@proteinjs/user-server 1.22.2 → 1.22.4

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@proteinjs/user-server",
-  "version": "1.22.2",
+  "version": "1.22.4",
   "description": "User server components",
   "publishConfig": {
     "access": "public"
@@ -22,15 +22,16 @@
     "test": "jest --runInBand --passWithNoTests"
   },
   "dependencies": {
-    "@proteinjs/db": "^1.47.0",
+    "@proteinjs/db": "^1.47.3",
     "@proteinjs/db-file": "^1.5.3",
     "@proteinjs/email-server": "^1.4.0",
     "@proteinjs/logger": "^1.0.21",
     "@proteinjs/reflection": "^1.2.0",
-    "@proteinjs/server": "^3.5.1",
+    "@proteinjs/server": "^3.8.5",
     "@proteinjs/server-api": "^3.0.11",
-    "@proteinjs/user": "^1.20.1",
+    "@proteinjs/user": "^1.20.2",
     "@proteinjs/util": "^1.6.1",
+    "@proteinjs/util-node": "^1.11.1",
     "argon2": "^0.45.1",
     "crypto-js": "4.0.0",
     "express-session": "1.17.1",
@@ -59,5 +60,5 @@
   },
   "main": "./dist/generated/index.js",
   "types": "./dist/generated/index.d.ts",
-  "gitHead": "ae97c22e42cbb471bddf3f0ddc08f93fad4be375"
+  "gitHead": "a2e6c0a0688d7681fb398354a07c76a9bb08644e"
 }

package/src/authentication/SocketIOSessionWatcher.ts

@@ -5,6 +5,11 @@ import { SocketIOServerRepo } from '@proteinjs/server';
 /**
  * Handles Socket.IO session cleanup (such as disconnecting sockets)
  * when sessions are deleted.
+ *
+ * A deletion is not always made by a running server: a boot's source-record sync — and a
+ * migration Job, which never starts one — deactivates a withdrawn machine account and deletes its
+ * sessions before any socket server exists. Then no socket can be open, and there is nothing to
+ * close.
  */
 export class SocketIOSessionWatcher implements TableWatcher<Session> {
   name(): string {
@@ -21,7 +26,14 @@ export class SocketIOSessionWatcher implements TableWatcher<Session> {
     initialQb: QueryBuilder<T>,
     deleteQb: QueryBuilder<T>
   ): Promise<void> {
+    const socketIOServer = SocketIOServerRepo.getSocketIOServerIfExists();
     const deletedSessionIds = deletedRecords.map((deletedRecord) => deletedRecord.sessionId);
-    SocketIOServerRepo.getSocketIOServer().in(deletedSessionIds).disconnectSockets(true);
+    // No rooms is never sent: socket.io applies an operation with an empty room list to EVERY
+    // socket on the namespace.
+    if (!socketIOServer || deletedSessionIds.length === 0) {
+      return;
+    }
+
+    socketIOServer.in(deletedSessionIds).disconnectSockets(true);
   }
 }

package/src/authentication/UserStatusTableWatcher.ts

@@ -1,6 +1,7 @@
 import { QueryBuilder, Table, TableWatcher, getDbAsSystem } from '@proteinjs/db';
 import { User, tables } from '@proteinjs/user';
 import { Logger } from '@proteinjs/logger';
+import { RequestDigests } from '@proteinjs/util-node';
 
 /**
  * The one owner of "deactivated ⇒ sessions die": any user-table update writing
@@ -48,7 +49,7 @@ export class UserStatusTableWatcher implements TableWatcher<User> {
       if (deletedSessions > 0) {
         this.logger.info({
           message: `Deactivation killed sessions`,
-          obj: { email: user.email, sessions: deletedSessions },
+          obj: { account: new RequestDigests().account(user.email), sessions: deletedSessions },
         });
       }
     });

package/src/authentication/authenticate.ts

@@ -1,7 +1,7 @@
 import { getDbAsSystem } from '@proteinjs/db';
 import { User, tables } from '@proteinjs/user';
 import { Logger } from '@proteinjs/logger';
-import { RequestDigests } from '../throttle/RequestDigests';
+import { RequestDigests } from '@proteinjs/util-node';
 import { DefaultAdminCredentials } from './DefaultAdminCredentials';
 import { PasswordHasher } from './PasswordHasher';
 

package/src/authorization/userCache.ts

@@ -2,6 +2,7 @@ import moment from 'moment';
 import { SessionDataCache } from '@proteinjs/server-api';
 import { getDbAsSystem } from '@proteinjs/db';
 import { Logger } from '@proteinjs/logger';
+import { RequestDigests } from '@proteinjs/util-node';
 import { User, tables, guestUser, USER_SESSION_CACHE_KEY } from '@proteinjs/user';
 import { DefaultAdminCredentials } from '../authentication/DefaultAdminCredentials';
 
