@starci/hfs 5.2.0 → 5.3.0

package/templates/be/auth-lite/src/features/api/auth/auth.module.ts

@@ -7,10 +7,15 @@ import { LogoutHandler } from "./application/logout.handler"
 import { GoogleBeginHandler } from "./application/google-begin.handler"
 import { GoogleCompleteHandler } from "./application/google-complete.handler"
 import { GetJwksHandler } from "./application/get-jwks.handler"
+import { SignupHandler } from "./application/signup.handler"
+import { ResendHandler } from "./application/resend.handler"
+import { ConfirmHandler } from "./application/confirm.handler"
+import { ForgotHandler } from "./application/forgot.handler"
+import { ResetHandler } from "./application/reset.handler"
 import { ConfigurableModuleClass } from "./auth.module-definition"
 
 @Module({
-    providers: [LoginHandler, RefreshHandler, SessionHandler, LogoutHandler, GoogleBeginHandler, GoogleCompleteHandler, GetJwksHandler],
+    providers: [LoginHandler, RefreshHandler, SessionHandler, LogoutHandler, GoogleBeginHandler, GoogleCompleteHandler, GetJwksHandler, SignupHandler, ResendHandler, ConfirmHandler, ForgotHandler, ResetHandler],
 })
 /** The auth feature: the handlers behind the sign-in doors. */
 export class AuthApiModule extends ConfigurableModuleClass {}

package/templates/be/auth-lite/src/features/api/auth/transport/http/auth-http.module-definition.ts

@@ -1,13 +1,6 @@
-// Managed by starci app sync (slot be.feature.auth); do not edit: run "npx starci app sync --execute".
-import { ConfigurableModuleBuilder, type ConfigurableModuleHost } from "@nestjs/common"
+import { defineConfigurableModule } from "@starci/nest-kit"
 import type { AuthHttpOptions } from "./auth-http.options"
 
-const built = new ConfigurableModuleBuilder<AuthHttpOptions>().setClassMethodName("register").build()
-type Host = ConfigurableModuleHost<AuthHttpOptions, "register", "create", {}>
-
 /** The configurable-module base of the auth-http module. */
-export const ConfigurableModuleClass: Host["ConfigurableModuleClass"] = built.ConfigurableModuleClass
-/** The injection token of the registered options. */
-export const MODULE_OPTIONS_TOKEN: Host["MODULE_OPTIONS_TOKEN"] = built.MODULE_OPTIONS_TOKEN
-/** The options of a synchronous registration, for the register signature. */
-export const OPTIONS_TYPE: Host["OPTIONS_TYPE"] = built.OPTIONS_TYPE
+export const { ConfigurableModuleClass, MODULE_OPTIONS_TOKEN, OPTIONS_TYPE } =
+    defineConfigurableModule<AuthHttpOptions>()

package/templates/be/auth-lite/src/features/api/auth/transport/http/auth.controller.ts

@@ -6,6 +6,11 @@ import { Public, PublicReason } from "@modules/domain/identity"
 import type { AccessGrant, GoogleRedirect, JwksDocument } from "@modules/integrations/passport"
 import { InjectCommandBus, InjectQueryBus } from "@modules/platform/cqrs"
 import { RateLimit, RateTier } from "@modules/platform/http-security"
+import { SignupCommand } from "../../application/signup.command"
+import { ResendCommand } from "../../application/resend.command"
+import { ConfirmCommand } from "../../application/confirm.command"
+import { ForgotCommand } from "../../application/forgot.command"
+import { ResetCommand } from "../../application/reset.command"
 import { GetJwksQuery } from "../../application/get-jwks.query"
 import { GoogleBeginCommand } from "../../application/google-begin.command"
 import { GoogleCompleteCommand } from "../../application/google-complete.command"
@@ -13,11 +18,16 @@ import { LoginCommand } from "../../application/login.command"
 import { LogoutCommand } from "../../application/logout.command"
 import { RefreshCommand } from "../../application/refresh.command"
 import { SessionCommand } from "../../application/session.command"
+import { ForgotRequest } from "./dto/forgot.request"
 import { GoogleStartRequest } from "./dto/google-start.request"
 import { LoginRequest } from "./dto/login.request"
+import { ResendRequest } from "./dto/resend.request"
+import { ResetRequest } from "./dto/reset.request"
+import { SignupRequest } from "./dto/signup.request"
+import { TokenRequest } from "./dto/token.request"
 
