@proteinjs/user-server 1.7.0 → 1.8.0

package/dist/test/AccountDeletion.integration.test.js

@@ -0,0 +1,710 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var __generator = (this && this.__generator) || function (thisArg, body) {
+    var _ = { label: 0, sent: function() { if (t[0] & 1) throw t[1]; return t[1]; }, trys: [], ops: [] }, f, y, t, g;
+    return g = { next: verb(0), "throw": verb(1), "return": verb(2) }, typeof Symbol === "function" && (g[Symbol.iterator] = function() { return this; }), g;
+    function verb(n) { return function (v) { return step([n, v]); }; }
+    function step(op) {
+        if (f) throw new TypeError("Generator is already executing.");
+        while (g && (g = 0, op[0] && (_ = 0)), _) try {
+            if (f = 1, y && (t = op[0] & 2 ? y["return"] : op[0] ? y["throw"] || ((t = y["return"]) && t.call(y), 0) : y.next) && !(t = t.call(y, op[1])).done) return t;
+            if (y = 0, t) op = [op[0] & 2, t.value];
+            switch (op[0]) {
+                case 0: case 1: t = op; break;
+                case 4: _.label++; return { value: op[1], done: false };
+                case 5: _.label++; y = op[1]; op = [0]; continue;
+                case 7: op = _.ops.pop(); _.trys.pop(); continue;
+                default:
+                    if (!(t = _.trys, t = t.length > 0 && t[t.length - 1]) && (op[0] === 6 || op[0] === 2)) { _ = 0; continue; }
+                    if (op[0] === 3 && (!t || (op[1] > t[0] && op[1] < t[3]))) { _.label = op[1]; break; }
+                    if (op[0] === 6 && _.label < t[1]) { _.label = t[1]; t = op; break; }
+                    if (t && _.label < t[2]) { _.label = t[2]; _.ops.push(op); break; }
+                    if (t[2]) _.ops.pop();
+                    _.trys.pop(); continue;
+            }
+            op = body.call(thisArg, _);
+        } catch (e) { op = [6, e]; y = 0; } finally { f = t = 0; }
+        if (op[0] & 5) throw op[1]; return { value: op[0] ? op[1] : void 0, done: true };
+    }
+};
+var __spreadArray = (this && this.__spreadArray) || function (to, from, pack) {
+    if (pack || arguments.length === 2) for (var i = 0, l = from.length, ar; i < l; i++) {
+        if (ar || !(i in from)) {
+            if (!ar) ar = Array.prototype.slice.call(from, 0, i);
+            ar[i] = from[i];
+        }
+    }
+    return to.concat(ar || Array.prototype.slice.call(from));
+};
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+var sha256_1 = __importDefault(require("crypto-js/sha256"));
+var moment_1 = __importDefault(require("moment"));
+var db_1 = require("@proteinjs/db");
+var reflection_1 = require("@proteinjs/reflection");
+// Deep import (test-only): ServiceAuth is the real RPC door but is not index-exported by
+// @proteinjs/service — the door test below runs the actual gate rather than pinning metadata.
+var ServiceAuth_1 = require("@proteinjs/service/dist/src/ServiceAuth");
+var user_1 = require("@proteinjs/user");
+var AccountDeletion_1 = require("../src/services/AccountDeletion");
+var authenticate_1 = require("../src/authentication/authenticate");
+var login_1 = require("../src/routes/login");
+var UserServerTestEnvironment_1 = require("./UserServerTestEnvironment");
+var testEnv = new UserServerTestEnvironment_1.UserServerTestEnvironment();
+var PASSWORD_A = 'alpha-password';
+var PASSWORD_B = 'beta-password';
+var RESOURCE_TABLE = 'file';
+/**
+ * BUILD §9.1 — the deactivation + cancel suite, two users, outcomes only (rows written against
+ * the emulator, never calls made). Fixture: A owns r1/r2 (shared outbound to B), B owns r3
+ * (shared inbound to A). A's deletion must revoke both directions while B's own grant — and
+ * A's owner grants, the purge walker's terminal targets — survive.
