@synopackageland/cli 0.3.10 → 0.4.1

package/templates/native-go/backend/internal/helper/relaxed_identity_test.go

@@ -0,0 +1,406 @@
+package helper
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"slices"
+	"testing"
+	"time"
+)
+
+type relaxedFake struct {
+	session                                      RelaxedSession
+	account                                      RelaxedAccount
+	groups                                       RelaxedGroups
+	app                                          RelaxedAppPermission
+	sessionCode, accountCode, groupCode, appCode Code
+	afterApp                                     func()
+}
+
+func (f *relaxedFake) ValidateRelaxedSession(ctx context.Context, _ SessionCarriers) (RelaxedSession, Code) {
+	if _, ok := ctx.Deadline(); !ok {
+		panic("missing deadline")
+	}
+	return f.session, f.sessionCode
+}
+func (f *relaxedFake) LookupRelaxedAccount(_ context.Context, name string) (RelaxedAccount, Code) {
+	return f.account, f.accountCode
+}
+func (f *relaxedFake) LookupRelaxedGroups(_ context.Context, account RelaxedAccount) (RelaxedGroups, Code) {
+	return f.groups, f.groupCode
+}
+func (f *relaxedFake) ValidateRelaxedApp(_ context.Context, _ SessionCarriers, _ RelaxedSession, _ RelaxedAccount, _ string) (RelaxedAppPermission, Code) {
+	if f.afterApp != nil {
+		f.afterApp()
+	}
+	return f.app, f.appCode
+}
+
+type relaxedFakeCohort struct {
+	keys       []GrantDrainKey
+	identities []RelaxedIdentity
+	before     func(GrantDrainKey)
+	fail       Code
+}
+
+func (f *relaxedFakeCohort) DrainGrant(_ context.Context, key GrantDrainKey) (GrantQuiescence, Code) {
+	f.keys = append(f.keys, key)
+	if f.before != nil {
+		f.before(key)
+	}
+	return completeGrantProof(key), f.fail
+}
+func (f *relaxedFakeCohort) drainRelaxedIdentity(_ context.Context, id RelaxedIdentity) Code {
+	f.identities = append(f.identities, id)
+	return f.fail
+}
+func relaxedFixture(t *testing.T) (*GrantAuthority, *memoryGrantRepository, *NativeProvider, *relaxedFake, *consentStub, *relaxedFakeCohort, SessionCarriers) {
+	t.Helper()
+	_, repo, _, _, _, consent, carriers, now := grantAuthorityFixture(t)
+	repo.policy.Inventory.DataAccess = "relaxed"
+	id := RelaxedIdentity{UID: 1001, Username: "alice"}
+	f := &relaxedFake{
+		session: RelaxedSession{Username: id.Username, CSRFVerified: true, SessionRef: grantRef('c'), CheckedAt: now},
+		account: RelaxedAccount{Identity: id, Kind: "local", Exists: true, Enabled: true, PrimaryGID: 100, PrimaryGIDKnown: true, StateKnown: true, ExpiryKnown: true, PasswordKnown: true, PasswordUsable: true, CheckedAt: now},
+		groups:  RelaxedGroups{Identity: id, Groups: []uint32{105, 101, 105}, Complete: true, PrimaryGID: 100, Admin: true, AdminKnown: true, CheckedAt: now},
+		app:     RelaxedAppPermission{Identity: id, AppID: "FixturePrivilege", ClientAddress: carriers.ClientAddress, SessionRef: grantRef('c'), Allowed: true, CheckedAt: now},
+	}
+	p := NewRelaxedNativeProvider(RelaxedAdapters{Sessions: f, Accounts: f, Groups: f, App: f, AppPrivilegeID: "FixturePrivilege"})
+	p.now = func() time.Time { return now }
+	cohort := &relaxedFakeCohort{}
+	a, code := NewGrantAuthority(repo, p, consent, cohort)
