@serfab/cadre-host 0.12.0 → 1.0.0

package/src/server/__tests__/grants-route.test.ts

@@ -1,263 +1,394 @@
-/**
- * Grantee-facing `/grants` route tests — the bearer-gated provisioning surface.
- *
- * Uses a fake orchestrator (no real children) so the focus is the HTTP contract:
- * bearer auth, request validation, per-grant ownership isolation, the quota gate,
- * and seedToken redaction. The live-node round-trips (peer/seed) are covered by
- * the cross-package integration scenario.
- */
-
-import Fastify from 'fastify';
-import { afterEach, beforeEach, describe, expect, it } from 'vitest';
-import { mkdtempSync, rmSync } from 'node:fs';
-import { tmpdir } from 'node:os';
-import { join } from 'node:path';
-
-import type {
-  Orchestrator,
-  OrchestratorCreateRequest,
-  OrchestratorCreateResult,
-  OrchestratorStats,
-} from '@serfab/cadre-provider';
-
-import { registerErrorHandler } from '../error-handler.js';
-import { registerGrantsRoutes } from '../routes/grants.js';
-import { DonationService } from '../../donation/donation-service.js';
-import { DonationStore } from '../../donation/donation-store.js';
-import { GrantService } from '../../donation/grant-service.js';
-import { GrantStore } from '../../donation/grant-store.js';
-
-class FakeOrchestrator implements Orchestrator {
-  stopped: string[] = [];
-  removed: string[] = [];
-  private counter = 0;
-  async createContainer(_request: OrchestratorCreateRequest): Promise<OrchestratorCreateResult> {
-    const n = ++this.counter;
-    return {
-      dockerId: `dock_${n}`,
-      healthEndpoint: `http://127.0.0.1:${9000 + n}/health`,
-      metricsEndpoint: `http://127.0.0.1:${9000 + n}/metrics`,
-      seedEndpoint: `http://127.0.0.1:${9000 + n}/seed`,
-      seedToken: `seed-token-${n}`,
-      p2pPort: 4000 + n,
-    };
-  }
-  async stopContainer(id: string): Promise<void> { this.stopped.push(id); }
-  async removeContainer(id: string): Promise<void> { this.removed.push(id); }
-  async getStats(): Promise<OrchestratorStats> {
-    return { cpuPercent: 0, memoryBytes: 0, networkRxBytes: 0, networkTxBytes: 0 };
-  }
-  async isRunning(): Promise<boolean> { return true; }
-  async getLogs(): Promise<string> { return ''; }
-}
-
-let tmpRoot: string;
-let app: ReturnType<typeof Fastify>;
-let grants: GrantService;
-let store: DonationStore;
-let token: string;
-const originalFetch = globalThis.fetch;
-
-/**
- * A well-formed 32-byte base64url owner key. `DonationService.provision`
- * shape-checks the pins, so a placeholder string is a 400 rather than a fixture.
- */
-const OWNER_KEY = Buffer.alloc(32, 7).toString('base64url');
-
-const body = {
-  partyId: 'party-P',
-  bootstrapNodes: ['/ip4/127.0.0.1/tcp/4001/p2p/12D3KooReq'],
-  ownerKeys: [OWNER_KEY],
-};
-
-const bearer = (t: string) => ({ authorization: `Bearer ${t}` });
-
-beforeEach(() => {
-  tmpRoot = mkdtempSync(join(tmpdir(), 'cadre-host-grants-svc-route-'));
-  grants = new GrantService({ store: new GrantStore(join(tmpRoot, 'grants')) });
-  token = grants.issue({ label: 'Alice', maxNodes: 2 }).token;
-  store = new DonationStore(join(tmpRoot, 'donations'));
-  const donations = new DonationService({ orchestrator: new FakeOrchestrator(), grants, store });
-  app = Fastify();
-  registerErrorHandler(app);
-  registerGrantsRoutes(app, { donations, grants });
-});
-
-afterEach(async () => {
-  globalThis.fetch = originalFetch;
-  await app.close();
-  try { rmSync(tmpRoot, { recursive: true, force: true }); } catch { /* ignore */ }
-});
-
-describe('POST /grants', () => {
-  it('provisions a donated node → 201, awaiting_seed, seedToken redacted', async () => {
-    const res = await app.inject({ method: 'POST', url: '/grants', headers: bearer(token), payload: body });