+ */
+describe('AccountDeletion — deactivation, manifest, resume, cancel-by-login', function () {
+    var userA;
+    var userB;
+    var r1 = 'resource-a-one';
+    var r2 = 'resource-a-two';
+    var r3 = 'resource-b-three';
+    var ownerA1;
+    var ownerA2;
+    var outbound1;
+    var outbound2;
+    var inbound;
+    var ownerB;
+    beforeAll(function () { return __awaiter(void 0, void 0, void 0, function () {
+        return __generator(this, function (_a) {
+            switch (_a.label) {
+                case 0: return [4 /*yield*/, testEnv.beforeAll()];
+                case 1:
+                    _a.sent();
+                    return [2 /*return*/];
+            }
+        });
+    }); }, 120000);
+    afterAll(function () { return __awaiter(void 0, void 0, void 0, function () {
+        return __generator(this, function (_a) {
+            switch (_a.label) {
+                case 0: return [4 /*yield*/, testEnv.afterAll()];
+                case 1:
+                    _a.sent();
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    beforeEach(function () { return __awaiter(void 0, void 0, void 0, function () {
+        var db;
+        return __generator(this, function (_a) {
+            switch (_a.label) {
+                case 0:
+                    db = (0, db_1.getDbAsSystem)();
+                    return [4 /*yield*/, db.delete(user_1.tables.AccountDeletion, {})];
+                case 1:
+                    _a.sent();
+                    return [4 /*yield*/, db.delete(user_1.tables.AccessGrant, {})];
+                case 2:
+                    _a.sent();
+                    return [4 /*yield*/, db.delete(user_1.tables.Session, {})];
+                case 3:
+                    _a.sent();
+                    return [4 /*yield*/, db.delete(user_1.tables.UserStatusEvent, {})];
+                case 4:
+                    _a.sent();
+                    return [4 /*yield*/, db.delete(user_1.tables.User, {})];
+                case 5:
+                    _a.sent();
+                    return [4 /*yield*/, createAccount('deleter@test.local', PASSWORD_A)];
+                case 6:
+                    userA = _a.sent();
+                    return [4 /*yield*/, createAccount('keeper@test.local', PASSWORD_B)];
+                case 7:
+                    userB = _a.sent();
+                    return [4 /*yield*/, insertGrant(userA.id, r1, 'owner')];
+                case 8:
+                    ownerA1 = _a.sent();
+                    return [4 /*yield*/, insertGrant(userA.id, r2, 'owner')];
+                case 9:
+                    ownerA2 = _a.sent();
+                    return [4 /*yield*/, insertGrant(userB.id, r1, 'read')];
+                case 10:
+                    outbound1 = _a.sent();
+                    return [4 /*yield*/, insertGrant(userB.id, r2, 'write')];
+                case 11:
+                    outbound2 = _a.sent();
+                    return [4 /*yield*/, insertGrant(userB.id, r3, 'owner')];
+                case 12:
+                    ownerB = _a.sent();
+                    return [4 /*yield*/, insertGrant(userA.id, r3, 'read')];
+                case 13:
+                    inbound = _a.sent();
+                    return [4 /*yield*/, insertSession('session-a-1', userA.email)];
+                case 14:
+                    _a.sent();
+                    return [4 /*yield*/, insertSession('session-a-2', userA.email)];
+                case 15:
+                    _a.sent();
+                    return [4 /*yield*/, insertSession('session-b-1', userB.email)];
+                case 16:
+                    _a.sent();
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    /** Insert an account the way the product stores it: lowercased email, sha256 password. */
+    var createAccount = function (email, password) { return __awaiter(void 0, void 0, void 0, function () {
+        return __generator(this, function (_a) {
+            switch (_a.label) {
+                case 0: return [4 /*yield*/, (0, db_1.getDbAsSystem)().insert(user_1.tables.User, {
+                        name: 'Deletion test user',
+                        email: email,
+                        password: (0, sha256_1.default)(password).toString(),
+                        emailVerified: true,
+                        roles: [],
+                    })];
+                case 1: return [2 /*return*/, _a.sent()];
+            }
+        });
+    }); };
+    var insertGrant = function (principalId, resourceId, accessLevel) { return __awaiter(void 0, void 0, void 0, function () {
+        return __generator(this, function (_a) {
+            switch (_a.label) {
+                case 0: return [4 /*yield*/, (0, db_1.getDbAsSystem)().insert(user_1.tables.AccessGrant, {
