@sixb/core 0.1.13 → 0.1.15

package/src/testing/auth-storage-contract.ts

@@ -81,6 +81,34 @@ async function createUser(
   })
 }
 
+async function completeOidcSignInForAva(
+  storage: AuthStorage,
+  directoryGroupIds: readonly string[] | undefined
+): Promise<void> {
+  await storage.oidcAuthorizationAttempts.create({
+    id: "oidc_directory",
+    projectId,
+    strategyId: "entra",
+    audience: "atlas",
+    stateHash: "directory-state",
+    nonceHash: "nonce-hash",
+    codeVerifier: "verifier",
+    createdAt: at("2026-05-14T10:00:00.000Z"),
+    expiresAt: at("2026-05-14T10:10:00.000Z"),
+  })
+  await storage.completeOidcSignIn({
+    projectId,
+    oidcAuthorizationAttemptId: "oidc_directory",
+    stateHash: "directory-state",
+    completedAt: at("2026-05-14T10:01:00.000Z"),
+    subject: "entra-ava",
+    email: "ava@acme.com",
+    directoryGroupIds,
+    newUserId: "usr_unused",
+    session: sessionInput("ses_directory"),
+  })
+}
+
 /**
  * Runs the shared `AuthStorage` contract against any storage implementation.
  *
@@ -1721,91 +1749,6 @@ export function runAuthStorageContractSuite<TStorage extends AuthStorage>(
       })
     })
 
-    test("closes bootstrap user creation when an active user already exists", async () => {
-      await withStorage(async (storage) => {
-        await createUser(storage, {
-          id: "usr_existing",
-          email: "existing@acme.com",
-        })
-        await storage.magicLinks.create({
-          id: "ml_1",
-          projectId,
-          strategyId: "magic-link",
-          audience: "atlas",
-          email: "founder@acme.com",
-          tokenHash: "link-hash",
-          createdAt: at("2026-05-14T10:01:00.000Z"),
-          expiresAt: at("2026-05-14T10:16:00.000Z"),
-        })
-
-        await expectAuthError(
-          storage.completeMagicLinkSignIn({
-            projectId,
-            magicLinkId: "ml_1",
-            tokenHash: "link-hash",
-            completedAt: at("2026-05-14T10:03:00.000Z"),
-            newUserId: "usr_founder",
-            allowUserCreationWithoutInvitation: true,
-            requireNoActiveUsersForUserCreation: true,
-            session: sessionInput("ses_founder"),
-          }),
-          "user_creation_not_allowed"
-        )
-        await expect(
-          storage.users.getByEmail({ projectId, email: "founder@acme.com" })
-        ).resolves.toBeNull()
-        await expect(storage.magicLinks.getById({ projectId, id: "ml_1" })).resolves.toMatchObject({
-          consumedAt: at("2026-05-14T10:03:00.000Z"),
-        })
-      })
-    })
-
-    test("does not apply the bootstrap closure guard to invited user creation", async () => {
-      await withStorage(async (storage) => {
-        await createUser(storage, {
-          id: "usr_existing",
-          email: "existing@acme.com",
-        })
-        await storage.invitations.createOrUpdateActive({
-          id: "inv_1",
-          projectId,
-          email: "invited@acme.com",
-          groupIds: ["commercial"],
-          createdAt: at("2026-05-14T10:00:00.000Z"),
-          expiresAt: at("2026-05-21T10:00:00.000Z"),
-        })
-        await storage.magicLinks.create({
-          id: "ml_1",
-          projectId,
-          strategyId: "magic-link",
-          audience: "atlas",
-          email: "invited@acme.com",
-          tokenHash: "link-hash",
-          createdAt: at("2026-05-14T10:01:00.000Z"),
-          expiresAt: at("2026-05-14T10:16:00.000Z"),
-        })
-
-        const result = await storage.completeMagicLinkSignIn({
-          projectId,
-          magicLinkId: "ml_1",
-          tokenHash: "link-hash",
-          completedAt: at("2026-05-14T10:03:00.000Z"),
-          newUserId: "usr_invited",
-          requireNoActiveUsersForUserCreation: true,
-          session: sessionInput("ses_invited"),
-        })
-
-        expect(result.user).toMatchObject({
-          id: "usr_invited",
-          email: "invited@acme.com",
-        })
-        expect(result.invitation).toMatchObject({
-          id: "inv_1",
-          status: "accepted",
-        })
-      })
-    })
-
     test("consumes valid magic links when an existing user is suspended", async () => {
       await withStorage(async (storage) => {
         await createUser(storage, { status: "suspended" })
@@ -1867,7 +1810,6 @@ export function runAuthStorageContractSuite<TStorage extends AuthStorage>(
           completedAt: at("2026-05-14T10:02:00.000Z"),
           subject: "00u1",
           email: "renamed@acme.com",
-          emailVerified: true,
           claims: { email: "renamed@acme.com" },
           newUserId: "usr_unused",
           session: sessionInput("ses_oidc"),
@@ -1885,65 +1827,35 @@ export function runAuthStorageContractSuite<TStorage extends AuthStorage>(
       })
     })
 