+	if code != "" {
+		t.Fatal(code)
+	}
+	a.now = p.now
+	return a, repo, p, f, consent, cohort, carriers
+}
+func relaxedActor(t *testing.T, p *NativeProvider, c SessionCarriers) NativeActor {
+	t.Helper()
+	actor, code := p.Resolve(context.Background(), c)
+	if code != "" {
+		t.Fatal(code)
+	}
+	return actor
+}
+func relaxedConsent(t *testing.T, a *GrantAuthority, r *memoryGrantRepository, p *NativeProvider, v *consentStub, c SessionCarriers, kind ScopeKind) Grant {
+	t.Helper()
+	actor := relaxedActor(t, p, c)
+	v.selection.Principal = actor.Principal()
+	v.selection.Scope.Kind = kind
+	v.selection.SessionRef = actor.SessionRef()
+	i := prepareGrant(t, a, c, kind)
+	return confirmGrant(t, a, r, c, i)
+}
+func setRelaxedIdentity(f *relaxedFake, id RelaxedIdentity) {
+	f.session.Username = id.Username
+	f.account.Identity = id
+	f.groups.Identity = id
+	f.app.Identity = id
+}
+func TestRelaxedIdentitySuccessAndSamePairRecreation(t *testing.T) {
+	a, r, p, f, v, _, c := relaxedFixture(t)
+	actor := relaxedActor(t, p, c)
+	if actor.IdentityBasis() != "uid-username" || actor.UID() != 1001 || actor.Username() != "alice" || !slices.Equal(actor.Groups(), []uint32{101, 105}) {
+		t.Fatal("wrong actor")
+	}
+	groups := actor.Groups()
+	groups[0] = 999
+	f.groups.Groups = []uint32{105, 101}
+	again, code := p.Revalidate(context.Background(), c, actor)
+	if code != "" || again.Principal() != actor.Principal() {
+		t.Fatal("same pair did not retain identity", code)
+	}
+	g := relaxedConsent(t, a, r, p, v, c, ScopePersonal)
+	encoded, _ := json.Marshal(g)
+	if !bytes.Contains(encoded, []byte(`"identityBasis":"uid-username"`)) || !bytes.Contains(encoded, []byte(`"uid":1001`)) || !bytes.Contains(encoded, []byte(`"username":"alice"`)) {
+		t.Fatal("grant lost explicit identity")
+	}
+	if _, code := DecodeGrantStore(bytes.NewReader(mustRelaxedJSON(t, r.store))); code != "" {
+		t.Fatal(code)
+	}
+	// There is deliberately no account-incarnation/reset/boundary input in S1R.
+	if actor := relaxedActor(t, p, c); actor.Principal() != g.Owner {
+		t.Fatal("same UID/name recreation changed grant identity")
+	}
+}
+func mustRelaxedJSON(t *testing.T, v any) []byte {
+	t.Helper()
+	b, e := json.Marshal(v)
+	if e != nil {
+		t.Fatal(e)
+	}
+	return b
+}
+func TestRelaxedAdaptersFailClosed(t *testing.T) {
+	cases := []struct {
+		name   string
+		change func(*NativeProvider, *relaxedFake, *SessionCarriers)
+		want   Code
+	}{
+		{"CSRF unproven", func(p *NativeProvider, f *relaxedFake, c *SessionCarriers) { f.session.CSRFVerified = false }, ErrUnsupported},
+		{"unregistered App ID", func(p *NativeProvider, f *relaxedFake, c *SessionCarriers) { p.relaxed.adapters.AppPrivilegeID = "" }, ErrUnsupported},
+		{"unknown account state", func(p *NativeProvider, f *relaxedFake, c *SessionCarriers) { f.account.StateKnown = false }, ErrUnavailable},
+		{"unknown expiry", func(p *NativeProvider, f *relaxedFake, c *SessionCarriers) { f.account.ExpiryKnown = false }, ErrUnavailable},
+		{"account expired", func(p *NativeProvider, f *relaxedFake, c *SessionCarriers) { f.account.Expired = true }, ErrDenied},
