@synopackageland/cli 0.4.0 → 0.4.1

package/templates/native-go/backend/internal/helper/relaxed_identity_contract.go

@@ -0,0 +1,105 @@
+package helper
+
+import (
+	"context"
+	"time"
+)
+
+// S1R observations are root-only adapter results, never request shapes. Each
+// source must prove the current local identity, obey ctx, and use safe codes.
+// No DSM implementation is installed until the target-build research is proven.
+type RelaxedIdentity struct {
+	UID      uint32
+	Username string
+}
+
+type RelaxedSession struct {
+	Username     string // native validated name; UID comes from current local lookup
+	SessionRef   string // server-issued opaque binding; not SID or cookie hash
+	CSRFVerified bool
+	CheckedAt    time.Time
+}
+type RelaxedAccount struct {
+	Identity        RelaxedIdentity
+	Kind            string
+	Exists, Enabled bool
+	PrimaryGID      uint32
+	PrimaryGIDKnown bool
+	StateKnown      bool
+	ExpiryKnown     bool
+	Expired         bool
+	PasswordKnown   bool
+	PasswordUsable  bool
+	CheckedAt       time.Time
+}
+type RelaxedGroups struct {
+	Identity   RelaxedIdentity
+	Groups     []uint32 // nil means incomplete; explicit empty is complete
+	Complete   bool
+	PrimaryGID uint32
+	Admin      bool
+	AdminKnown bool
+	CheckedAt  time.Time
+}
+type RelaxedAppPermission struct {
+	Identity      RelaxedIdentity
+	AppID         string
+	ClientAddress string
+	SessionRef    string
+	Allowed       bool
+	CheckedAt     time.Time
+}
+
+type RelaxedSessionValidator interface {
+	ValidateRelaxedSession(context.Context, SessionCarriers) (RelaxedSession, Code)
+}
+type RelaxedAccountProvider interface {
+	LookupRelaxedAccount(context.Context, string) (RelaxedAccount, Code)
+}
+type RelaxedGroupProvider interface {
+	LookupRelaxedGroups(context.Context, RelaxedAccount) (RelaxedGroups, Code)
+}
+type RelaxedAppValidator interface {
+	ValidateRelaxedApp(context.Context, SessionCarriers, RelaxedSession, RelaxedAccount, string) (RelaxedAppPermission, Code)
+}
+
+type RelaxedAdapters struct {
+	// Trusted DSM registration binding; never inferred from package or window name.
+	AppPrivilegeID string
+	Sessions       RelaxedSessionValidator
+	Accounts       RelaxedAccountProvider
+	Groups         RelaxedGroupProvider
+	App            RelaxedAppValidator
+}
+
+// Nil adapters fail closed. A provider also needs the existing S3 ordering
+// owner before minting actors, so identity changes cannot bypass durable R/Q.
+func NewRelaxedNativeProvider(adapters RelaxedAdapters) *NativeProvider {
+	return &NativeProvider{relaxed: &relaxedProvider{adapters: adapters}, now: time.Now}
+}
+
+type relaxedProvider struct {
+	adapters   RelaxedAdapters
+	authority  *GrantAuthority
+	principals map[RelaxedIdentity]Principal
+	blocked    map[RelaxedIdentity]bool
+}
+
+// drainRelaxedIdentity must use the SAME owned S2 cohort, including the user's
+// operations on grants issued by others. Absence is cleanup-required, never Q.