 @Controller("auth")
-/** The cookie doors of sign-in: email and password, Google, refresh, session, sign-out and the public keys. */
+/** The cookie doors of sign-in: email and password, the email doors (sign up, confirm, resend, forgot, reset), Google, refresh, session, sign-out and the public keys. */
 export class AuthController {
     constructor(
         @InjectCommandBus() private readonly commandBus: CommandBus,
@@ -80,6 +90,51 @@ export class AuthController {
         return this.commandBus.execute(new GoogleCompleteCommand({ request: { exchange: { req, res } } }))
     }
 
+    /** Creates an unconfirmed account and mails the confirmation link; always answers 204. */
+    @Post("signup")
+    @HttpCode(204)
+    @Public({ reason: PublicReason.AuthHandshake })
+    @RateLimit(RateTier.Strict)
+    signup(@Body() body: SignupRequest): Promise<void> {
+        return this.commandBus.execute(new SignupCommand({ request: { email: body.email, password: body.password, language: body.language } }))
+    }
+
+    /** Mails a new confirmation link; always answers 204. */
+    @Post("resend")
+    @HttpCode(204)
+    @Public({ reason: PublicReason.AuthHandshake })
+    @RateLimit(RateTier.Strict)
+    resend(@Body() body: ResendRequest): Promise<void> {
+        return this.commandBus.execute(new ResendCommand({ request: { email: body.email, language: body.language } }))
+    }
+
+    /** Spends a confirmation link; a spent, expired or unknown link is refused with IDENTITY_RESET_TOKEN_INVALID. */
+    @Post("confirm")
+    @HttpCode(204)
+    @Public({ reason: PublicReason.AuthHandshake })
+    @RateLimit(RateTier.Strict)
+    confirm(@Body() body: TokenRequest): Promise<void> {
+        return this.commandBus.execute(new ConfirmCommand({ request: { token: body.token } }))
+    }
+
+    /** Mails a password reset link when the address has an account; always answers 204. */
+    @Post("forgot")
+    @HttpCode(204)
+    @Public({ reason: PublicReason.AuthHandshake })
+    @RateLimit(RateTier.Strict)
+    forgot(@Body() body: ForgotRequest): Promise<void> {
+        return this.commandBus.execute(new ForgotCommand({ request: { email: body.email, language: body.language } }))
+    }
+
+    /** Spends a reset link and sets the new password; every session of the person ends. */
+    @Post("reset")
+    @HttpCode(204)
+    @Public({ reason: PublicReason.AuthHandshake })
+    @RateLimit(RateTier.Strict)
+    reset(@Body() body: ResetRequest): Promise<void> {
+        return this.commandBus.execute(new ResetCommand({ request: { token: body.token, password: body.password } }))
+    }
+
     /** The public keys access tokens verify against. */
     @Get("jwks")
     @Public({ reason: PublicReason.AuthHandshake })

package/templates/be/auth-lite/src/features/api/auth/transport/http/dto/forgot.request.ts

@@ -0,0 +1,16 @@
+// Managed by starci app sync (slot be.feature.auth); do not edit: run "npx starci app sync --execute".
+import { IsEmail, IsIn, IsOptional, MaxLength } from "class-validator"
+import type { MailLanguage } from "@modules/integrations/mail"
+
+/** The posted address of a password reset request. */
+export class ForgotRequest {
+    /** The sign-in address. */
+    @IsEmail()
+    @MaxLength(254)
+    email!: string
+
+    /** The language of the mail; the app's default when left out. */
+    @IsOptional()
+    @IsIn(["vi", "en"])
+    language?: MailLanguage
+}

package/templates/be/auth-lite/src/features/api/auth/transport/http/dto/resend.request.ts

@@ -0,0 +1,16 @@
+// Managed by starci app sync (slot be.feature.auth); do not edit: run "npx starci app sync --execute".
+import { IsEmail, IsIn, IsOptional, MaxLength } from "class-validator"
+import type { MailLanguage } from "@modules/integrations/mail"
+
+/** The posted address of a resend. */
+export class ResendRequest {
+    /** The sign-in address. */
+    @IsEmail()
+    @MaxLength(254)
+    email!: string
+
+    /** The language of the mail; the app's default when left out. */
+    @IsOptional()
+    @IsIn(["vi", "en"])
+    language?: MailLanguage
+}

package/templates/be/auth-lite/src/features/api/auth/transport/http/dto/reset.request.ts

