@synopackageland/cli 0.5.3 → 0.6.0

package/dist/templates/native-go/backend/internal/helper/relaxed_identity_contract.go

@@ -1,105 +0,0 @@
-package helper
-
-import (
-	"context"
-	"time"
-)
-
-// S1R observations are root-only adapter results, never request shapes. Each
-// source must prove the current local identity, obey ctx, and use safe codes.
-// No DSM implementation is installed until the target-build research is proven.
-type RelaxedIdentity struct {
-	UID      uint32
-	Username string
-}
-
-type RelaxedSession struct {
-	Username     string // native validated name; UID comes from current local lookup
-	SessionRef   string // server-issued opaque binding; not SID or cookie hash
-	CSRFVerified bool
-	CheckedAt    time.Time
-}
-type RelaxedAccount struct {
-	Identity        RelaxedIdentity
-	Kind            string
-	Exists, Enabled bool
-	PrimaryGID      uint32
-	PrimaryGIDKnown bool
-	StateKnown      bool
-	ExpiryKnown     bool
-	Expired         bool
-	PasswordKnown   bool
-	PasswordUsable  bool
-	CheckedAt       time.Time
-}
-type RelaxedGroups struct {
-	Identity   RelaxedIdentity
-	Groups     []uint32 // nil means incomplete; explicit empty is complete
-	Complete   bool
-	PrimaryGID uint32
-	Admin      bool
-	AdminKnown bool
-	CheckedAt  time.Time
-}
-type RelaxedAppPermission struct {
-	Identity      RelaxedIdentity
-	AppID         string
-	ClientAddress string
-	SessionRef    string
-	Allowed       bool
-	CheckedAt     time.Time
-}
-
-type RelaxedSessionValidator interface {
-	ValidateRelaxedSession(context.Context, SessionCarriers) (RelaxedSession, Code)
-}
-type RelaxedAccountProvider interface {
-	LookupRelaxedAccount(context.Context, string) (RelaxedAccount, Code)
-}
-type RelaxedGroupProvider interface {
-	LookupRelaxedGroups(context.Context, RelaxedAccount) (RelaxedGroups, Code)
-}
-type RelaxedAppValidator interface {
-	ValidateRelaxedApp(context.Context, SessionCarriers, RelaxedSession, RelaxedAccount, string) (RelaxedAppPermission, Code)
-}
-
-type RelaxedAdapters struct {
-	// Trusted DSM registration binding; never inferred from package or window name.
-	AppPrivilegeID string
-	Sessions       RelaxedSessionValidator
-	Accounts       RelaxedAccountProvider
-	Groups         RelaxedGroupProvider
-	App            RelaxedAppValidator
-}
-
-// Nil adapters fail closed. A provider also needs the existing S3 ordering
-// owner before minting actors, so identity changes cannot bypass durable R/Q.
-func NewRelaxedNativeProvider(adapters RelaxedAdapters) *NativeProvider {
-	return &NativeProvider{relaxed: &relaxedProvider{adapters: adapters}, now: time.Now}
-}
-
-type relaxedProvider struct {
-	adapters   RelaxedAdapters
-	authority  *GrantAuthority
-	principals map[RelaxedIdentity]Principal
-	blocked    map[RelaxedIdentity]bool
-}
-
-// drainRelaxedIdentity must use the SAME owned S2 cohort, including the user's
-// operations on grants issued by others. Absence is cleanup-required, never Q.
