@stigmer/server 3.14.1 → 3.15.0

package/src/domain/identityaccount/__tests__/provisioning.test.ts

@@ -0,0 +1,281 @@
+/**
+ * Pins direct-account self-provisioning (provisioning.ts), the cloud's
+ * `provisionDirectAccount` flow (its iam/account/provisioning.ts header,
+ * steps 1 to 3) as OSS core, over a fake IdentityAccountStore and an
+ * injected UserInfoClient — no network, no store driver:
+ *
+ *   1. idempotent early return when the subject already has an account
+ *      (no create, no userinfo call);
+ *   2. the profile comes from the userinfo endpoint of the ISSUER THAT
+ *      VOUCHED for the token (caller.issuer; T01_1_review.md A8), fetched
+ *      with the caller's own access token, for every token-bearing caller
+ *      — the cloud's posture, one path, given_name/family_name as the IdP
+ *      states them (a claims shortcut that split `name` into two would be
+ *      guesswork; recorded in T01_3_execution.md). A caller with no issuer
+ *      never dials out: its profile is what the CallerIdentity carries;
+ *   3. create through the ONE create path the domain owns (the same path
+ *      the create RPC's chain runs, so the tuple lifecycle and the
+ *      provisioning slot fire for both); a first-login race resolves the
+ *      winner by subject whatever the failure's shape.
+ *
+ * Step 4 of the cloud's flow (the personal organization) is not core: it
+ * fires on `identity-account-provision:post-persist` in the composition.
+ */
+import { create } from "@bufbuild/protobuf";
+import { describe, expect, it } from "vitest";
+
+import type { IdentityAccount } from "@stigmer/protos/ai/stigmer/iam/identityaccount/v1/api_pb";
+import { IdentityAccountSchema } from "@stigmer/protos/ai/stigmer/iam/identityaccount/v1/api_pb";
+import { IdentityAccountProvisioningMode } from "@stigmer/protos/ai/stigmer/iam/identityaccount/v1/enum_pb";
+
+import type { CallerIdentity } from "../../../extensions/identity.js";
+import { accountIdFor } from "../constants.js";
+import {
+  UserInfoFetchError,
+  newDirectAccountProvisioner,
+} from "../provisioning.js";
+import type {
+  CreateAccountInput,
+  UserInfoClient,
+  UserProfile,
+} from "../provisioning.js";
+import type { IdentityAccountStore } from "../store.js";
+import { fakeIdentityAccountStore as fakeAccounts } from "./support.js";
+
+/** The one create path, as the test sees it: derive, save, return. */
+function fakeCreatePath(accounts: IdentityAccountStore) {
+  const calls: CreateAccountInput[] = [];
+  return {
+    calls,
+    async createAccount(
+      input: CreateAccountInput,
+      _caller: CallerIdentity,
+    ): Promise<IdentityAccount> {
+      calls.push(input);
+      const account = create(IdentityAccountSchema, {
+        apiVersion: "iam.stigmer.ai/v1",
+        kind: "IdentityAccount",
+        metadata: { id: accountIdFor(input.spec.idpId), name: input.name },
+        spec: input.spec,
+      });
+      await accounts.save(account);
+      return account;
+    },
+  };
+}
+
+/** Records every `[issuer, token]` the provisioner asks about. */
+function fakeUserInfo(
+  profile: UserProfile | Error,
+): UserInfoClient & { calls: Array<[string, string]>; tokens: string[] } {
+  const calls: Array<[string, string]> = [];
+  return {
+    calls,
+    get tokens() {
+      return calls.map(([, token]) => token);
+    },
+    async fetchUserProfile(issuer, accessToken) {
+      calls.push([issuer, accessToken]);
+      if (profile instanceof Error) throw profile;
+      return profile;
+    },
+  };
+}
+
+const PROFILE: UserProfile = {
+  email: "alice@example.com",
+  firstName: "Alice",
+  lastName: "Liddell",
+  pictureUrl: "https://img.example/alice.png",
+};
+
+function oidcCaller(sub: string): CallerIdentity {
+  return {
+    identityId: sub,
+    callerClass: "user",
+    issuer: "https://issuer.test",
+    rawToken: `token-for-${sub}`,
+  };
+}
+
+const operatorCaller: CallerIdentity = {
+  identityId: "operator@example.com",
+  callerClass: "user",
+  issuer: "",
+  rawToken: "",
+  email: "operator@example.com",
+  displayName: "The Operator",
+};
+