@@ -42,7 +43,7 @@ export const userCache: SessionDataCache<User> = {
           // account is deactivated — every request runs as the unauthenticated guest.
           logger.warn({
             message: `Session references a deactivated account; resolving as unauthenticated`,
-            obj: { sessionId, userEmail },
+            obj: { sessionId, account: new RequestDigests().account(userEmail) },
           });
         } else if (accountUser) {
           delete (accountUser as any)['password'];
@@ -54,7 +55,7 @@ export const userCache: SessionDataCache<User> = {
           // build as an unhandled rejection and downs the process.
           logger.warn({
             message: `Session references an account that does not exist; resolving as unauthenticated`,
-            obj: { sessionId, userEmail },
+            obj: { sessionId, account: new RequestDigests().account(userEmail) },
           });
         }
       }

package/src/routes/devLogin.ts

@@ -1,5 +1,6 @@
 import { Route } from '@proteinjs/server-api';
 import { Logger } from '@proteinjs/logger';
+import { RequestDigests } from '@proteinjs/util-node';
 import { emailRegex } from '@proteinjs/util';
 import { establishSession } from '../authentication/establishSession';
 import { Roles } from '../services/Roles';
@@ -88,22 +89,33 @@ export const devLogin: Route = {
       email = requested;
     }
     email = email.toLowerCase();
+    const digests = new RequestDigests();
 
-    const creation = await new Signup().createAccount({
-      name: email.slice(0, email.indexOf('@')),
-      email,
-      password: 'test',
-      emailVerified: false, // same shape an inviteless signup produces
-      invitedBy: null,
-    });
+    let creation: 'created' | 'exists';
+    try {
+      creation = await new Signup().createAccount({
+        name: email.slice(0, email.indexOf('@')),
+        email,
+        password: 'test',
+        emailVerified: false, // same shape an inviteless signup produces
+        invitedBy: null,
+      });
+    } catch (error) {
+      // createAccount refuses in plain words (an address a machine-account declaration owns); the
+      // dev door answers the way its other refusals do — the words, no session, no row.
+      response
+        .status(400)
+        .send(`/dev/login: ${error instanceof Error ? error.message : 'the account could not be created'}`);
+      return;
+    }
     if (creation === 'created') {
-      logger.info({ message: 'Dev auto-login created missing test account', obj: { email } });
+      logger.info({ message: 'Dev auto-login created missing test account', obj: { account: digests.account(email) } });
     }
 
     const bootstrapEmail = (process.env.DEV_BOOTSTRAP_ADMIN_EMAIL ?? '').trim().toLowerCase();
     if (bootstrapEmail && email === bootstrapEmail) {
       const outcome = await new Roles().bootstrapAdmin(email);
-      logger.info({ message: `Dev bootstrap admin door: ${outcome}`, obj: { email } });
+      logger.info({ message: `Dev bootstrap admin door: ${outcome}`, obj: { account: digests.account(email) } });
     }
 
     const bootstrapRoles = DevBootstrapRoles.rolesFor(email);
@@ -115,7 +127,7 @@ export const devLogin: Route = {
     // establishSession commits the session row before the redirect — the redirected GET / must
     // never read the store ahead of the write (observed: first /dev/login load landed on /login).
     await establishSession(request, email);
-    logger.info({ message: 'Dev auto-login session established', obj: { email } });
+    logger.info({ message: 'Dev auto-login session established', obj: { account: digests.account(email) } });
     response.redirect('/');
   },
 };

package/src/routes/executePasswordReset.ts

@@ -1,9 +1,9 @@
 import { Route } from '@proteinjs/server-api';
 import { routes } from '@proteinjs/user';
 import { Logger } from '@proteinjs/logger';
+import { RequestDigests } from '@proteinjs/util-node';
 import { PasswordHasher } from '../authentication/PasswordHasher';
 import { PasswordResetToken } from '../authentication/PasswordResetToken';
-import { RequestDigests } from '../throttle/RequestDigests';
 import { signInThrottle } from '../throttle/SignInThrottle';
 