-    expect(res.statusCode).toBe(201);
-    const donation = (res.json() as { data: { donation: Record<string, unknown> } }).data.donation;
-    expect(donation.status).toBe('awaiting_seed');
-    expect(donation.partyId).toBe('party-P');
-    expect(donation.seedToken).toBeUndefined();
-    expect(donation.seedEndpoint).toBeUndefined();
-  });
-
-  it('rejects a missing bearer → 401', async () => {
-    const res = await app.inject({ method: 'POST', url: '/grants', payload: body });
-    expect(res.statusCode).toBe(401);
-    expect((res.json() as { error: { code: string } }).error.code).toBe('unauthorized');
-  });
-
-  it('rejects an unknown bearer → 401', async () => {
-    const res = await app.inject({ method: 'POST', url: '/grants', headers: bearer('nope'), payload: body });
-    expect(res.statusCode).toBe(401);
-  });
-
-  it('rejects a missing partyId → 400 invalid_request', async () => {
-    const res = await app.inject({
-      method: 'POST', url: '/grants', headers: bearer(token),
-      payload: { bootstrapNodes: body.bootstrapNodes, ownerKeys: body.ownerKeys },
-    });
-    expect(res.statusCode).toBe(400);
-    expect((res.json() as { error: { code: string } }).error.code).toBe('invalid_request');
-  });
-
-  it('rejects empty ownerKeys → 400 invalid_request', async () => {
-    const res = await app.inject({
-      method: 'POST', url: '/grants', headers: bearer(token),
-      payload: { ...body, ownerKeys: [] },
-    });
-    expect(res.statusCode).toBe(400);
-  });
-
-  // A typo'd pin used to be answered 201 and only fail when the spawned child
-  // tried to decode it at boot — by which point the caller had no way to act on it.
-  it('rejects a malformed ownerKeys entry → 400 invalid_request, naming the bad key', async () => {
-    const res = await app.inject({
-      method: 'POST', url: '/grants', headers: bearer(token),
-      payload: { ...body, ownerKeys: [OWNER_KEY, 'this-is-not-a-key'] },
-    });
-    expect(res.statusCode).toBe(400);
-    const error = (res.json() as { error: { code: string; message: string } }).error;
-    expect(error.code).toBe('invalid_request');
-    expect(error.message).toContain('this-is-not-a-key');
-  });
-
-  // Element types are the route's job: the service's shape check assumes strings,
-  // so a number here would come back as an internal `.trim is not a function`.
-  it('rejects a non-string ownerKeys entry → 400 naming the field, not a decoder error', async () => {
-    const res = await app.inject({
-      method: 'POST', url: '/grants', headers: bearer(token),
-      payload: { ...body, ownerKeys: [42] },
-    });
-    expect(res.statusCode).toBe(400);
-    const error = (res.json() as { error: { code: string; message: string } }).error;
-    expect(error.code).toBe('invalid_request');
-    expect(error.message).toBe('ownerKeys must be an array of strings');
-  });
-
-  it('enforces the grant quota → 429 quota_exceeded once maxNodes is reached', async () => {
-    const g = grants.issue({ label: 'Bob', maxNodes: 1 }).token;
-    const first = await app.inject({ method: 'POST', url: '/grants', headers: bearer(g), payload: body });
-    expect(first.statusCode).toBe(201);
-    const second = await app.inject({ method: 'POST', url: '/grants', headers: bearer(g), payload: body });
-    expect(second.statusCode).toBe(429);
-    expect((second.json() as { error: { code: string } }).error.code).toBe('quota_exceeded');
-  });
-});
-
-describe('GET /grants auth', () => {
-  it('rejects an unknown bearer → 401 unauthorized (code matches the status)', async () => {
-    const res = await app.inject({ method: 'GET', url: '/grants', headers: bearer('nope') });
-    expect(res.statusCode).toBe(401);
-    expect((res.json() as { error: { code: string } }).error.code).toBe('unauthorized');