+describe("provisionDirectAccount", () => {
+  it("returns the existing account for a held subject without creating or dialling out", async () => {
+    const accounts = fakeAccounts();
+    const path = fakeCreatePath(accounts);
+    const userInfo = fakeUserInfo(PROFILE);
+    const provisioner = newDirectAccountProvisioner({
+      accounts,
+      createAccount: path.createAccount,
+      userInfo,
+    });
+    const first = await provisioner.provisionDirectAccount(
+      "auth0|alice",
+      oidcCaller("auth0|alice"),
+    );
+    const second = await provisioner.provisionDirectAccount(
+      "auth0|alice",
+      oidcCaller("auth0|alice"),
+    );
+
+    expect(second).toEqual(first);
+    expect(path.calls).toHaveLength(1);
+    expect(userInfo.tokens).toEqual(["token-for-auth0|alice"]);
+  });
+
+  it("a token-bearing caller's profile comes from the vouching issuer's userinfo with the caller's own token", async () => {
+    const accounts = fakeAccounts();
+    const path = fakeCreatePath(accounts);
+    const userInfo = fakeUserInfo(PROFILE);
+    const provisioner = newDirectAccountProvisioner({
+      accounts,
+      createAccount: path.createAccount,
+      userInfo,
+    });
+    const account = await provisioner.provisionDirectAccount(
+      "auth0|alice",
+      oidcCaller("auth0|alice"),
+    );
+
+    expect(userInfo.calls).toEqual([
+      ["https://issuer.test", "token-for-auth0|alice"],
+    ]);
+    expect(account.metadata?.id).toBe(accountIdFor("auth0|alice"));
+    expect(account.metadata?.name).toBe("alice@example.com");
+    expect(account.spec).toMatchObject({
+      idpId: "auth0|alice",
+      email: "alice@example.com",
+      firstName: "Alice",
+      lastName: "Liddell",
+      pictureUrl: "https://img.example/alice.png",
+      provisioningMode: IdentityAccountProvisioningMode.direct,
+      isMachineAccount: false,
+    });
+  });
+
+  it("a userinfo failure is UserInfoFetchError (the handler's UNAVAILABLE arm) and nothing is created", async () => {
+    const accounts = fakeAccounts();
+    const path = fakeCreatePath(accounts);
+    const provisioner = newDirectAccountProvisioner({
+      accounts,
+      createAccount: path.createAccount,
+      userInfo: fakeUserInfo(new Error("userinfo answered 503")),
+    });
+
+    await expect(
+      provisioner.provisionDirectAccount("auth0|bob", oidcCaller("auth0|bob")),
+    ).rejects.toBeInstanceOf(UserInfoFetchError);
+    expect(path.calls).toHaveLength(0);
+    expect(accounts.rows.size).toBe(0);
+  });
+
+  it("a caller with no issuer never dials out — its profile is what the identity carries", async () => {
+    const accounts = fakeAccounts();
+    const path = fakeCreatePath(accounts);
+    const userInfo = fakeUserInfo(new Error("must not be called"));
+    const provisioner = newDirectAccountProvisioner({
+      accounts,
+      createAccount: path.createAccount,
+      userInfo,
+    });
+    const account = await provisioner.provisionDirectAccount(
+      "local|operator@example.com",
+      operatorCaller,
+    );
+
+    expect(userInfo.tokens).toEqual([]);
+    expect(account.metadata?.name).toBe("The Operator");
+    expect(account.spec?.email).toBe("operator@example.com");
+    expect(account.spec?.idpId).toBe("local|operator@example.com");
+  });
+
+  it("a machine subject (…@clients) is flagged is_machine_account by the backend", async () => {
+    const accounts = fakeAccounts();
+    const path = fakeCreatePath(accounts);
+    const provisioner = newDirectAccountProvisioner({
+      accounts,
+      createAccount: path.createAccount,
+      userInfo: fakeUserInfo({ ...PROFILE, email: "" }),
+    });
+    const account = await provisioner.provisionDirectAccount(
+      "abc123@clients",
+      oidcCaller("abc123@clients"),
+    );
+    expect(account.spec?.isMachineAccount).toBe(true);
+  });
+
+  it("the first-login race resolves to the winner by subject whatever the failure's shape", async () => {
+    const accounts = fakeAccounts();
+    const path = fakeCreatePath(accounts);
+    // The create path loses the race to a row that appears underneath it.