 /**
@@ -27,6 +27,7 @@ export const executePasswordReset: Route = {
   method: routes.executePasswordReset.method,
   onRequest: async (request, response): Promise<void> => {
     const logger = new Logger({ name: 'executePasswordReset' });
+    const digests = new RequestDigests();
     const { token, newPassword } = request.body ?? {};
     if (typeof newPassword !== 'string' || newPassword.length === 0) {
       response.status(400).send({ error: 'New password cannot be blank' });
@@ -45,7 +46,7 @@ export const executePasswordReset: Route = {
     }
 
     if (resolution.status === 'expired') {
-      logger.info({ message: `Expired reset token used`, obj: { email: resolution.user.email } });
+      logger.info({ message: `Expired reset token used`, obj: { account: digests.account(resolution.user.email) } });
       response.status(400).send({ error: 'Reset token has expired' });
       return;
     }
@@ -53,13 +54,13 @@ export const executePasswordReset: Route = {
     const { user } = resolution;
     const hashedPassword = await new PasswordHasher().hash(newPassword);
     if (!(await resetToken.redeem(user, resolution.token, hashedPassword))) {
-      logger.info({ message: `Reset token already redeemed`, obj: { email: user.email } });
+      logger.info({ message: `Reset token already redeemed`, obj: { account: digests.account(user.email) } });
       response.status(400).send({ error: 'Invalid or expired reset token' });
       return;
     }
 
-    signInThrottle.recordSuccess(new RequestDigests().account(user.email));
-    logger.info({ message: `Password successfully reset`, obj: { email: user.email } });
+    signInThrottle.recordSuccess(digests.account(user.email));
+    logger.info({ message: `Password successfully reset`, obj: { account: digests.account(user.email) } });
     response.send({ message: 'Password has been successfully reset' });
   },
 };

package/src/routes/initiatePasswordReset.ts

@@ -2,6 +2,7 @@ import { Route } from '@proteinjs/server-api';
 import { getDbAsSystem } from '@proteinjs/db';
 import { routes, tables, uiRoutes } from '@proteinjs/user';
 import { Logger } from '@proteinjs/logger';
+import { RequestDigests } from '@proteinjs/util-node';
 import moment from 'moment';
 import {
   EmailSender,
@@ -9,7 +10,6 @@ import {
 } from '@proteinjs/email-server';
 import { PasswordResetToken } from '../authentication/PasswordResetToken';
 import { ClientAddress } from '../throttle/ClientAddress';
-import { RequestDigests } from '../throttle/RequestDigests';
 import { passwordResetThrottle } from '../throttle/PasswordResetThrottle';
 
 /**

package/src/routes/signup.ts

@@ -1,5 +1,6 @@
 import { Route } from '@proteinjs/server-api';
 import { Logger } from '@proteinjs/logger';
+import { RequestDigests } from '@proteinjs/util-node';
 import { UserSignup, routes } from '@proteinjs/user';
 import { establishSession } from '../authentication/establishSession';
 import { Signup } from '../services/Signup';
@@ -40,8 +41,10 @@ export const signup: Route = {
       );
     } catch (error: any) {
       // createUser throws plain-words errors deliberately (invite expired / invite required /
-      // email missing); the message is the user-facing contract, same as the RPC layer's.
-      logger.error({ message: 'Signup failed', error });
+      // email missing); the message is the user-facing contract, same as the RPC layer's. The log
+      // gets the error through the digest door: a concurrent double sign-up's unique-index refusal
+      // names the address in the database's own words.
+      logger.error({ message: 'Signup failed', error: new RequestDigests().redactError(error) });
       response.send({ error: error instanceof Error ? error.message : 'Sign up failed.' });
       return;
     }

package/src/routes/validateResetPasswordToken.ts

@@ -1,6 +1,7 @@
 import { Route } from '@proteinjs/server-api';
 import { routes } from '@proteinjs/user';
 import { Logger } from '@proteinjs/logger';
+import { RequestDigests } from '@proteinjs/util-node';
 import { PasswordResetToken } from '../authentication/PasswordResetToken';
 
 export const validateResetPasswordToken: Route = {
@@ -26,7 +27,10 @@ export const validateResetPasswordToken: Route = {
     }
 
