@proteinjs/user-server 1.7.0 → 1.8.0

package/dist/test/MachineAccounts.integration.test.js

@@ -0,0 +1,597 @@
+"use strict";
+var __extends = (this && this.__extends) || (function () {
+    var extendStatics = function (d, b) {
+        extendStatics = Object.setPrototypeOf ||
+            ({ __proto__: [] } instanceof Array && function (d, b) { d.__proto__ = b; }) ||
+            function (d, b) { for (var p in b) if (Object.prototype.hasOwnProperty.call(b, p)) d[p] = b[p]; };
+        return extendStatics(d, b);
+    };
+    return function (d, b) {
+        if (typeof b !== "function" && b !== null)
+            throw new TypeError("Class extends value " + String(b) + " is not a constructor or null");
+        extendStatics(d, b);
+        function __() { this.constructor = d; }
+        d.prototype = b === null ? Object.create(b) : (__.prototype = b.prototype, new __());
+    };
+})();
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var __generator = (this && this.__generator) || function (thisArg, body) {
+    var _ = { label: 0, sent: function() { if (t[0] & 1) throw t[1]; return t[1]; }, trys: [], ops: [] }, f, y, t, g;
+    return g = { next: verb(0), "throw": verb(1), "return": verb(2) }, typeof Symbol === "function" && (g[Symbol.iterator] = function() { return this; }), g;
+    function verb(n) { return function (v) { return step([n, v]); }; }
+    function step(op) {
+        if (f) throw new TypeError("Generator is already executing.");
+        while (g && (g = 0, op[0] && (_ = 0)), _) try {
+            if (f = 1, y && (t = op[0] & 2 ? y["return"] : op[0] ? y["throw"] || ((t = y["return"]) && t.call(y), 0) : y.next) && !(t = t.call(y, op[1])).done) return t;
+            if (y = 0, t) op = [op[0] & 2, t.value];
+            switch (op[0]) {
+                case 0: case 1: t = op; break;
+                case 4: _.label++; return { value: op[1], done: false };
+                case 5: _.label++; y = op[1]; op = [0]; continue;
+                case 7: op = _.ops.pop(); _.trys.pop(); continue;
+                default:
+                    if (!(t = _.trys, t = t.length > 0 && t[t.length - 1]) && (op[0] === 6 || op[0] === 2)) { _ = 0; continue; }
+                    if (op[0] === 3 && (!t || (op[1] > t[0] && op[1] < t[3]))) { _.label = op[1]; break; }
+                    if (op[0] === 6 && _.label < t[1]) { _.label = t[1]; t = op; break; }
+                    if (t && _.label < t[2]) { _.label = t[2]; _.ops.push(op); break; }
+                    if (t[2]) _.ops.pop();
+                    _.trys.pop(); continue;
+            }
+            op = body.call(thisArg, _);
+        } catch (e) { op = [6, e]; y = 0; } finally { f = t = 0; }
+        if (op[0] & 5) throw op[1]; return { value: op[0] ? op[1] : void 0, done: true };
+    }
+};
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+var sha256_1 = __importDefault(require("crypto-js/sha256"));
+var db_1 = require("@proteinjs/db");
+var reflection_1 = require("@proteinjs/reflection");
+// Deep import (test-only): ServiceAuth is the real RPC door but is not index-exported by
+// @proteinjs/service — the door test below runs the actual gate rather than pinning metadata.
+var ServiceAuth_1 = require("@proteinjs/service/dist/src/ServiceAuth");
+var user_1 = require("@proteinjs/user");
+var authenticate_1 = require("../src/authentication/authenticate");
+var UserStatusTableWatcher_1 = require("../src/authentication/UserStatusTableWatcher");
+var MachineCredentials_1 = require("../src/services/MachineCredentials");
+var Roles_1 = require("../src/services/Roles");
+var SetUserStatus_1 = require("../src/services/SetUserStatus");
+var UserServerTestEnvironment_1 = require("./UserServerTestEnvironment");
+var testEnv = new UserServerTestEnvironment_1.UserServerTestEnvironment();
+/** The consumer-mapped role machine declarations grant (registered into the catalog below). */
+var OpsRole = /** @class */ (function () {
+    function OpsRole() {
+        this.role = 'ops';
+        this.description = 'Operational machinery';
+    }
+    return OpsRole;
+}());
+var TestOpsMachineAccount = /** @class */ (function (_super) {
+    __extends(TestOpsMachineAccount, _super);
+    function TestOpsMachineAccount() {
+        var _this = _super !== null && _super.apply(this, arguments) || this;
+        _this.id = 'machine-test-ops';
+        _this.email = 'machine-ops@test.local';
+        _this.accountName = 'Test ops machine';
+        _this.roles = ['ops'];
+        _this.secretName = 'test-ops-secret';
+        return _this;
+    }
+    return TestOpsMachineAccount;
+}(user_1.MachineAccount));
+/**
+ * Reset `TableWatcherRunner`'s static watcher map so the NEXT Db construction recomputes it from
+ * the (just-changed) discovery seam. The class is internal to @proteinjs/db (its exports map
+ * blocks deep imports), so it's reached through a Db instance — the test-harness cast convention.
+ */
+var resetTableWatcherMap = function () {
+    var runner = (0, db_1.getDbAsSystem)().tableWatcherRunner;
+    runner.constructor.tableWatcherMap = undefined;
+};
+/**
+ * Machine accounts as source records, at the user layer: declare-only on the REAL mixed user
+ * table, adopt-in-place by email (id + password survive — the old credential still logs in),
+ * removed-from-source auto-deactivation with session kill through the categorical
+ * UserStatusTableWatcher, the machine/human ledger split (Roles refuses machine targets),
+ * declaration validation, and credential minting (hash-only at rest, plaintext shown once).