-type relaxedIdentityCohort interface {
-	drainRelaxedIdentity(context.Context, RelaxedIdentity) Code
-}
-
-func (r *relaxedProvider) bind(a *GrantAuthority) Code {
-	if r == nil || a == nil || r.authority != nil {
-		return ErrUnavailable
-	}
-	if a.policy.Inventory.Protocol != DataProtocol || a.policy.Inventory.DataAccess != "relaxed" {
-		return ErrIncompatible
-	}
-	r.authority = a
-	r.principals = map[RelaxedIdentity]Principal{}
-	r.blocked = map[RelaxedIdentity]bool{}
-	return ""
-}

package/dist/templates/native-go/backend/internal/helper/relaxed_identity_test.go

@@ -1,406 +0,0 @@
-package helper
-
-import (
-	"bytes"
-	"context"
-	"encoding/json"
-	"slices"
-	"testing"
-	"time"
-)
-
-type relaxedFake struct {
-	session                                      RelaxedSession
-	account                                      RelaxedAccount
-	groups                                       RelaxedGroups
-	app                                          RelaxedAppPermission
-	sessionCode, accountCode, groupCode, appCode Code
-	afterApp                                     func()
-}
-
-func (f *relaxedFake) ValidateRelaxedSession(ctx context.Context, _ SessionCarriers) (RelaxedSession, Code) {
-	if _, ok := ctx.Deadline(); !ok {
-		panic("missing deadline")
-	}
-	return f.session, f.sessionCode
-}
-func (f *relaxedFake) LookupRelaxedAccount(_ context.Context, name string) (RelaxedAccount, Code) {
-	return f.account, f.accountCode
-}
-func (f *relaxedFake) LookupRelaxedGroups(_ context.Context, account RelaxedAccount) (RelaxedGroups, Code) {
-	return f.groups, f.groupCode
-}
-func (f *relaxedFake) ValidateRelaxedApp(_ context.Context, _ SessionCarriers, _ RelaxedSession, _ RelaxedAccount, _ string) (RelaxedAppPermission, Code) {
-	if f.afterApp != nil {
-		f.afterApp()
-	}
-	return f.app, f.appCode
-}
-
-type relaxedFakeCohort struct {
-	keys       []GrantDrainKey
-	identities []RelaxedIdentity
-	before     func(GrantDrainKey)
-	fail       Code
-}
-
-func (f *relaxedFakeCohort) DrainGrant(_ context.Context, key GrantDrainKey) (GrantQuiescence, Code) {
-	f.keys = append(f.keys, key)
-	if f.before != nil {
-		f.before(key)
-	}
-	return completeGrantProof(key), f.fail
-}
-func (f *relaxedFakeCohort) drainRelaxedIdentity(_ context.Context, id RelaxedIdentity) Code {
-	f.identities = append(f.identities, id)
-	return f.fail
-}
-func relaxedFixture(t *testing.T) (*GrantAuthority, *memoryGrantRepository, *NativeProvider, *relaxedFake, *consentStub, *relaxedFakeCohort, SessionCarriers) {
-	t.Helper()
-	_, repo, _, _, _, consent, carriers, now := grantAuthorityFixture(t)
-	repo.policy.Inventory.DataAccess = "relaxed"
-	id := RelaxedIdentity{UID: 1001, Username: "alice"}
-	f := &relaxedFake{
-		session: RelaxedSession{Username: id.Username, CSRFVerified: true, SessionRef: grantRef('c'), CheckedAt: now},
-		account: RelaxedAccount{Identity: id, Kind: "local", Exists: true, Enabled: true, PrimaryGID: 100, PrimaryGIDKnown: true, StateKnown: true, ExpiryKnown: true, PasswordKnown: true, PasswordUsable: true, CheckedAt: now},
-		groups:  RelaxedGroups{Identity: id, Groups: []uint32{105, 101, 105}, Complete: true, PrimaryGID: 100, Admin: true, AdminKnown: true, CheckedAt: now},