+		{"unknown password policy", func(p *NativeProvider, f *relaxedFake, c *SessionCarriers) { f.account.PasswordKnown = false }, ErrUnavailable},
+		{"password unusable", func(p *NativeProvider, f *relaxedFake, c *SessionCarriers) { f.account.PasswordUsable = false }, ErrDenied},
+		{"unknown primary GID", func(p *NativeProvider, f *relaxedFake, c *SessionCarriers) { f.account.PrimaryGIDKnown = false }, ErrUnavailable},
+		{"partial groups", func(p *NativeProvider, f *relaxedFake, c *SessionCarriers) { f.groups.Complete = false }, ErrUnavailable},
+		{"wrong group primary GID", func(p *NativeProvider, f *relaxedFake, c *SessionCarriers) { f.groups.PrimaryGID++ }, ErrSuspended},
+		{"wrong App IP", func(p *NativeProvider, f *relaxedFake, c *SessionCarriers) { f.app.ClientAddress = "192.0.2.2" }, ErrDenied},
+		{"missing session", func(p *NativeProvider, f *relaxedFake, c *SessionCarriers) { p.relaxed.adapters.Sessions = nil }, ErrUnavailable},
+		{"missing account", func(p *NativeProvider, f *relaxedFake, c *SessionCarriers) { p.relaxed.adapters.Accounts = nil }, ErrUnavailable},
+		{"missing groups", func(p *NativeProvider, f *relaxedFake, c *SessionCarriers) { p.relaxed.adapters.Groups = nil }, ErrUnavailable},
+		{"missing App", func(p *NativeProvider, f *relaxedFake, c *SessionCarriers) { p.relaxed.adapters.App = nil }, ErrUnavailable},
+		{"anonymous", func(p *NativeProvider, f *relaxedFake, c *SessionCarriers) { c.Cookie = "" }, ErrDenied},
+		{"expired session", func(p *NativeProvider, f *relaxedFake, c *SessionCarriers) { f.sessionCode = ErrDenied }, ErrDenied},
+		{"deleted", func(p *NativeProvider, f *relaxedFake, c *SessionCarriers) { f.account.Exists = false }, ErrDenied},
+		{"disabled", func(p *NativeProvider, f *relaxedFake, c *SessionCarriers) { f.account.Enabled = false }, ErrDenied},
+		{"LDAP", func(p *NativeProvider, f *relaxedFake, c *SessionCarriers) { f.account.Kind = "ldap" }, ErrUnsupported},
+		{"session root", func(p *NativeProvider, f *relaxedFake, c *SessionCarriers) { f.account.Identity.UID = 0 }, ErrDenied},
+		{"unknown UID", func(p *NativeProvider, f *relaxedFake, c *SessionCarriers) { f.account.Identity.UID = 0 }, ErrDenied},
+		{"root group", func(p *NativeProvider, f *relaxedFake, c *SessionCarriers) { f.account.PrimaryGID = 0 }, ErrDenied},
+		{"account name mismatch", func(p *NativeProvider, f *relaxedFake, c *SessionCarriers) { f.account.Identity.Username = "other" }, ErrSuspended},
+		{"group identity mismatch", func(p *NativeProvider, f *relaxedFake, c *SessionCarriers) { f.groups.Identity.UID++ }, ErrSuspended},
+		{"unknown groups", func(p *NativeProvider, f *relaxedFake, c *SessionCarriers) { f.groups.Groups = nil }, ErrUnavailable},
+		{"unknown role", func(p *NativeProvider, f *relaxedFake, c *SessionCarriers) { f.groups.AdminKnown = false }, ErrUnavailable},
+		{"App revoked", func(p *NativeProvider, f *relaxedFake, c *SessionCarriers) { f.app.Allowed = false }, ErrDenied},
+		{"wrong App", func(p *NativeProvider, f *relaxedFake, c *SessionCarriers) { f.app.AppID = "OtherApp" }, ErrDenied},
+		{"wrong App actor", func(p *NativeProvider, f *relaxedFake, c *SessionCarriers) { f.app.Identity.UID++ }, ErrDenied},
