@selvajs/platform 0.21.0-beta.3 → 1.0.0-beta.5

package/dist/testing/suites/authProviderSuite.js

@@ -1,19 +1,10 @@
 // Conformance suite for IAuthProvider: token round-trips, identity, password auth, admin management.
 import { describe, it, expect } from 'vitest';
 import { makeUuid } from './helpers.js';
-export function runAuthProviderConformance(opts) {
-    const { name, createProvider, userManagement = false } = opts;
-    describe(`IAuthProvider conformance: ${name}`, () => {
-        // Token round-trips
-        it('verifyLogin returns a session token that verifyToken accepts', async () => {
-            const { provider, adminPassword, adminEmail = '' } = await createProvider();
-            const result = await provider.passwordAuth.verifyLogin(adminEmail, adminPassword);
-            expect(result.kind).toBe('success');
-            if (result.kind !== 'success')
-                return;
-            const verified = await provider.verifyToken(result.sessionToken);
-            expect(verified?.id).toBe(result.user.id);
-        });
+/** Cases every auth provider must pass, password or not. */
+export function runAuthCoreConformance(opts) {
+    const { name, createProvider } = opts;
+    describe(`IAuthProvider core conformance: ${name}`, () => {
         it('verifyToken returns null for a garbage token', async () => {
             const { provider } = await createProvider();
             const result = await provider.verifyToken('not-a-valid-token');
@@ -24,35 +15,57 @@ export function runAuthProviderConformance(opts) {
             const result = await provider.verifyToken('');
             expect(result).toBeNull();
         });
+        it('getUser returns null for unknown id', async () => {
+            const { provider } = await createProvider();
+            // Valid UUID shape but not an actual user — stricter backends (Postgres
+            // uuid columns) reject non-UUID ids outright, so we never send those.
+            const result = await provider.getUser(makeUuid());
+            expect(result).toBeNull();
+        });
+    });
+}
+/** Cases for a provider with `passwordAuth`. */
+export function runPasswordAuthConformance(opts) {
+    const { name, createProvider, userManagement = false, selfRegistration = false } = opts;
+    describe(`IAuthProvider password conformance: ${name}`, () => {
+        // Token round-trips
+        it('verifyLogin returns a session token that verifyToken accepts', async () => {
+            const { provider, adminPassword, adminEmail = '' } = await createProvider();
+            const result = await provider.passwordAuth.verifyLogin(adminEmail, adminPassword);
+            expect(result.kind).toBe('success');
+            if (result.kind !== 'success')
+                return;
+            const verified = await provider.verifyToken(result.sessionToken);
+            expect(verified?.id).toBe(result.user.id);
+        });
         // Password auth (only runs when passwordAuth is present)
         it('verifyLogin returns success with correct password', async () => {
             const { provider, adminPassword, adminEmail = '' } = await createProvider();
-            if (!provider.passwordAuth)
-                return;
             const result = await provider.passwordAuth.verifyLogin(adminEmail, adminPassword);
             expect(result.kind).toBe('success');
             if (result.kind !== 'success')
                 return;
-            // Identity-only — platform permissions live on IPlatformPermissionStore now.
+            // Identity-only: platform permissions live on IPlatformPermissionStore.
             expect(result.user.id).toBeTruthy();
             expect(typeof result.sessionToken).toBe('string');
             expect(result.sessionToken.length).toBeGreaterThan(0);
         });
+        if (selfRegistration) {
+            it('registerUser creates an account that can sign in', async () => {
+                const { provider } = await createProvider();