+                        principal: new db_1.Reference(user_1.tables.User.name, principalId),
+                        resource: new db_1.Reference(RESOURCE_TABLE, resourceId),
+                        resourceTable: RESOURCE_TABLE,
+                        accessLevel: accessLevel,
+                    })];
+                case 1: return [2 /*return*/, _a.sent()];
+            }
+        });
+    }); };
+    var insertSession = function (sessionId, userEmail) { return __awaiter(void 0, void 0, void 0, function () {
+        return __generator(this, function (_a) {
+            switch (_a.label) {
+                case 0: return [4 /*yield*/, (0, db_1.getDbAsSystem)().insert(user_1.tables.Session, {
+                        sessionId: sessionId,
+                        session: '{}',
+                        expires: new Date(Date.now() + 24 * 60 * 60 * 1000),
+                        userEmail: userEmail,
+                    })];
+                case 1: return [2 /*return*/, _a.sent()];
+            }
+        });
+    }); };
+    var grantRows = function () { return __awaiter(void 0, void 0, void 0, function () { return __generator(this, function (_a) {
+        switch (_a.label) {
+            case 0: return [4 /*yield*/, (0, db_1.getDbAsSystem)().query(user_1.tables.AccessGrant, {})];
+            case 1: return [2 /*return*/, _a.sent()];
+        }
+    }); }); };
+    var sessionRows = function () { return __awaiter(void 0, void 0, void 0, function () { return __generator(this, function (_a) {
+        switch (_a.label) {
+            case 0: return [4 /*yield*/, (0, db_1.getDbAsSystem)().query(user_1.tables.Session, {})];
+            case 1: return [2 /*return*/, _a.sent()];
+        }
+    }); }); };
+    var auditRows = function () { return __awaiter(void 0, void 0, void 0, function () { return __generator(this, function (_a) {
+        switch (_a.label) {
+            case 0: return [4 /*yield*/, (0, db_1.getDbAsSystem)().query(user_1.tables.UserStatusEvent, {})];
+            case 1: return [2 /*return*/, _a.sent()];
+        }
+    }); }); };
+    var deletionRow = function (userId) { return __awaiter(void 0, void 0, void 0, function () { return __generator(this, function (_a) {
+        switch (_a.label) {
+            case 0: return [4 /*yield*/, (0, db_1.getDbAsSystem)().get(user_1.tables.AccountDeletion, { userId: userId })];
+            case 1: return [2 /*return*/, _a.sent()];
+        }
+    }); }); };
+    var userRow = function (id) { return __awaiter(void 0, void 0, void 0, function () { return __generator(this, function (_a) {
+        switch (_a.label) {
+            case 0: return [4 /*yield*/, (0, db_1.getDbAsSystem)().get(user_1.tables.User, { id: id })];
+            case 1: return [2 /*return*/, _a.sent()];
+        }
+    }); }); };
+    var sortById = function (rows) { return __spreadArray([], rows, true).sort(function (a, b) { return a.id.localeCompare(b.id); }); };
+    var expectedManifest = function () { return [
+        { id: inbound.id, principal: userA.id, resource: r3, resourceTable: RESOURCE_TABLE, accessLevel: 'read' },
+        { id: outbound1.id, principal: userB.id, resource: r1, resourceTable: RESOURCE_TABLE, accessLevel: 'read' },
+        { id: outbound2.id, principal: userB.id, resource: r2, resourceTable: RESOURCE_TABLE, accessLevel: 'write' },
+    ]; };
+    /** Drive the real login route with a fake request/response pair. */
+    var invokeLogin = function (email, password) { return __awaiter(void 0, void 0, void 0, function () {
+        var loggedInAs, sent, response, request;
+        return __generator(this, function (_a) {
+            switch (_a.label) {
+                case 0:
+                    response = {
+                        send: function (body) {
+                            sent = body;
+                        },
+                        status: function () { return response; },
+                    };
+                    request = {
+                        body: { email: email, password: password },
+                        login: function (loginEmail, callback) {
+                            loggedInAs = loginEmail;
+                            callback();
+                        },
+                    };
+                    return [4 /*yield*/, login_1.login.onRequest(request, response)];
+                case 1:
+                    _a.sent();
+                    return [2 /*return*/, { loggedInAs: loggedInAs, sent: sent }];
+            }
+        });
+    }); };
+    it('the service door admits any signed-in account and refuses guests', function () {
+        // ServiceAuth funnels through UserAuth, which resolves the current user from the
+        // source-graph-registered AuthenticatedUserRepo — seed it the way the env seeds session
+        // storage (tests do not load the generated source graph).