-  });
-});
-
-describe('GET /grants (ownership isolation)', () => {
-  it('lists only the donations the presented grant authorized', async () => {
-    const other = grants.issue({ label: 'Carol' }).token;
-    await app.inject({ method: 'POST', url: '/grants', headers: bearer(token), payload: body });
-    await app.inject({ method: 'POST', url: '/grants', headers: bearer(other), payload: body });
-
-    const mine = await app.inject({ method: 'GET', url: '/grants', headers: bearer(token) });
-    const donations = (mine.json() as { data: { donations: Array<{ grantToken: string }> } }).data.donations;
-    expect(donations).toHaveLength(1);
-    expect(donations[0].grantToken).toBe(token);
-  });
-
-  it('a foreign grant cannot read another grant’s donation → 404', async () => {
-    const other = grants.issue({ label: 'Carol' }).token;
-    const created = await app.inject({ method: 'POST', url: '/grants', headers: bearer(token), payload: body });
-    const id = (created.json() as { data: { donation: { id: string } } }).data.donation.id;
-
-    const mine = await app.inject({ method: 'GET', url: `/grants/${id}`, headers: bearer(token) });
-    expect(mine.statusCode).toBe(200);
-
-    const foreign = await app.inject({ method: 'GET', url: `/grants/${id}`, headers: bearer(other) });
-    expect(foreign.statusCode).toBe(404);
-  });
-});
-
-describe('PUT /grants/:id/seed validation', () => {
-  it('rejects a missing seed body → 400 invalid_request', async () => {
-    const created = await app.inject({ method: 'POST', url: '/grants', headers: bearer(token), payload: body });
-    const id = (created.json() as { data: { donation: { id: string } } }).data.donation.id;
-    const res = await app.inject({ method: 'PUT', url: `/grants/${id}/seed`, headers: bearer(token), payload: {} });
-    expect(res.statusCode).toBe(400);
-    expect((res.json() as { error: { code: string } }).error.code).toBe('invalid_request');
-  });
-
-  it('answers 409 invalid_state when the loan ends while the seed is in flight', async () => {
-    const created = await app.inject({ method: 'POST', url: '/grants', headers: bearer(token), payload: body });
-    const id = (created.json() as { data: { donation: { id: string } } }).data.donation.id;
-
-    // The borrower's DELETE lands inside the seed window: the node accepts the
-    // seed, but by the time it answers the loan is over. The ending wins, so the
-    // route must NOT report a 200 that implies a live, freshly seeded node.
-    globalThis.fetch = (async () => {
-      await app.inject({ method: 'DELETE', url: `/grants/${id}`, headers: bearer(token) });
-      return { ok: true, json: async () => ({ success: true, peersAdded: 2 }) } as unknown as Response;
-    }) as typeof globalThis.fetch;
-
-    const res = await app.inject({
-      method: 'PUT', url: `/grants/${id}/seed`, headers: bearer(token), payload: { seed: 'encoded-seed' },
-    });
-
-    expect(res.statusCode).toBe(409);
-    expect((res.json() as { error: { code: string } }).error.code).toBe('invalid_state');
-    const after = await app.inject({ method: 'GET', url: `/grants/${id}`, headers: bearer(token) });
-    expect((after.json() as { data: { donation: { status: string } } }).data.donation.status)
-      .toBe('terminated');
-  });
-
-  it('answers 404 not_found when the record vanishes while the seed is in flight', async () => {
-    const created = await app.inject({ method: 'POST', url: '/grants', headers: bearer(token), payload: body });
-    const id = (created.json() as { data: { donation: { id: string } } }).data.donation.id;
-
-    // The row is gone by the time the node answers — the other half of the
-    // abandon mapping, which has no status to report.