+type relaxedIdentityCohort interface {
+	drainRelaxedIdentity(context.Context, RelaxedIdentity) Code
+}
+
+func (r *relaxedProvider) bind(a *GrantAuthority) Code {
+	if r == nil || a == nil || r.authority != nil {
+		return ErrUnavailable
+	}
+	if a.policy.Inventory.Protocol != DataProtocol || a.policy.Inventory.DataAccess != "relaxed" {
+		return ErrIncompatible
+	}
+	r.authority = a
+	r.principals = map[RelaxedIdentity]Principal{}
+	r.blocked = map[RelaxedIdentity]bool{}
+	return ""
+}

package/templates/native-go/backend/internal/helper/relaxed_identity_test.go

@@ -0,0 +1,406 @@
+package helper
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"slices"
+	"testing"
+	"time"
+)
+
+type relaxedFake struct {
+	session                                      RelaxedSession
+	account                                      RelaxedAccount
+	groups                                       RelaxedGroups
+	app                                          RelaxedAppPermission
+	sessionCode, accountCode, groupCode, appCode Code
+	afterApp                                     func()
+}
+
+func (f *relaxedFake) ValidateRelaxedSession(ctx context.Context, _ SessionCarriers) (RelaxedSession, Code) {
+	if _, ok := ctx.Deadline(); !ok {
+		panic("missing deadline")
+	}
+	return f.session, f.sessionCode
+}
+func (f *relaxedFake) LookupRelaxedAccount(_ context.Context, name string) (RelaxedAccount, Code) {
+	return f.account, f.accountCode
+}
+func (f *relaxedFake) LookupRelaxedGroups(_ context.Context, account RelaxedAccount) (RelaxedGroups, Code) {
+	return f.groups, f.groupCode
+}
+func (f *relaxedFake) ValidateRelaxedApp(_ context.Context, _ SessionCarriers, _ RelaxedSession, _ RelaxedAccount, _ string) (RelaxedAppPermission, Code) {
+	if f.afterApp != nil {
+		f.afterApp()
+	}
+	return f.app, f.appCode
+}
+
+type relaxedFakeCohort struct {
+	keys       []GrantDrainKey
+	identities []RelaxedIdentity
+	before     func(GrantDrainKey)
+	fail       Code
+}
+
+func (f *relaxedFakeCohort) DrainGrant(_ context.Context, key GrantDrainKey) (GrantQuiescence, Code) {
+	f.keys = append(f.keys, key)
+	if f.before != nil {
+		f.before(key)
+	}
+	return completeGrantProof(key), f.fail
+}
+func (f *relaxedFakeCohort) drainRelaxedIdentity(_ context.Context, id RelaxedIdentity) Code {
+	f.identities = append(f.identities, id)
+	return f.fail
+}
+func relaxedFixture(t *testing.T) (*GrantAuthority, *memoryGrantRepository, *NativeProvider, *relaxedFake, *consentStub, *relaxedFakeCohort, SessionCarriers) {
+	t.Helper()
+	_, repo, _, _, _, consent, carriers, now := grantAuthorityFixture(t)
+	repo.policy.Inventory.DataAccess = "relaxed"
+	id := RelaxedIdentity{UID: 1001, Username: "alice"}
+	f := &relaxedFake{
+		session: RelaxedSession{Username: id.Username, CSRFVerified: true, SessionRef: grantRef('c'), CheckedAt: now},
+		account: RelaxedAccount{Identity: id, Kind: "local", Exists: true, Enabled: true, PrimaryGID: 100, PrimaryGIDKnown: true, StateKnown: true, ExpiryKnown: true, PasswordKnown: true, PasswordUsable: true, CheckedAt: now},
+		groups:  RelaxedGroups{Identity: id, Groups: []uint32{105, 101, 105}, Complete: true, PrimaryGID: 100, Admin: true, AdminKnown: true, CheckedAt: now},
+		app:     RelaxedAppPermission{Identity: id, AppID: "FixturePrivilege", ClientAddress: carriers.ClientAddress, SessionRef: grantRef('c'), Allowed: true, CheckedAt: now},