+		{"wrong App session", func(p *NativeProvider, f *relaxedFake, c *SessionCarriers) { f.app.SessionRef = grantRef('f') }, ErrDenied},
+		{"raw adapter error", func(p *NativeProvider, f *relaxedFake, c *SessionCarriers) { f.groupCode = Code("native diagnostic") }, ErrUnavailable},
+		{"session proof old", func(p *NativeProvider, f *relaxedFake, c *SessionCarriers) {
+			f.session.CheckedAt = f.session.CheckedAt.Add(-NativeProofFreshness - time.Nanosecond)
+		}, ErrStale},
+		{"account proof zero", func(p *NativeProvider, f *relaxedFake, c *SessionCarriers) { f.account.CheckedAt = time.Time{} }, ErrStale},
+		{"group proof future", func(p *NativeProvider, f *relaxedFake, c *SessionCarriers) {
+			f.groups.CheckedAt = f.groups.CheckedAt.Add(time.Nanosecond)
+		}, ErrStale},
+		{"App proof zero", func(p *NativeProvider, f *relaxedFake, c *SessionCarriers) { f.app.CheckedAt = time.Time{} }, ErrStale},
+	}
+	for _, tt := range cases {
+		t.Run(tt.name, func(t *testing.T) {
+			_, _, p, f, _, _, c := relaxedFixture(t)
+			tt.change(p, f, &c)
+			actor, code := p.Resolve(context.Background(), c)
+			if code != tt.want || actor.valid {
+				t.Fatalf("code=%q want=%q actor=%v", code, tt.want, actor.valid)
+			}
+		})
+	}
+	p := NewRelaxedNativeProvider(RelaxedAdapters{})
+	if actor, code := p.Resolve(context.Background(), SessionCarriers{}); code != ErrUnavailable || actor.valid {
+		t.Fatal(code)
+	}
+}
+func TestRelaxedIdentityMismatchRevokesEveryOwnedGrantBeforeQ(t *testing.T) {
+	for _, rename := range []bool{false, true} {
+		t.Run(map[bool]string{false: "UID", true: "username"}[rename], func(t *testing.T) {
+			a, r, p, f, v, cohort, c := relaxedFixture(t)
+			old := relaxedActor(t, p, c)
+			gs := []Grant{relaxedConsent(t, a, r, p, v, c, ScopePersonal), relaxedConsent(t, a, r, p, v, c, ScopePersonal), relaxedConsent(t, a, r, p, v, c, ScopeShared)}
+			setRelaxedIdentity(f, RelaxedIdentity{UID: 2001, Username: "bob"})
+			other := relaxedConsent(t, a, r, p, v, c, ScopePersonal)
+			next := RelaxedIdentity{UID: 1002, Username: "alice"}
+			if rename {
+				next = RelaxedIdentity{UID: 1001, Username: "alice2"}
+			}
+			setRelaxedIdentity(f, next)
+			cohort.before = func(_ GrantDrainKey) {
+				if r.inTransaction {
+					t.Fatal("Q under disk locks")
+				}
+				if actor, code := p.Resolve(context.Background(), c); code == "" || actor.valid {
+					t.Fatal("prospective identity admitted before Q")
+				}
+				for _, g := range gs {
+					if findGrant(&r.store, g.ID).State != GrantRevoked {
+						t.Fatal("Q before all durable R")
+					}
+				}
+				if code := a.WithGrantAdmission(GrantAdmission{old, gs[0].ID, gs[0].Revision, ActionRead, gs[0].LastValidated, true}, func(Grant, NativeActor) Code { t.Fatal("old admission ran"); return "" }); code == "" {
+					t.Fatal("admitted old actor")
+				}
+			}
+			if actor, code := p.Resolve(context.Background(), c); code != ErrSuspended || actor.valid {
+				t.Fatal("mismatch admitted", code)
+			}
+			if len(cohort.keys) != 3 || len(cohort.identities) != 1 || findGrant(&r.store, other.ID).State != GrantActive {
+				t.Fatal("wrong invalidation scope")
+			}
+			// Fresh consent after complete Q creates a new ID; no revoked record revives.