+    const winner = create(IdentityAccountSchema, {
+      metadata: { id: accountIdFor("auth0|carol"), name: "carol@example.com" },
+      spec: { idpId: "auth0|carol", email: "carol@example.com" },
+    });
+    const provisioner = newDirectAccountProvisioner({
+      accounts,
+      async createAccount(input, caller) {
+        await accounts.save(winner);
+        return path.createAccount(input, caller);
+      },
+      userInfo: fakeUserInfo(PROFILE),
+    });
+
+    const resolved = await provisioner.provisionDirectAccount(
+      "auth0|carol",
+      oidcCaller("auth0|carol"),
+    );
+    expect(resolved).toEqual(winner);
+    expect(accounts.rows.size).toBe(1);
+  });
+
+  it("a create failure with no winner behind it propagates as the infrastructure fault it is", async () => {
+    const accounts = fakeAccounts();
+    const provisioner = newDirectAccountProvisioner({
+      accounts,
+      async createAccount() {
+        throw new Error("store is on fire");
+      },
+      userInfo: fakeUserInfo(PROFILE),
+    });
+    await expect(
+      provisioner.provisionDirectAccount(
+        "auth0|dave",
+        oidcCaller("auth0|dave"),
+      ),
+    ).rejects.toThrow("store is on fire");
+  });
+
+  it("two concurrent first logins for one subject end in one row and one answer", async () => {
+    const accounts = fakeAccounts();
+    const path = fakeCreatePath(accounts);
+    const provisioner = newDirectAccountProvisioner({
+      accounts,
+      createAccount: path.createAccount,
+      userInfo: fakeUserInfo(PROFILE),
+    });
+
+    const [a, b] = await Promise.all([
+      provisioner.provisionDirectAccount(
+        "auth0|erin",
+        oidcCaller("auth0|erin"),
+      ),
+      provisioner.provisionDirectAccount(
+        "auth0|erin",
+        oidcCaller("auth0|erin"),
+      ),
+    ]);
+
+    expect(a.metadata?.id).toBe(accountIdFor("auth0|erin"));
+    expect(b.metadata?.id).toBe(a.metadata?.id);
+    expect(accounts.rows.size).toBe(1);
+  });
+});

package/src/domain/identityaccount/__tests__/resolve.test.ts

@@ -0,0 +1,114 @@
+/**
+ * Pins the one statement of "what identityId does this subject get
+ * stamped with" (resolve.ts; 20260911.11 Q-IA-2, A1, A6), the rule both
+ * verifiers call after their credential checks pass:
+ *
+ *   - a subject with a DIRECT account resolves to that account's id (the
+ *     cloud's direct-login posture, iam/direct/verifier.ts);
+ *   - a subject without one is returned unchanged, so the caller is
+ *     admitted idp-shaped and whoAmI / provisionMyAccount can run;
+ *   - one `findDirectByIdpId` read per call, no cache — a row that
+ *     appears between two calls is seen by the second (the liveness
+ *     posture the API-key lane already has);
+ *   - a store fault propagates as the SAME error object, never a
+ *     credential rejection (the chassis maps a non-ConnectError to
+ *     INTERNAL);
+ *   - a hit whose row carries no id is an infrastructure fault naming the
+ *     subject, never a `""` principal — the one deliberate divergence
+ *     from the cloud's inline `?? ""`.