+        reflection_1.SourceRepository.get().objectCache['@proteinjs/user-auth/AuthenticatedUserRepo'] = [new user_1.UserRepo()];
+        var canRun = function () {
+            return ServiceAuth_1.ServiceAuth.canRunService(new AccountDeletion_1.AccountDeletion(), { name: 'requestDeletion' }, [PASSWORD_A]);
+        };
+        testEnv.actAs(userA); // a plain account with no roles at all
+        expect(canRun()).toBe(true);
+        testEnv.actAs(user_1.guestUser);
+        expect(canRun()).toBe(false);
+    });
+    it('deactivates: revokes grants both directions, persists the full manifest, flips + audits standing, kills sessions', function () { return __awaiter(void 0, void 0, void 0, function () {
+        var result, remaining, deletion, hoursOut, flipped, events, sessions;
+        return __generator(this, function (_a) {
+            switch (_a.label) {
+                case 0:
+                    testEnv.actAs(userA);
+                    return [4 /*yield*/, new AccountDeletion_1.AccountDeletion().requestDeletion(PASSWORD_A)];
+                case 1:
+                    result = _a.sent();
+                    return [4 /*yield*/, grantRows()];
+                case 2:
+                    remaining = _a.sent();
+                    expect(sortById(remaining).map(function (grant) { return grant.id; })).toEqual(sortById([ownerA1, ownerA2, ownerB]).map(function (grant) { return grant.id; }));
+                    return [4 /*yield*/, deletionRow(userA.id)];
+                case 3:
+                    deletion = _a.sent();
+                    expect(deletion).toBeTruthy();
+                    expect(deletion.phase).toBe('grace');
+                    expect(deletion.leaseSeq).toBe(0);
+                    expect(deletion.userEmail).toBe(userA.email);
+                    expect(__spreadArray([], deletion.ownedResourceIds, true).sort()).toEqual([r1, r2].sort());
+                    expect(sortById(deletion.manifestGrants)).toEqual(sortById(expectedManifest()));
+                    hoursOut = (0, moment_1.default)(deletion.purgeAfter).diff((0, moment_1.default)(), 'hours', true);
+                    expect(hoursOut).toBeGreaterThan(719);
+                    expect(hoursOut).toBeLessThan(721);
+                    expect(Math.abs(result.purgeAfter.valueOf() - (0, moment_1.default)(deletion.purgeAfter).valueOf())).toBeLessThan(1000);
+                    return [4 /*yield*/, userRow(userA.id)];
+                case 4:
+                    flipped = _a.sent();
+                    expect(flipped.status).toBe('deactivated');
+                    expect(flipped.deleteRequestedAt).toBeTruthy();
+                    expect(Math.abs((0, moment_1.default)(flipped.purgeAfter).valueOf() - (0, moment_1.default)(deletion.purgeAfter).valueOf())).toBeLessThan(1000);
+                    return [4 /*yield*/, auditRows()];
+                case 5:
+                    events = _a.sent();
+                    expect(events).toHaveLength(1);
+                    expect(events[0]).toMatchObject({ actor: userA.id, target: userA.id, status: 'deactivated' });
+                    return [4 /*yield*/, sessionRows()];
+                case 6:
+                    sessions = _a.sent();
+                    expect(sessions).toHaveLength(1);
+                    expect(sessions[0].userEmail).toBe(userB.email);
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    it('refuses a wrong password with zero writes', function () { return __awaiter(void 0, void 0, void 0, function () {
+        var _a, _b, _c, _d, untouched;
+        return __generator(this, function (_e) {
+            switch (_e.label) {
+                case 0:
+                    testEnv.actAs(userA);
+                    return [4 /*yield*/, expect(new AccountDeletion_1.AccountDeletion().requestDeletion('wrong-password')).rejects.toThrow('Password incorrect')];
+                case 1:
+                    _e.sent();
+                    _a = expect;
+                    return [4 /*yield*/, deletionRow(userA.id)];
+                case 2:
+                    _a.apply(void 0, [_e.sent()]).toBeFalsy();
+                    _b = expect;
+                    return [4 /*yield*/, grantRows()];
+                case 3:
+                    _b.apply(void 0, [_e.sent()]).toHaveLength(6);
+                    _c = expect;
+                    return [4 /*yield*/, sessionRows()];
+                case 4:
+                    _c.apply(void 0, [_e.sent()]).toHaveLength(3);
+                    _d = expect;
+                    return [4 /*yield*/, auditRows()];
+                case 5:
+                    _d.apply(void 0, [_e.sent()]).toHaveLength(0);
+                    return [4 /*yield*/, userRow(userA.id)];
+                case 6:
+                    untouched = _e.sent();
+                    expect(untouched.status).toBe('active');
+                    expect(untouched.deleteRequestedAt).toBeFalsy();
+                    expect(untouched.purgeAfter).toBeFalsy();
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    it('resume keeps the FULL manifest after a crash mid-revocation — never re-enumerates', function () { return __awaiter(void 0, void 0, void 0, function () {
+        var service, persisted, _i, _a, grant, resumed, remaining, _b, _c;
+        return __generator(this, function (_d) {
+            switch (_d.label) {
+                case 0:
+                    testEnv.actAs(userA);
+                    service = new AccountDeletion_1.AccountDeletion();
+                    return [4 /*yield*/, service.requestDeletion(PASSWORD_A)];
+                case 1:
+                    _d.sent();
+                    return [4 /*yield*/, deletionRow(userA.id)];
+                case 2:
+                    persisted = _d.sent();
+                    expect(persisted.manifestGrants).toHaveLength(3);
+                    _i = 0, _a = [outbound1, outbound2];
+                    _d.label = 3;
+                case 3:
+                    if (!(_i < _a.length)) return [3 /*break*/, 6];
+                    grant = _a[_i];
+                    return [4 /*yield*/, (0, db_1.getDbAsSystem)().insert(user_1.tables.AccessGrant, {
+                            id: grant.id,
+                            principal: new db_1.Reference(user_1.tables.User.name, grant.principal._id),
+                            resource: new db_1.Reference(RESOURCE_TABLE, grant.resource._id),
+                            resourceTable: RESOURCE_TABLE,
+                            accessLevel: grant.accessLevel,
+                        })];
+                case 4:
+                    _d.sent();
+                    _d.label = 5;
+                case 5:
+                    _i++;
+                    return [3 /*break*/, 3];
+                case 6: return [4 /*yield*/, (0, db_1.getDbAsSystem)().update(user_1.tables.User, {
+                        id: userA.id,
+                        status: 'active',
+                        deleteRequestedAt: null,
+                        purgeAfter: null,
+                    })];
+                case 7:
+                    _d.sent();
+                    return [4 /*yield*/, insertSession('session-a-3', userA.email)];
+                case 8:
+                    _d.sent();
+                    // The user's retry resumes from the stored manifest.
+                    return [4 /*yield*/, service.requestDeletion(PASSWORD_A)];
+                case 9:
+                    // The user's retry resumes from the stored manifest.
+                    _d.sent();
+                    return [4 /*yield*/, deletionRow(userA.id)];
+                case 10:
+                    resumed = _d.sent();
+                    expect(sortById(resumed.manifestGrants)).toEqual(sortById(expectedManifest()));
+                    expect(__spreadArray([], resumed.ownedResourceIds, true).sort()).toEqual([r1, r2].sort());
+                    return [4 /*yield*/, grantRows()];
+                case 11:
+                    remaining = _d.sent();
+                    expect(sortById(remaining).map(function (grant) { return grant.id; })).toEqual(sortById([ownerA1, ownerA2, ownerB]).map(function (grant) { return grant.id; }));
+                    _b = expect;
+                    return [4 /*yield*/, userRow(userA.id)];
+                case 12:
+                    _b.apply(void 0, [(_d.sent()).status]).toBe('deactivated');
+                    _c = expect;
+                    return [4 /*yield*/, sessionRows()];
+                case 13:
+                    _c.apply(void 0, [(_d.sent()).map(function (session) { return session.userEmail; })]).toEqual([userB.email]);
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    it('cancel restores grants (fresh ids), reactivates + audits, nulls stamps, deletes the manifest row', function () { return __awaiter(void 0, void 0, void 0, function () {
+        var manifest, outcome, all, _loop_1, _i, manifest_1, entry, restored, events, _a;
+        return __generator(this, function (_b) {
+            switch (_b.label) {
+                case 0:
+                    testEnv.actAs(userA);
+                    return [4 /*yield*/, new AccountDeletion_1.AccountDeletion().requestDeletion(PASSWORD_A)];
+                case 1:
+                    _b.sent();
+                    return [4 /*yield*/, deletionRow(userA.id)];
+                case 2:
+                    manifest = (_b.sent()).manifestGrants;
+                    return [4 /*yield*/, new AccountDeletion_1.AccountDeletion().cancelPendingDeletion(userA.email)];
+                case 3:
+                    outcome = _b.sent();
+                    expect(outcome).toBe('restored');
+                    return [4 /*yield*/, grantRows()];
+                case 4:
+                    all = _b.sent();
+                    expect(all).toHaveLength(6);
+                    _loop_1 = function (entry) {
+                        var matches = all.filter(function (grant) {
+                            return grant.principal._id === entry.principal &&
+                                grant.resource._id === entry.resource &&
+                                grant.accessLevel === entry.accessLevel;
+                        });
+                        expect(matches).toHaveLength(1);
+                        expect(matches[0].id).not.toBe(entry.id);
+                    };
+                    for (_i = 0, manifest_1 = manifest; _i < manifest_1.length; _i++) {
+                        entry = manifest_1[_i];
+                        _loop_1(entry);
+                    }
+                    return [4 /*yield*/, userRow(userA.id)];
+                case 5:
+                    restored = _b.sent();
+                    expect(restored.status).toBe('active');
+                    expect(restored.deleteRequestedAt).toBeFalsy();
+                    expect(restored.purgeAfter).toBeFalsy();
+                    return [4 /*yield*/, auditRows()];
+                case 6:
+                    events = _b.sent();
+                    expect(events.map(function (event) { return event.status; }).sort()).toEqual(['active', 'deactivated']);
+                    _a = expect;
+                    return [4 /*yield*/, deletionRow(userA.id)];
+                case 7:
+                    _a.apply(void 0, [_b.sent()]).toBeFalsy();
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    it('cancel resumes a crashed prior cancel: restoring-phase re-entry, no duplicate grants', function () { return __awaiter(void 0, void 0, void 0, function () {
+        var deletion, first, outcome, all, _loop_2, _i, _a, entry, _b, _c;
+        return __generator(this, function (_d) {
+            switch (_d.label) {
+                case 0:
+                    testEnv.actAs(userA);
+                    return [4 /*yield*/, new AccountDeletion_1.AccountDeletion().requestDeletion(PASSWORD_A)];
+                case 1:
+                    _d.sent();
+                    return [4 /*yield*/, deletionRow(userA.id)];
+                case 2:
+                    deletion = _d.sent();
+                    // A prior cancel claimed the row, restored ONE grant, then crashed.
+                    return [4 /*yield*/, (0, db_1.getDbAsSystem)().update(user_1.tables.AccountDeletion, { id: deletion.id, phase: 'restoring' })];
+                case 3:
+                    // A prior cancel claimed the row, restored ONE grant, then crashed.
+                    _d.sent();
+                    first = deletion.manifestGrants[0];
+                    return [4 /*yield*/, (0, db_1.getDbAsSystem)().insert(user_1.tables.AccessGrant, {
+                            principal: new db_1.Reference(user_1.tables.User.name, first.principal),
+                            resource: new db_1.Reference(first.resourceTable, first.resource),
+                            resourceTable: first.resourceTable,
+                            accessLevel: first.accessLevel,
+                        })];
+                case 4:
+                    _d.sent();
+                    return [4 /*yield*/, new AccountDeletion_1.AccountDeletion().cancelPendingDeletion(userA.email)];
+                case 5:
+                    outcome = _d.sent();
+                    expect(outcome).toBe('restored');
+                    return [4 /*yield*/, grantRows()];
+                case 6:
+                    all = _d.sent();
+                    expect(all).toHaveLength(6);
+                    _loop_2 = function (entry) {
+                        var matches = all.filter(function (grant) {
+                            return grant.principal._id === entry.principal &&
+                                grant.resource._id === entry.resource &&
+                                grant.accessLevel === entry.accessLevel;
+                        });
+                        expect(matches).toHaveLength(1);
+                    };