@@ -0,0 +1,18 @@
+// Managed by starci app sync (slot be.feature.auth); do not edit: run "npx starci app sync --execute".
+import { IsString, MaxLength, MinLength } from "class-validator"
+
+/** The posted link token and new password. */
+export class ResetRequest {
+    /** The token the link carries. */
+    @IsString()
+    @MinLength(16)
+    @MaxLength(256)
+    token!: string
+
+    /** The new password. */
+    @IsString()
+    @MinLength(1)
+    @MaxLength(128)
+    password!: string
+
+}

package/templates/be/auth-lite/src/features/api/auth/transport/http/dto/signup.request.ts

@@ -0,0 +1,22 @@
+// Managed by starci app sync (slot be.feature.auth); do not edit: run "npx starci app sync --execute".
+import { IsEmail, IsIn, IsOptional, IsString, MaxLength, MinLength } from "class-validator"
+import type { MailLanguage } from "@modules/integrations/mail"
+
+/** The posted sign-up data. */
+export class SignupRequest {
+    /** The sign-in address. */
+    @IsEmail()
+    @MaxLength(254)
+    email!: string
+
+    /** The password. */
+    @IsString()
+    @MinLength(1)
+    @MaxLength(128)
+    password!: string
+
+    /** The language of the mail; the app's default when left out. */
+    @IsOptional()
+    @IsIn(["vi", "en"])
+    language?: MailLanguage
+}

package/templates/be/auth-lite/src/features/api/auth/transport/http/dto/token.request.ts

@@ -0,0 +1,11 @@
+// Managed by starci app sync (slot be.feature.auth); do not edit: run "npx starci app sync --execute".
+import { IsString, MaxLength, MinLength } from "class-validator"
+
+/** The posted link token. */
+export class TokenRequest {
+    /** The token the link carries. */
+    @IsString()
+    @MinLength(16)
+    @MaxLength(256)
+    token!: string
+}

package/templates/be/auth-lite/src/modules/domain/identity/account-directory.service.spec.ts

@@ -1,46 +1,46 @@
 // Managed by starci app sync (slot be.identity.sign-in); do not edit: run "npx starci app sync --execute".
 import "reflect-metadata"
 import { Test } from "@nestjs/testing"
-import { FakeClock, mockEntityManager } from "@starci/jest-preset"
-import { CLOCK } from "@modules/platform/clock"
+import { mockEntityManager } from "@starci/jest-preset"
 import { PRIMARY_ENTITY_MANAGER } from "@modules/platform/database"
-import { authUserRow as user } from "@tests/fixtures/builders/identity.builder"
-import { AuthUserEntity } from "./persistence/entities"
-import { IdentityAccountDirectoryService, isDisabled } from "./account-directory.service"
+import { accountByIdRow } from "@tests/fixtures/builders/identity.builder"
+import { IdentityAccountDirectoryService } from "./account-directory.service"
 
-const AT = "2026-02-03T04:05:06.000Z"
+const USER_BY_ID = 'SELECT * FROM "public"."be_auth_user_by_id"($1)'
 
-const build = async (rows: ReadonlyArray<AuthUserEntity | null>) => {
-    const entityManager = mockEntityManager({ findOne: rows.map((result) => [AuthUserEntity, result] as const) })
+const build = async (rows: unknown) => {
+    const entityManager = mockEntityManager({ query: [USER_BY_ID, rows] })
     const moduleRef = await Test.createTestingModule({
-        providers: [
-            IdentityAccountDirectoryService,
-            { provide: PRIMARY_ENTITY_MANAGER, useValue: entityManager },
-            { provide: CLOCK, useValue: new FakeClock(AT) },
-        ],
+        providers: [IdentityAccountDirectoryService, { provide: PRIMARY_ENTITY_MANAGER, useValue: entityManager }],
     }).compile()
-    return moduleRef.get(IdentityAccountDirectoryService)
+    return { directory: moduleRef.get(IdentityAccountDirectoryService), entityManager }
 }
 
