@rubytech/create-sitedesk-code 0.1.519 → 0.1.520

package/payload/platform/plugins/cloudflare/mcp/__tests__/authorize.test.ts

@@ -12,12 +12,27 @@ import {
 } from '../../skills/data-portal/template/functions/api/_lib/authorize'
 import type { D1Database } from '../../skills/data-portal/template/functions/api/_lib/types'
 
-// Models the real resolveSession query: sessions JOIN people, requiring the
-// session's pcCheck to still match substr(people.hash, 1, 16). A fake that
-// skipped the join would let the revocation tests below pass vacuously.
+// The two tenants every cross-account case below is written against. The store
+// is shared, so these are rows in ONE database, not two databases.
+const ACC = 'acct-a'
+const OTHER = 'acct-b'
+
+// Models the real resolveSession query: the session row is scoped by account,
+// and it JOINs people on BOTH ownerId and accountId, requiring the session's
+// pcCheck to still match substr(people.hash, 1, 16). A fake that joined on
+// ownerId alone would let the revocation AND the cross-tenant tests below pass
+// vacuously.
 function fakeDb(
-  seed: Array<{ sessionId: string; ownerId: string; pcCheck: string; expiresAt: number }> = [],
-  people: Array<{ ownerId: string; hash: string }> = [{ ownerId: 'alice', hash: 'HASH-v1-padded00' }],
+  seed: Array<{
+    sessionId: string
+    ownerId: string
+    accountId: string
+    pcCheck: string
+    expiresAt: number
+  }> = [],
+  people: Array<{ ownerId: string; accountId: string; hash: string }> = [
+    { ownerId: 'alice', accountId: ACC, hash: 'HASH-v1-padded00' },
+  ],
 ) {
   const rows = [...seed]
   const peopleRows = [...people]
@@ -31,13 +46,25 @@ function fakeDb(
         },
         async run() {
           if (/INSERT INTO sessions/i.test(query)) {
-            const [sessionId, ownerId, pcCheck, expiresAt] = bound as [string, string, string, number]
-            rows.push({ sessionId, ownerId, pcCheck, expiresAt })
+            const [sessionId, ownerId, accountId, pcCheck, expiresAt] = bound as [
+              string,
+              string,
+              string,
+              string,
+              number,
+            ]
+            rows.push({ sessionId, ownerId, accountId, pcCheck, expiresAt })
           }
           if (/DELETE FROM sessions/i.test(query)) {
-            const [ownerId, nowMs] = bound as [string, number]
+            const [ownerId, accountId, nowMs] = bound as [string, string, number]
             for (let i = rows.length - 1; i >= 0; i--) {
-              if (rows[i].ownerId === ownerId && rows[i].expiresAt <= nowMs) rows.splice(i, 1)
+              if (
+                rows[i].ownerId === ownerId &&
+                rows[i].accountId === accountId &&
+                rows[i].expiresAt <= nowMs
+              ) {
+                rows.splice(i, 1)
+              }
             }
           }
           return { meta: { changes: 1 } }
@@ -46,13 +73,17 @@ function fakeDb(
           return { results: [] }
         },
         async first<T>() {
-          const [sessionId, nowMs] = bound as [string, number]
-          const hit = rows.find((r) => r.sessionId === sessionId && r.expiresAt > nowMs)
+          const [sessionId, accountId, nowMs] = bound as [string, string, number]
+          const hit = rows.find(
+            (r) => r.sessionId === sessionId && r.accountId === accountId && r.expiresAt > nowMs,
+          )
           if (!hit) return null as T | null
-          const person = peopleRows.find((p) => p.ownerId === hit.ownerId)
+          const person = peopleRows.find(
+            (p) => p.ownerId === hit.ownerId && p.accountId === hit.accountId,
+          )
           if (!person) return null as T | null // unenrolled -> the JOIN drops it
           if (person.hash.slice(0, 16) !== hit.pcCheck) return null as T | null // rotated
-          return { ownerId: hit.ownerId } as T
+          return { ownerId: hit.ownerId, accountId: person.accountId } as T
         },
       }
       return stmt
@@ -66,28 +97,82 @@ const PC = 'HASH-v1-padded00'.slice(0, 16)
 describe('sessions', () => {
   it('mints a session resolvable to its owner', async () => {
     const { db } = fakeDb()
-    await mintSession(db, 'alice', 'sess-1', 1_000_000, PC)
-    expect(await resolveSession(db, 'sess-1', 1_000_000)).toEqual({ ownerId: 'alice', accountId: '', folders: [] })
+    await mintSession(db, 'alice', ACC, 'sess-1', 1_000_000, PC)
+    expect(await resolveSession(db, 'sess-1', ACC, 1_000_000)).toEqual({
+      ownerId: 'alice',
+      accountId: ACC,
+      folders: [],
+    })
   })
 