+			fresh := relaxedConsent(t, a, r, p, v, c, ScopePersonal)
+			if fresh.ID == gs[0].ID || fresh.Owner == old.Principal() {
+				t.Fatal("old grant revived")
+			}
+		})
+	}
+}
+func TestRelaxedInvalidationFailureKeepsFence(t *testing.T) {
+	for _, failure := range []string{"commit", "drain", "Q save"} {
+		t.Run(failure, func(t *testing.T) {
+			a, r, p, f, v, cohort, c := relaxedFixture(t)
+			g := relaxedConsent(t, a, r, p, v, c, ScopePersonal)
+			switch failure {
+			case "commit":
+				r.fail = ErrCommitUncertain
+			case "drain":
+				cohort.fail = ErrCleanupRequired
+			case "Q save":
+				r.qFailure = ErrUnavailable
+			}
+			setRelaxedIdentity(f, RelaxedIdentity{UID: 1002, Username: "alice"})
+			if actor, code := p.Resolve(context.Background(), c); code != ErrCleanupRequired || actor.valid {
+				t.Fatal("false R/Q", code)
+			}
+			if code := a.WithGrantAdmission(GrantAdmission{relaxedActorWithoutResolve(g), g.ID, g.Revision, ActionRead, g.LastValidated, true}, func(Grant, NativeActor) Code { t.Fatal("failed invalidation admitted"); return "" }); code == "" {
+				t.Fatal("fence lost")
+			}
+			if failure != "commit" && findGrant(&r.store, g.ID).State != GrantRevoked {
+				t.Fatal("lost durable R")
+			}
+			if actor, code := p.Resolve(context.Background(), c); code == "" || actor.valid {
+				t.Fatal("failure cleared itself")
+			}
+		})
+	}
+}
+func relaxedActorWithoutResolve(g Grant) NativeActor {
+	return NativeActor{account: LocalAccount{Principal: g.Owner, Enabled: true, UID: 1001, GID: 100, Username: "alice", CheckedAt: time.Unix(1700000000, 0)}, valid: true}
+}
+func TestRelaxedRevalidateCredentialsCancellationAndAging(t *testing.T) {
+	_, _, p, f, _, _, c := relaxedFixture(t)
+	old := relaxedActor(t, p, c)
+	f.groups.Groups = []uint32{}
+	if _, code := p.Revalidate(context.Background(), c, old); code != ErrStale {
+		t.Fatal(code)
+	}
+	f.groups.Groups = []uint32{101, 105}
+	f.account.PrimaryGID++
+	f.groups.PrimaryGID++
+	if _, code := p.Revalidate(context.Background(), c, old); code != ErrStale {
+		t.Fatal("GID should stale credentials", code)
+	}
+	f.account.PrimaryGID--
+	f.groups.PrimaryGID--
+	ctx, cancel := context.WithCancel(context.Background())
+	f.afterApp = cancel
+	if _, code := p.Resolve(ctx, c); code != ErrCanceled {
+		t.Fatal(code)
+	}
+	f.afterApp = func() {
+		now := p.now()
+		p.now = func() time.Time { return now.Add(NativeProofFreshness + time.Nanosecond) }
+	}
+	if _, code := p.Resolve(context.Background(), c); code != ErrStale {
+		t.Fatal("extended old session proof", code)
+	}
+}
+
+func TestRelaxedPrincipalDecoderAndLegacyIsolation(t *testing.T) {
+	a, r, p, _, v, _, c := relaxedFixture(t)
+	g := relaxedConsent(t, a, r, p, v, c, ScopePersonal)
+	for _, change := range []func(*Principal){
+		func(p *Principal) { p.IdentityBasis = "" }, func(p *Principal) { p.IdentityBasis = "managed-enrollment" },
+		func(p *Principal) { p.UID = 0 }, func(p *Principal) { p.Username = "" }, func(p *Principal) { p.Username = "../other" },
+	} {
+		next := cloneAuthorityStore(r.store)
+		change(&next.Grants[0].Owner)
+		next.Grants[0].Issuer = next.Grants[0].Owner
+		if _, code := DecodeGrantStore(bytes.NewReader(mustRelaxedJSON(t, next))); code == "" {
+			t.Fatal("malformed S1R principal accepted")
+		}
+	}
+	// Old schema-1 records retain their strict semantics and cannot be silently
+	// promoted into a relaxed grant by interpreting a digest as an account ID.