 describe("IdentityAccountDirectoryService.find", () => {
-    it("answers the standing of a live account, a banned one, a deleted one and a missing one", async () => {
-        const subject = await build([user("live"), user("banned"), user("ban-ended"), user("deleted"), null])
-
-        expect(await subject.find("u-1")).toEqual({ id: "u-1", email: "a@example.test", disabled: false })
-        expect((await subject.find("u-1"))?.disabled).toBe(true)
-        expect((await subject.find("u-1"))?.disabled).toBe(false)
-        expect((await subject.find("u-1"))?.disabled).toBe(true)
-        expect(await subject.find("u-2")).toBeUndefined()
+    it("answers the standing of a live account through the door", async () => {
+        const { directory, entityManager } = await build([accountByIdRow("live")])
+
+        expect(await directory.find("u-1")).toEqual({ id: "u-1", email: "a@example.test", disabled: false })
+        expect(entityManager.query).toHaveBeenCalledWith(USER_BY_ID, ["u-1"])
+    })
+
+    it("answers a disabled account as disabled, and an account without an address with none", async () => {
+        const banned = await build([accountByIdRow("disabled")])
+        const addressless = await build([accountByIdRow("addressless")])
+
+        expect((await banned.directory.find("u-1"))?.disabled).toBe(true)
+        expect(await addressless.directory.find("u-1")).toEqual({ id: "u-1", email: null, disabled: false })
+    })
+
+    it("answers undefined for an account that does not exist", async () => {
+        const { directory } = await build([])
+
+        expect(await directory.find("u-2")).toBeUndefined()
     })
-})
 
-describe("isDisabled", () => {
-    it("is true for a deleted account and for a ban that has not ended", () => {
-        const now = new Date(AT)
+    it("refuses a door answer that is not the account shape", async () => {
+        const { directory } = await build([{ id: "u-1", email: "a@example.test", disabled: "no" }])
 
-        expect(isDisabled(user("deleted"), now)).toBe(true)
-        expect(isDisabled(user("banned"), now)).toBe(true)
-        expect(isDisabled(user("ban-ended"), now)).toBe(false)
-        expect(isDisabled(user("live"), now)).toBe(false)
+        await expect(directory.find("u-1")).rejects.toMatchObject({ code: "DATABASE_RETURNING_ROW_REJECTED" })
     })
 })

package/templates/be/auth-lite/src/modules/domain/identity/account-directory.service.ts

@@ -2,27 +2,18 @@
 import { Injectable } from "@nestjs/common"
 import type { EntityManager } from "typeorm"
 import type { AccountDirectory, AccountStanding } from "@modules/integrations/passport"
-import { InjectClock } from "@modules/platform/clock"
-import type { Clock } from "@modules/platform/clock"
 import { InjectPrimaryEntityManager } from "@modules/platform/database"
-import { AuthUserEntity } from "./persistence/entities"
-
-/** True when the account is deleted or banned at this instant. */
-export const isDisabled = (user: AuthUserEntity, now: Date): boolean =>
-    user.deletedAt !== null || (user.bannedUntil !== null && user.bannedUntil > now)
+import { accountDoors } from "./persistence/account-doors.port"
 
 @Injectable()
-/** The package's account directory over auth.users: whether an account still stands, for a refresh to go on. */
+/** The package's account directory over the account doors: whether an account still stands, for a refresh to go on. */
 export class IdentityAccountDirectoryService implements AccountDirectory {
-    constructor(
-        @InjectPrimaryEntityManager() private readonly entityManager: EntityManager,
-        @InjectClock() private readonly clock: Clock,
-    ) {}
+    constructor(@InjectPrimaryEntityManager() private readonly entityManager: EntityManager) {}
 
-    /** The standing of one account, or undefined when it does not exist. */
+    /** The standing of one account (disabled is decided by the database clock), or undefined when it does not exist. */
     async find(userId: string): Promise<AccountStanding | undefined> {
-        const user = await this.entityManager.findOne(AuthUserEntity, { where: { id: userId } })
-        if (user === null) return undefined
-        return { id: user.id, email: user.email, disabled: isDisabled(user, this.clock.now()) }
+        const account = await accountDoors.userById(this.entityManager, userId)
+        if (account === undefined) return undefined
+        return { id: account.id, email: account.email, disabled: account.disabled }
     }
 }

package/templates/be/auth-lite/src/modules/domain/identity/authenticator.service.spec.ts