+ */
+describe('Machine accounts as source records', function () {
+    var objectCache = function () { return reflection_1.SourceRepository.get().objectCache; };
+    /** One boot of Db.init's source-record leg with these MachineAccount declarations. */
+    var boot = function (declarations) { return __awaiter(void 0, void 0, void 0, function () {
+        return __generator(this, function (_a) {
+            switch (_a.label) {
+                case 0:
+                    objectCache()['@proteinjs/db/SourceRecordLoader'] = declarations;
+                    return [4 /*yield*/, new db_1.SourceRecordSyncRunner().load()];
+                case 1:
+                    _a.sent();
+                    return [2 /*return*/];
+            }
+        });
+    }); };
+    var machineRow = function () { return __awaiter(void 0, void 0, void 0, function () { return __generator(this, function (_a) {
+        switch (_a.label) {
+            case 0: return [4 /*yield*/, (0, db_1.getDbAsSystem)().get(user_1.tables.User, { email: 'machine-ops@test.local' })];
+            case 1: return [2 /*return*/, _a.sent()];
+        }
+    }); }); };
+    var insertSession = function (sessionId, userEmail) { return __awaiter(void 0, void 0, void 0, function () {
+        return __generator(this, function (_a) {
+            switch (_a.label) {
+                case 0: return [4 /*yield*/, (0, db_1.getDbAsSystem)().insert(user_1.tables.Session, {
+                        sessionId: sessionId,
+                        session: '{}',
+                        expires: new Date(Date.now() + 60 * 60 * 1000),
+                        userEmail: userEmail,
+                    })];
+                case 1: return [2 /*return*/, _a.sent()];
+            }
+        });
+    }); };
+    var sessionEmails = function () { return __awaiter(void 0, void 0, void 0, function () { return __generator(this, function (_a) {
+        switch (_a.label) {
+            case 0: return [4 /*yield*/, (0, db_1.getDbAsSystem)().query(user_1.tables.Session, {})];
+            case 1: return [2 /*return*/, (_a.sent()).map(function (session) { return session.userEmail; })];
+        }
+    }); }); };
+    beforeAll(function () { return __awaiter(void 0, void 0, void 0, function () {
+        return __generator(this, function (_a) {
+            switch (_a.label) {
+                case 0: return [4 /*yield*/, testEnv.beforeAll()];
+                case 1:
+                    _a.sent();
+                    reflection_1.SourceRepository.get().objectCache['@proteinjs/user-auth/AuthenticatedUserRepo'] = [new user_1.UserRepo()];
+                    objectCache()['@proteinjs/user/RoleCatalogEntry'] = [new OpsRole()];
+                    // Exactly the deactivation watcher observes this run, rebuilt from the seeded cache.
+                    objectCache()['@proteinjs/db/TableWatcher'] = [new UserStatusTableWatcher_1.UserStatusTableWatcher()];
+                    resetTableWatcherMap();
+                    return [2 /*return*/];
+            }
+        });
+    }); }, 120000);
+    afterAll(function () { return __awaiter(void 0, void 0, void 0, function () {
+        return __generator(this, function (_a) {
+            switch (_a.label) {
+                case 0:
+                    delete objectCache()['@proteinjs/db/SourceRecordLoader'];
+                    delete objectCache()['@proteinjs/db/TableWatcher'];
+                    delete objectCache()['@proteinjs/user/RoleCatalogEntry'];
+                    resetTableWatcherMap();
+                    return [4 /*yield*/, testEnv.afterAll()];
+                case 1:
+                    _a.sent();
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    beforeEach(function () { return __awaiter(void 0, void 0, void 0, function () {
+        var db;
+        return __generator(this, function (_a) {
+            switch (_a.label) {
+                case 0:
+                    db = (0, db_1.getDbAsSystem)();
+                    return [4 /*yield*/, db.delete(user_1.tables.Session, {})];
+                case 1:
+                    _a.sent();
+                    return [4 /*yield*/, db.delete(user_1.tables.UserStatusEvent, {})];
+                case 2:
+                    _a.sent();
+                    return [4 /*yield*/, db.delete(user_1.tables.RoleGrantEvent, {})];
+                case 3:
+                    _a.sent();
+                    return [4 /*yield*/, db.delete(user_1.tables.User, {})];
+                case 4:
+                    _a.sent();
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    it('declare-only on the mixed user table: the declaration lands source-owned; human rows are untouched', function () { return __awaiter(void 0, void 0, void 0, function () {
+        var human, machine, humanAfter;
+        return __generator(this, function (_a) {
+            switch (_a.label) {
+                case 0: return [4 /*yield*/, testEnv.createUser({ name: 'A human', email: 'human@test.local', roles: ['ops'] })];
+                case 1:
+                    human = _a.sent();
+                    return [4 /*yield*/, boot([new TestOpsMachineAccount()])];
+                case 2:
+                    _a.sent();
+                    return [4 /*yield*/, machineRow()];
+                case 3:
+                    machine = _a.sent();
+                    expect(machine).toMatchObject({
+                        id: 'machine-test-ops',
+                        name: 'Test ops machine',
+                        roles: ['ops'],
+                        emailVerified: true,
+                        status: 'active',
+                        isLoadedFromSource: true,
+                    });
+                    // No declarable password: the fresh row carries none, so authenticate's email+hash match
+                    // can never admit it until a credential is minted.
+                    expect(machine.password).toBeFalsy();
+                    return [4 /*yield*/, (0, db_1.getDbAsSystem)().get(user_1.tables.User, { id: human.id })];
+                case 4:
+                    humanAfter = _a.sent();
+                    expect(humanAfter.isLoadedFromSource).toBeFalsy();
+                    expect(humanAfter).toMatchObject({ name: 'A human', roles: ['ops'] });
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    it('adopt-in-place by email: the hand-made row keeps its id and password; declared fields revert', function () { return __awaiter(void 0, void 0, void 0, function () {
+        var handMade, adopted, _a;
+        return __generator(this, function (_b) {
+            switch (_b.label) {
+                case 0: return [4 /*yield*/, testEnv.createUser({
+                        name: 'Hand-made bridge',
+                        email: 'machine-ops@test.local',
+                        roles: ['ops', 'stale-role'],
+                    })];
+                case 1:
+                    handMade = _b.sent();
+                    return [4 /*yield*/, boot([new TestOpsMachineAccount()])];
+                case 2:
+                    _b.sent();
+                    return [4 /*yield*/, machineRow()];
+                case 3:
+                    adopted = _b.sent();
+                    expect(adopted.id).toBe(handMade.id);
+                    expect(adopted).toMatchObject({
+                        name: 'Test ops machine',
+                        roles: ['ops'],
+                        status: 'active',
+                        isLoadedFromSource: true,
+                    });
+                    // The credential survived adoption: the account still authenticates with its old password
+                    // (createUser stores sha256('test')... it stores the raw string; assert equality instead).