   it('does not resolve an expired session', async () => {
     const { db } = fakeDb()
-    await mintSession(db, 'alice', 'sess-1', 1_000_000, PC)
-    expect(await resolveSession(db, 'sess-1', 1_000_000 + SESSION_TTL_MS + 1)).toBeNull()
+    await mintSession(db, 'alice', ACC, 'sess-1', 1_000_000, PC)
+    expect(await resolveSession(db, 'sess-1', ACC, 1_000_000 + SESSION_TTL_MS + 1)).toBeNull()
   })
 
   it('does not resolve an unknown session', async () => {
     const { db } = fakeDb()
-    expect(await resolveSession(db, 'nope', 1_000_000)).toBeNull()
+    expect(await resolveSession(db, 'nope', ACC, 1_000_000)).toBeNull()
   })
 
   it('prunes that owner expired rows on mint, so sessions do not grow forever', async () => {
     const { db, rows } = fakeDb([
-      { sessionId: 'old', ownerId: 'alice', pcCheck: PC, expiresAt: 1 },
+      { sessionId: 'old', ownerId: 'alice', accountId: ACC, pcCheck: PC, expiresAt: 1 },
     ])
-    await mintSession(db, 'alice', 'sess-1', 1_000_000, PC)
+    await mintSession(db, 'alice', ACC, 'sess-1', 1_000_000, PC)
     expect(rows.map((r) => r.sessionId)).toEqual(['sess-1'])
   })
+
+  it('prunes only its own tenant expired rows', async () => {
+    // The GC deletes by owner, and on a shared store two tenants may hold the
+    // same owner id. Unscoped, one portal's routine mint would silently delete
+    // another portal's session rows.
+    const { db, rows } = fakeDb([
+      { sessionId: 'mine', ownerId: 'alice', accountId: ACC, pcCheck: PC, expiresAt: 1 },
+      { sessionId: 'theirs', ownerId: 'alice', accountId: OTHER, pcCheck: PC, expiresAt: 1 },
+    ])
+    await mintSession(db, 'alice', ACC, 'sess-1', 1_000_000, PC)
+    expect(rows.map((r) => r.sessionId).sort()).toEqual(['sess-1', 'theirs'])
+  })
+})
+
+describe('cross-tenant sessions — the shared-store property', () => {
+  // Two clients each enrol someone called 'alice'. Nothing but accountId tells
+  // them apart, so every one of these would have been a real leak under the
+  // per-owner join the pre-2099 template used.
+  function twoTenants() {
+    return fakeDb(
+      [],
+      [
+        { ownerId: 'alice', accountId: ACC, hash: 'HASH-v1-padded00' },
+        { ownerId: 'alice', accountId: OTHER, hash: 'OTHER-v1-pad0000' },
+      ],
+    )
+  }
+
+  it('does not resolve another tenant session id', async () => {
+    const { db } = twoTenants()
+    await mintSession(db, 'alice', OTHER, 'sess-other', 1_000_000, 'OTHER-v1-pad0000'.slice(0, 16))
+    expect(await resolveSession(db, 'sess-other', ACC, 1_000_000)).toBeNull()
+  })
+
+  it('resolves each tenant own session to its own account', async () => {
+    const { db } = twoTenants()
+    await mintSession(db, 'alice', ACC, 'sess-a', 1_000_000, PC)
+    await mintSession(db, 'alice', OTHER, 'sess-b', 1_000_000, 'OTHER-v1-pad0000'.slice(0, 16))
+    expect((await resolveSession(db, 'sess-a', ACC, 1_000_000))?.accountId).toBe(ACC)
+    expect((await resolveSession(db, 'sess-b', OTHER, 1_000_000))?.accountId).toBe(OTHER)
+  })
+
+  it('does not let one tenant passcode rotation revoke the other sessions', async () => {
+    const { db, peopleRows } = twoTenants()
+    await mintSession(db, 'alice', ACC, 'sess-a', 1_000_000, PC)
+    await mintSession(db, 'alice', OTHER, 'sess-b', 1_000_000, 'OTHER-v1-pad0000'.slice(0, 16))
+    peopleRows[1].hash = 'OTHER-v2-rotated' // the other client rotates their alice
+    expect(await resolveSession(db, 'sess-a', ACC, 1_000_000)).not.toBeNull()
+    expect(await resolveSession(db, 'sess-b', OTHER, 1_000_000)).toBeNull()
+  })
 })
 