-    globalThis.fetch = (async () => {
-      store.remove(id);
-      return { ok: true, json: async () => ({ success: true, peersAdded: 2 }) } as unknown as Response;
-    }) as typeof globalThis.fetch;
-
-    const res = await app.inject({
-      method: 'PUT', url: `/grants/${id}/seed`, headers: bearer(token), payload: { seed: 'encoded-seed' },
-    });
-
-    expect(res.statusCode).toBe(404);
-    expect((res.json() as { error: { code: string } }).error.code).toBe('not_found');
-  });
-});
-
-describe('DELETE /grants/:id', () => {
-  it('terminates a donation and drops it from the live tally', async () => {
-    const created = await app.inject({ method: 'POST', url: '/grants', headers: bearer(token), payload: body });
-    const id = (created.json() as { data: { donation: { id: string } } }).data.donation.id;
-
-    const del = await app.inject({ method: 'DELETE', url: `/grants/${id}`, headers: bearer(token) });
-    expect(del.statusCode).toBe(200);
-
-    const one = await app.inject({ method: 'GET', url: `/grants/${id}`, headers: bearer(token) });
-    expect((one.json() as { data: { donation: { status: string } } }).data.donation.status).toBe('terminated');
-  });
-});
+/**
+ * Grantee-facing `/grants` route tests — the bearer-gated provisioning surface.
+ *
+ * Uses a fake orchestrator (no real children) so the focus is the HTTP contract:
+ * bearer auth, request validation, per-grant ownership isolation, the quota gate,
+ * and seedToken redaction. The live-node round-trips (peer/seed) are covered by
+ * the cross-package integration scenario.
+ */
+
+import type { FastifyInstance } from 'fastify';
+import { afterEach, beforeEach, describe, expect, it } from 'vitest';
+import { mkdtempSync, rmSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+
+import type {
+  Orchestrator,
+  OrchestratorCreateRequest,
+  OrchestratorCreateResult,
+  OrchestratorStats,
+} from '@serfab/cadre-provider';
+
+import { registerErrorHandler } from '../error-handler.js';
+import { registerGrantsRoutes } from '../routes/grants.js';
+import { buildFastify } from '../server.js';
+import { DonationService } from '../../donation/donation-service.js';
+import { DonationStore } from '../../donation/donation-store.js';
+import { GrantService } from '../../donation/grant-service.js';
+import { GrantStore } from '../../donation/grant-store.js';
+
+class FakeOrchestrator implements Orchestrator {
+  stopped: string[] = [];
+  removed: string[] = [];
+  private counter = 0;
+  async createContainer(_request: OrchestratorCreateRequest): Promise<OrchestratorCreateResult> {
+    const n = ++this.counter;
+    return {
+      dockerId: `dock_${n}`,
+      healthEndpoint: `http://127.0.0.1:${9000 + n}/health`,
+      metricsEndpoint: `http://127.0.0.1:${9000 + n}/metrics`,
+      seedEndpoint: `http://127.0.0.1:${9000 + n}/seed`,
+      seedToken: `seed-token-${n}`,
+      p2pPort: 4000 + n,
+    };
+  }
+  async stopContainer(id: string): Promise<void> { this.stopped.push(id); }
+  async removeContainer(id: string): Promise<void> { this.removed.push(id); }
+  async getStats(): Promise<OrchestratorStats> {
+    return { cpuPercent: 0, memoryBytes: 0, networkRxBytes: 0, networkTxBytes: 0 };
+  }
+  async isRunning(): Promise<boolean> { return true; }
+  async getLogs(): Promise<string> { return ''; }
+}
+
+let tmpRoot: string;
+let app: FastifyInstance;
+let grants: GrantService;
+let store: DonationStore;
+let token: string;
+const originalFetch = globalThis.fetch;
+
+/**
+ * A well-formed 32-byte base64url owner key. `DonationService.provision`
+ * shape-checks the pins, so a placeholder string is a 400 rather than a fixture.
+ */
+const OWNER_KEY = Buffer.alloc(32, 7).toString('base64url');
+
+const body = {
+  partyId: 'party-P',
+  bootstrapNodes: ['/ip4/127.0.0.1/tcp/4001/p2p/12D3KooWA9hbnKrRnPRSPTRkzXqTHzGE8YpJ3JHZmQ5tGwLRTMmp'],
+  ownerKeys: [OWNER_KEY],
+};
+
+const bearer = (t: string) => ({ authorization: `Bearer ${t}` });
+
+beforeEach(() => {
+  tmpRoot = mkdtempSync(join(tmpdir(), 'cadre-host-grants-svc-route-'));
+  grants = new GrantService({ store: new GrantStore(join(tmpRoot, 'grants')) });
+  token = grants.issue({ label: 'Alice', maxNodes: 2 }).token;
+  store = new DonationStore(join(tmpRoot, 'donations'));
+  const donations = new DonationService({ orchestrator: new FakeOrchestrator(), grants, store });
+  // The production constructor, so these tests run with the same body parsing.