+                const email = `register-${makeUuid()}@example.com`;
+                const user = await provider.passwordAuth.registerUser(email, 'pass12345678');
+                expect(user?.email).toBe(email);
+                const login = await provider.passwordAuth.verifyLogin(email, 'pass12345678');
+                expect(login.kind).toBe('success');
+            });
+        }
         it('verifyLogin returns failed for wrong password', async () => {
             const { provider, adminEmail = '' } = await createProvider();
-            if (!provider.passwordAuth)
-                return;
             const result = await provider.passwordAuth.verifyLogin(adminEmail, 'wrong-password-xyz');
             expect(result.kind).toBe('failed');
         });
         // getUser
-        it('getUser returns null for unknown id', async () => {
-            const { provider } = await createProvider();
-            // Valid UUID shape but not an actual user — stricter backends (Postgres
-            // uuid columns) reject non-UUID ids outright, so we never send those.
-            const result = await provider.getUser(makeUuid());
-            expect(result).toBeNull();
-        });
         // ============================================================================
         // User management (opt-in)
         // ============================================================================
@@ -102,12 +115,8 @@ export function runAuthProviderConformance(opts) {
                 const result = await provider.deleteUser(makeUuid());
                 expect(result).toBe('not_found');
             });
-            // Note: the §2 sole-`instance_admin` invariant is no longer enforced
-            // by IAuthProvider — it lives on IPlatformPermissionStore now and
-            // callers consult `countInstanceAdminsExcluding` before destructive
-            // ops. Auth-side delete/disable just deletes the identity and
-            // trusts the caller. See `runPlatformPermissionStoreConformance`
-            // for the invariant tests.
+            // Auth-side delete/disable trusts the caller: the sole-`instance_admin`
+            // invariant is `runPlatformPermissionStoreConformance`'s to test.
             it('createUserWithPassword returns an identity record without profile fields', async () => {
                 const { provider } = await createProvider();
                 const user = await provider.passwordAuth.createUserWithPassword(`new-${makeUuid()}@example.com`, 'pass12345678');
@@ -127,6 +136,14 @@ export function runAuthProviderConformance(opts) {
                 const fetched = await provider.getUser(created.id);
                 expect(fetched?.disabled).toBe(true);
             });
+            it('verifyLogin refuses a disabled user', async () => {
+                const { provider } = await createProvider();
+                const email = `disabled-${makeUuid()}@example.com`;
+                const created = await provider.passwordAuth.createUserWithPassword(email, 'pass12345678');
+                await provider.disableUser(created.id);
+                const result = await provider.passwordAuth.verifyLogin(email, 'pass12345678');
+                expect(result).toMatchObject({ kind: 'failed' });
+            });
             it('disableUser returns not_found for unknown user', async () => {
                 const { provider } = await createProvider();
                 const result = await provider.disableUser(makeUuid());
@@ -156,4 +173,12 @@ export function runAuthProviderConformance(opts) {
         }
     });
 }
-//# sourceMappingURL=authProviderSuite.js.map
+/**
+ * Both of the above, gated on what the provider has. New cases go behind an option
+ * so a third-party adapter does not turn red on upgrade.
+ */
+export function runAuthProviderConformance(opts) {
+    runAuthCoreConformance(opts);
+    if (!opts.passwordless)
+        runPasswordAuthConformance(opts);
+}