 describe('session revocation — the property the design claims', () => {
@@ -96,19 +181,23 @@ describe('session revocation — the property the design claims', () => {
     // people.hash, so pcCheck no longer matches and the live session dies —
     // by construction, not by remembering to delete anything.
     const { db, peopleRows } = fakeDb()
-    await mintSession(db, 'alice', 'sess-1', 1_000_000, PC)
-    expect(await resolveSession(db, 'sess-1', 1_000_000)).toEqual({ ownerId: 'alice', accountId: '', folders: [] })
+    await mintSession(db, 'alice', ACC, 'sess-1', 1_000_000, PC)
+    expect(await resolveSession(db, 'sess-1', ACC, 1_000_000)).toEqual({
+      ownerId: 'alice',
+      accountId: ACC,
+      folders: [],
+    })
 
     peopleRows[0].hash = 'HASH-v2-rotated0' // operator re-runs enrolment
 
-    expect(await resolveSession(db, 'sess-1', 1_000_000)).toBeNull()
+    expect(await resolveSession(db, 'sess-1', ACC, 1_000_000)).toBeNull()
   })
 
   it('stops resolving once the person is unenrolled', async () => {
     const { db, peopleRows } = fakeDb()
-    await mintSession(db, 'alice', 'sess-1', 1_000_000, PC)
+    await mintSession(db, 'alice', ACC, 'sess-1', 1_000_000, PC)
     peopleRows.length = 0
-    expect(await resolveSession(db, 'sess-1', 1_000_000)).toBeNull()
+    expect(await resolveSession(db, 'sess-1', ACC, 1_000_000)).toBeNull()
   })
 })
 
@@ -144,34 +233,34 @@ describe('readSessionCookie', () => {
 })
 
 describe('authorizeKey — the isolation rule', () => {
-  it('allows a key under the owner prefix', () => {
-    expect(authorizeKey('alice', 'alice/invoice.pdf')).toBe(true)
+  it('allows a key under the account and owner prefix', () => {
+    expect(authorizeKey(ACC, 'alice', `${ACC}/alice/invoice.pdf`)).toBe(true)
   })
 
   it('denies another owner prefix', () => {
-    expect(authorizeKey('alice', 'bob/invoice.pdf')).toBe(false)
+    expect(authorizeKey(ACC, 'alice', `${ACC}/bob/invoice.pdf`)).toBe(false)
   })
 
   it('denies a traversal escape', () => {
-    expect(authorizeKey('alice', 'alice/../bob/invoice.pdf')).toBe(false)
+    expect(authorizeKey(ACC, 'alice', `${ACC}/alice/../bob/invoice.pdf`)).toBe(false)
   })
 
   it('denies a prefix that merely starts with the owner id', () => {
     // 'alice' must not authorize 'alice-evil/...': a startsWith check on the
     // bare id would pass this. The separator is part of the rule.
-    expect(authorizeKey('alice', 'alice-evil/invoice.pdf')).toBe(false)
+    expect(authorizeKey(ACC, 'alice', `${ACC}/alice-evil/invoice.pdf`)).toBe(false)
   })
 
   it('denies a bare key with no prefix', () => {
-    expect(authorizeKey('alice', 'invoice.pdf')).toBe(false)
+    expect(authorizeKey(ACC, 'alice', 'invoice.pdf')).toBe(false)
   })
 
   it('denies an absolute-looking key', () => {
-    expect(authorizeKey('alice', '/alice/invoice.pdf')).toBe(false)
+    expect(authorizeKey(ACC, 'alice', `/${ACC}/alice/invoice.pdf`)).toBe(false)
   })
 
   it('denies an empty key', () => {
-    expect(authorizeKey('alice', '')).toBe(false)
+    expect(authorizeKey(ACC, 'alice', '')).toBe(false)
   })
 