@@ -8,16 +8,25 @@ import type { AuthPasswords, GoogleProfile, SignInBudget } from "@modules/integr
 import { CLOCK } from "@modules/platform/clock"
 import { PRIMARY_ENTITY_MANAGER } from "@modules/platform/database"
 import { IDS } from "@modules/platform/ids"
+import { LOGGER } from "@modules/platform/logging"
+import type { Logger } from "@modules/platform/logging"
 import { IdentityError, IdentityErrorCode } from "./errors/identity.error"
 import { IDENTITY_AUTH_PASSWORDS, IDENTITY_SIGN_IN_BUDGET } from "./identity.decorators"
-import { authUserRow as user } from "@tests/fixtures/builders/identity.builder"
+import { IdentitySignInLogEvent } from "./identity-sign-in.log-events"
+import { accountByEmailRow, accountByIdRow } from "@tests/fixtures/builders/identity.builder"
 import { IdentityAuthenticatorService } from "./authenticator.service"
-import { AuthIdentityEntity, AuthUserEntity } from "./persistence/entities"
+
+/** The statements callDbFunction sends for the account doors. */
+const USER_BY_EMAIL = 'SELECT * FROM "public"."be_auth_user_by_email"($1)'
+const USER_BY_ID = 'SELECT * FROM "public"."be_auth_user_by_id"($1)'
+const USER_BY_GOOGLE = 'SELECT * FROM "public"."be_auth_user_by_google"($1)'
+const CREATE_USER = 'SELECT * FROM "public"."be_auth_create_user"($1, $2, $3, $4, $5, $6)'
+const LINK_GOOGLE = 'SELECT * FROM "public"."be_auth_link_google"($1, $2, $3, $4)'
+const TOUCH_USER = 'SELECT * FROM "public"."be_auth_touch_user"($1, $2, $3, $4)'
 
 const NEW_ID = "00000000-0000-4000-8000-000000000001"
 const AT = "2026-02-03T04:05:06.000Z"
 const NOW = new Date(AT)
-const BEFORE = new Date("2026-02-03T04:00:00.000Z")
 
 const profile = (patch: Partial<GoogleProfile> = {}): GoogleProfile => ({
     subject: "g-1",
@@ -28,11 +37,16 @@ const profile = (patch: Partial<GoogleProfile> = {}): GoogleProfile => ({
     ...patch,
 })
 
-const build = async (entityManager: MockEntityManager, matches = true) => {
+type Stubs = ReadonlyArray<readonly [string, unknown]>
+
+const build = async (answers: Stubs, matches = true) => {
+    const entityManager: MockEntityManager = answers.length === 0 ? mockEntityManager() : mockEntityManager({ query: answers })
+    fakeTransaction(entityManager)
     const passwords = mock<AuthPasswords>()
     passwords.verify.mockResolvedValue(matches)
     const budget = mock<SignInBudget>()
     budget.counted.mockImplementation(async (_kind, _address, check) => (await check()).value)
+    const logger = mock<Logger>()
     const moduleRef = await Test.createTestingModule({
         providers: [
             IdentityAuthenticatorService,
@@ -41,105 +55,155 @@ const build = async (entityManager: MockEntityManager, matches = true) => {
             { provide: IDENTITY_SIGN_IN_BUDGET, useValue: budget },
             { provide: CLOCK, useValue: new FakeClock(AT) },
             { provide: IDS, useValue: fakeIds() },
+            { provide: LOGGER, useValue: logger },
         ],
     }).compile()
-    return { subject: moduleRef.get(IdentityAuthenticatorService), passwords, budget }
+    return { subject: moduleRef.get(IdentityAuthenticatorService), entityManager, passwords, budget, logger }
 }
 
 const refusal = (code: string): unknown => expect.objectContaining({ code })
 
 describe("IdentityAuthenticatorService.verifyPassword", () => {
-    it("answers the person of a right pair, normalising the address, and records the sign-in", async () => {
-        const entityManager = mockEntityManager({ findOne: [AuthUserEntity, user()], update: [AuthUserEntity, {}] })
-        const { subject, passwords, budget } = await build(entityManager)
+    it("answers the person of a right pair, normalising the address, and records the sign-in through the door", async () => {
+        const { subject, entityManager, passwords, budget } = await build([
+            [USER_BY_EMAIL, [accountByEmailRow()]],
+            [TOUCH_USER, []],
+        ])
 
         expect(await subject.verifyPassword("  A@Example.test ", "correct horse")).toEqual({ userId: "u-1", email: "a@example.test" })
 