package/dist/testing/suites/computeServerStoreSuite.d.ts

@@ -1,7 +1,7 @@
 /**
  * Adapter conformance suite for IComputeServerStore.
  *
- * Architecture spec §4.8 — servers are scoped (platform vs. org-private), with a global
+ * Servers are scoped (platform vs. org-private), with a global
  * `defaultServerId` and per-org `orgDefaults`. The store surface exposes
  * scope-targeted mutations; visibility filtering is done by callers via
  * the pure helpers in `@selvajs/platform`.
@@ -18,4 +18,3 @@ export interface ComputeServerStoreConformanceOptions {
     seedOrg?: (orgId: string) => Promise<void>;
 }
 export declare function runComputeServerStoreConformance(opts: ComputeServerStoreConformanceOptions): void;
-//# sourceMappingURL=computeServerStoreSuite.d.ts.map

package/dist/testing/suites/computeServerStoreSuite.js

@@ -1,7 +1,7 @@
 /**
  * Adapter conformance suite for IComputeServerStore.
  *
- * Architecture spec §4.8 — servers are scoped (platform vs. org-private), with a global
+ * Servers are scoped (platform vs. org-private), with a global
  * `defaultServerId` and per-org `orgDefaults`. The store surface exposes
  * scope-targeted mutations; visibility filtering is done by callers via
  * the pure helpers in `@selvajs/platform`.
@@ -65,11 +65,76 @@ export function runComputeServerStoreConformance(opts) {
         it('getConfig on empty returns an empty servers list', async () => {
             const store = await createStore();
             const got = await store.getConfig(SYSTEM_CONTEXT);
-            expect(Array.isArray(got.servers)).toBe(true);
+            expect(got.servers).toEqual([]);
+        });
+        it('getConfig hides keys unless asked, and reports that one is stored', async () => {
+            const store = await createStore();
+            const id = makeUuid();
+            await store.savePlatformServers(SYSTEM_CONTEXT, [
+                {
+                    id,
+                    scope: 'platform',
+                    sharedWith: 'all',
+                    label: 'Keyed',
+                    serverUrl: 'http://compute.test',
+                    apiKey: 'rhino-key'
+                }
+            ], id);
+            const plain = await store.getConfig(SYSTEM_CONTEXT);
+            expect(plain.servers[0].apiKey).toBeUndefined();
+            expect(plain.servers[0].hasApiKey).toBe(true);
+            const keyed = await store.getConfig(SYSTEM_CONTEXT, { includeApiKeys: true });
+            expect(keyed.servers[0].apiKey).toBe('rhino-key');
+        });
+        it('getServerApiKey returns one key, and undefined for an unknown server', async () => {
+            const store = await createStore();
+            const id = makeUuid();
+            await store.savePlatformServers(SYSTEM_CONTEXT, [
+                {
+                    id,
+                    scope: 'platform',
+                    sharedWith: 'all',
+                    label: 'Keyed',
+                    serverUrl: 'http://compute.test',
+                    apiKey: 'rhino-key'
+                }
+            ], id);
+            expect(await store.getServerApiKey(SYSTEM_CONTEXT, id)).toBe('rhino-key');
+            expect(await store.getServerApiKey(SYSTEM_CONTEXT, makeUuid())).toBeUndefined();
+        });
+        it('verifySecrets passes on keys this store wrote', async () => {
+            const store = await createStore();
+            const id = makeUuid();
+            await store.savePlatformServers(SYSTEM_CONTEXT, [
+                {
+                    id,
+                    scope: 'platform',
+                    sharedWith: 'all',
+                    label: 'Keyed',
+                    serverUrl: 'http://compute.test',
+                    apiKey: 'rhino-key'
+                }
+            ], id);
+            const report = await store.verifySecrets?.();
+            if (report)
+                expect(report).toEqual({ ok: true, failures: [], plaintextFound: false });
         });
         // ============================================================================
-        // Org-private servers + orgDefaults (Architecture spec §4.8)
+        // Org-private servers + orgDefaults
         // ============================================================================
+        it('saveOrgServers ignores an entry that is not an org server', async () => {
+            const store = await createStore();
+            const orgId = await seed();
+            const stray = {
+                id: makeUuid(),
+                scope: 'platform',
+                sharedWith: 'all',
+                label: 'Stray',
+                serverUrl: 'http://compute.test'
+            };
+            await store.saveOrgServers(SYSTEM_CONTEXT, orgId, [stray]);
+            expect((await store.getConfig(SYSTEM_CONTEXT)).servers).toEqual([]);
+        });
         it('saveOrgServers stores rows owned by the org', async () => {
             const store = await createStore();
             const orgId = await seed();
@@ -136,4 +201,3 @@ export function runComputeServerStoreConformance(opts) {
         });
     });
 }
-//# sourceMappingURL=computeServerStoreSuite.js.map

package/dist/testing/suites/definitionStoreSuite.d.ts

@@ -26,6 +26,8 @@ export interface DefinitionTestScope {
      * Must reference a real row for FK-enforcing adapters.
      */
     secondaryProjectId: string;
+    /** Used by the ctx-isolation cases when `projectId` is one anyone can see. */
+    privateProjectId?: string;
     /** Optional third user id for ctx-isolation tests. Required when ctxIsolation is set. */
     secondaryUserId?: string;
     /** Token for `secondaryUserId`, when used. */
@@ -49,4 +51,3 @@ export interface DefinitionStoreConformanceOptions {
     ctxIsolation?: boolean;
 }
 export declare function runDefinitionStoreConformance(opts: DefinitionStoreConformanceOptions): void;
-//# sourceMappingURL=definitionStoreSuite.d.ts.map

