        held.mockRestore();
+      }
+    });
+
+    // One account, one session; the loser was refused by the index and logged it — the refusal
+    // naming the index, the address in its words replaced by the address's digest.
+    expect((await getDbAsSystem().query(tables.User, { email: 'logs-race@test.local' })).length).toBe(1);
+    expect(outcomes.filter((outcome) => outcome.loggedInAs === 'logs-race@test.local')).toHaveLength(1);
+    const refusal = log.linesContaining('Signup failed');
+    expect(refusal.lines).toHaveLength(1);
+    expect(refusal.text).toContain('user_email_unique');
+    expect(refusal.addresses).toEqual([]);
+    expect(refusal.text).toContain(digests.address('logs-race@test.local'));
+    // The database driver's own line for the refused statement is the driver's (the version a
+    // package lock pins decides whether it prints bound values); this door's lines are the ones above.
+    expect(log.linesContaining('[signup]').addresses).toEqual([]);
+  });
+
+  it('an invite whose send or write fails with the address in its error: the invitee by its digest, the error too', async () => {
+    const inviter = await testEnv.createUser({ name: 'Inviter', email: 'logs-inviter-2@test.local', roles: ['admin'] });
+    testEnv.actAs(inviter);
+    await new Signup().sendInvite('invitee-standing@example.invalid');
+    // What a caught error looks like when its words are the address's: a refusal naming the key.
+    const naming = (address: string) =>
+      Object.assign(new Error(`6 ALREADY_EXISTS: Row [${address}] in table Invite already exists`), {
+        code: 6,
+        details: `Row [${address}] in table Invite already exists`,
+      });
+
+    const log = await LogCapture.during(async () => {
+      const failing = jest
+        .spyOn(EmailSender.prototype, 'sendEmail')
+        .mockImplementation(async (options) => Promise.reject(naming(String(options.to))));
+      try {
+        expect((await new Signup().sendInvite('Invitee-Named@Example.invalid')).sent).toBe(false);
+        expect((await new Signup().resendInvite('invitee-standing@example.invalid')).sent).toBe(false);
+      } finally {
+        failing.mockRestore();
+      }
+    });
+
+    expect(log.text).toContain('Error sending invite');
+    expect(log.text).toContain('Error re-sending invite');
+    expect(log.text).toContain('in table Invite already exists');
+    expect(log.addresses).toEqual([]);
+    expect(log.text).toContain(digests.address('invitee-named@example.invalid'));
+    expect(log.text).toContain(digests.address('invitee-standing@example.invalid'));
+  });
+
+  it('sign-in and sessions: a deactivated account refused, a session on a deactivated account, a session on a missing account', async () => {
+    await getDbAsSystem().insert(tables.User, {
+      name: 'Deactivated',
+      email: 'logs-deactivated@test.local',
+      password: sha256('correct-password').toString(),
+      emailVerified: true,
+      roles: [],
+      status: 'deactivated',
+    });
+
+    const log = await LogCapture.during(async () => {
+      expect(await authenticate('Logs-Deactivated@test.local', 'correct-password')).toBe(
+        'This account has been deactivated'
+      );
+      expect((await userCache.create('logs-session-1', 'logs-deactivated@test.local')).id).toBe('guest');
+      expect((await userCache.create('logs-session-2', 'logs-missing@test.local')).id).toBe('guest');
+    });
+
+    expect(log.addresses).toEqual([]);
+    expect(log.text).toContain(digests.account('logs-deactivated@test.local'));
+    expect(log.text).toContain(digests.account('logs-missing@test.local'));
+  });
+
+  it('the sessions a deactivation kills, and a minted machine credential', async () => {
+    const human = await testEnv.createUser({ name: 'Soon Deactivated', email: 'logs-kill@test.local' });
+    const expires = new Date(Date.now() + 60 * 60 * 1000);
+    await getDbAsSystem().insert(tables.Session, {
+      sessionId: 'logs-kill',
+      session: '{}',
+      expires,
+      userEmail: human.email,
+    });
+    const declarations = [new LogsMachineAccount()];
+    objectCache()['@proteinjs/db/SourceRecordLoader'] = declarations;
+    namedObjectCache()['@proteinjs/db/SourceRecordLoader'] = declarations.map((object) => ({
+      qualifiedName: '@proteinjs/user-server-test/LogsMachineAccount',
+      packageName: '@proteinjs/user-server',
+      object,
+    }));
+    await new SourceRecordSyncRunner().load();
+
+    const log = await LogCapture.during(async () => {
+      await getDbAsSystem().update(tables.User, { id: human.id, status: 'deactivated' });
+      expect((await new MachineCredentials().mintCredential('machine-logs@test.local')).secretName).toBe(
+        'logs-ops-secret'
+      );
+    });
+
+    expect(await getDbAsSystem().query(tables.Session, { sessionId: 'logs-kill' })).toEqual([]);
+    expect(log.addresses).toEqual([]);
+    expect(log.text).toContain(digests.account('logs-kill@test.local'));
+    expect(log.text).toContain(digests.account('machine-logs@test.local'));
+  });
+
+  it('the dev doors: a missing test account created, the first-admin grant, a session established', async () => {
+    process.env.DEVELOPMENT = 'true';
+    process.env.DEV_AUTO_LOGIN_EMAIL = 'logs-dev@test.local';
+    process.env.DEV_BOOTSTRAP_ADMIN_EMAIL = 'logs-dev@test.local';
+    delete process.env.DEV_BOOTSTRAP_ROLES;
+    // The first-admin door grants only while no account holds admin.