+ */
+import { create } from "@bufbuild/protobuf";
+import { ConnectError } from "@connectrpc/connect";
+import { describe, expect, it, vi } from "vitest";
+
+import { IdentityAccountSchema } from "@stigmer/protos/ai/stigmer/iam/identityaccount/v1/api_pb";
+import { IdentityAccountProvisioningMode } from "@stigmer/protos/ai/stigmer/iam/identityaccount/v1/enum_pb";
+
+import { accountIdFor } from "../constants.js";
+import { identityIdForSubject } from "../resolve.js";
+import type { AccountsBySubject } from "../resolve.js";
+import { fakeIdentityAccountStore } from "./support.js";
+
+function seeded(sub: string, id: string = accountIdFor(sub)) {
+  const accounts = fakeIdentityAccountStore();
+  accounts.rows.set(
+    id,
+    create(IdentityAccountSchema, {
+      metadata: { id, name: sub },
+      spec: {
+        idpId: sub,
+        provisioningMode: IdentityAccountProvisioningMode.direct,
+      },
+    }),
+  );
+  return accounts;
+}
+
+describe("identityIdForSubject", () => {
+  it("a subject with an account resolves to the account's id", async () => {
+    const accounts = seeded("auth0|known");
+    expect(await identityIdForSubject(accounts, "auth0|known")).toBe(
+      accountIdFor("auth0|known"),
+    );
+  });
+
+  it("a subject without an account is returned unchanged — the caller stays idp-shaped", async () => {
+    const accounts = seeded("auth0|someone-else");
+    expect(await identityIdForSubject(accounts, "auth0|unknown")).toBe(
+      "auth0|unknown",
+    );
+  });
+
+  it("is one read per call with no cache — a row that appears between two calls is seen by the second", async () => {
+    const accounts = fakeIdentityAccountStore();
+    const lookup = vi.spyOn(accounts, "findDirectByIdpId");
+
+    expect(await identityIdForSubject(accounts, "auth0|late")).toBe(
+      "auth0|late",
+    );
+    accounts.rows.set(
+      accountIdFor("auth0|late"),
+      create(IdentityAccountSchema, {
+        metadata: { id: accountIdFor("auth0|late"), name: "late" },
+        spec: {
+          idpId: "auth0|late",
+          provisioningMode: IdentityAccountProvisioningMode.direct,
+        },
+      }),
+    );
+    expect(await identityIdForSubject(accounts, "auth0|late")).toBe(
+      accountIdFor("auth0|late"),
+    );
+    expect(lookup).toHaveBeenCalledTimes(2);
+    expect(lookup).toHaveBeenNthCalledWith(1, "auth0|late");
+    expect(lookup).toHaveBeenNthCalledWith(2, "auth0|late");
+  });
+
+  it("a store fault propagates as the same error — never a credential rejection", async () => {
+    const fault = new Error("store is on fire");
+    const broken: AccountsBySubject = {
+      findDirectByIdpId: () => Promise.reject(fault),
+    };
+    const error = await identityIdForSubject(broken, "auth0|anyone").then(
+      () => {
+        throw new Error("expected rejection");
+      },
+      (e: unknown) => e,
+    );
+    expect(error).toBe(fault);
+    expect(error).not.toBeInstanceOf(ConnectError);
+  });
+
+  it("a hit whose row carries no id is an infrastructure fault naming the subject — never a '' principal", async () => {
+    const accounts = seeded("auth0|corrupt", "");
+    const error = await identityIdForSubject(accounts, "auth0|corrupt").then(
+      () => {
+        throw new Error("expected rejection");
+      },
+      (e: unknown) => e,
+    );
+    expect(error).toBeInstanceOf(Error);
+    expect(error).not.toBeInstanceOf(ConnectError);
+    expect(String(error)).toContain("auth0|corrupt");
+  });
+});

package/src/domain/identityaccount/__tests__/resource-store.test.ts

@@ -0,0 +1,216 @@
+/**
+ * Runs the IdentityAccountStore port-contract kit (../store-contract.ts)
+ * over the OSS adapter (../resource-store.ts) on both drivers through the
+ * drivers' own fixtures (sqlite always; Postgres under TEST_DATABASE_URL,
+ * the store contract's gating), and pins the two behaviors that are the
+ * OSS adapter's rather than the port's (T01_1_review.md A1):
+ *
+ *   - every subject lookup is a PRIMARY-KEY read of the derived id — it
+ *     never calls Store.findByField (the per-request scan A1 removed).