-		app:     RelaxedAppPermission{Identity: id, AppID: "FixturePrivilege", ClientAddress: carriers.ClientAddress, SessionRef: grantRef('c'), Allowed: true, CheckedAt: now},
-	}
-	p := NewRelaxedNativeProvider(RelaxedAdapters{Sessions: f, Accounts: f, Groups: f, App: f, AppPrivilegeID: "FixturePrivilege"})
-	p.now = func() time.Time { return now }
-	cohort := &relaxedFakeCohort{}
-	a, code := NewGrantAuthority(repo, p, consent, cohort)
-	if code != "" {
-		t.Fatal(code)
-	}
-	a.now = p.now
-	return a, repo, p, f, consent, cohort, carriers
-}
-func relaxedActor(t *testing.T, p *NativeProvider, c SessionCarriers) NativeActor {
-	t.Helper()
-	actor, code := p.Resolve(context.Background(), c)
-	if code != "" {
-		t.Fatal(code)
-	}
-	return actor
-}
-func relaxedConsent(t *testing.T, a *GrantAuthority, r *memoryGrantRepository, p *NativeProvider, v *consentStub, c SessionCarriers, kind ScopeKind) Grant {
-	t.Helper()
-	actor := relaxedActor(t, p, c)
-	v.selection.Principal = actor.Principal()
-	v.selection.Scope.Kind = kind
-	v.selection.SessionRef = actor.SessionRef()
-	i := prepareGrant(t, a, c, kind)
-	return confirmGrant(t, a, r, c, i)
-}
-func setRelaxedIdentity(f *relaxedFake, id RelaxedIdentity) {
-	f.session.Username = id.Username
-	f.account.Identity = id
-	f.groups.Identity = id
-	f.app.Identity = id
-}
-func TestRelaxedIdentitySuccessAndSamePairRecreation(t *testing.T) {
-	a, r, p, f, v, _, c := relaxedFixture(t)
-	actor := relaxedActor(t, p, c)
-	if actor.IdentityBasis() != "uid-username" || actor.UID() != 1001 || actor.Username() != "alice" || !slices.Equal(actor.Groups(), []uint32{101, 105}) {
-		t.Fatal("wrong actor")
-	}
-	groups := actor.Groups()
-	groups[0] = 999
-	f.groups.Groups = []uint32{105, 101}
-	again, code := p.Revalidate(context.Background(), c, actor)
-	if code != "" || again.Principal() != actor.Principal() {
-		t.Fatal("same pair did not retain identity", code)
-	}
-	g := relaxedConsent(t, a, r, p, v, c, ScopePersonal)
-	encoded, _ := json.Marshal(g)
-	if !bytes.Contains(encoded, []byte(`"identityBasis":"uid-username"`)) || !bytes.Contains(encoded, []byte(`"uid":1001`)) || !bytes.Contains(encoded, []byte(`"username":"alice"`)) {
-		t.Fatal("grant lost explicit identity")
-	}
-	if _, code := DecodeGrantStore(bytes.NewReader(mustRelaxedJSON(t, r.store))); code != "" {
-		t.Fatal(code)
-	}
-	// There is deliberately no account-incarnation/reset/boundary input in S1R.
-	if actor := relaxedActor(t, p, c); actor.Principal() != g.Owner {
-		t.Fatal("same UID/name recreation changed grant identity")
-	}
-}
-func mustRelaxedJSON(t *testing.T, v any) []byte {
-	t.Helper()
-	b, e := json.Marshal(v)
-	if e != nil {
-		t.Fatal(e)
-	}
-	return b
-}
-func TestRelaxedAdaptersFailClosed(t *testing.T) {
-	cases := []struct {
-		name   string
-		change func(*NativeProvider, *relaxedFake, *SessionCarriers)
-		want   Code
-	}{
-		{"CSRF unproven", func(p *NativeProvider, f *relaxedFake, c *SessionCarriers) { f.session.CSRFVerified = false }, ErrUnsupported},
-		{"unregistered App ID", func(p *NativeProvider, f *relaxedFake, c *SessionCarriers) { p.relaxed.adapters.AppPrivilegeID = "" }, ErrUnsupported},