+                    expect(adopted.password).toBe(handMade.password);
+                    _a = expect;
+                    return [4 /*yield*/, (0, db_1.getDbAsSystem)().query(user_1.tables.User, { email: 'machine-ops@test.local' })];
+                case 4:
+                    _a.apply(void 0, [(_b.sent()).length]).toBe(1);
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    it('removed from source: deactivated (never deleted), sessions killed, login refused; re-declaring reactivates', function () { return __awaiter(void 0, void 0, void 0, function () {
+        var human, removed, _a, _b, _c, _d;
+        return __generator(this, function (_e) {
+            switch (_e.label) {
+                case 0: return [4 /*yield*/, testEnv.createUser({ name: 'A human', email: 'human@test.local' })];
+                case 1:
+                    human = _e.sent();
+                    return [4 /*yield*/, boot([new TestOpsMachineAccount()])];
+                case 2:
+                    _e.sent();
+                    return [4 /*yield*/, insertSession('machine-session', 'machine-ops@test.local')];
+                case 3:
+                    _e.sent();
+                    return [4 /*yield*/, insertSession('human-session', human.email)];
+                case 4:
+                    _e.sent();
+                    return [4 /*yield*/, boot([])];
+                case 5:
+                    _e.sent();
+                    return [4 /*yield*/, machineRow()];
+                case 6:
+                    removed = _e.sent();
+                    expect(removed).toBeDefined();
+                    expect(removed.status).toBe('deactivated');
+                    // The categorical watcher killed the machine sessions; the human session is untouched.
+                    _a = expect;
+                    return [4 /*yield*/, sessionEmails()];
+                case 7:
+                    // The categorical watcher killed the machine sessions; the human session is untouched.
+                    _a.apply(void 0, [_e.sent()]).toEqual([human.email]);
+                    // The one login door refuses a deactivated account even with matching credentials.
+                    return [4 /*yield*/, (0, db_1.getDbAsSystem)().update(user_1.tables.User, { id: removed.id, password: (0, sha256_1.default)('bridge-pw').toString() })];
+                case 8:
+                    // The one login door refuses a deactivated account even with matching credentials.
+                    _e.sent();
+                    _b = expect;
+                    return [4 /*yield*/, (0, authenticate_1.authenticate)('machine-ops@test.local', 'bridge-pw')];
+                case 9:
+                    _b.apply(void 0, [_e.sent()]).toBe('This account has been deactivated');
+                    // Decommission is reversible in code: re-declaring reverts status via drift reversion.
+                    return [4 /*yield*/, boot([new TestOpsMachineAccount()])];
+                case 10:
+                    // Decommission is reversible in code: re-declaring reverts status via drift reversion.
+                    _e.sent();
+                    _c = expect;
+                    return [4 /*yield*/, machineRow()];
+                case 11:
+                    _c.apply(void 0, [(_e.sent()).status]).toBe('active');
+                    _d = expect;
+                    return [4 /*yield*/, (0, authenticate_1.authenticate)('machine-ops@test.local', 'bridge-pw')];
+                case 12:
+                    _d.apply(void 0, [_e.sent()]).toBe(true);
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    it("the staff toggle rides the same watcher: SetUserStatus deactivation kills the target's sessions", function () { return __awaiter(void 0, void 0, void 0, function () {
+        var admin, target, _a;
+        return __generator(this, function (_b) {
+            switch (_b.label) {
+                case 0: return [4 /*yield*/, testEnv.createUser({ name: 'Admin', email: 'admin@test.local', roles: ['admin'] })];
+                case 1:
+                    admin = _b.sent();
+                    return [4 /*yield*/, testEnv.createUser({ name: 'Target', email: 'target@test.local' })];
+                case 2:
+                    target = _b.sent();
+                    return [4 /*yield*/, insertSession('target-session', target.email)];
+                case 3:
+                    _b.sent();
+                    return [4 /*yield*/, insertSession('admin-session', admin.email)];
+                case 4:
+                    _b.sent();
+                    testEnv.actAs(admin);
+                    return [4 /*yield*/, new SetUserStatus_1.SetUserStatus().setUserStatus(target.id, 'deactivated')];
+                case 5:
+                    _b.sent();
+                    _a = expect;
+                    return [4 /*yield*/, sessionEmails()];
+                case 6:
+                    _a.apply(void 0, [_b.sent()]).toEqual([admin.email]);
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    it('the Roles service refuses machine-account targets (git is the machine audit); human grants still work', function () { return __awaiter(void 0, void 0, void 0, function () {
+        var admin, human, machine, _a, _b;
+        return __generator(this, function (_c) {
+            switch (_c.label) {
+                case 0: return [4 /*yield*/, testEnv.createUser({ name: 'Admin', email: 'admin@test.local', roles: ['admin'] })];
+                case 1:
+                    admin = _c.sent();
+                    return [4 /*yield*/, testEnv.createUser({ name: 'A human', email: 'human@test.local' })];
+                case 2:
+                    human = _c.sent();
+                    return [4 /*yield*/, boot([new TestOpsMachineAccount()])];
+                case 3:
+                    _c.sent();
+                    testEnv.actAs(admin);
+                    return [4 /*yield*/, machineRow()];
+                case 4:
+                    machine = _c.sent();
+                    return [4 /*yield*/, expect(new Roles_1.Roles().grantRole(machine.id, 'ops')).rejects.toThrow(/machine account: its roles are declared in code/)];
+                case 5:
+                    _c.sent();
+                    return [4 /*yield*/, expect(new Roles_1.Roles().revokeRole(machine.id, 'ops')).rejects.toThrow(/machine account: its roles are declared in code/)];
+                case 6:
+                    _c.sent();
+                    // No machine rows in the human ledger.
+                    _a = expect;
+                    return [4 /*yield*/, (0, db_1.getDbAsSystem)().query(user_1.tables.RoleGrantEvent, { target: machine.id })];
+                case 7:
+                    // No machine rows in the human ledger.