-    test("auto-links OIDC by verified email only when explicitly allowed", async () => {
+    test("links a new OIDC identity to the existing user with its email", async () => {
       await withStorage(async (storage) => {
         await createUser(storage, { id: "usr_existing", email: "ava@acme.com" })
         await storage.oidcAuthorizationAttempts.create({
-          id: "oidc_blocked",
+          id: "oidc_1",
           projectId,
           strategyId: "okta",
           audience: "atlas",
-          stateHash: "blocked-state",
+          stateHash: "state-hash",
           nonceHash: "nonce-hash",
           codeVerifier: "verifier",
           createdAt: at("2026-05-14T10:00:00.000Z"),
           expiresAt: at("2026-05-14T10:10:00.000Z"),
         })
 
-        await expectAuthError(
-          storage.completeOidcSignIn({
-            projectId,
-            oidcAuthorizationAttemptId: "oidc_blocked",
-            stateHash: "blocked-state",
-            completedAt: at("2026-05-14T10:01:00.000Z"),
-            subject: "00u1",
-            email: "ava@acme.com",
-            emailVerified: false,
-            autoLinkByVerifiedEmail: true,
-            newUserId: "usr_unused",
-            session: sessionInput("ses_blocked"),
-          }),
-          "email_link_not_allowed"
-        )
-
-        await storage.oidcAuthorizationAttempts.create({
-          id: "oidc_allowed",
-          projectId,
-          strategyId: "okta",
-          audience: "atlas",
-          stateHash: "allowed-state",
-          nonceHash: "nonce-hash",
-          codeVerifier: "verifier",
-          createdAt: at("2026-05-14T10:02:00.000Z"),
-          expiresAt: at("2026-05-14T10:12:00.000Z"),
-        })
         const result = await storage.completeOidcSignIn({
           projectId,
-          oidcAuthorizationAttemptId: "oidc_allowed",
-          stateHash: "allowed-state",
-          completedAt: at("2026-05-14T10:03:00.000Z"),
+          oidcAuthorizationAttemptId: "oidc_1",
+          stateHash: "state-hash",
+          completedAt: at("2026-05-14T10:01:00.000Z"),
           subject: "00u1",
           email: "ava@acme.com",
-          emailVerified: true,
-          autoLinkByVerifiedEmail: true,
           newUserId: "usr_unused",
-          session: sessionInput("ses_allowed"),
+          session: sessionInput("ses_oidc"),
         })
 
         expect(result.user.id).toBe("usr_existing")
-        expect(result.identity).toMatchObject({
-          userId: "usr_existing",
-        })
+        expect(result.identity).toMatchObject({ subject: "00u1", userId: "usr_existing" })
+        await expect(storage.users.getById({ projectId, id: "usr_unused" })).resolves.toBeNull()
       })
     })
 