-		{"unknown account state", func(p *NativeProvider, f *relaxedFake, c *SessionCarriers) { f.account.StateKnown = false }, ErrUnavailable},
-		{"unknown expiry", func(p *NativeProvider, f *relaxedFake, c *SessionCarriers) { f.account.ExpiryKnown = false }, ErrUnavailable},
-		{"account expired", func(p *NativeProvider, f *relaxedFake, c *SessionCarriers) { f.account.Expired = true }, ErrDenied},
-		{"unknown password policy", func(p *NativeProvider, f *relaxedFake, c *SessionCarriers) { f.account.PasswordKnown = false }, ErrUnavailable},
-		{"password unusable", func(p *NativeProvider, f *relaxedFake, c *SessionCarriers) { f.account.PasswordUsable = false }, ErrDenied},
-		{"unknown primary GID", func(p *NativeProvider, f *relaxedFake, c *SessionCarriers) { f.account.PrimaryGIDKnown = false }, ErrUnavailable},
-		{"partial groups", func(p *NativeProvider, f *relaxedFake, c *SessionCarriers) { f.groups.Complete = false }, ErrUnavailable},
-		{"wrong group primary GID", func(p *NativeProvider, f *relaxedFake, c *SessionCarriers) { f.groups.PrimaryGID++ }, ErrSuspended},
-		{"wrong App IP", func(p *NativeProvider, f *relaxedFake, c *SessionCarriers) { f.app.ClientAddress = "192.0.2.2" }, ErrDenied},
-		{"missing session", func(p *NativeProvider, f *relaxedFake, c *SessionCarriers) { p.relaxed.adapters.Sessions = nil }, ErrUnavailable},
-		{"missing account", func(p *NativeProvider, f *relaxedFake, c *SessionCarriers) { p.relaxed.adapters.Accounts = nil }, ErrUnavailable},
-		{"missing groups", func(p *NativeProvider, f *relaxedFake, c *SessionCarriers) { p.relaxed.adapters.Groups = nil }, ErrUnavailable},
-		{"missing App", func(p *NativeProvider, f *relaxedFake, c *SessionCarriers) { p.relaxed.adapters.App = nil }, ErrUnavailable},
-		{"anonymous", func(p *NativeProvider, f *relaxedFake, c *SessionCarriers) { c.Cookie = "" }, ErrDenied},
-		{"expired session", func(p *NativeProvider, f *relaxedFake, c *SessionCarriers) { f.sessionCode = ErrDenied }, ErrDenied},
-		{"deleted", func(p *NativeProvider, f *relaxedFake, c *SessionCarriers) { f.account.Exists = false }, ErrDenied},
-		{"disabled", func(p *NativeProvider, f *relaxedFake, c *SessionCarriers) { f.account.Enabled = false }, ErrDenied},
-		{"LDAP", func(p *NativeProvider, f *relaxedFake, c *SessionCarriers) { f.account.Kind = "ldap" }, ErrUnsupported},
-		{"session root", func(p *NativeProvider, f *relaxedFake, c *SessionCarriers) { f.account.Identity.UID = 0 }, ErrDenied},
-		{"unknown UID", func(p *NativeProvider, f *relaxedFake, c *SessionCarriers) { f.account.Identity.UID = 0 }, ErrDenied},
-		{"root group", func(p *NativeProvider, f *relaxedFake, c *SessionCarriers) { f.account.PrimaryGID = 0 }, ErrDenied},
-		{"account name mismatch", func(p *NativeProvider, f *relaxedFake, c *SessionCarriers) { f.account.Identity.Username = "other" }, ErrSuspended},
-		{"group identity mismatch", func(p *NativeProvider, f *relaxedFake, c *SessionCarriers) { f.groups.Identity.UID++ }, ErrSuspended},
-		{"unknown groups", func(p *NativeProvider, f *relaxedFake, c *SessionCarriers) { f.groups.Groups = nil }, ErrUnavailable},