+                    for (_i = 0, _a = deletion.manifestGrants; _i < _a.length; _i++) {
+                        entry = _a[_i];
+                        _loop_2(entry);
+                    }
+                    _b = expect;
+                    return [4 /*yield*/, userRow(userA.id)];
+                case 7:
+                    _b.apply(void 0, [(_d.sent()).status]).toBe('active');
+                    _c = expect;
+                    return [4 /*yield*/, deletionRow(userA.id)];
+                case 8:
+                    _c.apply(void 0, [_d.sent()]).toBeFalsy();
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    it('cancel refuses once the purge walker has claimed the row', function () { return __awaiter(void 0, void 0, void 0, function () {
+        var deletion, outcome, _a, _b, _c;
+        return __generator(this, function (_d) {
+            switch (_d.label) {
+                case 0:
+                    testEnv.actAs(userA);
+                    return [4 /*yield*/, new AccountDeletion_1.AccountDeletion().requestDeletion(PASSWORD_A)];
+                case 1:
+                    _d.sent();
+                    return [4 /*yield*/, deletionRow(userA.id)];
+                case 2:
+                    deletion = _d.sent();
+                    return [4 /*yield*/, (0, db_1.getDbAsSystem)().update(user_1.tables.AccountDeletion, { id: deletion.id, phase: 'purging' })];
+                case 3:
+                    _d.sent();
+                    return [4 /*yield*/, new AccountDeletion_1.AccountDeletion().cancelPendingDeletion(userA.email)];
+                case 4:
+                    outcome = _d.sent();
+                    expect(outcome).toBe('purging');
+                    // Nothing restored: standing stays deactivated, grants stay revoked, manifest row stays.
+                    _a = expect;
+                    return [4 /*yield*/, userRow(userA.id)];
+                case 5:
+                    // Nothing restored: standing stays deactivated, grants stay revoked, manifest row stays.
+                    _a.apply(void 0, [(_d.sent()).status]).toBe('deactivated');
+                    _b = expect;
+                    return [4 /*yield*/, grantRows()];
+                case 6:
+                    _b.apply(void 0, [_d.sent()]).toHaveLength(3);
+                    _c = expect;
+                    return [4 /*yield*/, deletionRow(userA.id)];
+                case 7:
+                    _c.apply(void 0, [(_d.sent()).phase]).toBe('purging');
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    it('cancel is a no-op for an account with no pending deletion', function () { return __awaiter(void 0, void 0, void 0, function () {
+        var _a, _b;
+        return __generator(this, function (_c) {
+            switch (_c.label) {
+                case 0:
+                    _a = expect;
+                    return [4 /*yield*/, new AccountDeletion_1.AccountDeletion().cancelPendingDeletion(userB.email)];
+                case 1:
+                    _a.apply(void 0, [_c.sent()]).toBe('not-pending');
+                    _b = expect;
+                    return [4 /*yield*/, grantRows()];
+                case 2:
+                    _b.apply(void 0, [_c.sent()]).toHaveLength(6);
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    it('authenticate matrix: active, staff-deactivated, pending-deletion, mid-purge', function () { return __awaiter(void 0, void 0, void 0, function () {
+        var _a, _b, _c, deletion, _d;
+        return __generator(this, function (_e) {
+            switch (_e.label) {
+                case 0:
+                    // Active + correct credentials.
+                    _a = expect;
+                    return [4 /*yield*/, (0, authenticate_1.authenticate)(userB.email, PASSWORD_B)];
+                case 1:
+                    // Active + correct credentials.
+                    _a.apply(void 0, [_e.sent()]).toBe(true);
+                    // Staff deactivation (no deleteRequestedAt) stays refused.
+                    return [4 /*yield*/, (0, db_1.getDbAsSystem)().update(user_1.tables.User, { id: userB.id, status: 'deactivated' })];
+                case 2:
+                    // Staff deactivation (no deleteRequestedAt) stays refused.
+                    _e.sent();
+                    _b = expect;
+                    return [4 /*yield*/, (0, authenticate_1.authenticate)(userB.email, PASSWORD_B)];
+                case 3:
+                    _b.apply(void 0, [_e.sent()]).toBe('This account has been deactivated');
+                    // Pending deletion: credentials valid — the login route decides (cancel hook).