   // authorizeKey's correctness silently depends on ownerId containing no
@@ -180,22 +269,49 @@ describe('authorizeKey — the isolation rule', () => {
   // person's files. Enrolment is an agent writing rows, so the invariant
   // cannot rest on the skill's prose — enforce it at the gate.
   it('denies when the ownerId itself contains a separator', () => {
-    expect(authorizeKey('alice/2024', 'alice/2024/invoice.pdf')).toBe(false)
+    expect(authorizeKey(ACC, 'alice/2024', `${ACC}/alice/2024/invoice.pdf`)).toBe(false)
   })
 
   it('denies an ownerId outside [a-z0-9-], failing closed', () => {
     for (const bad of ['alice/2024', 'Alice', 'alice..', 'alice bob', '../alice', 'alice%2f']) {
-      expect(authorizeKey(bad, `${bad}/invoice.pdf`)).toBe(false)
+      expect(authorizeKey(ACC, bad, `${ACC}/${bad}/invoice.pdf`)).toBe(false)
     }
   })
 
   it('still allows a well-formed ownerId', () => {
-    expect(authorizeKey('alice-smith-2', 'alice-smith-2/invoice.pdf')).toBe(true)
+    expect(authorizeKey(ACC, 'alice-smith-2', `${ACC}/alice-smith-2/invoice.pdf`)).toBe(true)
+  })
+})
+
+describe('authorizeKey — the tenant half of the rule', () => {
+  // The store is shared, so the account segment is the only thing separating
+  // one client's objects from another's. Every key on the delete, download and
+  // multipart paths arrives from the client, so this is checked, never assumed.
+  it('denies another tenant prefix even with the right owner', () => {
+    expect(authorizeKey(ACC, 'alice', `${OTHER}/alice/invoice.pdf`)).toBe(false)
+  })
+
+  it('denies a bare owner prefix that omits the account', () => {
+    expect(authorizeKey(ACC, 'alice', 'alice/invoice.pdf')).toBe(false)
+  })
+
+  it('denies a tenant that merely starts with the account id', () => {
+    expect(authorizeKey(ACC, 'alice', `${ACC}-evil/alice/invoice.pdf`)).toBe(false)
+  })
+
+  it('denies an accountId outside [a-z0-9-], failing closed', () => {
+    for (const bad of ['acct/a', 'Acct', 'acct..', 'acct a', '../acct']) {
+      expect(authorizeKey(bad, 'alice', `${bad}/alice/invoice.pdf`)).toBe(false)
+    }
+  })
+
+  it('denies an empty accountId rather than degrading to an owner-only rule', () => {
+    expect(authorizeKey('', 'alice', 'alice/invoice.pdf')).toBe(false)
   })
 })
 
 describe('ownerPrefix', () => {
-  it('is the owner id plus a separator', () => {
-    expect(ownerPrefix('alice')).toBe('alice/')
+  it('is the account and the owner id, each with a separator', () => {
+    expect(ownerPrefix(ACC, 'alice')).toBe('acct-a/alice/')
   })
 })

package/payload/platform/plugins/cloudflare/mcp/__tests__/file-routes.test.ts

@@ -4,18 +4,36 @@ import { processDownload } from '../../skills/data-portal/template/functions/api
 import { processDelete } from '../../skills/data-portal/template/functions/api/delete'
 import type { PortalEnv } from '../../skills/data-portal/template/functions/api/_lib/types'
 