         expect(budget.counted).toHaveBeenCalledWith("login", "a@example.test", expect.any(Function))
         expect(passwords.verify).toHaveBeenCalledWith("correct horse", "hash")
-        expect(entityManager.update).toHaveBeenCalledWith(AuthUserEntity, { id: "u-1" }, { lastSignInAt: NOW })
+        expect(entityManager.query).toHaveBeenCalledWith(USER_BY_EMAIL, ["a@example.test"])
+        expect(entityManager.query).toHaveBeenCalledWith(TOUCH_USER, ["u-1", NOW, false, "{}"])
     })
 
     it("refuses an unknown address and a wrong password with the same code, and still spends the check on a decoy", async () => {
-        const unknown = await build(mockEntityManager({ findOne: [AuthUserEntity, null] }))
-        const wrong = await build(mockEntityManager({ findOne: [AuthUserEntity, user()] }), false)
+        const unknown = await build([[USER_BY_EMAIL, []]])
+        const wrong = await build([[USER_BY_EMAIL, [accountByEmailRow()]]], false)
 
         await expect(unknown.subject.verifyPassword("a@example.test", "pw")).rejects.toEqual(refusal(IdentityErrorCode.PairRefused))
         await expect(wrong.subject.verifyPassword("a@example.test", "pw")).rejects.toBeInstanceOf(IdentityError)
         expect(unknown.passwords.verify).toHaveBeenCalledWith("pw", "")
+        expect(wrong.entityManager.query).not.toHaveBeenCalledWith(TOUCH_USER, expect.anything())
     })
 
     it("compares an empty password for one bcrypt cannot read, an account without a hash against the decoy", async () => {
-        const { subject, passwords } = await build(mockEntityManager({ findOne: [AuthUserEntity, user("passwordless")] }), false)
+        const { subject, passwords } = await build([[USER_BY_EMAIL, [accountByEmailRow("passwordless")]]], false)
 
         await expect(subject.verifyPassword("a@example.test", "x".repeat(100))).rejects.toBeInstanceOf(IdentityError)
 
         expect(passwords.verify).toHaveBeenCalledWith("", "")
     })
 
-    it("refuses a banned or deleted account and an unconfirmed one after the password was right", async () => {
-        const banned = await build(mockEntityManager({ findOne: [AuthUserEntity, user("banned")] }))
-        const unconfirmed = await build(mockEntityManager({ findOne: [AuthUserEntity, user("unconfirmed")] }))
-        const addressless = await build(mockEntityManager({ findOne: [AuthUserEntity, user("addressless")] }))
+    it("refuses a disabled account and an unconfirmed one after the password was right, recording no sign-in", async () => {
+        const disabled = await build([[USER_BY_EMAIL, [accountByEmailRow("disabled")]]])
+        const unconfirmed = await build([[USER_BY_EMAIL, [accountByEmailRow("unconfirmed")]]])
 
-        await expect(banned.subject.verifyPassword("a@example.test", "pw")).rejects.toEqual(refusal(IdentityErrorCode.AccountDisabled))
+        await expect(disabled.subject.verifyPassword("a@example.test", "pw")).rejects.toEqual(refusal(IdentityErrorCode.AccountDisabled))
         await expect(unconfirmed.subject.verifyPassword("a@example.test", "pw")).rejects.toEqual(refusal(IdentityErrorCode.EmailNotConfirmed))
-        await expect(addressless.subject.verifyPassword("a@example.test", "pw")).rejects.toEqual(refusal(IdentityErrorCode.EmailNotConfirmed))
+        expect(disabled.entityManager.query).not.toHaveBeenCalledWith(TOUCH_USER, expect.anything())
+        expect(unconfirmed.entityManager.query).not.toHaveBeenCalledWith(TOUCH_USER, expect.anything())
     })
 })
 
 describe("IdentityAuthenticatorService.signInWithGoogle", () => {
-    it("refuses a profile without a verified address", async () => {
-        const { subject } = await build(mockEntityManager())
+    it("refuses a profile without a verified address, and calls no door", async () => {
+        const { subject, entityManager } = await build([])
 
         await expect(subject.signInWithGoogle(profile({ emailVerified: false }))).rejects.toEqual(refusal(PassportErrorCode.GoogleRejected))
         await expect(subject.signInWithGoogle(profile({ email: null }))).rejects.toEqual(refusal(PassportErrorCode.GoogleRejected))
+        expect(entityManager.query).not.toHaveBeenCalled()
     })
 