+	}
+	p := NewRelaxedNativeProvider(RelaxedAdapters{Sessions: f, Accounts: f, Groups: f, App: f, AppPrivilegeID: "FixturePrivilege"})
+	p.now = func() time.Time { return now }
+	cohort := &relaxedFakeCohort{}
+	a, code := NewGrantAuthority(repo, p, consent, cohort)
+	if code != "" {
+		t.Fatal(code)
+	}
+	a.now = p.now
+	return a, repo, p, f, consent, cohort, carriers
+}
+func relaxedActor(t *testing.T, p *NativeProvider, c SessionCarriers) NativeActor {
+	t.Helper()
+	actor, code := p.Resolve(context.Background(), c)
+	if code != "" {
+		t.Fatal(code)
+	}
+	return actor
+}
+func relaxedConsent(t *testing.T, a *GrantAuthority, r *memoryGrantRepository, p *NativeProvider, v *consentStub, c SessionCarriers, kind ScopeKind) Grant {
+	t.Helper()
+	actor := relaxedActor(t, p, c)
+	v.selection.Principal = actor.Principal()
+	v.selection.Scope.Kind = kind
+	v.selection.SessionRef = actor.SessionRef()
+	i := prepareGrant(t, a, c, kind)
+	return confirmGrant(t, a, r, c, i)
+}
+func setRelaxedIdentity(f *relaxedFake, id RelaxedIdentity) {
+	f.session.Username = id.Username
+	f.account.Identity = id
+	f.groups.Identity = id
+	f.app.Identity = id
+}
+func TestRelaxedIdentitySuccessAndSamePairRecreation(t *testing.T) {
+	a, r, p, f, v, _, c := relaxedFixture(t)
+	actor := relaxedActor(t, p, c)
+	if actor.IdentityBasis() != "uid-username" || actor.UID() != 1001 || actor.Username() != "alice" || !slices.Equal(actor.Groups(), []uint32{101, 105}) {
+		t.Fatal("wrong actor")
+	}
+	groups := actor.Groups()
+	groups[0] = 999
+	f.groups.Groups = []uint32{105, 101}
+	again, code := p.Revalidate(context.Background(), c, actor)
+	if code != "" || again.Principal() != actor.Principal() {
+		t.Fatal("same pair did not retain identity", code)
+	}
+	g := relaxedConsent(t, a, r, p, v, c, ScopePersonal)
+	encoded, _ := json.Marshal(g)
+	if !bytes.Contains(encoded, []byte(`"identityBasis":"uid-username"`)) || !bytes.Contains(encoded, []byte(`"uid":1001`)) || !bytes.Contains(encoded, []byte(`"username":"alice"`)) {
+		t.Fatal("grant lost explicit identity")
+	}
+	if _, code := DecodeGrantStore(bytes.NewReader(mustRelaxedJSON(t, r.store))); code != "" {
+		t.Fatal(code)
+	}
+	// There is deliberately no account-incarnation/reset/boundary input in S1R.
+	if actor := relaxedActor(t, p, c); actor.Principal() != g.Owner {
+		t.Fatal("same UID/name recreation changed grant identity")
+	}
+}
+func mustRelaxedJSON(t *testing.T, v any) []byte {
+	t.Helper()
+	b, e := json.Marshal(v)
+	if e != nil {
+		t.Fatal(e)
+	}
+	return b
+}
+func TestRelaxedAdaptersFailClosed(t *testing.T) {
+	cases := []struct {
+		name   string
+		change func(*NativeProvider, *relaxedFake, *SessionCarriers)
+		want   Code
+	}{
+		{"CSRF unproven", func(p *NativeProvider, f *relaxedFake, c *SessionCarriers) { f.session.CSRFVerified = false }, ErrUnsupported},
+		{"unregistered App ID", func(p *NativeProvider, f *relaxedFake, c *SessionCarriers) { p.relaxed.adapters.AppPrivilegeID = "" }, ErrUnsupported},
+		{"unknown account state", func(p *NativeProvider, f *relaxedFake, c *SessionCarriers) { f.account.StateKnown = false }, ErrUnavailable},
+		{"unknown expiry", func(p *NativeProvider, f *relaxedFake, c *SessionCarriers) { f.account.ExpiryKnown = false }, ErrUnavailable},