@@ -1977,7 +1889,6 @@ export function runAuthStorageContractSuite<TStorage extends AuthStorage>(
           subject: "00u1",
           email: "ava@acme.com",
           displayName: "Ava Chen",
-          emailVerified: true,
           newUserId: "usr_oidc",
           session: sessionInput("ses_oidc"),
         })
@@ -2024,7 +1935,6 @@ export function runAuthStorageContractSuite<TStorage extends AuthStorage>(
             completedAt: at("2026-05-14T10:01:00.000Z"),
             subject: "00u1",
             email: "ava@acme.com",
-            emailVerified: true,
             newUserId: "usr_oidc",
             session: sessionInput("ses_oidc"),
           }),
@@ -2036,7 +1946,7 @@ export function runAuthStorageContractSuite<TStorage extends AuthStorage>(
       })
     })
 
-    test("allows first OIDC bootstrap user creation with manual groups", async () => {
+    test("allows OIDC bootstrap user creation with manual groups", async () => {
       await withStorage(async (storage) => {
         await storage.oidcAuthorizationAttempts.create({
           id: "oidc_bootstrap",
@@ -2057,9 +1967,7 @@ export function runAuthStorageContractSuite<TStorage extends AuthStorage>(
           completedAt: at("2026-05-14T10:01:00.000Z"),
           subject: "00u1",
           email: "founder@acme.com",
-          emailVerified: true,
           allowUserCreationWithoutInvitation: true,
-          requireNoActiveUsersForUserCreation: true,
           manualGroupIds: ["security-admins"],
           newUserId: "usr_founder",
           session: sessionInput("ses_oidc_bootstrap"),
@@ -2075,6 +1983,72 @@ export function runAuthStorageContractSuite<TStorage extends AuthStorage>(
       })
     })
 
+    test("syncs directory memberships to exactly the groups the provider grants", async () => {
+      await withStorage(async (storage) => {
+        await createUser(storage)
+        for (const [groupId, source] of [
+          ["security-admins", "manual"],
+          ["commercial", "invitation"],
+          ["legacy-team", "directory"],
+        ] as const) {
+          await storage.groupMemberships.upsert({ projectId, userId: "usr_1", groupId, source })
+        }
+
+        await completeOidcSignInForAva(storage, ["security-admins", "field-ops"])
+
+        // legacy-team is no longer granted; security-admins keeps its manual source.
+        await expect(
+          storage.groupMemberships.listForUser({ projectId, userId: "usr_1" })
+        ).resolves.toMatchObject([
+          { groupId: "commercial", source: "invitation" },
+          { groupId: "field-ops", source: "directory" },
+          { groupId: "security-admins", source: "manual" },
+        ])
+      })
+    })
+
+    test("removes every directory membership when the provider grants no groups", async () => {
+      await withStorage(async (storage) => {
+        await createUser(storage)
+        await storage.groupMemberships.upsert({
+          projectId,
+          userId: "usr_1",
+          groupId: "security-admins",
+          source: "manual",
+        })
+        await storage.groupMemberships.upsert({
+          projectId,
+          userId: "usr_1",
+          groupId: "field-ops",
+          source: "directory",
+        })
+
+        await completeOidcSignInForAva(storage, [])
+
+        await expect(
+          storage.groupMemberships.listForUser({ projectId, userId: "usr_1" })
+        ).resolves.toMatchObject([{ groupId: "security-admins", source: "manual" }])
+      })
+    })
+
+    test("leaves directory memberships alone when sign-in syncs no groups", async () => {
+      await withStorage(async (storage) => {
+        await createUser(storage)
+        await storage.groupMemberships.upsert({
+          projectId,
+          userId: "usr_1",
+          groupId: "field-ops",
+          source: "directory",
+        })
+
+        await completeOidcSignInForAva(storage, undefined)
+
+        await expect(
+          storage.groupMemberships.listForUser({ projectId, userId: "usr_1" })
+        ).resolves.toMatchObject([{ groupId: "field-ops", source: "directory" }])
+      })
+    })
+
     test("suspends users and revokes active sessions immediately", async () => {
       await withStorage(async (storage) => {
         await createUser(storage)