-    it("signs in the account a Google subject is already linked to", async () => {
-        const linked: AuthIdentityEntity = { id: "i-1", providerId: "g-1", userId: "u-1", identityData: {}, provider: "google", lastSignInAt: null, createdAt: BEFORE, updatedAt: BEFORE }
-        const entityManager = mockEntityManager({ findOne: [[AuthIdentityEntity, linked], [AuthUserEntity, user("unconfirmed")]], update: [AuthUserEntity, {}] })
-        fakeTransaction(entityManager)
-        const { subject } = await build(entityManager)
+    it("signs in the account a Google subject is already linked to, confirming its mailbox", async () => {
+        const { subject, entityManager } = await build([
+            [USER_BY_GOOGLE, [{ be_auth_user_by_google: "u-1" }]],
+            [LINK_GOOGLE, []],
+            [TOUCH_USER, []],
+            [USER_BY_ID, [accountByIdRow()]],
+        ])
 
         expect(await subject.signInWithGoogle(profile())).toEqual({ userId: "u-1", email: "a@example.test" })
 
-        expect(entityManager.insert).not.toHaveBeenCalled()
-        expect(entityManager.update).toHaveBeenCalledWith(AuthUserEntity, { id: "u-1" }, { lastSignInAt: NOW, emailConfirmedAt: NOW })
+        expect(entityManager.query).not.toHaveBeenCalledWith(USER_BY_EMAIL, expect.anything())
+        expect(entityManager.query).not.toHaveBeenCalledWith(CREATE_USER, expect.anything())
+        expect(entityManager.query).toHaveBeenCalledWith(TOUCH_USER, ["u-1", NOW, true, expect.stringContaining('"full_name":"A"')])
     })
 
-    it("links an existing account by its verified address and keeps its confirmation date", async () => {
-        const entityManager = mockEntityManager({ findOne: [[AuthIdentityEntity, null], [AuthUserEntity, user()]], insert: [AuthIdentityEntity, {}], update: [AuthUserEntity, {}] })
-        fakeTransaction(entityManager)
-        const { subject } = await build(entityManager)
+    it("links an existing account by its verified address", async () => {
+        const { subject, entityManager } = await build([
+            [USER_BY_GOOGLE, [{ be_auth_user_by_google: null }]],
+            [USER_BY_EMAIL, [accountByEmailRow()]],
+            [LINK_GOOGLE, []],
+            [TOUCH_USER, []],
+            [USER_BY_ID, [accountByIdRow()]],
+        ])
 
         expect(await subject.signInWithGoogle(profile())).toEqual({ userId: "u-1", email: "a@example.test" })
 
-        expect(entityManager.insert).toHaveBeenCalledWith(AuthIdentityEntity, expect.objectContaining({ id: NEW_ID, providerId: "g-1", userId: "u-1", provider: "google" }))
-        expect(entityManager.update).toHaveBeenCalledWith(AuthUserEntity, { id: "u-1" }, { lastSignInAt: NOW, emailConfirmedAt: BEFORE })
+        expect(entityManager.query).toHaveBeenCalledWith(USER_BY_EMAIL, ["a@example.test"])
+        expect(entityManager.query).toHaveBeenCalledWith(LINK_GOOGLE, ["u-1", "g-1", expect.stringContaining('"sub":"g-1"'), NOW])
+        expect(entityManager.query).not.toHaveBeenCalledWith(CREATE_USER, expect.anything())
     })
 
-    it("creates the account of a new person and links their Google identity", async () => {
-        const entityManager = mockEntityManager({
-            findOne: [[AuthIdentityEntity, null], [AuthUserEntity, null], [AuthUserEntity, user("created")]],
-            insert: [[AuthUserEntity, {}], [AuthIdentityEntity, {}]],
-            update: [AuthUserEntity, {}],
-        })
-        fakeTransaction(entityManager)
-        const { subject } = await build(entityManager)
+})
+
+describe("IdentityAuthenticatorService.signInWithGoogle (new accounts and refusals)", () => {
+    it("creates the account of a new person, links their Google identity and logs the id alone", async () => {
+        const { subject, entityManager, logger } = await build([
+            [USER_BY_GOOGLE, [{ be_auth_user_by_google: null }]],
+            [USER_BY_EMAIL, []],
+            [CREATE_USER, [{ be_auth_create_user: NEW_ID }]],
+            [LINK_GOOGLE, []],
+            [TOUCH_USER, []],
+            [USER_BY_ID, [accountByIdRow("live", NEW_ID)]],
+        ])
 
         expect(await subject.signInWithGoogle(profile())).toEqual({ userId: NEW_ID, email: "a@example.test" })
 