+		{"account expired", func(p *NativeProvider, f *relaxedFake, c *SessionCarriers) { f.account.Expired = true }, ErrDenied},
+		{"unknown password policy", func(p *NativeProvider, f *relaxedFake, c *SessionCarriers) { f.account.PasswordKnown = false }, ErrUnavailable},
+		{"password unusable", func(p *NativeProvider, f *relaxedFake, c *SessionCarriers) { f.account.PasswordUsable = false }, ErrDenied},
+		{"unknown primary GID", func(p *NativeProvider, f *relaxedFake, c *SessionCarriers) { f.account.PrimaryGIDKnown = false }, ErrUnavailable},
+		{"partial groups", func(p *NativeProvider, f *relaxedFake, c *SessionCarriers) { f.groups.Complete = false }, ErrUnavailable},
+		{"wrong group primary GID", func(p *NativeProvider, f *relaxedFake, c *SessionCarriers) { f.groups.PrimaryGID++ }, ErrSuspended},
+		{"wrong App IP", func(p *NativeProvider, f *relaxedFake, c *SessionCarriers) { f.app.ClientAddress = "192.0.2.2" }, ErrDenied},
+		{"missing session", func(p *NativeProvider, f *relaxedFake, c *SessionCarriers) { p.relaxed.adapters.Sessions = nil }, ErrUnavailable},
+		{"missing account", func(p *NativeProvider, f *relaxedFake, c *SessionCarriers) { p.relaxed.adapters.Accounts = nil }, ErrUnavailable},
+		{"missing groups", func(p *NativeProvider, f *relaxedFake, c *SessionCarriers) { p.relaxed.adapters.Groups = nil }, ErrUnavailable},
+		{"missing App", func(p *NativeProvider, f *relaxedFake, c *SessionCarriers) { p.relaxed.adapters.App = nil }, ErrUnavailable},
+		{"anonymous", func(p *NativeProvider, f *relaxedFake, c *SessionCarriers) { c.Cookie = "" }, ErrDenied},
+		{"expired session", func(p *NativeProvider, f *relaxedFake, c *SessionCarriers) { f.sessionCode = ErrDenied }, ErrDenied},
+		{"deleted", func(p *NativeProvider, f *relaxedFake, c *SessionCarriers) { f.account.Exists = false }, ErrDenied},
+		{"disabled", func(p *NativeProvider, f *relaxedFake, c *SessionCarriers) { f.account.Enabled = false }, ErrDenied},
+		{"LDAP", func(p *NativeProvider, f *relaxedFake, c *SessionCarriers) { f.account.Kind = "ldap" }, ErrUnsupported},
+		{"session root", func(p *NativeProvider, f *relaxedFake, c *SessionCarriers) { f.account.Identity.UID = 0 }, ErrDenied},
+		{"unknown UID", func(p *NativeProvider, f *relaxedFake, c *SessionCarriers) { f.account.Identity.UID = 0 }, ErrDenied},
+		{"root group", func(p *NativeProvider, f *relaxedFake, c *SessionCarriers) { f.account.PrimaryGID = 0 }, ErrDenied},
+		{"account name mismatch", func(p *NativeProvider, f *relaxedFake, c *SessionCarriers) { f.account.Identity.Username = "other" }, ErrSuspended},
+		{"group identity mismatch", func(p *NativeProvider, f *relaxedFake, c *SessionCarriers) { f.groups.Identity.UID++ }, ErrSuspended},
+		{"unknown groups", func(p *NativeProvider, f *relaxedFake, c *SessionCarriers) { f.groups.Groups = nil }, ErrUnavailable},
+		{"unknown role", func(p *NativeProvider, f *relaxedFake, c *SessionCarriers) { f.groups.AdminKnown = false }, ErrUnavailable},
+		{"App revoked", func(p *NativeProvider, f *relaxedFake, c *SessionCarriers) { f.app.Allowed = false }, ErrDenied},
+		{"wrong App", func(p *NativeProvider, f *relaxedFake, c *SessionCarriers) { f.app.AppID = "OtherApp" }, ErrDenied},