package/src/testing/ontology-storage-contract.ts

@@ -410,38 +410,76 @@ export function runOntologyStorageContractSuite<TStorage extends OntologyStorage
             abandonedAt: "2026-01-01T00:03:00.000Z",
           })
         ).rejects.toMatchObject({ kind: "execution-lost" })
+        const adopted = await storage.ontology.sources.adopt({
+          projectId: "contract-project",
+          source,
+          execution: reclaimed.execution,
+          adoptedAt: "2026-01-01T00:01:30.000Z",
+        })
+        expect(adopted).toMatchObject({
+          record: {
+            materializationId: "staging-candidate",
+            status: "ready",
+            executionToken: reclaimed.execution.executionToken,
+            updatedAt: "2026-01-01T00:01:30.000Z",
+          },
+          resumeStagingOrdinal: 1,
+        })
+        // Adopting twice from the same execution is a no-op, not a second owner change.
+        expect(
+          await storage.ontology.sources.adopt({
+            projectId: "contract-project",
+            source,
+            execution: reclaimed.execution,
+            adoptedAt: "2026-01-01T00:01:40.000Z",
+          })
+        ).toMatchObject({ record: { executionToken: reclaimed.execution.executionToken } })
+
         const abandoned = await storage.ontology.sources.abandon({
-          kind: "reclaim",
+          kind: "run",
           projectId: "contract-project",
           source,
           execution: reclaimed.execution,
           abandonedAt: "2026-01-01T00:02:00.000Z",
         })
         expect(abandoned).toMatchObject({ status: "abandoned", executionToken: null })
+        expect(
+          await storage.ontology.sources.abandon({
+            kind: "run",
+            projectId: "contract-project",
+            source,
+            execution: reclaimed.execution,
+            abandonedAt: "2026-01-01T00:02:00.000Z",
+          })
+        ).toBeNull()
+        expect(
+          await storage.ontology.sources.adopt({
+            projectId: "contract-project",
+            source,
+            execution: reclaimed.execution,
+            adoptedAt: "2026-01-01T00:02:10.000Z",
+          })
+        ).toBeNull()
         expect(
           await storage.ontology.sources.summarizeTerminal({ projectId: "contract-project" })
         ).toEqual({ count: 1, oldestTerminalAt: "2026-01-01T00:02:00.000Z" })
 
+        // Superseded retention does not hold an abandoned candidate back.
         expect(
           await storage.ontology.sources.cleanupTerminal({
             projectId: "contract-project",
             terminalBefore: "2026-02-01T00:00:00.000Z",
-            limit: 1,
+            limit: 10,
           })
+        ).toEqual({ rowsDeleted: 0, materializationsDeleted: 0 })
+        expect(
+          await storage.ontology.sources.purgeAbandoned({ projectId: "contract-project", limit: 1 })
         ).toEqual({ rowsDeleted: 1, materializationsDeleted: 0 })
         expect(
-          await storage.ontology.sources.cleanupTerminal({
-            projectId: "contract-project",
-            terminalBefore: "2026-02-01T00:00:00.000Z",
-            limit: 1,
-          })
+          await storage.ontology.sources.purgeAbandoned({ projectId: "contract-project", limit: 1 })
         ).toEqual({ rowsDeleted: 1, materializationsDeleted: 0 })
         expect(
-          await storage.ontology.sources.cleanupTerminal({
-            projectId: "contract-project",
-            terminalBefore: "2026-02-01T00:00:00.000Z",
-            limit: 1,
-          })
+          await storage.ontology.sources.purgeAbandoned({ projectId: "contract-project", limit: 1 })
         ).toEqual({ rowsDeleted: 0, materializationsDeleted: 1 })
         expect(
           await storage.ontology.sources.summarizeTerminal({ projectId: "contract-project" })
@@ -449,6 +487,95 @@ export function runOntologyStorageContractSuite<TStorage extends OntologyStorage
       })
     })
 