-// alice's session is 'sess-a'; bob owns 'bob/secret.pdf'.
+// The portal is account 'acct-a'; alice's session is 'sess-a'; bob owns
+// 'acct-a/bob/secret.pdf'. The store is shared by every portal (Task 2099), so
+// the account is the first key segment and a column on every row, and the fake
+// below filters on it exactly as the real queries do.
 function makeEnv() {
   const manifest = [
-    { fileId: 'f1', ownerId: 'alice', filename: 'a.pdf', objectKey: 'alice/a.pdf', size: 10 },
-    { fileId: 'f2', ownerId: 'bob', filename: 'secret.pdf', objectKey: 'bob/secret.pdf', size: 20 },
+    {
+      fileId: 'f1',
+      accountId: 'acct-a',
+      ownerId: 'alice',
+      filename: 'a.pdf',
+      objectKey: 'acct-a/alice/a.pdf',
+      size: 10,
+    },
+    {
+      fileId: 'f2',
+      accountId: 'acct-a',
+      ownerId: 'bob',
+      filename: 'secret.pdf',
+      objectKey: 'acct-a/bob/secret.pdf',
+      size: 20,
+    },
   ]
   const objects = new Map<string, string>([
-    ['alice/a.pdf', 'A'],
-    ['bob/secret.pdf', 'B'],
+    ['acct-a/alice/a.pdf', 'A'],
+    ['acct-a/bob/secret.pdf', 'B'],
   ])
   const deleted: string[] = []
   const env = {
+    PORTAL_ACCOUNT_ID: 'acct-a',
     DB: {
       prepare(query: string) {
         let bound: unknown[] = []
@@ -25,23 +43,48 @@ function makeEnv() {
             return stmt
           },
           async run() {
+            // Every single-row manifest statement binds (objectKey, accountId):
+            // objectKey is unique per account, not globally.
             if (/DELETE FROM manifest/i.test(query)) {
-              const i = manifest.findIndex((m) => m.objectKey === bound[0])
+              const i = manifest.findIndex(
+                (m) => m.objectKey === bound[0] && m.accountId === bound[1],
+              )
               if (i >= 0) manifest.splice(i, 1)
             }
             return { meta: { changes: 1 } }
           },
           async all<T>() {
-            const owner = bound[0] as string
-            return { results: manifest.filter((m) => m.ownerId === owner) as T[] }
+            // The account's published folder index is empty in these fixtures:
+            // this file covers upload rows and key isolation, not the tree.
+            if (/FROM directory/i.test(query)) {
+              return { results: [] as T[] }
+            }
+            // The manifest list binds (accountId, ownerId): the owner says
+            // which files, the account whose.
+            const [account, owner] = bound as string[]
+            return {
+              results: manifest.filter(
+                (m) => m.accountId === account && m.ownerId === owner,
+              ) as T[],
+            }
           },
           async first<T>() {
             if (/FROM sessions/i.test(query)) {
-              const map: Record<string, string> = { 'sess-a': 'alice', 'sess-b': 'bob' }
-              const owner = map[bound[0] as string]
-              return (owner ? { ownerId: owner } : null) as T | null
+              // Bound (sessionId, accountId, nowMs). The join is on BOTH the
+              // session's account and the people row's, so a session resolves
+              // only against its own portal's account and the resolved
+              // people.accountId has to come back matching.
+              const map: Record<string, { ownerId: string; accountId: string }> = {
+                'sess-a': { ownerId: 'alice', accountId: 'acct-a' },
+                'sess-b': { ownerId: 'bob', accountId: 'acct-a' },
+              }
+              const row = map[bound[0] as string]
+              return (row && row.accountId === bound[1]
+                ? { ownerId: row.ownerId, accountId: row.accountId, folders: '' }
+                : null) as T | null
             }
-            return (manifest.find((m) => m.objectKey === bound[0]) ?? null) as T | null
+            return (manifest.find((m) => m.objectKey === bound[0] && m.accountId === bound[1]) ??
+              null) as T | null
           },
         }
         return stmt
@@ -74,7 +117,7 @@ describe('processFiles', () => {
     const res = await processFiles('sess-a', env, () => {}, 1_000_000)
     expect(res.status).toBe(200)
     const files = res.payload.files as Array<{ objectKey: string }>
-    expect(files.map((f) => f.objectKey)).toEqual(['alice/a.pdf'])
+    expect(files.map((f) => f.objectKey)).toEqual(['acct-a/alice/a.pdf'])
   })
 
   it("never includes another owner's file", async () => {
@@ -93,56 +136,72 @@ describe('processFiles', () => {
 describe('processDownload — isolation', () => {
   it("allows the owner's own key", async () => {
     const { env } = makeEnv()
-    expect((await processDownload('sess-a', 'alice/a.pdf', env, () => {}, 1_000_000)).status).toBe(
-      200,
-    )
+    expect(
+      (await processDownload('sess-a', 'acct-a/alice/a.pdf', env, () => {}, 1_000_000)).status,
+    ).toBe(200)
   })
 
   it("denies person A's session on person B's key", async () => {
     const { env } = makeEnv()
-    const res = await processDownload('sess-a', 'bob/secret.pdf', env, () => {}, 1_000_000)
+    const res = await processDownload('sess-a', 'acct-a/bob/secret.pdf', env, () => {}, 1_000_000)
     expect(res.status).toBe(403)
   })
 
   it('denies a traversal escape', async () => {
     const { env } = makeEnv()
-    const res = await processDownload('sess-a', 'alice/../bob/secret.pdf', env, () => {}, 1_000_000)
+    const res = await processDownload(
+      'sess-a',
+      'acct-a/alice/../bob/secret.pdf',
+      env,
+      () => {},
+      1_000_000,
+    )
     expect(res.status).toBe(403)
   })
 