package/dist/testing/suites/definitionStoreSuite.js

@@ -6,25 +6,21 @@
  * reference protection (Permissions spec §6), and error shapes.
  */
 import { describe, it, expect } from 'vitest';
-import { makeCtx, makeUuid } from './helpers.js';
+import { makeSeedHelpers, makeUuid } from './helpers.js';
 const DEFAULT_SCOPE = {
     ownerId: 'user-1',
     projectId: 'project-1',
     secondaryProjectId: 'project-2',
     secondaryUserId: 'user-b'
 };
-// Suite-wide token map. `scopeFor` populates it from the scope; `ctx`
-// auto-attaches the matching token so adapters with DB-side auth (Supabase
-// RLS) run as the right user. Local providers ignore tokens entirely.
-const tokens = new Map();
-function ctx(userId, opts = {}) {
-    return makeCtx(userId, { ...opts, sessionToken: tokens.get(userId) });
-}
+// `scopeFor` registers the scope's tokens, so `ctx` runs as the right user on an
+// adapter with DB-side auth (Supabase RLS). This suite seeds nobody itself.
+const { ctx, registerToken } = makeSeedHelpers(async (userId) => ({ userId }));
 function recordTokensFromScope(scope) {
     if (scope.ownerSessionToken)
-        tokens.set(scope.ownerId, scope.ownerSessionToken);
+        registerToken(scope.ownerId, scope.ownerSessionToken);
     if (scope.secondaryUserId && scope.secondaryUserSessionToken) {
-        tokens.set(scope.secondaryUserId, scope.secondaryUserSessionToken);
+        registerToken(scope.secondaryUserId, scope.secondaryUserSessionToken);
     }
 }
 function record(scope, overrides = {}) {
@@ -163,6 +159,15 @@ export function runDefinitionStoreConformance(opts) {
             expect(got?.displayName).toBe('New');
             expect(got.updatedAt >= created.updatedAt).toBe(true);
         });
+        it('update with null tags clears them', async () => {
+            const store = await createStore();
+            const scope = await scopeFor();
+            const guid = makeUuid();
+            await store.create(ctx(scope.ownerId), record(scope, { guid, tags: ['roof'] }));
+            await store.update(ctx(scope.ownerId), guid, { tags: null });
+            const got = await store.get(ctx(scope.ownerId), guid);
+            expect(got?.tags ?? []).toEqual([]);
+        });
         it('solveCacheLimit round-trips: absent → inherit, set → value, null → cleared', async () => {
             const store = await createStore();
             const scope = await scopeFor();
@@ -269,9 +274,8 @@ export function runDefinitionStoreConformance(opts) {
             expect(got?.nextVersionNumber).toBe(4);
         });
         it('reserveNextVersionNumber mints a FRESH number after delete-latest (fileKeys never collide)', async () => {
-            // The whole reason the counter exists: max(existing)+1 reused a number
-            // after deleting the latest version, colliding the fileKey. The monotonic
-            // counter must hand out a number BEYOND any deleted version's.
+            // The counter exists because max(existing)+1 would reuse a deleted number
+            // and collide the fileKey, so it must go beyond any deleted version's.
             const store = await createStore();
             const scope = await scopeFor();
             const guid = makeUuid();
@@ -574,7 +578,7 @@ export function runDefinitionStoreConformance(opts) {
                 if (!otherUser)
                     throw new Error('ctxIsolation requires scope.secondaryUserId');
                 const guid = makeUuid();
-                await store.create(ctx(scope.ownerId), record(scope, { guid }));
+                await store.create(ctx(scope.ownerId), record(scope, { guid, projectId: scope.privateProjectId ?? scope.projectId }));
                 const page = await store.list(ctx(otherUser));
                 expect(page.items.map((r) => r.guid)).not.toContain(guid);
             });
@@ -585,11 +589,10 @@ export function runDefinitionStoreConformance(opts) {
                 if (!otherUser)
                     throw new Error('ctxIsolation requires scope.secondaryUserId');
                 const guid = makeUuid();
-                await store.create(ctx(scope.ownerId), record(scope, { guid }));
+                await store.create(ctx(scope.ownerId), record(scope, { guid, projectId: scope.privateProjectId ?? scope.projectId }));
                 const got = await store.get(ctx(otherUser), guid);
                 expect(got).toBeNull();
             });
         }
     });
 }
-//# sourceMappingURL=definitionStoreSuite.js.map