+	legacy, code := DecodeGrantStore(bytes.NewReader(dataFixture(t, "grant-store")))
+	if code != "" {
+		t.Fatal(code)
+	}
+	actor := relaxedActor(t, p, c)
+	proof := GrantAdmission{actor, g.ID, g.Revision, ActionRead, g.LastValidated, true}
+	proof.Actor.account.Principal = legacy.Grants[0].Owner
+	if code := a.WithGrantAdmission(proof, func(Grant, NativeActor) Code { t.Fatal("legacy principal admitted into relaxed authority"); return "" }); code == "" {
+		t.Fatal("lost identity-basis gate")
+	}
+}
+func TestRelaxedDisableAndAppRevokeInvalidatePreviouslyGrantedUser(t *testing.T) {
+	for _, what := range []string{"disabled", "deleted", "lookup denied", "App checker denied", "App revoke"} {
+		t.Run(what, func(t *testing.T) {
+			a, r, p, f, v, cohort, c := relaxedFixture(t)
+			g := relaxedConsent(t, a, r, p, v, c, ScopePersonal)
+			switch what {
+			case "lookup denied":
+				f.accountCode = ErrDenied
+			case "App checker denied":
+				f.appCode = ErrDenied
+			case "disabled":
+				f.account.Enabled = false
+			case "deleted":
+				f.account.Exists = false
+			case "App revoke":
+				f.app.Allowed = false
+			}
+			if actor, code := p.Resolve(context.Background(), c); code != ErrDenied || actor.valid {
+				t.Fatal(code)
+			}
+			if findGrant(&r.store, g.ID).State != GrantRevoked || len(cohort.keys) != 1 || len(cohort.identities) != 1 {
+				t.Fatal("old authority survived observation")
+			}
+			f.account.Enabled = true
+			f.accountCode = ""
+			f.appCode = ""
+			f.account.Exists = true
+			f.app.Allowed = true
+			if actor := relaxedActor(t, p, c); actor.Principal() == g.Owner {
+				t.Fatal("restore revived old actor generation")
+			}
+			if findGrant(&r.store, g.ID).State != GrantRevoked {
+				t.Fatal("restore un-revoked grant")
+			}
+		})
+	}
+}
+func TestRelaxedSwappedSessionDoesNotRevokeOtherUsersGrants(t *testing.T) {
+	a, r, p, f, v, _, c := relaxedFixture(t)
+	old := relaxedActor(t, p, c)
+	mine := relaxedConsent(t, a, r, p, v, c, ScopePersonal)
+	setRelaxedIdentity(f, RelaxedIdentity{UID: 2001, Username: "bob"})
+	other := relaxedConsent(t, a, r, p, v, c, ScopePersonal)
+	if actor, code := p.Revalidate(context.Background(), c, old); code != ErrSuspended || actor.valid {
+		t.Fatal("cross-user snapshot accepted", code)
+	}
+	if findGrant(&r.store, mine.ID).State != GrantRevoked || findGrant(&r.store, other.ID).State != GrantActive {
+		t.Fatal("wrong account revoked")
+	}
+	if relaxedActor(t, p, c).Principal() != other.Owner {
+		t.Fatal("foreign identity generation changed")
+	}
+}
+
+func TestRelaxedNegativeAccountObservationRevokesRecordedIdentity(t *testing.T) {
+	for _, kind := range []string{"canonical rename", "deleted without tuple"} {
+		t.Run(kind, func(t *testing.T) {
+			a, r, p, f, v, cohort, c := relaxedFixture(t)
+			g := relaxedConsent(t, a, r, p, v, c, ScopePersonal)
+			old := g.Owner
+			want := ErrSuspended
+			if kind == "canonical rename" {
+				f.account.Identity.Username = "alice-renamed"
+			} else {
+				f.account.Exists = false
+				f.account.Identity = RelaxedIdentity{}
+				f.account.PrimaryGIDKnown = false
+				want = ErrDenied
+			}
+			if actor, code := p.Resolve(context.Background(), c); code != want || actor.valid {
+				t.Fatalf("code=%q want=%q", code, want)