     if (resolution.status === 'expired') {
-      logger.info({ message: `Expired reset token used`, obj: { email: resolution.user.email } });
+      logger.info({
+        message: `Expired reset token used`,
+        obj: { account: new RequestDigests().account(resolution.user.email) },
+      });
       response.status(200).send({ isValid: false, message: 'Token has expired' });
       return;
     }

package/src/services/MachineCredentials.ts

@@ -1,14 +1,17 @@
 import { randomBytes } from 'crypto';
 import { getDbAsSystem } from '@proteinjs/db';
 import {
+  MachineAccountRefusal,
   MachineAccountView,
   MachineCredentialsService,
   MintedMachineCredential,
   USER_PERMISSIONS,
+  User,
   getMachineAccounts,
   tables,
 } from '@proteinjs/user';
 import { Logger } from '@proteinjs/logger';
+import { RequestDigests } from '@proteinjs/util-node';
 import { Service } from '@proteinjs/service';
 import { PasswordHasher } from '../authentication/PasswordHasher';
 
@@ -23,7 +26,9 @@ import { PasswordHasher } from '../authentication/PasswordHasher';
  * account's existing sessions (the old
  * credential dies with them), and returns the plaintext ONCE for pasting into the declaration's
  * Secret Manager secret. The same call rotates. Machine rows only (`is_loaded_from_source`);
- * human credentials go through the password-reset flow.
+ * human credentials go through the password-reset flow. A declared address held by a row the
+ * boot sync does not own (a person's signup, a hand-made row) has no machine account at all —
+ * the sync refused the declaration — and both the list and the mint say so.
  */
 export class MachineCredentials implements MachineCredentialsService {
   public serviceMetadata: Service['serviceMetadata'] = {
@@ -36,15 +41,22 @@ export class MachineCredentials implements MachineCredentialsService {
     const db = getDbAsSystem();
     const views: MachineAccountView[] = [];
     for (const declaration of getMachineAccounts()) {
-      const row = await db.get(tables.User, { email: declaration.email });
-      const booted = !!row && row.isLoadedFromSource === true;
+      const row: User | undefined = await db.get(tables.User, { email: declaration.email });
+      const refusal = row && this.refusal(row);
       views.push({
         email: declaration.email,
         accountName: declaration.accountName,
         roles: [...declaration.roles],
         secretName: declaration.secretName,
-        status: booted ? (row.status === 'deactivated' ? 'deactivated' : 'active') : 'pending first boot',
-        hasCredential: booted && !!row.password,
+        status: !row
+          ? 'pending first boot'
+          : refusal
+            ? 'declaration refused'
+            : row.status === 'deactivated'
+              ? 'deactivated'
+              : 'active',
+        ...(refusal ? { refusal } : {}),
+        hasCredential: !!row && !refusal && !!row.password,
       });
     }
 
@@ -63,11 +75,20 @@ export class MachineCredentials implements MachineCredentialsService {
     }
 
     const db = getDbAsSystem();
-    const user = await db.get(tables.User, { email: normalizedEmail });
-    if (!user || user.isLoadedFromSource !== true) {
+    const user: User | undefined = await db.get(tables.User, { email: normalizedEmail });
+    if (!user) {
       throw new Error(
         `The machine account row for '${normalizedEmail}' has not been loaded from source yet — ` +
-          `the boot sync creates (or adopts) it. Boot the server with the declaration, then mint.`
+          `the boot sync creates it. Boot the server with the declaration, then mint.`
+      );
+    }
+
+    const refusal = this.refusal(user);
+    if (refusal) {
+      throw new Error(
+        `The declaration for '${normalizedEmail}' was refused at boot: ${refusal} — the boot sync ` +
+          `never takes over a row it does not own, so there is no machine account to mint for. The ` +
+          `first boot after that row is gone creates it.`
       );
     }
 