   it('denies an unauthenticated caller', async () => {
     const { env } = makeEnv()
-    expect((await processDownload('', 'alice/a.pdf', env, () => {}, 1_000_000)).status).toBe(401)
+    expect((await processDownload('', 'acct-a/alice/a.pdf', env, () => {}, 1_000_000)).status).toBe(
+      401,
+    )
   })
 })
 
 describe('processDelete — isolation and both-sides', () => {
   it('removes object and manifest row together', async () => {
     const { env, deleted, manifest } = makeEnv()
-    const res = await processDelete('sess-a', 'alice/a.pdf', env, () => {}, () => 1_000_000)
+    const res = await processDelete('sess-a', 'acct-a/alice/a.pdf', env, () => {}, () => 1_000_000)
     expect(res.status).toBe(200)
-    expect(deleted).toEqual(['alice/a.pdf'])
-    expect(manifest.find((m) => m.objectKey === 'alice/a.pdf')).toBeUndefined()
+    expect(deleted).toEqual(['acct-a/alice/a.pdf'])
+    expect(manifest.find((m) => m.objectKey === 'acct-a/alice/a.pdf')).toBeUndefined()
   })
 
   it("denies person A's session on person B's key, and deletes nothing", async () => {
     const { env, deleted, manifest } = makeEnv()
-    const res = await processDelete('sess-a', 'bob/secret.pdf', env, () => {}, () => 1_000_000)
+    const res = await processDelete(
+      'sess-a',
+      'acct-a/bob/secret.pdf',
+      env,
+      () => {},
+      () => 1_000_000,
+    )
     expect(res.status).toBe(403)
     expect(deleted).toEqual([])
-    expect(manifest.find((m) => m.objectKey === 'bob/secret.pdf')).toBeDefined()
+    expect(manifest.find((m) => m.objectKey === 'acct-a/bob/secret.pdf')).toBeDefined()
   })
 
   it('denies an unauthenticated caller', async () => {
     const { env, deleted } = makeEnv()
-    expect((await processDelete('', 'alice/a.pdf', env, () => {}, () => 1_000_000)).status).toBe(401)
+    expect(
+      (await processDelete('', 'acct-a/alice/a.pdf', env, () => {}, () => 1_000_000)).status,
+    ).toBe(401)
     expect(deleted).toEqual([])
   })
 
   it('emits a per-step lifeline, not one bare line', async () => {
     const { env } = makeEnv()
     const lines: string[] = []
-    await processDelete('sess-a', 'alice/a.pdf', env, (l) => lines.push(l), () => 1_000_000)
+    await processDelete('sess-a', 'acct-a/alice/a.pdf', env, (l) => lines.push(l), () => 1_000_000)
     const joined = lines.join('\n')
     expect(joined).toContain('op=r2-delete')
     expect(joined).toContain('op=manifest-delete')
@@ -157,12 +216,18 @@ describe('processDelete — isolation and both-sides', () => {
       throw new Error('r2 unavailable')
     }
     const lines: string[] = []
-    const res = await processDelete('sess-a', 'alice/a.pdf', env, (l) => lines.push(l), () => 1_000_000)
+    const res = await processDelete(
+      'sess-a',
+      'acct-a/alice/a.pdf',
+      env,
+      (l) => lines.push(l),
+      () => 1_000_000,
+    )
     expect(res.status).toBe(502)
     expect(lines.join('\n')).toContain('op=r2-delete')
     expect(lines.join('\n')).toContain('result=failed')
     // The row must survive an object that was never deleted.
-    expect(manifest.find((m) => m.objectKey === 'alice/a.pdf')).toBeDefined()
+    expect(manifest.find((m) => m.objectKey === 'acct-a/alice/a.pdf')).toBeDefined()
   })
 
   it('derives result from the post-condition rather than hardcoding ok', async () => {
@@ -171,7 +236,13 @@ describe('processDelete — isolation and both-sides', () => {
     const { env } = makeEnv()
     ;(env.BUCKET as unknown as { delete: () => Promise<void> }).delete = async () => {}
     const lines: string[] = []
-    const res = await processDelete('sess-a', 'alice/a.pdf', env, (l) => lines.push(l), () => 1_000_000)
+    const res = await processDelete(
+      'sess-a',
+      'acct-a/alice/a.pdf',
+      env,
+      (l) => lines.push(l),
+      () => 1_000_000,
+    )
     expect(res.status).toBe(500)
     expect(lines.join('\n')).toMatch(/op=complete .*result=incomplete objectPresent=true/)
   })