package/dist/testing/suites/emailLinkAuthSuite.d.ts

@@ -18,15 +18,12 @@ export interface EmailLinkAuthConformanceOptions {
      * with self-signup enabled or disabled — the suite's tests are robust to
      * either, since they don't assume new users get created.
      *
-     * `validEmail` is an address the adapter will accept (must pass adapter
-     * validation; doesn't need to actually receive mail). `invalidEmail` is
-     * one the adapter must reject as malformed.
+     * `invalidEmail` is an address the adapter must reject as malformed. A valid
+     * send isn't tested here: it needs real mail delivery.
      */
     createAdapter: () => Promise<{
         adapter: IEmailLinkAuth;
-        validEmail: string;
         invalidEmail: string;
     }>;
 }
 export declare function runEmailLinkAuthConformance(opts: EmailLinkAuthConformanceOptions): void;
-//# sourceMappingURL=emailLinkAuthSuite.d.ts.map

package/dist/testing/suites/emailLinkAuthSuite.js

@@ -36,16 +36,8 @@ export function runEmailLinkAuthConformance(opts) {
             const result = await adapter.sendMagicLink(invalidEmail, 'https://example.com/auth/email/callback');
             expect(result.ok).toBe(false);
             if (!result.ok) {
-                expect(['invalid_email', 'rate_limited']).toContain(result.reason);
+                expect(result.reason).toBe('invalid_email');
             }
         });
-        // `sendMagicLink` for a valid email is intentionally NOT tested here:
-        // it requires real Supabase project credentials with email delivery
-        // enabled, and we'd be asserting on side-effects (mail sent) we can't
-        // observe. Adapter-specific integration tests cover that path.
-        void '';
     });
-    // keep `createAdapter` referenced for adapters that have nothing more to test
-    void createAdapter;
 }
-//# sourceMappingURL=emailLinkAuthSuite.js.map

package/dist/testing/suites/eventSinkSuite.d.ts

@@ -49,4 +49,3 @@ export interface EventSinkConformanceOptions {
     cleanup?: () => Promise<void> | void;
 }
 export declare function runEventSinkConformance(opts: EventSinkConformanceOptions): void;
-//# sourceMappingURL=eventSinkSuite.d.ts.map

package/dist/testing/suites/eventSinkSuite.js

@@ -151,6 +151,15 @@ export function runEventSinkConformance(opts) {
             await expect(provider.orgs.createOrg(ctx, makeOrg({ id: orgId, ownerId: actorId }))).rejects.toThrow();
             expect(sink.ofType('org.created')).toHaveLength(0);
         });
+        it('stamps tokenId on an event from an API-token request', async () => {
+            const tokenId = makeUuid();
+            const keyed = {
+                ...ctx,
+                apiScope: { tokenId, scopes: [], expiresAt: '2099-01-01T00:00:00.000Z' }
+            };
+            await provider.orgs.createOrg(keyed, makeOrg({ id: makeUuid(), ownerId: actorId }));
+            expect(sink.ofType('org.created')[0]).toMatchObject({ actorId, tokenId });
+        });
         it('system-context mutations emit with actorId="system"', async () => {
             const sysCtx = {
                 userId: '',
@@ -261,4 +270,3 @@ function makeShareLink(overrides) {
         solveCount: 0
     };
 }
-//# sourceMappingURL=eventSinkSuite.js.map