+		{"wrong App actor", func(p *NativeProvider, f *relaxedFake, c *SessionCarriers) { f.app.Identity.UID++ }, ErrDenied},
+		{"wrong App session", func(p *NativeProvider, f *relaxedFake, c *SessionCarriers) { f.app.SessionRef = grantRef('f') }, ErrDenied},
+		{"raw adapter error", func(p *NativeProvider, f *relaxedFake, c *SessionCarriers) { f.groupCode = Code("native diagnostic") }, ErrUnavailable},
+		{"session proof old", func(p *NativeProvider, f *relaxedFake, c *SessionCarriers) {
+			f.session.CheckedAt = f.session.CheckedAt.Add(-NativeProofFreshness - time.Nanosecond)
+		}, ErrStale},
+		{"account proof zero", func(p *NativeProvider, f *relaxedFake, c *SessionCarriers) { f.account.CheckedAt = time.Time{} }, ErrStale},
+		{"group proof future", func(p *NativeProvider, f *relaxedFake, c *SessionCarriers) {
+			f.groups.CheckedAt = f.groups.CheckedAt.Add(time.Nanosecond)
+		}, ErrStale},
+		{"App proof zero", func(p *NativeProvider, f *relaxedFake, c *SessionCarriers) { f.app.CheckedAt = time.Time{} }, ErrStale},
+	}
+	for _, tt := range cases {
+		t.Run(tt.name, func(t *testing.T) {
+			_, _, p, f, _, _, c := relaxedFixture(t)
+			tt.change(p, f, &c)
+			actor, code := p.Resolve(context.Background(), c)
+			if code != tt.want || actor.valid {
+				t.Fatalf("code=%q want=%q actor=%v", code, tt.want, actor.valid)
+			}
+		})
+	}
+	p := NewRelaxedNativeProvider(RelaxedAdapters{})
+	if actor, code := p.Resolve(context.Background(), SessionCarriers{}); code != ErrUnavailable || actor.valid {
+		t.Fatal(code)
+	}
+}
+func TestRelaxedIdentityMismatchRevokesEveryOwnedGrantBeforeQ(t *testing.T) {
+	for _, rename := range []bool{false, true} {
+		t.Run(map[bool]string{false: "UID", true: "username"}[rename], func(t *testing.T) {
+			a, r, p, f, v, cohort, c := relaxedFixture(t)
+			old := relaxedActor(t, p, c)
+			gs := []Grant{relaxedConsent(t, a, r, p, v, c, ScopePersonal), relaxedConsent(t, a, r, p, v, c, ScopePersonal), relaxedConsent(t, a, r, p, v, c, ScopeShared)}
+			setRelaxedIdentity(f, RelaxedIdentity{UID: 2001, Username: "bob"})
+			other := relaxedConsent(t, a, r, p, v, c, ScopePersonal)
+			next := RelaxedIdentity{UID: 1002, Username: "alice"}
+			if rename {
+				next = RelaxedIdentity{UID: 1001, Username: "alice2"}
+			}
+			setRelaxedIdentity(f, next)
+			cohort.before = func(_ GrantDrainKey) {
+				if r.inTransaction {
+					t.Fatal("Q under disk locks")
+				}
+				if actor, code := p.Resolve(context.Background(), c); code == "" || actor.valid {
+					t.Fatal("prospective identity admitted before Q")
+				}
+				for _, g := range gs {
+					if findGrant(&r.store, g.ID).State != GrantRevoked {
+						t.Fatal("Q before all durable R")
+					}
+				}
+				if code := a.WithGrantAdmission(GrantAdmission{old, gs[0].ID, gs[0].Revision, ActionRead, gs[0].LastValidated, true}, func(Grant, NativeActor) Code { t.Fatal("old admission ran"); return "" }); code == "" {
+					t.Fatal("admitted old actor")
+				}
+			}
+			if actor, code := p.Resolve(context.Background(), c); code != ErrSuspended || actor.valid {
+				t.Fatal("mismatch admitted", code)
+			}
+			if len(cohort.keys) != 3 || len(cohort.identities) != 1 || findGrant(&r.store, other.ID).State != GrantActive {
+				t.Fatal("wrong invalidation scope")
+			}
+			// Fresh consent after complete Q creates a new ID; no revoked record revives.