+ *     Asserted with a spy over the real store, not by inspection;
+ *     findDirectByEmail is the one lookup that scans (an administrative
+ *     RPC, T01_1_review.md finding 2);
+ *   - save refuses a direct account whose id is not its derived id — the
+ *     invariant that makes the primary-key read correct, since a stray row
+ *     would be unreachable by subject forever.
+ *
+ * The kit's case list is pinned by name here so a case cannot drop out of
+ * the kit unnoticed: the cloud driver's test iterates the same export and
+ * would silently prove less.
+ */
+import { create } from "@bufbuild/protobuf";
+import { afterAll, afterEach, beforeEach, describe, expect, it } from "vitest";
+
+import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
+import { ApiResourceMetadataSchema } from "@stigmer/protos/ai/stigmer/commons/apiresource/metadata_pb";
+import type { IdentityAccount } from "@stigmer/protos/ai/stigmer/iam/identityaccount/v1/api_pb";
+import { IdentityAccountSchema } from "@stigmer/protos/ai/stigmer/iam/identityaccount/v1/api_pb";
+import { IdentityAccountProvisioningMode } from "@stigmer/protos/ai/stigmer/iam/identityaccount/v1/enum_pb";
+
+import type { Store } from "../../../store/interface.js";
+import { PostgresStore } from "../../../store/postgres/store.js";
+import {
+  createTestDatabase,
+  testDatabaseAdminUrl,
+  type TestDatabase,
+} from "../../../store/postgres/__tests__/support.js";
+import { tempStore } from "../../../store/sqlite/__tests__/support.js";
+import { accountIdFor } from "../constants.js";
+import { newResourceIdentityAccountStore } from "../resource-store.js";
+import type { IdentityAccountStoreContractFixture } from "../store-contract.js";
+import { identityAccountStoreContract } from "../store-contract.js";
+import type { IdentityAccountStore } from "../store.js";
+
+/** The kit's contract lines, pinned: a dropped or renamed case is a visible diff here. */
+const CONTRACT_CASE_NAMES = [
+  "save then findById round-trips the account",
+  "a second save under a held id is DuplicateAccountError, and the first row stands",
+  "findDirectByIdpId answers a direct account by its subject and undefined for an unknown one",
+  "findByIdpId (any mode) answers the same direct account",
+  "findDirectByEmail is an exact, case-sensitive match on direct accounts",
+  "update replaces the row in place and keeps the id",
+  "deleteById removes the row; the subject is free to be provisioned again",
+  "findByIds answers the present ones in request order and skips the unknown",
+  "a disconnected store is an infrastructure fault, never 'not found'",
+  "two concurrent saves of one subject end in fulfilments and DuplicateAccountErrors only, and the winner is readable by subject",
+  "findDirectByIdpId and findDirectByEmail never answer a federated account, while findByIdpId (any mode) does",
+  "findByIds answers one row per distinct id, in first-occurrence order; an empty request answers an empty list",