+                    testEnv.actAs(userA);
+                    return [4 /*yield*/, new AccountDeletion_1.AccountDeletion().requestDeletion(PASSWORD_A)];
+                case 4:
+                    _e.sent();
+                    _c = expect;
+                    return [4 /*yield*/, (0, authenticate_1.authenticate)(userA.email, PASSWORD_A)];
+                case 5:
+                    _c.apply(void 0, [_e.sent()]).toBe(true);
+                    return [4 /*yield*/, deletionRow(userA.id)];
+                case 6:
+                    deletion = _e.sent();
+                    return [4 /*yield*/, (0, db_1.getDbAsSystem)().update(user_1.tables.AccountDeletion, { id: deletion.id, phase: 'purging' })];
+                case 7:
+                    _e.sent();
+                    _d = expect;
+                    return [4 /*yield*/, (0, authenticate_1.authenticate)(userA.email, PASSWORD_A)];
+                case 8:
+                    _d.apply(void 0, [_e.sent()]).toBe(true);
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    it('cancel-by-login: logging back in during grace restores the account before the session starts', function () { return __awaiter(void 0, void 0, void 0, function () {
+        var _a, loggedInAs, sent, _b, _c, _d;
+        return __generator(this, function (_e) {
+            switch (_e.label) {
+                case 0:
+                    testEnv.actAs(userA);
+                    return [4 /*yield*/, new AccountDeletion_1.AccountDeletion().requestDeletion(PASSWORD_A)];
+                case 1:
+                    _e.sent();
+                    return [4 /*yield*/, invokeLogin(userA.email, PASSWORD_A)];
+                case 2:
+                    _a = _e.sent(), loggedInAs = _a.loggedInAs, sent = _a.sent;
+                    expect(sent).toEqual({});
+                    expect(loggedInAs).toBe(userA.email);
+                    _b = expect;
+                    return [4 /*yield*/, userRow(userA.id)];
+                case 3:
+                    _b.apply(void 0, [(_e.sent()).status]).toBe('active');
+                    _c = expect;
+                    return [4 /*yield*/, grantRows()];
+                case 4:
+                    _c.apply(void 0, [_e.sent()]).toHaveLength(6);
+                    _d = expect;
+                    return [4 /*yield*/, deletionRow(userA.id)];
+                case 5:
+                    _d.apply(void 0, [_e.sent()]).toBeFalsy();
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    it('login refuses a mid-purge account with the no-longer-restorable message', function () { return __awaiter(void 0, void 0, void 0, function () {
+        var deletion, _a, loggedInAs, sent, _b;
+        return __generator(this, function (_c) {
+            switch (_c.label) {
+                case 0:
+                    testEnv.actAs(userA);
+                    return [4 /*yield*/, new AccountDeletion_1.AccountDeletion().requestDeletion(PASSWORD_A)];
+                case 1:
+                    _c.sent();
+                    return [4 /*yield*/, deletionRow(userA.id)];
+                case 2:
+                    deletion = _c.sent();
+                    return [4 /*yield*/, (0, db_1.getDbAsSystem)().update(user_1.tables.AccountDeletion, { id: deletion.id, phase: 'purging' })];
+                case 3:
+                    _c.sent();
+                    return [4 /*yield*/, invokeLogin(userA.email, PASSWORD_A)];
+                case 4:
+                    _a = _c.sent(), loggedInAs = _a.loggedInAs, sent = _a.sent;
+                    expect(sent).toEqual({ error: 'This account is being deleted and can no longer be restored.' });
+                    expect(loggedInAs).toBeUndefined();
+                    _b = expect;
+                    return [4 /*yield*/, userRow(userA.id)];
+                case 5:
+                    _b.apply(void 0, [(_c.sent()).status]).toBe('deactivated');
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    it('login refuses a staff-deactivated account outright', function () { return __awaiter(void 0, void 0, void 0, function () {
+        var _a, loggedInAs, sent;
+        return __generator(this, function (_b) {
+            switch (_b.label) {
+                case 0: return [4 /*yield*/, (0, db_1.getDbAsSystem)().update(user_1.tables.User, { id: userB.id, status: 'deactivated' })];
+                case 1:
+                    _b.sent();
+                    return [4 /*yield*/, invokeLogin(userB.email, PASSWORD_B)];
+                case 2:
+                    _a = _b.sent(), loggedInAs = _a.loggedInAs, sent = _a.sent;
+                    expect(sent).toEqual({ error: 'This account has been deactivated' });
+                    expect(loggedInAs).toBeUndefined();
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+});
+//# sourceMappingURL=AccountDeletion.integration.test.js.map