+			fresh := relaxedConsent(t, a, r, p, v, c, ScopePersonal)
+			if fresh.ID == gs[0].ID || fresh.Owner == old.Principal() {
+				t.Fatal("old grant revived")
+			}
+		})
+	}
+}
+func TestRelaxedInvalidationFailureKeepsFence(t *testing.T) {
+	for _, failure := range []string{"commit", "drain", "Q save"} {
+		t.Run(failure, func(t *testing.T) {
+			a, r, p, f, v, cohort, c := relaxedFixture(t)
+			g := relaxedConsent(t, a, r, p, v, c, ScopePersonal)
+			switch failure {
+			case "commit":
+				r.fail = ErrCommitUncertain
+			case "drain":
+				cohort.fail = ErrCleanupRequired
+			case "Q save":
+				r.qFailure = ErrUnavailable
+			}
+			setRelaxedIdentity(f, RelaxedIdentity{UID: 1002, Username: "alice"})
+			if actor, code := p.Resolve(context.Background(), c); code != ErrCleanupRequired || actor.valid {
+				t.Fatal("false R/Q", code)
+			}
+			if code := a.WithGrantAdmission(GrantAdmission{relaxedActorWithoutResolve(g), g.ID, g.Revision, ActionRead, g.LastValidated, true}, func(Grant, NativeActor) Code { t.Fatal("failed invalidation admitted"); return "" }); code == "" {
+				t.Fatal("fence lost")
+			}
+			if failure != "commit" && findGrant(&r.store, g.ID).State != GrantRevoked {
+				t.Fatal("lost durable R")
+			}
+			if actor, code := p.Resolve(context.Background(), c); code == "" || actor.valid {
+				t.Fatal("failure cleared itself")
+			}
+		})
+	}
+}
+func relaxedActorWithoutResolve(g Grant) NativeActor {
+	return NativeActor{account: LocalAccount{Principal: g.Owner, Enabled: true, UID: 1001, GID: 100, Username: "alice", CheckedAt: time.Unix(1700000000, 0)}, valid: true}
+}
+func TestRelaxedRevalidateCredentialsCancellationAndAging(t *testing.T) {
+	_, _, p, f, _, _, c := relaxedFixture(t)
+	old := relaxedActor(t, p, c)
+	f.groups.Groups = []uint32{}
+	if _, code := p.Revalidate(context.Background(), c, old); code != ErrStale {
+		t.Fatal(code)
+	}
+	f.groups.Groups = []uint32{101, 105}
+	f.account.PrimaryGID++
+	f.groups.PrimaryGID++
+	if _, code := p.Revalidate(context.Background(), c, old); code != ErrStale {
+		t.Fatal("GID should stale credentials", code)
+	}
+	f.account.PrimaryGID--
+	f.groups.PrimaryGID--
+	ctx, cancel := context.WithCancel(context.Background())
+	f.afterApp = cancel
+	if _, code := p.Resolve(ctx, c); code != ErrCanceled {
+		t.Fatal(code)
+	}
+	f.afterApp = func() {
+		now := p.now()
+		p.now = func() time.Time { return now.Add(NativeProofFreshness + time.Nanosecond) }
+	}
+	if _, code := p.Resolve(context.Background(), c); code != ErrStale {
+		t.Fatal("extended old session proof", code)
+	}
+}
+
+func TestRelaxedPrincipalDecoderAndLegacyIsolation(t *testing.T) {
+	a, r, p, _, v, _, c := relaxedFixture(t)
+	g := relaxedConsent(t, a, r, p, v, c, ScopePersonal)
+	for _, change := range []func(*Principal){
+		func(p *Principal) { p.IdentityBasis = "" }, func(p *Principal) { p.IdentityBasis = "managed-enrollment" },
+		func(p *Principal) { p.UID = 0 }, func(p *Principal) { p.Username = "" }, func(p *Principal) { p.Username = "../other" },
+	} {
+		next := cloneAuthorityStore(r.store)
+		change(&next.Grants[0].Owner)
+		next.Grants[0].Issuer = next.Grants[0].Owner
+		if _, code := DecodeGrantStore(bytes.NewReader(mustRelaxedJSON(t, next))); code == "" {
+			t.Fatal("malformed S1R principal accepted")
+		}
+	}
+	// Old schema-1 records retain their strict semantics and cannot be silently
+	// promoted into a relaxed grant by interpreting a digest as an account ID.