+  "update of an unknown id is a no-op: no row appears",
+  "deleteById of an unknown id resolves",
+  "save refuses a direct account with an empty idp_id",
+] as const;
+
+/** A direct account as the domain writes it: id derived, mode direct. */
+function makeDirectAccount(overrides: {
+  idpId: string;
+  email?: string;
+}): IdentityAccount {
+  return create(IdentityAccountSchema, {
+    apiVersion: "iam.stigmer.ai/v1",
+    kind: "IdentityAccount",
+    metadata: {
+      id: accountIdFor(overrides.idpId),
+      name: overrides.email ?? overrides.idpId,
+    },
+    spec: {
+      idpId: overrides.idpId,
+      email: overrides.email ?? "",
+      provisioningMode: IdentityAccountProvisioningMode.direct,
+    },
+  });
+}
+
+interface OpenedStore {
+  readonly store: Store;
+  close(): Promise<void>;
+}
+
+interface DriverFixture {
+  readonly name: string;
+  readonly skip: boolean;
+  open(): Promise<OpenedStore>;
+}
+
+const sqliteFixture: DriverFixture = {
+  name: "sqlite",
+  skip: false,
+  async open() {
+    const temp = tempStore();
+    return { store: temp.store, close: () => temp.cleanup() };
+  },
+};
+
+let postgresDatabase: TestDatabase | undefined;
+const postgresFixture: DriverFixture = {
+  name: "postgres",
+  skip: testDatabaseAdminUrl() === undefined,
+  async open() {
+    if (postgresDatabase === undefined) {
+      postgresDatabase = await createTestDatabase();
+    }
+    const store = await PostgresStore.open(postgresDatabase.databaseUrl);
+    await store.deleteResourcesByKind(ApiResourceKind.identity_account);
+    return { store, close: () => store.close() };
+  },
+};
+
+afterAll(async () => {
+  await postgresDatabase?.drop();
+});
+
+describe.each([sqliteFixture, postgresFixture])(
+  "IdentityAccountStore over the OSS adapter ($name)",
+  (fixture) => {
+    describe.skipIf(fixture.skip)("the port-contract kit", () => {
+      const cases = identityAccountStoreContract(
+        async (): Promise<IdentityAccountStoreContractFixture> => {
+          const opened = await fixture.open();
+          return {
+            store: newResourceIdentityAccountStore(opened.store),
+            // Both drivers' close is idempotent, so cleanup after a
+            // disconnect is a no-op on the handle (plus the temp dir).
+            disconnect: () => opened.store.close(),
+            cleanup: () => opened.close(),
+          };
+        },
+      );
+
+      it("carries every contract line, by name", () => {
+        expect(cases.map((contractCase) => contractCase.name)).toEqual(
+          CONTRACT_CASE_NAMES,
+        );
+      });
+
+      for (const contractCase of cases) {
+        it(contractCase.name, contractCase.run);
+      }
+    });
+
+    describe.skipIf(fixture.skip)("the OSS adapter's own invariants", () => {
+      let opened: OpenedStore;
+      let accounts: IdentityAccountStore;
+      // Every findByField call the adapter makes, by field path — the spy
+      // that proves the hot path is a primary-key read.