+  app = buildFastify();
+  registerErrorHandler(app);
+  registerGrantsRoutes(app, { donations, grants });
+});
+
+afterEach(async () => {
+  globalThis.fetch = originalFetch;
+  await app.close();
+  try { rmSync(tmpRoot, { recursive: true, force: true }); } catch { /* ignore */ }
+});
+
+describe('POST /grants', () => {
+  it('provisions a donated node → 201, awaiting_seed, seedToken redacted', async () => {
+    const res = await app.inject({ method: 'POST', url: '/grants', headers: bearer(token), payload: body });
+    expect(res.statusCode).toBe(201);
+    const donation = (res.json() as { data: { donation: Record<string, unknown> } }).data.donation;
+    expect(donation.status).toBe('awaiting_seed');
+    expect(donation.partyId).toBe('party-P');
+    expect(donation.seedToken).toBeUndefined();
+    expect(donation.seedEndpoint).toBeUndefined();
+  });
+
+  it('rejects a missing bearer → 401', async () => {
+    const res = await app.inject({ method: 'POST', url: '/grants', payload: body });
+    expect(res.statusCode).toBe(401);
+    expect((res.json() as { error: { code: string } }).error.code).toBe('unauthorized');
+  });
+
+  it('rejects an unknown bearer → 401', async () => {
+    const res = await app.inject({ method: 'POST', url: '/grants', headers: bearer('nope'), payload: body });
+    expect(res.statusCode).toBe(401);
+  });
+
+  it('rejects a missing partyId → 400 invalid_request', async () => {
+    const res = await app.inject({
+      method: 'POST', url: '/grants', headers: bearer(token),
+      payload: { bootstrapNodes: body.bootstrapNodes, ownerKeys: body.ownerKeys },
+    });
+    expect(res.statusCode).toBe(400);
+    expect((res.json() as { error: { code: string } }).error.code).toBe('invalid_request');
+  });
+
+  it('rejects empty ownerKeys → 400 invalid_request', async () => {
+    const res = await app.inject({
+      method: 'POST', url: '/grants', headers: bearer(token),
+      payload: { ...body, ownerKeys: [] },
+    });
+    expect(res.statusCode).toBe(400);
+  });
+
+  // A typo'd pin used to be answered 201 and only fail when the spawned child
+  // tried to decode it at boot — by which point the caller had no way to act on it.
+  it('rejects a malformed ownerKeys entry → 400 invalid_request, naming the bad key', async () => {
+    const res = await app.inject({
+      method: 'POST', url: '/grants', headers: bearer(token),
+      payload: { ...body, ownerKeys: [OWNER_KEY, 'this-is-not-a-key'] },
+    });
+    expect(res.statusCode).toBe(400);
+    const error = (res.json() as { error: { code: string; message: string } }).error;
+    expect(error.code).toBe('invalid_request');
+    expect(error.message).toContain('this-is-not-a-key');
+  });
+
+  // Element types are the route's job: the service's shape check assumes strings,
+  // so a number here would come back as an internal `.trim is not a function`.
+  it('rejects a non-string ownerKeys entry → 400 naming the field, not a decoder error', async () => {
+    const res = await app.inject({
+      method: 'POST', url: '/grants', headers: bearer(token),
+      payload: { ...body, ownerKeys: [42] },
+    });
+    expect(res.statusCode).toBe(400);
+    const error = (res.json() as { error: { code: string; message: string } }).error;
+    expect(error.code).toBe('invalid_request');
+    expect(error.message).toBe('ownerKeys must be an array of strings');
+  });
+
+  // The address rule the whole `bootstrap-node-validation.ts` module exists for,
+  // at the route boundary. Its accept/reject table is pinned in
+  // `bootstrap-node-validation.test.ts`; what matters here is that a bad address
+  // is a 400 naming the entry, and that no child was spawned on the way.