@@ -79,7 +100,7 @@ export class MachineCredentials implements MachineCredentialsService {
     await db.delete(tables.Session, { userEmail: normalizedEmail });
     logger.info({
       message: `Minted machine credential`,
-      obj: { email: normalizedEmail, secretName: declaration.secretName },
+      obj: { account: new RequestDigests().account(normalizedEmail), secretName: declaration.secretName },
     });
 
     return {
@@ -91,4 +112,18 @@ export class MachineCredentials implements MachineCredentialsService {
         `secret, then restart the service that reads it — the previous credential is already invalid.`,
     };
   }
+
+  /**
+   * Why the boot sync refused a declaration whose address this row holds — undefined for the
+   * account's own row. The sync owns a row only when it created it (`isLoadedFromSource`); any
+   * other row under a declared address is never taken over (@proteinjs/db's natural-key refusal),
+   * and the one machine marker says whose row it is.
+   */
+  private refusal(row: User): MachineAccountRefusal | undefined {
+    if (row.isLoadedFromSource === true) {
+      return undefined;
+    }
+
+    return row.machine === true ? 'a hand-made machine row holds this address' : 'a person holds this address';
+  }
 }

package/src/services/Roles.ts

@@ -1,6 +1,7 @@
 import { getDbAsSystem, QueryBuilderFactory } from '@proteinjs/db';
 import { RolesService, RolesCatalog, UserAuth, UserRepo, tables, USER_PERMISSIONS } from '@proteinjs/user';
 import { Logger } from '@proteinjs/logger';
+import { RequestDigests } from '@proteinjs/util-node';
 import { Service } from '@proteinjs/service';
 
 /**
@@ -67,7 +68,10 @@ export class Roles implements RolesService {
       await db.update(tables.User, { id: user.id, roles: [...roles, 'admin'] });
       await db.insert(tables.RoleGrantEvent, { actor: user.id, target: user.id, role: 'admin', action: 'grant' });
     });
-    logger.info({ message: 'Break-glass admin granted by the dev first-admin door', obj: { target: user.id, email } });
+    logger.info({
+      message: 'Break-glass admin granted by the dev first-admin door',
+      obj: { target: user.id, account: new RequestDigests().account(email) },
+    });
     return 'granted';
   }
 
@@ -122,7 +126,7 @@ export class Roles implements RolesService {
     });
     logger.info({
       message: 'Roles granted by the dev role-bootstrap door',
-      obj: { target: user.id, email, granted: outcome.granted },
+      obj: { target: user.id, account: new RequestDigests().account(email), granted: outcome.granted },
     });
     return outcome;
   }

package/src/services/Signup.ts

@@ -11,10 +11,12 @@ import {
   User,
   UserSignup,
   USER_PERMISSIONS,
+  getMachineAccounts,
 } from '@proteinjs/user';
 import moment from 'moment';
 import { lib } from 'crypto-js';
 import { Logger } from '@proteinjs/logger';
+import { RequestDigests } from '@proteinjs/util-node';
 import {
   EmailSender,
   getDefaultInviteEmailConfigFactory,
@@ -124,7 +126,10 @@ export class Signup implements SignupService {
       invitedBy: invite ? invite.invitedBy : null,
     });
     if (creation === 'exists') {
-      logger.error({ message: `User with this email already exists`, obj: { email } });
+      logger.error({
+        message: `User with this email already exists`,
+        obj: { account: new RequestDigests().account(email) },
+      });
       if (config.getExistingUserEmailContent) {
         const { text, html } = config.getExistingUserEmailContent();
         await emailSender.sendEmail({
@@ -146,7 +151,7 @@ export class Signup implements SignupService {
       html,
       ...config.options,
     });
-    logger.info({ message: `Created user`, obj: { email } });
+    logger.info({ message: `Created user`, obj: { account: new RequestDigests().account(email) } });
     return { outcome: 'created', email };
   }
 