+      let findByFieldPaths: string[];
+
+      beforeEach(async () => {
+        opened = await fixture.open();
+        findByFieldPaths = [];
+        const spied: Store = Object.create(opened.store, {
+          findByField: {
+            value: (...args: Parameters<Store["findByField"]>) => {
+              findByFieldPaths.push(args[1]);
+              return opened.store.findByField(...args);
+            },
+          },
+        }) as Store;
+        accounts = newResourceIdentityAccountStore(spied);
+      });
+
+      afterEach(async () => {
+        await opened.close();
+      });
+
+      it("every subject lookup is a primary-key read — never a findByField scan", async () => {
+        await accounts.save(makeDirectAccount({ idpId: "auth0|carol" }));
+        expect(
+          (await accounts.findDirectByIdpId("auth0|carol"))?.metadata?.id,
+        ).toBe(accountIdFor("auth0|carol"));
+        expect((await accounts.findByIdpId("auth0|carol"))?.spec?.idpId).toBe(
+          "auth0|carol",
+        );
+        expect(
+          await accounts.findDirectByIdpId("auth0|nobody"),
+        ).toBeUndefined();
+        expect(findByFieldPaths).toEqual([]);
+      });
+
+      it("findDirectByEmail is the one lookup that scans (administrative, exact match)", async () => {
+        await accounts.save(
+          makeDirectAccount({ idpId: "auth0|erin", email: "erin@example.com" }),
+        );
+        expect(
+          (await accounts.findDirectByEmail("erin@example.com"))?.spec?.idpId,
+        ).toBe("auth0|erin");
+        expect(
+          await accounts.findDirectByEmail("nobody@example.com"),
+        ).toBeUndefined();
+        expect(findByFieldPaths).toEqual(["spec.email", "spec.email"]);
+      });
+
+      it("refuses to save a direct account whose id is not its derived id", async () => {
+        const stray = makeDirectAccount({ idpId: "auth0|judy" });
+        stray.metadata = create(ApiResourceMetadataSchema, {
+          id: "ida_01hzzzzzzzzzzzzzzzzzzzzzzz",
+          name: "stray",
+        });
+        await expect(accounts.save(stray)).rejects.toThrow(
+          "direct account id must be derived from its idp_id",
+        );
+        expect(
+          await opened.store.listResources(ApiResourceKind.identity_account),
+        ).toHaveLength(0);
+      });
+    });
+  },
+);

package/src/domain/identityaccount/__tests__/support.ts

@@ -0,0 +1,58 @@
+/**
+ * Test fixtures for the identity-account domain: an in-memory
+ * IdentityAccountStore with the primary-key semantics the OSS adapter has
+ * (a second save under a held id is DuplicateAccountError), so provisioning
+ * and verifier tests exercise the port's contract without a store driver.
+ * Driver-backed fixtures live with the drivers (the sqlite and postgres
+ * __tests__/support modules under src/store).
+ */
+import type { IdentityAccount } from "@stigmer/protos/ai/stigmer/iam/identityaccount/v1/api_pb";
+
+import { DuplicateAccountError } from "../store.js";
+import type { IdentityAccountStore } from "../store.js";
+
+export interface FakeIdentityAccountStore extends IdentityAccountStore {
+  readonly rows: Map<string, IdentityAccount>;
+}
+
+export function fakeIdentityAccountStore(): FakeIdentityAccountStore {
+  const rows = new Map<string, IdentityAccount>();
+  const byIdpId = (idpId: string): IdentityAccount | undefined =>
+    [...rows.values()].find((row) => row.spec?.idpId === idpId);
+  return {
+    rows,
+    async save(account) {
+      const id = account.metadata?.id ?? "";
+      if (rows.has(id)) {
+        throw new DuplicateAccountError(
+          `identity account '${id}' already exists`,
+        );
+      }
+      rows.set(id, account);
+    },
+    async update(account) {
+      rows.set(account.metadata?.id ?? "", account);
+    },
+    async deleteById(id) {
+      rows.delete(id);
+    },
+    async findById(id) {
+      return rows.get(id);
+    },
+    async findByIdpId(idpId) {
+      return byIdpId(idpId);
+    },
+    async findDirectByIdpId(idpId) {
+      return byIdpId(idpId);
+    },
+    async findDirectByEmail(email) {
+      return [...rows.values()].find((row) => row.spec?.email === email);
+    },
+    async findByIds(ids) {
+      return ids.flatMap((id) => {
+        const row = rows.get(id);
+        return row === undefined ? [] : [row];
+      });
+    },
+  };
+}