+                    _a.apply(void 0, [_c.sent()]).toHaveLength(0);
+                    return [4 /*yield*/, new Roles_1.Roles().grantRole(human.id, 'ops')];
+                case 8:
+                    _c.sent();
+                    _b = expect;
+                    return [4 /*yield*/, (0, db_1.getDbAsSystem)().get(user_1.tables.User, { id: human.id })];
+                case 9:
+                    _b.apply(void 0, [(_c.sent()).roles]).toEqual(['ops']);
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    it('declaration validation fails boot loudly: non-lowercase email, unknown role, break-glass role', function () { return __awaiter(void 0, void 0, void 0, function () {
+        var UppercaseEmail, UnknownRole, BreakGlass;
+        return __generator(this, function (_a) {
+            switch (_a.label) {
+                case 0:
+                    UppercaseEmail = /** @class */ (function (_super) {
+                        __extends(UppercaseEmail, _super);
+                        function UppercaseEmail() {
+                            var _this = _super !== null && _super.apply(this, arguments) || this;
+                            _this.email = 'Machine-Ops@test.local';
+                            return _this;
+                        }
+                        return UppercaseEmail;
+                    }(TestOpsMachineAccount));
+                    return [4 /*yield*/, expect(boot([new UppercaseEmail()])).rejects.toThrow(/emails must be lowercase/)];
+                case 1:
+                    _a.sent();
+                    UnknownRole = /** @class */ (function (_super) {
+                        __extends(UnknownRole, _super);
+                        function UnknownRole() {
+                            var _this = _super !== null && _super.apply(this, arguments) || this;
+                            _this.roles = ['not-a-role'];
+                            return _this;
+                        }
+                        return UnknownRole;
+                    }(TestOpsMachineAccount));
+                    return [4 /*yield*/, expect(boot([new UnknownRole()])).rejects.toThrow(/unknown role 'not-a-role'/)];
+                case 2:
+                    _a.sent();
+                    BreakGlass = /** @class */ (function (_super) {
+                        __extends(BreakGlass, _super);
+                        function BreakGlass() {
+                            var _this = _super !== null && _super.apply(this, arguments) || this;
+                            _this.roles = ['admin'];
+                            return _this;
+                        }
+                        return BreakGlass;
+                    }(TestOpsMachineAccount));
+                    return [4 /*yield*/, expect(boot([new BreakGlass()])).rejects.toThrow(/break-glass role 'admin'/)];
+                case 3:
+                    _a.sent();
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    describe('credential minting', function () {
+        beforeEach(function () { return __awaiter(void 0, void 0, void 0, function () {
+            return __generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0: return [4 /*yield*/, boot([new TestOpsMachineAccount()])];
+                    case 1:
+                        _a.sent();
+                        return [2 /*return*/];
+                }
+            });
+        }); });
+        it('mints a generated credential: hash-only at rest, sessions rotated, plaintext + paste note returned once', function () { return __awaiter(void 0, void 0, void 0, function () {
+            var minted, row, _a, _b;
+            return __generator(this, function (_c) {
+                switch (_c.label) {
+                    case 0: return [4 /*yield*/, insertSession('old-credential-session', 'machine-ops@test.local')];
+                    case 1:
+                        _c.sent();
+                        return [4 /*yield*/, new MachineCredentials_1.MachineCredentials().mintCredential('machine-ops@test.local')];
+                    case 2:
+                        minted = _c.sent();
+                        expect(minted.email).toBe('machine-ops@test.local');
+                        expect(minted.password).toMatch(/^[0-9a-f]{64}$/); // 256 bits, generated — never human-chosen
+                        expect(minted.secretName).toBe('test-ops-secret');
+                        expect(minted.note).toMatch(/test-ops-secret/);
+                        expect(minted.note).toMatch(/restart/i);
+                        return [4 /*yield*/, machineRow()];
+                    case 3:
+                        row = _c.sent();
+                        expect(row.password).toBe((0, sha256_1.default)(minted.password).toString());
+                        // The old credential's sessions died with the rotation...
+                        _a = expect;
+                        return [4 /*yield*/, sessionEmails()];
+                    case 4:
+                        // The old credential's sessions died with the rotation...
+                        _a.apply(void 0, [_c.sent()]).toEqual([]);
+                        // ...and the minted credential is immediately loggable.
+                        _b = expect;
+                        return [4 /*yield*/, (0, authenticate_1.authenticate)('machine-ops@test.local', minted.password)];
+                    case 5:
+                        // ...and the minted credential is immediately loggable.
+                        _b.apply(void 0, [_c.sent()]).toBe(true);
+                        return [2 /*return*/];
+                }
+            });
+        }); });
+        it('lists declared accounts with row state for the admin surface', function () { return __awaiter(void 0, void 0, void 0, function () {
+            var NotBooted, before, after;
+            return __generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0:
+                        NotBooted = /** @class */ (function (_super) {
+                            __extends(NotBooted, _super);
+                            function NotBooted() {
+                                var _this = _super !== null && _super.apply(this, arguments) || this;
+                                _this.id = 'machine-not-booted';
+                                _this.email = 'machine-not-booted@test.local';
+                                _this.secretName = 'not-booted-secret';
+                                return _this;
+                            }
+                            return NotBooted;
+                        }(TestOpsMachineAccount));
+                        objectCache()['@proteinjs/db/SourceRecordLoader'] = [new TestOpsMachineAccount(), new NotBooted()];
+                        return [4 /*yield*/, new MachineCredentials_1.MachineCredentials().listMachineAccounts()];
+                    case 1:
+                        before = _a.sent();
+                        expect(before).toEqual([
+                            {
+                                email: 'machine-ops@test.local',
+                                accountName: 'Test ops machine',
+                                roles: ['ops'],
+                                secretName: 'test-ops-secret',
+                                status: 'active',
+                                hasCredential: false,
+                            },
+                            {
+                                email: 'machine-not-booted@test.local',
+                                accountName: 'Test ops machine',
+                                roles: ['ops'],
+                                secretName: 'not-booted-secret',
+                                status: 'pending first boot',
+                                hasCredential: false,
+                            },
+                        ]);
+                        return [4 /*yield*/, new MachineCredentials_1.MachineCredentials().mintCredential('machine-ops@test.local')];
+                    case 2:
+                        _a.sent();
+                        return [4 /*yield*/, new MachineCredentials_1.MachineCredentials().listMachineAccounts()];
+                    case 3:
+                        after = _a.sent();
+                        expect(after[0]).toMatchObject({ email: 'machine-ops@test.local', hasCredential: true });
+                        return [2 /*return*/];
+                }
+            });
+        }); });
+        it('refuses non-machine targets: undeclared emails and human accounts', function () { return __awaiter(void 0, void 0, void 0, function () {
+            return __generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0: return [4 /*yield*/, testEnv.createUser({ name: 'A human', email: 'human@test.local' })];
+                    case 1:
+                        _a.sent();
+                        return [4 /*yield*/, expect(new MachineCredentials_1.MachineCredentials().mintCredential('human@test.local')).rejects.toThrow(/No machine account is declared/)];
+                    case 2:
+                        _a.sent();
+                        return [4 /*yield*/, expect(new MachineCredentials_1.MachineCredentials().mintCredential('nobody@test.local')).rejects.toThrow(/No machine account is declared/)];
+                    case 3:
+                        _a.sent();
+                        return [2 /*return*/];
+                }
+            });
+        }); });
+        it('refuses a declared account whose row has not been loaded from source yet', function () { return __awaiter(void 0, void 0, void 0, function () {
+            var NotBooted;
+            return __generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0:
+                        NotBooted = /** @class */ (function (_super) {
+                            __extends(NotBooted, _super);
+                            function NotBooted() {
+                                var _this = _super !== null && _super.apply(this, arguments) || this;
+                                _this.id = 'machine-not-booted';
+                                _this.email = 'machine-not-booted@test.local';
+                                return _this;
+                            }
+                            return NotBooted;
+                        }(TestOpsMachineAccount));
+                        // Declared (discoverable) but never booted: no source-owned row exists.