+  it('rejects an unusable bootstrapNodes entry → 400 invalid_request, naming the bad address', async () => {
+    const res = await app.inject({
+      method: 'POST', url: '/grants', headers: bearer(token),
+      payload: { ...body, bootstrapNodes: [...body.bootstrapNodes, 'not-an-address'] },
+    });
+    expect(res.statusCode).toBe(400);
+    const error = (res.json() as { error: { code: string; message: string } }).error;
+    expect(error.code).toBe('invalid_request');
+    expect(error.message).toContain('not-an-address');
+  });
+
+  it('provisions nothing for any of the unusable-address shapes', async () => {
+    const bad: unknown[] = [
+      [42],
+      ['not-an-address'],
+      // Parses, but names no peer: the child would start with zero bootstrap
+      // peers and never reach the requester's cadre.
+      ['/ip4/127.0.0.1/tcp/4001'],
+      // Names a peer id that does not decode: the child dies constructing libp2p.
+      ['/ip4/127.0.0.1/tcp/4001/p2p/12D3KooReq'],
+      // Names a decodable peer but no place to dial it: bootstrap keeps it, libp2p
+      // finds no transport for it, and the node is alone just the same.
+      ['/p2p/12D3KooWA9hbnKrRnPRSPTRkzXqTHzGE8YpJ3JHZmQ5tGwLRTMmp'],
+      [''],
+    ];
+    for (const bootstrapNodes of bad) {
+      const res = await app.inject({
+        method: 'POST', url: '/grants', headers: bearer(token),
+        payload: { ...body, bootstrapNodes },
+      });
+      expect(res.statusCode, `expected 400 for ${JSON.stringify(bootstrapNodes)}`).toBe(400);
+    }
+
+    const list = await app.inject({ method: 'GET', url: '/grants', headers: bearer(token) });
+    expect((list.json() as { data: { donations: unknown[] } }).data.donations).toHaveLength(0);
+  });
+
+  // A phone has no address to give, so it sends none and dials the lent node itself:
+  // leaving the field out, or sending an empty list, provisions a node with no
+  // bootstrap peers rather than being rejected.
+  it('provisions with bootstrapNodes absent or empty → 201, recording an empty list', async () => {
+    const { bootstrapNodes: _bootstrapNodes, ...withoutBootstrap } = body;
+    for (const payload of [withoutBootstrap, { ...body, bootstrapNodes: [] }]) {
+      const res = await app.inject({ method: 'POST', url: '/grants', headers: bearer(token), payload });
+      expect(res.statusCode, `expected 201 for ${JSON.stringify(payload)}`).toBe(201);
+      const donation = (res.json() as { data: { donation: { id: string; bootstrapNodes?: string[] } } }).data.donation;
+      expect(donation.bootstrapNodes).toEqual([]);
+      expect(store.get(donation.id)?.bootstrapNodes).toEqual([]);
+    }
+  });
+
+  it('rejects a non-string partyId → 400, rather than stringifying it into the child config', async () => {
+    for (const partyId of [42, { id: 'party-P' }, '   ']) {
+      const res = await app.inject({
+        method: 'POST', url: '/grants', headers: bearer(token),
+        payload: { ...body, partyId },
+      });
+      expect(res.statusCode, `expected 400 for partyId ${JSON.stringify(partyId)}`).toBe(400);
+      expect((res.json() as { error: { message: string } }).error.message).toBe('partyId is required');
+    }
+  });
+
+  it('rejects an unknown profile → 400', async () => {
+    const res = await app.inject({
+      method: 'POST', url: '/grants', headers: bearer(token),
+      payload: { ...body, profile: 'archive' },
+    });
+    expect(res.statusCode).toBe(400);
+    expect((res.json() as { error: { message: string } }).error.message)
+      .toBe('profile must be "storage" or "transaction"');
+  });
+
+  it('enforces the grant quota → 429 quota_exceeded once maxNodes is reached', async () => {
+    const g = grants.issue({ label: 'Bob', maxNodes: 1 }).token;
+    const first = await app.inject({ method: 'POST', url: '/grants', headers: bearer(g), payload: body });
+    expect(first.statusCode).toBe(201);
+    const second = await app.inject({ method: 'POST', url: '/grants', headers: bearer(g), payload: body });
+    expect(second.statusCode).toBe(429);
+    expect((second.json() as { error: { code: string } }).error.code).toBe('quota_exceeded');