package/dist/testing/suites/helpers.d.ts

@@ -14,6 +14,11 @@ export declare function makeCtx(userId: string, opts?: {
     orgPermissions?: RequestContext['orgPermissions'];
     sessionToken?: string;
 }): RequestContext;
+/**
+ * A system context holding no permissions of its own, for proving a store leans on
+ * `system` rather than on a permission `SYSTEM_CONTEXT` happens to carry.
+ */
+export declare function makeSystemCtx(userId?: string): RequestContext;
 export declare function makeUuid(): string;
 /**
  * Optional hook adapters pass when their backend enforces referential
@@ -52,4 +57,3 @@ export declare function makeSeedHelpers(seedUser: SeedUserFn): {
     registerToken: (userId: string, sessionToken: string) => void;
     tokens: Map<string, string>;
 };
-//# sourceMappingURL=helpers.d.ts.map

package/dist/testing/suites/helpers.js

@@ -17,6 +17,13 @@ export function makeCtx(userId, opts = {}) {
         adapterContext: opts.sessionToken ? { sessionToken: opts.sessionToken } : undefined
     };
 }
+/**
+ * A system context holding no permissions of its own, for proving a store leans on
+ * `system` rather than on a permission `SYSTEM_CONTEXT` happens to carry.
+ */
+export function makeSystemCtx(userId = '') {
+    return { userId, platformPermissions: [], orgPermissions: [], system: true };
+}
 export function makeUuid() {
     return crypto.randomUUID();
 }
@@ -44,4 +51,3 @@ export function makeSeedHelpers(seedUser) {
     }
     return { seed, ctx, registerToken, tokens };
 }
-//# sourceMappingURL=helpers.js.map

package/dist/testing/suites/inviteStoreSuite.d.ts

@@ -31,4 +31,3 @@ export interface InviteStoreConformanceOptions {
     seedUser?: SeedUserFn;
 }
 export declare function runInviteStoreConformance(opts: InviteStoreConformanceOptions): void;
-//# sourceMappingURL=inviteStoreSuite.d.ts.map

package/dist/testing/suites/inviteStoreSuite.js

@@ -81,23 +81,34 @@ export function runInviteStoreConformance(opts) {
             await store.markAccepted(SYSTEM_CONTEXT, inv.id, acceptor);
             const got = await store.getByTokenHash(SYSTEM_CONTEXT, inv.tokenHash);
             expect(got).toBeNull();
+            const page = await store.listByOrg(ctx(scope.adminId), scope.orgId, { limit: 100 });
+            const row = page.items.find((i) => i.id === inv.id);
+            expect(row?.acceptedAt).toBeTruthy();
+            expect(row?.acceptedByUserId).toBe(acceptor);
         });
-        it('markAccepted is idempotent (second call is a no-op)', async () => {
+        it('markAccepted is idempotent: the first acceptor stays', async () => {
             const store = await createStore();
             const scope = await scopeFor();
             const { userId: acceptor } = await seedUser(makeUuid());
             const inv = invite(scope);
             await store.create(ctx(scope.adminId), inv);
-            await store.markAccepted(SYSTEM_CONTEXT, inv.id, acceptor);
-            await store.markAccepted(SYSTEM_CONTEXT, inv.id, acceptor);
+            const { userId: second } = await seedUser(makeUuid());
+            expect(await store.markAccepted(SYSTEM_CONTEXT, inv.id, acceptor)).toBe(true);
+            expect(await store.markAccepted(SYSTEM_CONTEXT, inv.id, second)).toBe(false);
+            const page = await store.listByOrg(ctx(scope.adminId), scope.orgId, { limit: 100 });
+            expect(page.items.find((i) => i.id === inv.id)?.acceptedByUserId).toBe(acceptor);
         });
         it('listByOrg returns invites for the org', async () => {
             const store = await createStore();
             const scope = await scopeFor();
-            for (let i = 0; i < 3; i++)
-                await store.create(ctx(scope.adminId), invite(scope));
+            const ids = [];
+            for (let i = 0; i < 3; i++) {
+                const inv = invite(scope);
+                ids.push(inv.id);
+                await store.create(ctx(scope.adminId), inv);
+            }
             const page = await store.listByOrg(ctx(scope.adminId), scope.orgId, { limit: 100 });
-            expect(page.items.length).toBeGreaterThanOrEqual(3);
+            expect(page.items.map((i) => i.id)).toEqual(expect.arrayContaining(ids));
         });
         it('revoke removes a pending invite', async () => {
             const store = await createStore();
@@ -157,4 +168,3 @@ export function runInviteStoreConformance(opts) {
         });
     });
 }
-//# sourceMappingURL=inviteStoreSuite.js.map