+			}
+			if findGrant(&r.store, g.ID).State != GrantRevoked || len(cohort.keys) != 1 || len(cohort.identities) != 1 || cohort.identities[0] != relaxedPrincipalIdentity(old) {
+				t.Fatal("negative account observation left old grants or operation identity alive")
+			}
+		})
+	}
+}

package/templates/native-go/backend/internal/helper/relaxed_invalidation.go

@@ -0,0 +1,200 @@
+package helper
+
+import (
+	"context"
+	"math"
+)
+
+// A deleted account cannot supply its former UID. Select its recorded identity
+// by the validated native name, never drop invalidation because lookup failed.
+func (r *relaxedProvider) invalidateName(ctx context.Context, name string, observed ...RelaxedIdentity) Code {
+	a := r.authority
+	a.mu.Lock()
+	selected := map[RelaxedIdentity]bool{}
+	related := func(id RelaxedIdentity) bool {
+		if id.Username == name {
+			return true
+		}
+		for _, current := range observed {
+			if validRelaxedIdentity(current) && relaxedRelated(id, current) {
+				return true
+			}
+		}
+		return false
+	}
+	for id := range r.principals {
+		if related(id) {
+			selected[id] = true
+		}
+	}
+	code := a.transaction(func(s *GrantStore) (bool, Code) {
+		for _, g := range s.Grants {
+			for _, p := range []Principal{g.Owner, g.Issuer} {
+				if p.IdentityBasis == "uid-username" && related(relaxedPrincipalIdentity(p)) {
+					selected[relaxedPrincipalIdentity(p)] = true
+				}
+			}
+		}
+		return false, ""
+	})
+	if code != "" {
+		a.mu.Unlock()
+		return ErrCleanupRequired
+	}
+	if len(selected) == 0 {
+		a.mu.Unlock()
+		return ""
+	}
+	ids := make([]RelaxedIdentity, 0, len(selected))
+	for id := range selected {
+		ids = append(ids, id)
+	}
+	return r.invalidateLocked(ctx, ids)
+}
+
+// Observed identity changes use the existing S3 transaction/order, never an
+// auxiliary store. Old generations are denied before R and never reused.
+func (r *relaxedProvider) invalidate(ctx context.Context, ids []RelaxedIdentity) Code {
+	if r == nil || r.authority == nil {
+		return ErrUnavailable
+	}
+	r.authority.mu.Lock()
+	return r.invalidateLocked(ctx, ids)
+}
+
+// Takes ownership of the held admission lock; all exit paths release it.
+func (r *relaxedProvider) invalidateLocked(ctx context.Context, ids []RelaxedIdentity, prospective ...RelaxedIdentity) Code {
+	ctx, cancel := context.WithTimeout(ctx, MetadataTimeout)
+	defer cancel()
+	a := r.authority
+	selected := map[RelaxedIdentity]bool{}
+	blocked := map[RelaxedIdentity]bool{}
+	for _, id := range append(append([]RelaxedIdentity{}, ids...), prospective...) {
+		if !validRelaxedIdentity(id) || r.blocked[id] {
+			a.fenced = true
+			a.mu.Unlock()
+			return ErrCleanupRequired
+		}
+		blocked[id] = true
+	}
+	for id := range blocked {
+		r.blocked[id] = true
+	}
+	for _, id := range ids {
+		selected[id] = true
+		delete(r.principals, id)
+	}
+	for id, pending := range a.intents {
+		if selected[relaxedActorIdentity(pending.actor)] {
+			delete(a.intents, id)
+		}
+	}
+	keys := []GrantDrainKey{}
+	code := safeGrantCode(a.repository.Transact(func(policy GrantPolicy, s *GrantStore) (bool, Code) {
+		if policy != a.policy || !policy.Enabled || a.fenced {
+			return false, ErrFenced
+		}
+		// Plan all revisions first, so overflow or malformed authority cannot partly R.