+  });
+});
+
+describe('GET /grants auth', () => {
+  it('rejects an unknown bearer → 401 unauthorized (code matches the status)', async () => {
+    const res = await app.inject({ method: 'GET', url: '/grants', headers: bearer('nope') });
+    expect(res.statusCode).toBe(401);
+    expect((res.json() as { error: { code: string } }).error.code).toBe('unauthorized');
+  });
+});
+
+describe('GET /grants (ownership isolation)', () => {
+  it('lists only the donations the presented grant authorized', async () => {
+    const other = grants.issue({ label: 'Carol' }).token;
+    await app.inject({ method: 'POST', url: '/grants', headers: bearer(token), payload: body });
+    await app.inject({ method: 'POST', url: '/grants', headers: bearer(other), payload: body });
+
+    const mine = await app.inject({ method: 'GET', url: '/grants', headers: bearer(token) });
+    const donations = (mine.json() as { data: { donations: Array<{ grantToken: string }> } }).data.donations;
+    expect(donations).toHaveLength(1);
+    expect(donations[0].grantToken).toBe(token);
+  });
+
+  it('a foreign grant cannot read another grant’s donation → 404', async () => {
+    const other = grants.issue({ label: 'Carol' }).token;
+    const created = await app.inject({ method: 'POST', url: '/grants', headers: bearer(token), payload: body });
+    const id = (created.json() as { data: { donation: { id: string } } }).data.donation.id;
+
+    const mine = await app.inject({ method: 'GET', url: `/grants/${id}`, headers: bearer(token) });
+    expect(mine.statusCode).toBe(200);
+
+    const foreign = await app.inject({ method: 'GET', url: `/grants/${id}`, headers: bearer(other) });
+    expect(foreign.statusCode).toBe(404);
+  });
+});
+
+describe('PUT /grants/:id/seed validation', () => {
+  it('rejects a missing seed body → 400 invalid_request', async () => {
+    const created = await app.inject({ method: 'POST', url: '/grants', headers: bearer(token), payload: body });
+    const id = (created.json() as { data: { donation: { id: string } } }).data.donation.id;
+    const res = await app.inject({ method: 'PUT', url: `/grants/${id}/seed`, headers: bearer(token), payload: {} });
+    expect(res.statusCode).toBe(400);
+    expect((res.json() as { error: { code: string } }).error.code).toBe('invalid_request');
+  });
+
+  it('answers 409 invalid_state when the loan ends while the seed is in flight', async () => {
+    const created = await app.inject({ method: 'POST', url: '/grants', headers: bearer(token), payload: body });
+    const id = (created.json() as { data: { donation: { id: string } } }).data.donation.id;
+
+    // The borrower's DELETE lands inside the seed window: the node accepts the
+    // seed, but by the time it answers the loan is over. The ending wins, so the
+    // route must NOT report a 200 that implies a live, freshly seeded node.
+    globalThis.fetch = (async () => {
+      await app.inject({ method: 'DELETE', url: `/grants/${id}`, headers: bearer(token) });
+      return { ok: true, json: async () => ({ success: true, peersAdded: 2 }) } as unknown as Response;
+    }) as typeof globalThis.fetch;
+
+    const res = await app.inject({
+      method: 'PUT', url: `/grants/${id}/seed`, headers: bearer(token), payload: { seed: 'encoded-seed' },
+    });
+
+    expect(res.statusCode).toBe(409);
+    expect((res.json() as { error: { code: string } }).error.code).toBe('invalid_state');
+    const after = await app.inject({ method: 'GET', url: `/grants/${id}`, headers: bearer(token) });
+    expect((after.json() as { data: { donation: { status: string } } }).data.donation.status)
+      .toBe('terminated');
+  });
+
+  it('answers 404 not_found when the record vanishes while the seed is in flight', async () => {
+    const created = await app.inject({ method: 'POST', url: '/grants', headers: bearer(token), payload: body });
+    const id = (created.json() as { data: { donation: { id: string } } }).data.donation.id;
+
+    // The row is gone by the time the node answers — the other half of the
+    // abandon mapping, which has no status to report.