+    const admins = await getDbAsSystem().query(tables.User, {});
+    for (const admin of admins.filter((user) => (user.roles ?? []).includes('admin'))) {
+      await getDbAsSystem().update(tables.User, { id: admin.id, roles: [] });
+    }
+
+    const log = await LogCapture.during(async () => {
+      expect((await invokeDevLogin()).loggedInAs).toBe('logs-dev@test.local');
+    });
+
+    expect(log.text).toContain('Dev bootstrap admin door: granted');
+    expect(log.addresses).toEqual([]);
+    expect(log.text).toContain(digests.account('logs-dev@test.local'));
+  });
+});

package/test/RequestDigests.test.ts

@@ -0,0 +1,81 @@
+import { createHash } from 'crypto';
+import { RequestDigests } from '../src/throttle/RequestDigests';
+
+/**
+ * The two keyed digests the throttled doors key their windows on and write on their log lines:
+ * the account digest (a keyed hash of the lowercased address) and the coarse IP hash. Both are
+ * stable for one key (so an operator can say "one account, one device" across lines, pods and
+ * restarts) and useless without it (never the address, never a plain hash a list of addresses
+ * could reverse).
+ */
+describe('RequestDigests', () => {
+  const digests = new RequestDigests({ secret: 'test-session-secret' });
+
+  it('the account digest is stable for one address whatever its case or surrounding spaces', () => {
+    const digest = digests.account('Ada.Lovelace@Example.com');
+
+    expect(digest).toMatch(/^[0-9a-f]{16}$/);
+    expect(digests.account('ada.lovelace@example.com')).toBe(digest);
+    expect(digests.account('  ADA.LOVELACE@EXAMPLE.COM ')).toBe(digest);
+    expect(digests.account('ada.lovelace@example.org')).not.toBe(digest);
+  });
+
+  it('the account digest is keyed: another key gives another digest, and it is no plain hash of the address', () => {
+    const address = 'ada.lovelace@example.com';
+    const digest = digests.account(address);
+
+    expect(new RequestDigests({ secret: 'another-secret' }).account(address)).not.toBe(digest);
+    expect(createHash('sha256').update(address).digest('hex')).not.toContain(digest);
+    expect(digest).not.toContain('ada');
+  });
+
+  it('the account digest and the coarse IP hash are separate: one value never reads as the other', () => {
+    expect(digests.account('203.0.113.7')).not.toBe(digests.coarseIp('203.0.113.7'));
+  });
+
+  it('the coarse IP hash is stable for one IPv4 address and differs for the next', () => {
+    const hash = digests.coarseIp('203.0.113.7');
+
+    expect(hash).toMatch(/^[0-9a-f]{16}$/);
+    expect(digests.coarseIp('203.0.113.7')).toBe(hash);
+    expect(digests.coarseIp('::ffff:203.0.113.7')).toBe(hash);
+    expect(digests.coarseIp('203.0.113.8')).not.toBe(hash);
+  });
+
+  it('IPv6 is coarsened to its /64 — one device rotates freely inside its own /64', () => {
+    const hash = digests.coarseIp('2001:db8:1:2:aaaa:bbbb:cccc:dddd');
+
+    expect(digests.coarseIp('2001:db8:1:2::1')).toBe(hash);
+    expect(digests.coarseIp('2001:0db8:0001:0002:ffff:0:0:1')).toBe(hash);
+    expect(digests.coarseIp('2001:db8:1:3::1')).not.toBe(hash);
+  });
+
+  it('with no key configured the digests refuse to run — never a plain hash, never a key of their own', () => {
+    const original = process.env.SESSION_SECRET;
+    delete process.env.SESSION_SECRET;
+    try {
+      expect(() => new RequestDigests().account('ada.lovelace@example.com')).toThrow(/SESSION_SECRET/);
+      expect(() => new RequestDigests({ secret: '' }).coarseIp('203.0.113.7')).toThrow(/SESSION_SECRET/);
+    } finally {
+      if (original !== undefined) {
+        process.env.SESSION_SECRET = original;
+      }
+    }
+  });
+
+  it('reads the key the deployment configures (SESSION_SECRET) when none is passed', () => {
+    const original = process.env.SESSION_SECRET;
+    process.env.SESSION_SECRET = 'test-session-secret';
+    try {
+      expect(new RequestDigests().account('ada.lovelace@example.com')).toBe(
+        digests.account('ada.lovelace@example.com')
+      );
+    } finally {
+      if (original === undefined) {
+        delete process.env.SESSION_SECRET;
+      } else {
+        process.env.SESSION_SECRET = original;
+      }
+    }
+  });
+});