+		indices := []int{}
+		for n, g := range s.Grants {
+			affected := false
+			for _, p := range []Principal{g.Owner, g.Issuer} {
+				if p.IdentityBasis == "uid-username" && selected[relaxedPrincipalIdentity(p)] {
+					affected = true
+				}
+			}
+			if !affected {
+				continue
+			}
+			revision := g.Revision
+			if g.State != GrantRevoked {
+				if revision == math.MaxUint64 || s.Revision == math.MaxUint64 {
+					return false, ErrLimit
+				}
+				revision++
+				indices = append(indices, n)
+			}
+			keys = append(keys, GrantDrainKey{policy.Epoch, g.ID, revision})
+		}
+		for _, n := range indices {
+			g := &s.Grants[n]
+			g.State = GrantRevoked
+			g.Reason = ErrRevoked
+			g.RevokedAt = max(g.CreatedAt, a.now().UnixMilli())
+			g.Revision++
+		}
+		if len(indices) > 0 {
+			s.Revision++
+		}
+		return len(indices) > 0, ""
+	}))
+	if code != "" {
+		a.fenced = true
+		clear(a.intents)
+	}
+	a.mu.Unlock()
+	complete := code == ""
+	// The caller's operations on foreign shared grants must stop without rewriting
+	// those grants. This seam must prove actual owned-child/relay completion.
+	identityCohort, ok := a.cohort.(relaxedIdentityCohort)
+	if !ok {
+		complete = false
+	} else {
+		for id := range selected {
+			if c := nativeObservationCode(ctx, identityCohort.drainRelaxedIdentity(ctx, id)); c != "" {
+				complete = false
+			}
+		}
+	}
+	for _, key := range keys {
+		q, c := a.drain(ctx, key)
+		if c != "" {
+			complete = false
+			continue
+		}
+		if code == "" {
+			a.mu.Lock()
+			saved := safeGrantCode(a.repository.SaveQuiescence(q))
+			a.mu.Unlock()
+			if saved != "" {
+				complete = false
+			}
+		}
+	}
+	a.mu.Lock()
+	defer a.mu.Unlock()
+	if !complete {
+		a.fenced = true
+		clear(a.intents)
+		if a.gate != nil {
+			a.gate.fenceLocked("relaxed-identity-cleanup-required")
+		}
+		return ErrCleanupRequired
+	}
+	for id := range blocked {
+		delete(r.blocked, id)
+	}
+	// The revoked grants remain revoked; a subsequent Resolve gets a new opaque
+	// generation and consent must create a new grant. Completed Q is not consent.
+	return ""
+}
+
+// This is the existing S2 owner/reaper, not a new identity process manager.
+func (c *operationCohort) drainRelaxedIdentity(ctx context.Context, id RelaxedIdentity) Code {
+	ctx, cancel := context.WithTimeout(ctx, RevokeDrainTimeout)
+	defer cancel()
+	if err := c.drainSelected(ctx, TerminateGrace, func(op *cohortOperation) bool {
+		return op.actor.relaxed != nil && relaxedActorIdentity(op.actor) == id
+	}); err != nil {
+		return ErrCleanupRequired
+	}
+	if nativeContextCode(ctx) != "" {
+		return ErrCleanupRequired
+	}
+	for _, op := range c.operations {
+		if op.actor.relaxed != nil && relaxedActorIdentity(op.actor) == id {
+			return ErrCleanupRequired
+		}
+	}
+	return ""
+}