+                        objectCache()['@proteinjs/db/SourceRecordLoader'] = [new TestOpsMachineAccount(), new NotBooted()];
+                        return [4 /*yield*/, expect(new MachineCredentials_1.MachineCredentials().mintCredential('machine-not-booted@test.local')).rejects.toThrow(/has not been loaded from source yet/)];
+                    case 1:
+                        _a.sent();
+                        return [2 /*return*/];
+                }
+            });
+        }); });
+        it("the door is the 'users' permission (admin passes as break-glass)", function () { return __awaiter(void 0, void 0, void 0, function () {
+            var admin, plain, canRun;
+            return __generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0: return [4 /*yield*/, testEnv.createUser({ name: 'Admin', email: 'admin@test.local', roles: ['admin'] })];
+                    case 1:
+                        admin = _a.sent();
+                        return [4 /*yield*/, testEnv.createUser({ name: 'Plain', email: 'plain@test.local', roles: ['ops'] })];
+                    case 2:
+                        plain = _a.sent();
+                        canRun = function () {
+                            return ServiceAuth_1.ServiceAuth.canRunService(new MachineCredentials_1.MachineCredentials(), { name: 'mintCredential' }, [
+                                'machine-ops@test.local',
+                            ]);
+                        };
+                        testEnv.actAs(plain);
+                        expect(canRun()).toBe(false);
+                        testEnv.actAs(admin);
+                        expect(canRun()).toBe(true);
+                        return [2 /*return*/];
+                }
+            });
+        }); });
+    });
+});
+//# sourceMappingURL=MachineAccounts.integration.test.js.map

package/dist/test/MachineAccounts.integration.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"MachineAccounts.integration.test.js","sourceRoot":"","sources":["../../test/MachineAccounts.integration.test.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,4DAAsC;AACtC,oCAAsE;AACtE,oDAAyD;AACzD,yFAAyF;AACzF,8FAA8F;AAC9F,uEAAsE;AACtE,wCAA2F;AAC3F,mEAAkE;AAClE,uFAAsF;AACtF,yEAAwE;AACxE,+CAA8C;AAC9C,+DAA8D;AAC9D,yEAAwE;AAExE,IAAM,OAAO,GAAG,IAAI,qDAAyB,EAAE,CAAC;AAEhD,+FAA+F;AAC/F;IAAA;QACE,SAAI,GAAG,KAAK,CAAC;QACb,gBAAW,GAAG,uBAAuB,CAAC;IACxC,CAAC;IAAD,cAAC;AAAD,CAAC,AAHD,IAGC;AAED;IAAoC,yCAAc;IAAlD;QAAA,qEAMC;QALC,QAAE,GAAG,kBAAkB,CAAC;QACxB,WAAK,GAAG,wBAAwB,CAAC;QACjC,iBAAW,GAAG,kBAAkB,CAAC;QACjC,WAAK,GAAG,CAAC,KAAK,CAAC,CAAC;QAChB,gBAAU,GAAG,iBAAiB,CAAC;;IACjC,CAAC;IAAD,4BAAC;AAAD,CAAC,AAND,CAAoC,qBAAc,GAMjD;AAID;;;;GAIG;AACH,IAAM,oBAAoB,GAAG;IAC3B,IAAM,MAAM,GAAI,IAAA,kBAAa,GAAgD,CAAC,kBAAkB,CAAC;IAChG,MAAM,CAAC,WAA6C,CAAC,eAAe,GAAG,SAAS,CAAC;AACpF,CAAC,CAAC;AAEF;;;;;;GAMG;AACH,QAAQ,CAAC,oCAAoC,EAAE;IAC7C,IAAM,WAAW,GAAG,cAAM,OAAC,6BAAgB,CAAC,GAAG,EAA2C,CAAC,WAAW,EAA5E,CAA4E,CAAC;IAEvG,sFAAsF;IACtF,IAAM,IAAI,GAAG,UAAO,YAA8B;;;;oBAChD,WAAW,EAAE,CAAC,kCAAkC,CAAC,GAAG,YAAY,CAAC;oBACjE,qBAAM,IAAI,2BAAsB,EAAE,CAAC,IAAI,EAAE,EAAA;;oBAAzC,SAAyC,CAAC;;;;SAC3C,CAAC;IAEF,IAAM,UAAU,GAAG;;oBAAY,qBAAM,IAAA,kBAAa,GAAE,CAAC,GAAG,CAAC,aAAM,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,wBAAwB,EAAE,CAAC,EAAA;oBAA3E,sBAAA,SAA2E,EAAA;;aAAA,CAAC;IAE3G,IAAM,aAAa,GAAG,UAAO,SAAiB,EAAE,SAAiB;;;wBAC/D,qBAAM,IAAA,kBAAa,GAAE,CAAC,MAAM,CAAC,aAAM,CAAC,OAAO,EAAE;wBAC3C,SAAS,WAAA;wBACT,OAAO,EAAE,IAAI;wBACb,OAAO,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;wBAC9C,SAAS,WAAA;qBACV,CAAC,EAAA;wBALF,sBAAA,SAKE,EAAA;;;SAAA,CAAC;IAEL,IAAM,aAAa,GAAG;;oBACnB,qBAAM,IAAA,kBAAa,GAAE,CAAC,KAAK,CAAC,aAAM,CAAC,OAAO,EAAE,EAAE,CAAC,EAAA;oBAAhD,sBAAA,CAAC,SAA+C,CAAC,CAAC,GAAG,CAAC,UAAC,OAAO,IAAK,OAAA,OAAO,CAAC,SAAS,EAAjB,CAAiB,CAAC,EAAA;;aAAA,CAAC;IAExF,SAAS,CAAC;;;wBACR,qBAAM,OAAO,CAAC,SAAS,EAAE,EAAA;;oBAAzB,SAAyB,CAAC;oBACzB,6BAAgB,CAAC,GAAG,EAA2C,CAAC,WAAW,CAC1E,4CAA4C,CAC7C,