@@ -183,7 +188,14 @@ export class Signup implements SignupService {
       await this.emailInvite(caseInsensitiveEmail, token, config);
       return { sent: true };
     } catch (error: any) {
-      logger.error({ message: 'Error sending invite', obj: { email: caseInsensitiveEmail }, error });
+      // The try block covers the Invite row's write and the mail: a refusal's own words may name
+      // the address, so the error reaches the log through the digest door too.
+      const digests = new RequestDigests();
+      logger.error({
+        message: 'Error sending invite',
+        obj: { invitee: digests.address(caseInsensitiveEmail) },
+        error: digests.redactError(error),
+      });
       return {
         sent: false,
         error: 'Error occurred.',
@@ -218,7 +230,12 @@ export class Signup implements SignupService {
       await this.emailInvite(caseInsensitiveEmail, token, config);
       return { sent: true };
     } catch (error: any) {
-      logger.error({ message: 'Error re-sending invite', obj: { email: caseInsensitiveEmail }, error });
+      const digests = new RequestDigests();
+      logger.error({
+        message: 'Error re-sending invite',
+        obj: { invitee: digests.address(caseInsensitiveEmail) },
+        error: digests.redactError(error),
+      });
       return {
         sent: false,
         error: 'Error occurred.',
@@ -300,6 +317,19 @@ export class Signup implements SignupService {
    * (`devLogin`, which auto-creates missing same-domain test accounts). Not exposed as an RPC:
    * the service surface is the `SignupService` INTERFACE (ServiceRouter walks its declared
    * methods), so extra class methods stay server-internal.
+   *
+   * An address a `MachineAccount` declaration owns is never registered, whatever its row state:
+   * a person's row under it would make the boot sync refuse the declaration (it never takes over
+   * a row it does not own), so the address is refused here in plain words — the declared machine
+   * accounts of this build are the list, nothing else.
+   *
+   * 'exists' means the address has an account this call did not create — found by the check, or
+   * written by a concurrent create between the check and this insert. Two creates for one address
+   * both pass the check; the database's unique index on the address refuses the second insert, and
+   * that refusal is the same fact the check reads, so the second answers 'exists' exactly as if it
+   * had arrived a moment later: its caller gets the existing-address response, no session, and the
+   * owner's mail — never the database's sentence, which names the address. An insert that fails
+   * while the address still has no account is a real failure and throws.
    */
   async createAccount(account: {
     name: string;
@@ -308,24 +338,39 @@ export class Signup implements SignupService {
     emailVerified: boolean;
     invitedBy: User['invitedBy'];
   }): Promise<'created' | 'exists'> {
-    const db = getDbAsSystem();
     const email = account.email.toLowerCase();
-    const existingUser = await db.get(tables.User, { email });
-    if (existingUser) {
+    if (getMachineAccounts().some((machineAccount) => machineAccount.email === email)) {
+      throw new Error(`This address can't be registered.`);
+    }
+
+    if (await this.hasAccount(email)) {
       return 'exists';
     }
 
-    await db.insert(tables.User, {
-      name: account.name,
-      email,
-      password: await new PasswordHasher().hash(account.password),
-      emailVerified: account.emailVerified,
-      roles: [],
-      invitedBy: account.invitedBy,
-    });
+    const password = await new PasswordHasher().hash(account.password);
+    try {
+      await getDbAsSystem().insert(tables.User, {
+        name: account.name,
+        email,
+        password,
+        emailVerified: account.emailVerified,
+        roles: [],
+        invitedBy: account.invitedBy,
+      });
+    } catch (error: unknown) {
+      if (await this.hasAccount(email)) {
+        return 'exists';
+      }
+      throw error;
+    }
     return 'created';
   }
 
+  /** Whether an account holds `email` (already lowercased) — the one existence read `createAccount` makes. */
+  private async hasAccount(email: string): Promise<boolean> {
+    return Boolean(await getDbAsSystem().get(tables.User, { email }));
+  }
+
   /** Resolves an invite token, distinguishing "expired" from "never existed / already revoked". */
   private async lookupInvite(token: string): Promise<InviteLookup> {
     const db = getDbAsSystem();

package/test/DevLogin.test.ts

@@ -1,5 +1,6 @@
 import { getDbAsSystem } from '@proteinjs/db';
-import { tables } from '@proteinjs/user';
+import { SourceRepository } from '@proteinjs/reflection';
+import { MachineAccount, tables } from '@proteinjs/user';
 import { PasswordHasher } from '../src/authentication/PasswordHasher';
 import { invokeDevLogin } from './devLoginHarness';
 import { UserServerTestEnvironment } from './UserServerTestEnvironment';
@@ -107,6 +108,39 @@ describe('devLogin route', () => {
     expect(await getUserRow('intruder@evil.example')).toBeUndefined();
   });
 