package/dist/testing/suites/oauthAuthSuite.d.ts

@@ -0,0 +1,18 @@
+/**
+ * Adapter conformance suite for IOAuthAuth and ISessionRefresh.
+ *
+ * Covers what can be checked in process: provider listing and the refusal of bad
+ * credentials. A real code exchange needs a browser at the IdP.
+ */
+import type { IOAuthAuth, ISessionRefresh } from '../../auth/index.js';
+export interface OAuthAuthConformanceOptions {
+    name: string;
+    createAdapter: () => Promise<{
+        oauth: IOAuthAuth;
+        sessionRefresh: ISessionRefresh;
+    }> | {
+        oauth: IOAuthAuth;
+        sessionRefresh: ISessionRefresh;
+    };
+}
+export declare function runOAuthAuthConformance(opts: OAuthAuthConformanceOptions): void;

package/dist/testing/suites/oauthAuthSuite.js

@@ -0,0 +1,26 @@
+/**
+ * Adapter conformance suite for IOAuthAuth and ISessionRefresh.
+ *
+ * Covers what can be checked in process: provider listing and the refusal of bad
+ * credentials. A real code exchange needs a browser at the IdP.
+ */
+import { describe, it, expect } from 'vitest';
+export function runOAuthAuthConformance(opts) {
+    const { name, createAdapter } = opts;
+    describe(`IOAuthAuth conformance: ${name}`, () => {
+        it('listProviders names providers in lowercase', async () => {
+            const { oauth } = await createAdapter();
+            for (const provider of oauth.listProviders()) {
+                expect(provider).toBe(provider.toLowerCase());
+            }
+        });
+        it('exchangeOAuthCode returns null for a code nobody issued', async () => {
+            const { oauth } = await createAdapter();
+            expect(await oauth.exchangeOAuthCode('not-a-real-code')).toBeNull();
+        });
+        it('refreshSession returns null for a token nobody issued', async () => {
+            const { sessionRefresh } = await createAdapter();
+            expect(await sessionRefresh.refreshSession('not-a-real-token')).toBeNull();
+        });
+    });
+}

package/dist/testing/suites/orgStoreSuite.d.ts

@@ -19,6 +19,11 @@ export interface OrgStoreConformanceOptions {
      * actually stored — callers use that, not the suggested one.
      */
     seedUser?: SeedUserFn;
+    /**
+     * Seeds the other party in the ctx-isolation cases. Needed where `seedUser` makes
+     * instance admins, who see everything by design.
+     */
+    seedOutsider?: SeedUserFn;
     /** If true, skip createOrg/deleteOrg tests (e.g. single-org providers). */
     singleOrgMode?: boolean;
     /** If true, run ctx-isolation tests (adapters with row-level security). */
@@ -39,4 +44,3 @@ export interface OrgStoreConformanceOptions {
     };
 }
 export declare function runOrgStoreConformance(opts: OrgStoreConformanceOptions): void;
-//# sourceMappingURL=orgStoreSuite.d.ts.map