+    globalThis.fetch = (async () => {
+      store.remove(id);
+      return { ok: true, json: async () => ({ success: true, peersAdded: 2 }) } as unknown as Response;
+    }) as typeof globalThis.fetch;
+
+    const res = await app.inject({
+      method: 'PUT', url: `/grants/${id}/seed`, headers: bearer(token), payload: { seed: 'encoded-seed' },
+    });
+
+    expect(res.statusCode).toBe(404);
+    expect((res.json() as { error: { code: string } }).error.code).toBe('not_found');
+  });
+});
+
+describe('DELETE /grants/:id', () => {
+  it('terminates a donation and drops it from the live tally', async () => {
+    const created = await app.inject({ method: 'POST', url: '/grants', headers: bearer(token), payload: body });
+    const id = (created.json() as { data: { donation: { id: string } } }).data.donation.id;
+
+    const del = await app.inject({ method: 'DELETE', url: `/grants/${id}`, headers: bearer(token) });
+    expect(del.statusCode).toBe(200);
+
+    const one = await app.inject({ method: 'GET', url: `/grants/${id}`, headers: bearer(token) });
+    expect((one.json() as { data: { donation: { status: string } } }).data.donation.status).toBe('terminated');
+  });
+
+  // The phone app sent `content-type: application/json` on its body-less DELETE, and
+  // Fastify's default parser answered 400 FST_ERR_CTP_EMPTY_JSON_BODY — so the loan,
+  // and the host's node, kept running.
+  it('ends the loan when the DELETE declares JSON but sends no body', async () => {
+    const created = await app.inject({ method: 'POST', url: '/grants', headers: bearer(token), payload: body });
+    const id = (created.json() as { data: { donation: { id: string } } }).data.donation.id;
+
+    const del = await app.inject({
+      method: 'DELETE', url: `/grants/${id}`,
+      headers: { ...bearer(token), 'content-type': 'application/json' },
+    });
+    expect(del.statusCode).toBe(200);
+    expect(store.get(id)?.status).toBe('terminated');
+  });
+});
+
+describe('JSON body parsing (buildFastify)', () => {
+  const json = (t: string) => ({ ...bearer(t), 'content-type': 'application/json' });
+
+  it('treats a declared-JSON empty body as no body, so the route answers its own 400', async () => {
+    const res = await app.inject({ method: 'POST', url: '/grants', headers: json(token) });
+    expect(res.statusCode).toBe(400);
+    const error = (res.json() as { error: { code: string; message: string } }).error;
+    expect(error.code).toBe('invalid_request');
+    expect(error.message).toBe('partyId is required');
+  });
+
+  it('still rejects a non-empty malformed body → 400 FST_ERR_CTP_INVALID_JSON_BODY', async () => {
+    const res = await app.inject({ method: 'POST', url: '/grants', headers: json(token), payload: '{"partyId":' });
+    expect(res.statusCode).toBe(400);
+    expect((res.json() as { error: { code: string } }).error.code).toBe('FST_ERR_CTP_INVALID_JSON_BODY');
+  });
+
+  it('still refuses a prototype-poisoning body, as Fastify\'s own parser does', async () => {
+    const res = await app.inject({
+      method: 'POST', url: '/grants', headers: json(token),
+      payload: '{"partyId":"party-P","__proto__":{"polluted":true}}',
+    });
+    expect(res.statusCode).toBe(400);
+    expect((res.json() as { error: { code: string } }).error.code).toBe('FST_ERR_CTP_INVALID_JSON_BODY');
+    const list = await app.inject({ method: 'GET', url: '/grants', headers: bearer(token) });
+    expect((list.json() as { data: { donations: unknown[] } }).data.donations).toHaveLength(0);
+  });
+
+  it('parses a well-formed body with a charset parameter on the content type', async () => {
+    const res = await app.inject({
+      method: 'POST', url: '/grants',
+      headers: { ...bearer(token), 'content-type': 'application/json; charset=utf-8' },
+      payload: JSON.stringify(body),
+    });
+    expect(res.statusCode).toBe(201);
+  });
+});