+  it('refuses a ?email a machine-account declaration owns with 400 in plain words — no session, no row', async () => {
+    // The declared machine accounts of the build are the list signup refuses from; the dev door
+    // creates missing accounts through the same function and must answer the way its other
+    // refusals do — in words, not as an unhandled throw.
+    class DeclaredMachineAccount extends MachineAccount {
+      id = 'declared-machine';
+      email = 'declared.machine@test.local';
+      accountName = 'Declared machine';
+      roles = [];
+      secretName = 'declared-machine-secret';
+    }
+    const repo = SourceRepository.get() as unknown as { namedObjectCache: Record<string, unknown[]> };
+    repo.namedObjectCache['@proteinjs/db/SourceRecordLoader'] = [
+      {
+        qualifiedName: '@proteinjs/user-server-test/DeclaredMachineAccount',
+        packageName: '@test/declarer',
+        object: new DeclaredMachineAccount(),
+      },
+    ];
+    try {
+      const outcome = await invokeDevLogin({ email: 'declared.machine@test.local' });
+
+      expect(outcome.status).toBe(400);
+      expect(String(outcome.body)).toContain(`This address can't be registered.`);
+      expect(outcome.loggedInAs).toBeUndefined();
+      expect(outcome.sessionSaved).toBe(false);
+      expect(outcome.redirect).toBeUndefined();
+      expect(await getUserRow('declared.machine@test.local')).toBeUndefined();
+    } finally {
+      delete repo.namedObjectCache['@proteinjs/db/SourceRecordLoader'];
+    }
+  });
+
   it('rejects a malformed same-domain ?email with 400 — no session, no stray account', async () => {
     // The observed shape: an unencoded `+` in the query decodes to a space, so
     // `?email=brent+shareproof-a@...` arrived as `brent shareproof-a@...` and minted a stray

package/test/LogCapture.test.ts

@@ -0,0 +1,29 @@
+import { LogCapture } from './LogCapture';
+
+/**
+ * The log capture's address reader — what `expect(log.addresses).toEqual([])` stands on. It reads
+ * an address in every spelling a log line can carry: bare, inside a name-and-address form, and
+ * URL-encoded (`%40` for the `@`, `%2B` for a `+`) as a logged request path carries it. A digest
+ * or a bare domain is not an address.
+ */
+describe('LogCapture.addresses', () => {
+  it('reads an address bare, in a name-and-address form, and URL-encoded in a logged path', async () => {
+    const log = await LogCapture.during(async () => {
+      console.log('Email sent successfully to ada@example.com');
+      console.info('Invite from "Grace" <grace.hopper@example.org>');
+      console.info('Started /dev/login?email=ada%2Blane%40example.com');
+      console.warn('Sign-in refused', { account: '0123456789abcdef', domain: 'example.com' });
+    });
+
+    expect(log.addresses).toEqual(['ada@example.com', 'grace.hopper@example.org', 'ada%2Blane%40example.com']);
+  });
+
+  it('reads nothing from a log that names people by digest and domain only', async () => {
+    const log = await LogCapture.during(async () => {
+      console.info('Email sent — 1 recipient (example.com)', { recipients: ['0123456789abcdef'] });
+      console.info('Finished /user/login 200');
+    });
+
+    expect(log.addresses).toEqual([]);
+  });
+});

package/test/LogCapture.ts

@@ -9,6 +9,12 @@ import { createHash } from 'crypto';
 export class LogCapture {
   /** How many leading characters of a token count as the token showing up in a log. */
   private static readonly TOKEN_PREFIX_LENGTH = 12;
+  /**
+   * An e-mail address, as the house's log check reads one: bare, or URL-encoded (`%40` for the `@`)
+   * as a logged request path carries it — a check that read only the bare spelling missed the one
+   * place an address is known to reach a log, the request log's URL.
+   */
+  private static readonly ADDRESS_SHAPE = /[A-Za-z0-9._%+-]+(?:@|%40)[A-Za-z0-9.-]+\.[A-Za-z]{2,}/g;
 
   private constructor(readonly lines: string[]) {}
 
@@ -38,6 +44,16 @@ export class LogCapture {
     return this.lines.join('\n');
   }
 
+  /** Every e-mail address the log holds, in order of appearance — a log names people by their digests, never by address. */
+  get addresses(): string[] {
+    return this.text.match(LogCapture.ADDRESS_SHAPE) ?? [];
+  }
+
+  /** The capture narrowed to the writes that contain `text` — one door's lines, read with the same readers. */
+  linesContaining(text: string): LogCapture {
+    return new LogCapture(this.lines.filter((line) => line.includes(text)));
+  }
+
   /**
    * Fails unless the log is free of `token` in every form that would let a log reader act on it
    * or tie a line to a row: the token, the SHA-256 digest a row stores for it, and the token's