GAAG,CAAC,IAAI,eAAQ,EAAE,CAAC,CAAC;oBACrB,WAAW,EAAE,CAAC,kCAAkC,CAAC,GAAG,CAAC,IAAI,OAAO,EAAE,CAAC,CAAC;oBACpE,qFAAqF;oBACrF,WAAW,EAAE,CAAC,4BAA4B,CAAC,GAAG,CAAC,IAAI,+CAAsB,EAAE,CAAC,CAAC;oBAC7E,oBAAoB,EAAE,CAAC;;;;SACxB,EAAE,MAAM,CAAC,CAAC;IAEX,QAAQ,CAAC;;;;oBACP,OAAO,WAAW,EAAE,CAAC,kCAAkC,CAAC,CAAC;oBACzD,OAAO,WAAW,EAAE,CAAC,4BAA4B,CAAC,CAAC;oBACnD,OAAO,WAAW,EAAE,CAAC,kCAAkC,CAAC,CAAC;oBACzD,oBAAoB,EAAE,CAAC;oBACvB,qBAAM,OAAO,CAAC,QAAQ,EAAE,EAAA;;oBAAxB,SAAwB,CAAC;;;;SAC1B,CAAC,CAAC;IAEH,UAAU,CAAC;;;;;oBACH,EAAE,GAAG,IAAA,kBAAa,GAAE,CAAC;oBAC3B,qBAAM,EAAE,CAAC,MAAM,CAAC,aAAM,CAAC,OAAO,EAAE,EAAE,CAAC,EAAA;;oBAAnC,SAAmC,CAAC;oBACpC,qBAAM,EAAE,CAAC,MAAM,CAAC,aAAM,CAAC,eAAe,EAAE,EAAE,CAAC,EAAA;;oBAA3C,SAA2C,CAAC;oBAC5C,qBAAM,EAAE,CAAC,MAAM,CAAC,aAAM,CAAC,cAAc,EAAE,EAAE,CAAC,EAAA;;oBAA1C,SAA0C,CAAC;oBAC3C,qBAAM,EAAE,CAAC,MAAM,CAAC,aAAM,CAAC,IAAI,EAAE,EAAE,CAAC,EAAA;;oBAAhC,SAAgC,CAAC;;;;SAClC,CAAC,CAAC;IAEH,EAAE,CAAC,oGAAoG,EAAE;;;;wBACzF,qBAAM,OAAO,CAAC,UAAU,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,kBAAkB,EAAE,KAAK,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,EAAA;;oBAAhG,KAAK,GAAG,SAAwF;oBACtG,qBAAM,IAAI,CAAC,CAAC,IAAI,qBAAqB,EAAE,CAAC,CAAC,EAAA;;oBAAzC,SAAyC,CAAC;oBAE1B,qBAAM,UAAU,EAAE,EAAA;;oBAA5B,OAAO,GAAG,SAAkB;oBAClC,MAAM,CAAC,OAAO,CAAC,CAAC,aAAa,CAAC;wBAC5B,EAAE,EAAE,kBAAkB;wBACtB,IAAI,EAAE,kBAAkB;wBACxB,KAAK,EAAE,CAAC,KAAK,CAAC;wBACd,aAAa,EAAE,IAAI;wBACnB,MAAM,EAAE,QAAQ;wBAChB,kBAAkB,EAAE,IAAI;qBACzB,CAAC,CAAC;oBACH,yFAAyF;oBACzF,mDAAmD;oBACnD,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,SAAS,EAAE,CAAC;oBAElB,qBAAM,IAAA,kBAAa,GAAE,CAAC,GAAG,CAAC,aAAM,CAAC,IAAI,EAAE,EAAE,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,EAAA;;oBAArE,UAAU,GAAG,SAAwD;oBAC3E,MAAM,CAAC,UAAU,CAAC,kBAAkB,CAAC,CAAC,SAAS,EAAE,CAAC;oBAClD,MAAM,CAAC,UAAU,CAAC,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;;;;SACvE,CAAC,CAAC;IAEH,EAAE,CAAC,8FAA8F,EAAE;;;;wBAGhF,qBAAM,OAAO,CAAC,UAAU,CAAC;wBACxC,IAAI,EAAE,kBAAkB;wBACxB,KAAK,EAAE,wBAAwB;wBAC/B,KAAK,EAAE,CAAC,KAAK,EAAE,YAAY,CAAC;qBAC7B,CAAC,EAAA;;oBAJI,QAAQ,GAAG,SAIf;oBAEF,qBAAM,IAAI,CAAC,CAAC,IAAI,qBAAqB,EAAE,CAAC,CAAC,EAAA;;oBAAzC,SAAyC,CAAC;oBAE1B,qBAAM,UAAU,EAAE,EAAA;;oBAA5B,OAAO,GAAG,SAAkB;oBAClC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;oBACrC,MAAM,CAAC,OAAO,CAAC,CAAC,aAAa,CAAC;wBAC5B,IAAI,EAAE,kBAAkB;wBACxB,KAAK,EAAE,CAAC,KAAK,CAAC;wBACd,MAAM,EAAE,QAAQ;wBAChB,kBAAkB,EAAE,IAAI;qBACzB,CAAC,CAAC;oBACH,0FAA0F;oBAC1F,2FAA2F;oBAC3F,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;oBACjD,KAAA,MAAM,CAAA;oBAAE,qBAAM,IAAA,kBAAa,GAAE,CAAC,KAAK,CAAC,aAAM,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,wBAAwB,EAAE,CAAC,EAAA;;oBAArF,kBAAO,CAAC,SAA6E,CAAC,CAAC,MAAM,EAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;;;;SACxG,CAAC,CAAC;IAEH,EAAE,CAAC,4GAA4G,EAAE;;;;wBACjG,qBAAM,OAAO,CAAC,UAAU,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC,EAAA;;oBAAhF,KAAK,GAAG,SAAwE;oBACtF,qBAAM,IAAI,CAAC,CAAC,IAAI,qBAAqB,EAAE,CAAC,CAAC,EAAA;;oBAAzC,SAAyC,CAAC;oBAC1C,qBAAM,aAAa,CAAC,iBAAiB,EAAE,wBAAwB,CAAC,EAAA;;oBAAhE,SAAgE,CAAC;oBACjE,qBAAM,aAAa,CAAC,eAAe,EAAE,KAAK,CAAC,KAAK,CAAC,EAAA;;oBAAjD,SAAiD,CAAC;oBAElD,qBAAM,IAAI,CAAC,EAAE,CAAC,EAAA;;oBAAd,SAAc,CAAC;oBAEC,qBAAM,UAAU,EAAE,EAAA;;oBAA5B,OAAO,GAAG,SAAkB;oBAClC,MAAM,CAAC,OAAO,CAAC,CAAC,WAAW,EAAE,CAAC;oBAC9B,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;oBAC3C,uFAAuF;oBACvF,KAAA,MAAM,CAAA;oBAAC,qBAAM,aAAa,EAAE,EAAA;;oBAD5B,uFAAuF;oBACvF,kBAAO,SAAqB,EAAC,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;oBACrD,mFAAmF;oBACnF,qBAAM,IAAA,kBAAa,GAAE,CAAC,MAAM,CAAC,aAAM,CAAC,IAAI,EAAE,EAAE,EAAE,EAAE,OAAO,CAAC,EAAE,EAAE,QAAQ,EAAE,IAAA,gBAAM,EAAC,WAAW,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,EAAA;;oBADvG,mFAAmF;oBACnF,SAAuG,CAAC;oBACxG,KAAA,MAAM,CAAA;oBAAC,qBAAM,IAAA,2BAAY,EAAC,wBAAwB,EAAE,WAAW,CAAC,EAAA;;oBAAhE,kBAAO,SAAyD,EAAC,CAAC,IAAI,CAAC,mCAAmC,CAAC,CAAC;oBAE5G,uFAAuF;oBACvF,qBAAM,IAAI,CAAC,CAAC,IAAI,qBAAqB,EAAE,CAAC,CAAC,EAAA;;oBADzC,uFAAuF;oBACvF,SAAyC,CAAC;oBAC1C,KAAA,MAAM,CAAA;oBAAE,qBAAM,UAAU,EAAE,EAAA;;oBAA1B,kBAAO,CAAC,SAAkB,CAAC,CAAC,MAAM,EAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;oBACnD,KAAA,MAAM,CAAA;oBAAC,qBAAM,IAAA,2BAAY,EAAC,wBAAwB,EAAE,WAAW,CAAC,EAAA;;oBAAhE,kBAAO,SAAyD,EAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;;;;SAC9E,CAAC,CAAC;IAEH,EAAE,CAAC,iGAAiG,EAAE;;;;wBACtF,qBAAM,OAAO,CAAC,UAAU,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,kBAAkB,EAAE,KAAK,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,EAAA;;oBAAhG,KAAK,GAAG,SAAwF;oBACvF,qBAAM,OAAO,CAAC,UAAU,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC,EAAA;;oBAAjF,MAAM,GAAG,SAAwE;oBACvF,qBAAM,aAAa,CAAC,gBAAgB,EAAE,MAAM,CAAC,KAAK,CAAC,EAAA;;oBAAnD,SAAmD,CAAC;oBACpD,qBAAM,aAAa,CAAC,eAAe,EAAE,KAAK,CAAC,KAAK,CAAC,EAAA;;oBAAjD,SAAiD,CAAC;oBAElD,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;oBACrB,qBAAM,IAAI,6BAAa,EAAE,CAAC,aAAa,CAAC,MAAM,CAAC,EAAE,EAAE,aAAa,CAAC,EAAA;;oBAAjE,SAAiE,CAAC;oBAElE,KAAA,MAAM,CAAA;oBAAC,qBAAM,aAAa,EAAE,EAAA;;oBAA5B,kBAAO,SAAqB,EAAC,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;;;;SACtD,CAAC,CAAC;IAEH,EAAE,CAAC,uGAAuG,EAAE;;;;wBAC5F,qBAAM,OAAO,CAAC,UAAU,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,kBAAkB,EAAE,KAAK,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,EAAA;;oBAAhG,KAAK,GAAG,SAAwF;oBACxF,qBAAM,OAAO,CAAC,UAAU,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC,EAAA;;oBAAhF,KAAK,GAAG,SAAwE;oBACtF,qBAAM,IAAI,CAAC,CAAC,IAAI,qBAAqB,EAAE,CAAC,CAAC,EAAA;;oBAAzC,SAAyC,CAAC;oBAC1C,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;oBAEL,qBAAM,UAAU,EAAE,EAAA;;oBAA5B,OAAO,GAAG,SAAkB;oBAClC,qBAAM,MAAM,CAAC,IAAI,aAAK,EAAE,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CACpE,iDAAiD,CAClD,EAAA;;oBAFD,SAEC,CAAC;oBACF,qBAAM,MAAM,CAAC,IAAI,aAAK,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CACrE,iDAAiD,CAClD,EAAA;;oBAFD,SAEC,CAAC;oBACF,uCAAuC;oBACvC,KAAA,MAAM,CAAA;oBAAC,qBAAM,IAAA,kBAAa,GAAE,CAAC,KAAK,CAAC,aAAM,CAAC,cAAc,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC,EAAA;;oBADjF,uCAAuC;oBACvC,kBAAO,SAA0E,EAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;oBAEnG,qBAAM,IAAI,aAAK,EAAE,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,EAAE,KAAK,CAAC,EAAA;;oBAA5C,SAA4C,CAAC;oBAC7C,KAAA,MAAM,CAAA;oBAAE,qBAAM,IAAA,kBAAa,GAAE,CAAC,GAAG,CAAC,aAAM,CAAC,IAAI,EAAE,EAAE,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,EAAA;;oBAAhE,kBAAO,CAAC,SAAwD,CAAC,CAAC,KAAK,EAAC,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;;;;SAC3F,CAAC,CAAC;IAEH,EAAE,CAAC,+FAA+F,EAAE;;;;;oBAClG;wBAA6B,kCAAqB;wBAAlD;4BAAA,qEAEC;4BADC,WAAK,GAAG,wBAAwB,CAAC;;wBACnC,CAAC;wBAAD,qBAAC;oBAAD,CAAC,AAFD,CAA6B,qBAAqB,GAEjD;oBACD,qBAAM,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,cAAc,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,0BAA0B,CAAC,EAAA;;oBAAtF,SAAsF,CAAC;oBAEvF;wBAA0B,+BAAqB;wBAA/C;4BAAA,qEAEC;4BADC,WAAK,GAAG,CAAC,YAAY,CAAC,CAAC;;wBACzB,CAAC;wBAAD,kBAAC;oBAAD,CAAC,AAFD,CAA0B,qBAAqB,GAE9C;oBACD,qBAAM,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,2BAA2B,CAAC,EAAA;;oBAApF,SAAoF,CAAC;oBAErF;wBAAyB,8BAAqB;wBAA9C;4BAAA,qEAEC;4BADC,WAAK,GAAG,CAAC,OAAO,CAAC,CAAC;;wBACpB,CAAC;wBAAD,iBAAC;oBAAD,CAAC,AAFD,CAAyB,qBAAqB,GAE7C;oBACD,qBAAM,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,UAAU,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,0BAA0B,CAAC,EAAA;;oBAAlF,SAAkF,CAAC;;;;SACpF,CAAC,CAAC;IAEH,QAAQ,CAAC,oBAAoB,EAAE;QAC7B,UAAU,CAAC;;;4BACT,qBAAM,IAAI,CAAC,CAAC,IAAI,qBAAqB,EAAE,CAAC,CAAC,EAAA;;wBAAzC,SAAyC,CAAC;;;;aAC3C,CAAC,CAAC;QAEH,EAAE,CAAC,yGAAyG,EAAE;;;;4BAC5G,qBAAM,aAAa,CAAC,wBAAwB,EAAE,wBAAwB,CAAC,EAAA;;wBAAvE,SAAuE,CAAC;wBAEzD,qBAAM,IAAI,uCAAkB,EAAE,CAAC,cAAc,CAAC,wBAAwB,CAAC,EAAA;;wBAAhF,MAAM,GAAG,SAAuE;wBAEtF,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAC;wBACpD,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC,CAAC,2CAA2C;wBAC9F,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