+	legacy, code := DecodeGrantStore(bytes.NewReader(dataFixture(t, "grant-store")))
+	if code != "" {
+		t.Fatal(code)
+	}
+	actor := relaxedActor(t, p, c)
+	proof := GrantAdmission{actor, g.ID, g.Revision, ActionRead, g.LastValidated, true}
+	proof.Actor.account.Principal = legacy.Grants[0].Owner
+	if code := a.WithGrantAdmission(proof, func(Grant, NativeActor) Code { t.Fatal("legacy principal admitted into relaxed authority"); return "" }); code == "" {
+		t.Fatal("lost identity-basis gate")
+	}
+}
+func TestRelaxedDisableAndAppRevokeInvalidatePreviouslyGrantedUser(t *testing.T) {
+	for _, what := range []string{"disabled", "deleted", "lookup denied", "App checker denied", "App revoke"} {
+		t.Run(what, func(t *testing.T) {
+			a, r, p, f, v, cohort, c := relaxedFixture(t)
+			g := relaxedConsent(t, a, r, p, v, c, ScopePersonal)
+			switch what {
+			case "lookup denied":
+				f.accountCode = ErrDenied
+			case "App checker denied":
+				f.appCode = ErrDenied
+			case "disabled":
+				f.account.Enabled = false
+			case "deleted":
+				f.account.Exists = false
+			case "App revoke":
+				f.app.Allowed = false
+			}
+			if actor, code := p.Resolve(context.Background(), c); code != ErrDenied || actor.valid {
+				t.Fatal(code)
+			}
+			if findGrant(&r.store, g.ID).State != GrantRevoked || len(cohort.keys) != 1 || len(cohort.identities) != 1 {
+				t.Fatal("old authority survived observation")
+			}
+			f.account.Enabled = true
+			f.accountCode = ""
+			f.appCode = ""
+			f.account.Exists = true
+			f.app.Allowed = true
+			if actor := relaxedActor(t, p, c); actor.Principal() == g.Owner {
+				t.Fatal("restore revived old actor generation")
+			}
+			if findGrant(&r.store, g.ID).State != GrantRevoked {
+				t.Fatal("restore un-revoked grant")
+			}
+		})
+	}
+}
+func TestRelaxedSwappedSessionDoesNotRevokeOtherUsersGrants(t *testing.T) {
+	a, r, p, f, v, _, c := relaxedFixture(t)
+	old := relaxedActor(t, p, c)
+	mine := relaxedConsent(t, a, r, p, v, c, ScopePersonal)
+	setRelaxedIdentity(f, RelaxedIdentity{UID: 2001, Username: "bob"})
+	other := relaxedConsent(t, a, r, p, v, c, ScopePersonal)
+	if actor, code := p.Revalidate(context.Background(), c, old); code != ErrSuspended || actor.valid {
+		t.Fatal("cross-user snapshot accepted", code)
+	}
+	if findGrant(&r.store, mine.ID).State != GrantRevoked || findGrant(&r.store, other.ID).State != GrantActive {
+		t.Fatal("wrong account revoked")
+	}
+	if relaxedActor(t, p, c).Principal() != other.Owner {
+		t.Fatal("foreign identity generation changed")
+	}
+}
+
+func TestRelaxedNegativeAccountObservationRevokesRecordedIdentity(t *testing.T) {
+	for _, kind := range []string{"canonical rename", "deleted without tuple"} {
+		t.Run(kind, func(t *testing.T) {
+			a, r, p, f, v, cohort, c := relaxedFixture(t)
+			g := relaxedConsent(t, a, r, p, v, c, ScopePersonal)
+			old := g.Owner
+			want := ErrSuspended
+			if kind == "canonical rename" {
+				f.account.Identity.Username = "alice-renamed"
+			} else {
+				f.account.Exists = false
+				f.account.Identity = RelaxedIdentity{}
+				f.account.PrimaryGIDKnown = false
+				want = ErrDenied
+			}
+			if actor, code := p.Resolve(context.Background(), c); code != want || actor.valid {
+				t.Fatalf("code=%q want=%q", code, want)
+			}
+			if findGrant(&r.store, g.ID).State != GrantRevoked || len(cohort.keys) != 1 || len(cohort.identities) != 1 || cohort.identities[0] != relaxedPrincipalIdentity(old) {
+				t.Fatal("negative account observation left old grants or operation identity alive")
+			}
+		})
+	}
+}