package/dist/testing/suites/orgStoreSuite.js

@@ -37,8 +37,9 @@ function member(orgId, userId, role = 'member') {
     };
 }
 export function runOrgStoreConformance(opts) {
-    const { name, createStore, seedUser = noopSeedUser, singleOrgMode = false, ctxIsolation = false, createCompanionStores } = opts;
+    const { name, createStore, seedUser = noopSeedUser, seedOutsider = seedUser, singleOrgMode = false, ctxIsolation = false, createCompanionStores } = opts;
     const { seed, ctx } = makeSeedHelpers(seedUser);
+    const outsider = makeSeedHelpers(seedOutsider);
     describe(`IOrgStore conformance: ${name}`, () => {
         // ============================================================================
         // Organizations
@@ -116,7 +117,7 @@ export function runOrgStoreConformance(opts) {
             });
         }
         else {
-            it('getOrg returns the default organization', async () => {
+            it('listOrgs returns the default organization', async () => {
                 const store = await createStore();
                 const u1 = await seed();
                 const orgs = await store.listOrgs(ctx(u1));
@@ -190,6 +191,25 @@ export function runOrgStoreConformance(opts) {
             const got = await store.getOrgMember(ctx(u1), orgId, u2);
             expect(got?.role).toBe('admin');
         });
+        it('updateOrgMemberPermissions replaces the set and leaves the role', async () => {
+            const store = await createStore();
+            const { u1, orgId } = await setupOrg(store);
+            const u2 = await seed();
+            await store.addOrgMember(ctx(u1), member(orgId, u2));
+            const before = await store.getOrgMember(ctx(u1), orgId, u2);
+            await store.updateOrgMemberPermissions(ctx(u1), orgId, u2, ['manage_projects']);
+            const after = await store.getOrgMember(ctx(u1), orgId, u2);
+            expect(after?.permissions).toEqual(['manage_projects']);
+            expect(after?.role).toBe(before?.role);
+        });
+        it('removeOrgMember throws 404 for someone who is not a member', async () => {
+            const store = await createStore();
+            const { u1, orgId } = await setupOrg(store);
+            const stranger = await seed();
+            await expect(store.removeOrgMember(ctx(u1), orgId, stranger)).rejects.toMatchObject({
+                statusCode: 404
+            });
+        });
         it('removeOrgMember deletes the member', async () => {
             const store = await createStore();
             const { u1, orgId } = await setupOrg(store);
@@ -347,22 +367,21 @@ export function runOrgStoreConformance(opts) {
             it('ctx isolation: orgs created by one user are not visible to another', async () => {
                 const store = await createStore();
                 const userA = await seed();
-                const userB = await seed();
+                const userB = await outsider.seed();
                 const orgA = makeUuid();
                 await store.createOrg(ctx(userA), org(userA, { id: orgA, slug: `org-a-${orgA.slice(0, 8)}` }));
-                const page = await store.listOrgs(ctx(userB));
+                const page = await store.listOrgs(outsider.ctx(userB));
                 expect(page.items.map((o) => o.id)).not.toContain(orgA);
             });
             it('ctx isolation: user cannot get an org they do not own', async () => {
                 const store = await createStore();
                 const userA = await seed();
-                const userB = await seed();
+                const userB = await outsider.seed();
                 const orgA = makeUuid();
                 await store.createOrg(ctx(userA), org(userA, { id: orgA, slug: `org-a-${orgA.slice(0, 8)}` }));
-                const got = await store.getOrg(ctx(userB), orgA);
+                const got = await store.getOrg(outsider.ctx(userB), orgA);
                 expect(got).toBeNull();
             });
         }
     });
 }
-//# sourceMappingURL=orgStoreSuite.js.map

package/dist/testing/suites/platformPermissionStoreSuite.d.ts

@@ -5,10 +5,6 @@
  * `countInstanceAdminsExcluding`, plus the §2 sole-`instance_admin`
  * invariant — `set` must return `'last_admin'` when dropping the only admin,
  * and `countInstanceAdminsExcluding` must exclude the named user.
- *
- * These tests used to live on the auth-provider conformance suite when the
- * invariant was enforced there; the move from `IAuthProvider` to
- * `IPlatformPermissionStore` brought them with it.
  */
 import type { IPlatformPermissionStore } from '../../index.js';
 export interface PlatformPermissionStoreConformanceOptions {
@@ -34,4 +30,3 @@ export interface PlatformPermissionStoreConformanceOptions {
     cleanup?: () => Promise<void> | void;
 }
 export declare function runPlatformPermissionStoreConformance(opts: PlatformPermissionStoreConformanceOptions): void;
-//# sourceMappingURL=platformPermissionStoreSuite.d.ts.map