-        expect(entityManager.insert).toHaveBeenCalledWith(AuthUserEntity, expect.objectContaining({ id: NEW_ID, email: "a@example.test", encryptedPassword: null, emailConfirmedAt: NOW }))
+        expect(entityManager.query).toHaveBeenCalledWith(CREATE_USER, [NEW_ID, "a@example.test", null, true, expect.stringContaining('"full_name":"A"'), NOW])
+        expect(entityManager.query).toHaveBeenCalledWith(LINK_GOOGLE, [NEW_ID, "g-1", expect.stringContaining("g-1"), NOW])
+        expect(logger.info).toHaveBeenCalledWith(IdentitySignInLogEvent.AccountCreated, { userId: NEW_ID })
     })
 
-    it("refuses a disabled account and an account that cannot be read back", async () => {
-        const disabled = mockEntityManager({ findOne: [[AuthIdentityEntity, null], [AuthUserEntity, user("deleted")]], insert: [AuthIdentityEntity, {}], update: [AuthUserEntity, {}] })
-        fakeTransaction(disabled)
-        const missing = mockEntityManager({ findOne: [[AuthIdentityEntity, null], [AuthUserEntity, null]], insert: [[AuthUserEntity, {}], [AuthIdentityEntity, {}]], update: [AuthUserEntity, {}] })
-        fakeTransaction(missing)
+    it("fills only the profile keys the Google profile has", async () => {
+        const { subject, entityManager } = await build([
+            [USER_BY_GOOGLE, [{ be_auth_user_by_google: "u-1" }]],
+            [LINK_GOOGLE, []],
+            [TOUCH_USER, []],
+            [USER_BY_ID, [accountByIdRow()]],
+        ])
+
+        await subject.signInWithGoogle(profile({ name: null, picture: "https://img.example.test/a.png" }))
 
-        await expect((await build(disabled)).subject.signInWithGoogle(profile())).rejects.toEqual(refusal(IdentityErrorCode.AccountDisabled))
-        await expect((await build(missing)).subject.signInWithGoogle(profile())).rejects.toEqual(refusal(PassportErrorCode.GoogleRejected))
+        const keys = { avatar_url: "https://img.example.test/a.png", picture: "https://img.example.test/a.png", email: "A@Example.test", email_verified: true }
+        expect(entityManager.query).toHaveBeenCalledWith(TOUCH_USER, ["u-1", NOW, true, JSON.stringify(keys)])
+    })
+
+    it("refuses when the create door answers no account", async () => {
+        const { subject, entityManager } = await build([
+            [USER_BY_GOOGLE, [{ be_auth_user_by_google: null }]],
+            [USER_BY_EMAIL, []],
+            [CREATE_USER, []],
+        ])
+
+        await expect(subject.signInWithGoogle(profile())).rejects.toEqual(refusal(PassportErrorCode.GoogleRejected))
+        expect(entityManager.query).not.toHaveBeenCalledWith(LINK_GOOGLE, expect.anything())
+    })
+
+    it("refuses a disabled account and an account that cannot be read back", async () => {
+        const linked: Stubs = [
+            [USER_BY_GOOGLE, [{ be_auth_user_by_google: "u-1" }]],
+            [LINK_GOOGLE, []],
+            [TOUCH_USER, []],
+        ]
+        const disabled = await build([...linked, [USER_BY_ID, [accountByIdRow("disabled")]]])
+        const gone = await build([...linked, [USER_BY_ID, []]])
+        const addressless = await build([...linked, [USER_BY_ID, [accountByIdRow("addressless")]]])
+
+        await expect(disabled.subject.signInWithGoogle(profile())).rejects.toEqual(refusal(IdentityErrorCode.AccountDisabled))
+        await expect(gone.subject.signInWithGoogle(profile())).rejects.toEqual(refusal(PassportErrorCode.GoogleRejected))
+        await expect(addressless.subject.signInWithGoogle(profile())).rejects.toEqual(refusal(PassportErrorCode.GoogleRejected))
     })
 })