;wBAClD,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC;wBAC/C,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;wBAG5B,qBAAM,UAAU,EAAE,EAAA;;wBAAxB,GAAG,GAAG,SAAkB;wBAC9B,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,IAAA,gBAAM,EAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC;wBAC9D,0DAA0D;wBAC1D,KAAA,MAAM,CAAA;wBAAC,qBAAM,aAAa,EAAE,EAAA;;wBAD5B,0DAA0D;wBAC1D,kBAAO,SAAqB,EAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;wBAC1C,wDAAwD;wBACxD,KAAA,MAAM,CAAA;wBAAC,qBAAM,IAAA,2BAAY,EAAC,wBAAwB,EAAE,MAAM,CAAC,QAAQ,CAAC,EAAA;;wBADpE,wDAAwD;wBACxD,kBAAO,SAA6D,EAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;;;;aAClF,CAAC,CAAC;QAEH,EAAE,CAAC,8DAA8D,EAAE;;;;;wBACjE;4BAAwB,6BAAqB;4BAA7C;gCAAA,qEAIC;gCAHC,QAAE,GAAG,oBAAoB,CAAC;gCAC1B,WAAK,GAAG,+BAA+B,CAAC;gCACxC,gBAAU,GAAG,mBAAmB,CAAC;;4BACnC,CAAC;4BAAD,gBAAC;wBAAD,CAAC,AAJD,CAAwB,qBAAqB,GAI5C;wBACD,WAAW,EAAE,CAAC,kCAAkC,CAAC,GAAG,CAAC,IAAI,qBAAqB,EAAE,EAAE,IAAI,SAAS,EAAE,CAAC,CAAC;wBAEpF,qBAAM,IAAI,uCAAkB,EAAE,CAAC,mBAAmB,EAAE,EAAA;;wBAA7D,MAAM,GAAG,SAAoD;wBACnE,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC;4BACrB;gCACE,KAAK,EAAE,wBAAwB;gCAC/B,WAAW,EAAE,kBAAkB;gCAC/B,KAAK,EAAE,CAAC,KAAK,CAAC;gCACd,UAAU,EAAE,iBAAiB;gCAC7B,MAAM,EAAE,QAAQ;gCAChB,aAAa,EAAE,KAAK;6BACrB;4BACD;gCACE,KAAK,EAAE,+BAA+B;gCACtC,WAAW,EAAE,kBAAkB;gCAC/B,KAAK,EAAE,CAAC,KAAK,CAAC;gCACd,UAAU,EAAE,mBAAmB;gCAC/B,MAAM,EAAE,oBAAoB;gCAC5B,aAAa,EAAE,KAAK;6BACrB;yBACF,CAAC,CAAC;wBAEH,qBAAM,IAAI,uCAAkB,EAAE,CAAC,cAAc,CAAC,wBAAwB,CAAC,EAAA;;wBAAvE,SAAuE,CAAC;wBAC1D,qBAAM,IAAI,uCAAkB,EAAE,CAAC,mBAAmB,EAAE,EAAA;;wBAA5D,KAAK,GAAG,SAAoD;wBAClE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,EAAE,KAAK,EAAE,wBAAwB,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;;;;aAC1F,CAAC,CAAC;QAEH,EAAE,CAAC,mEAAmE,EAAE;;;4BACtE,qBAAM,OAAO,CAAC,UAAU,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC,EAAA;;wBAAxE,SAAwE,CAAC;wBACzE,qBAAM,MAAM,CAAC,IAAI,uCAAkB,EAAE,CAAC,cAAc,CAAC,kBAAkB,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CACvF,gCAAgC,CACjC,EAAA;;wBAFD,SAEC,CAAC;wBACF,qBAAM,MAAM,CAAC,IAAI,uCAAkB,EAAE,CAAC,cAAc,CAAC,mBAAmB,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CACxF,gCAAgC,CACjC,EAAA;;wBAFD,SAEC,CAAC;;;;aACH,CAAC,CAAC;QAEH,EAAE,CAAC,0EAA0E,EAAE;;;;;wBAC7E;4BAAwB,6BAAqB;4BAA7C;gCAAA,qEAGC;gCAFC,QAAE,GAAG,oBAAoB,CAAC;gCAC1B,WAAK,GAAG,+BAA+B,CAAC;;4BAC1C,CAAC;4BAAD,gBAAC;wBAAD,CAAC,AAHD,CAAwB,qBAAqB,GAG5C;wBACD,wEAAwE;wBACxE,WAAW,EAAE,CAAC,kCAAkC,CAAC,GAAG,CAAC,IAAI,qBAAqB,EAAE,EAAE,IAAI,SAAS,EAAE,CAAC,CAAC;wBACnG,qBAAM,MAAM,CAAC,IAAI,uCAAkB,EAAE,CAAC,cAAc,CAAC,+BAA+B,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CACpG,qCAAqC,CACtC,EAAA;;wBAFD,SAEC,CAAC;;;;aACH,CAAC,CAAC;QAEH,EAAE,CAAC,kEAAkE,EAAE;;;;4BACvD,qBAAM,OAAO,CAAC,UAAU,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,kBAAkB,EAAE,KAAK,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,EAAA;;wBAAhG,KAAK,GAAG,SAAwF;wBACxF,qBAAM,OAAO,CAAC,UAAU,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,kBAAkB,EAAE,KAAK,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,EAAA;;wBAA9F,KAAK,GAAG,SAAsF;wBAC9F,MAAM,GAAG;4BACb,OAAA,yBAAW,CAAC,aAAa,CAAC,IAAI,uCAAkB,EAAE,EAAE,EAAE,IAAI,EAAE,gBAAgB,EAAS,EAAE;gCACrF,wBAAwB;6BACzB,CAAC;wBAFF,CAEE,CAAC;wBAEL,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;wBACrB,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;wBAC7B,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;wBACrB,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;;;;aAC7B,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/test/PasswordMigration.integration.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=PasswordMigration.integration.test.d.ts.map

package/dist/test/PasswordMigration.integration.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"PasswordMigration.integration.test.d.ts","sourceRoot":"","sources":["../../test/PasswordMigration.integration.test.ts"],"names":[],"mappings":""}