+    test("adopts a staging candidate at its last staged root", async () => {
+      await withStorage(async (storage) => {
+        const identity = replacementIdentity("01")
+        const claimed = await startTestProjectionRun(storage, {
+          id: "resumed-run",
+          projectId: "contract-project",
+          identity,
+          target: { objectTypeId: "ContractDevice" },
+        })
+        const source = { projectionId: identity.projectionId }
+        await storage.ontology.sources.beginMaterialization({
+          projectId: "contract-project",
+          source,
+          materializationId: "resumed-candidate",
+          execution: claimed.execution,
+          projectionKind: "object",
+          protocol: "replacement",
+          datasetVersion: identity.datasetVersion,
+          projectionRevision: identity.projectionRevision,
+          ownershipHash: identity.ownershipHash,
+          ontologyRevision: identity.ontologyRevision,
+          createdAt: "2026-01-01T00:00:00.000Z",
+        })
+        const row = (primaryId: string, stagingOrdinal: number) => ({
+          root: { kind: "object" as const, ref: { objectTypeId: "ContractDevice", primaryId } },
+          assertion: {
+            kind: "object" as const,
+            ref: { objectTypeId: "ContractDevice", primaryId },
+            properties: { name: primaryId },
+          },
+          stagingOrdinal,
+        })
+        await storage.ontology.sources.stageRows({
+          projectId: "contract-project",
+          source,
+          materializationId: "resumed-candidate",
+          execution: claimed.execution,
+          rows: [row("zero", 0), row("one", 1)],
+        })
+
+        const reclaimed = await storage.projectionRuns.startOrReclaim({
+          id: claimed.run.id,
+          projectId: claimed.run.projectId,
+          identity,
+          target: { objectTypeId: "ContractDevice" },
+        })
+        const adopted = await storage.ontology.sources.adopt({
+          projectId: "contract-project",
+          source,
+          execution: reclaimed.execution,
+          adoptedAt: "2026-01-01T00:01:00.000Z",
+        })
+        expect(adopted).toMatchObject({
+          record: { status: "staging", executionToken: reclaimed.execution.executionToken },
+          resumeStagingOrdinal: 1,
+        })
+        // The previous execution lost the candidate with the run.
+        await expect(
+          storage.ontology.sources.stageRows({
+            projectId: "contract-project",
+            source,
+            materializationId: "resumed-candidate",
+            execution: claimed.execution,
+            rows: [row("two", 2)],
+          })
+        ).rejects.toMatchObject({ kind: "execution-lost" })
+        expect(
+          await storage.ontology.sources.stageRows({
+            projectId: "contract-project",
+            source,
+            materializationId: "resumed-candidate",
+            execution: reclaimed.execution,
+            rows: [row("one", 1), row("two", 2)],
+          })
+        ).toEqual({ inserted: 1, unchanged: 1 })
+        expect(
+          await storage.ontology.sources.markReady({
+            projectId: "contract-project",
+            source,
+            materializationId: "resumed-candidate",
+            execution: reclaimed.execution,
+            rootCount: 3,
+            assertionCount: 3,
+            readyAt: "2026-01-01T00:02:00.000Z",
+          })
+        ).toMatchObject({ status: "ready", rootCount: 3 })
+      })
+    })
+
     test("atomically activates explicit empty candidates and rejects competing stale heads", async () => {
       await withStorage(async (storage) => {
         const first = await createReadyEmptyCandidate(storage, "run-one", "candidate-one", "01")
@@ -532,16 +659,15 @@ export function runOntologyStorageContractSuite<TStorage extends OntologyStorage
           )
         ).rejects.toThrow("execution token is stale")
         await storage.ontology.sources.abandon({
-          kind: "reclaim",
+          kind: "run",
           projectId: "contract-project",
           source: stale.source,
           execution: reclaimed.execution,
           abandonedAt: "2026-01-06T00:01:00.000Z",
         })
 
-        const cleanup = await storage.ontology.sources.cleanupTerminal({
+        const cleanup = await storage.ontology.sources.purgeAbandoned({
           projectId: "contract-project",
-          terminalBefore: "2026-02-01T00:00:00.000Z",
           limit: 10,
         })
         expect(cleanup.materializationsDeleted).toBeGreaterThanOrEqual(1)