-		{"unknown role", func(p *NativeProvider, f *relaxedFake, c *SessionCarriers) { f.groups.AdminKnown = false }, ErrUnavailable},
-		{"App revoked", func(p *NativeProvider, f *relaxedFake, c *SessionCarriers) { f.app.Allowed = false }, ErrDenied},
-		{"wrong App", func(p *NativeProvider, f *relaxedFake, c *SessionCarriers) { f.app.AppID = "OtherApp" }, ErrDenied},
-		{"wrong App actor", func(p *NativeProvider, f *relaxedFake, c *SessionCarriers) { f.app.Identity.UID++ }, ErrDenied},
-		{"wrong App session", func(p *NativeProvider, f *relaxedFake, c *SessionCarriers) { f.app.SessionRef = grantRef('f') }, ErrDenied},
-		{"raw adapter error", func(p *NativeProvider, f *relaxedFake, c *SessionCarriers) { f.groupCode = Code("native diagnostic") }, ErrUnavailable},
-		{"session proof old", func(p *NativeProvider, f *relaxedFake, c *SessionCarriers) {
-			f.session.CheckedAt = f.session.CheckedAt.Add(-NativeProofFreshness - time.Nanosecond)
-		}, ErrStale},
-		{"account proof zero", func(p *NativeProvider, f *relaxedFake, c *SessionCarriers) { f.account.CheckedAt = time.Time{} }, ErrStale},
-		{"group proof future", func(p *NativeProvider, f *relaxedFake, c *SessionCarriers) {
-			f.groups.CheckedAt = f.groups.CheckedAt.Add(time.Nanosecond)
-		}, ErrStale},
-		{"App proof zero", func(p *NativeProvider, f *relaxedFake, c *SessionCarriers) { f.app.CheckedAt = time.Time{} }, ErrStale},
-	}
-	for _, tt := range cases {
-		t.Run(tt.name, func(t *testing.T) {
-			_, _, p, f, _, _, c := relaxedFixture(t)
-			tt.change(p, f, &c)
-			actor, code := p.Resolve(context.Background(), c)
-			if code != tt.want || actor.valid {
-				t.Fatalf("code=%q want=%q actor=%v", code, tt.want, actor.valid)
-			}
-		})
-	}
-	p := NewRelaxedNativeProvider(RelaxedAdapters{})
-	if actor, code := p.Resolve(context.Background(), SessionCarriers{}); code != ErrUnavailable || actor.valid {
-		t.Fatal(code)
-	}
-}
-func TestRelaxedIdentityMismatchRevokesEveryOwnedGrantBeforeQ(t *testing.T) {
-	for _, rename := range []bool{false, true} {
-		t.Run(map[bool]string{false: "UID", true: "username"}[rename], func(t *testing.T) {
-			a, r, p, f, v, cohort, c := relaxedFixture(t)
-			old := relaxedActor(t, p, c)
-			gs := []Grant{relaxedConsent(t, a, r, p, v, c, ScopePersonal), relaxedConsent(t, a, r, p, v, c, ScopePersonal), relaxedConsent(t, a, r, p, v, c, ScopeShared)}
-			setRelaxedIdentity(f, RelaxedIdentity{UID: 2001, Username: "bob"})
-			other := relaxedConsent(t, a, r, p, v, c, ScopePersonal)
-			next := RelaxedIdentity{UID: 1002, Username: "alice"}
-			if rename {
-				next = RelaxedIdentity{UID: 1001, Username: "alice2"}
-			}
-			setRelaxedIdentity(f, next)
-			cohort.before = func(_ GrantDrainKey) {
-				if r.inTransaction {
-					t.Fatal("Q under disk locks")
-				}
-				if actor, code := p.Resolve(context.Background(), c); code == "" || actor.valid {
-					t.Fatal("prospective identity admitted before Q")
-				}
-				for _, g := range gs {
-					if findGrant(&r.store, g.ID).State != GrantRevoked {
-						t.Fatal("Q before all durable R")
-					}
-				}
-				if code := a.WithGrantAdmission(GrantAdmission{old, gs[0].ID, gs[0].Revision, ActionRead, gs[0].LastValidated, true}, func(Grant, NativeActor) Code { t.Fatal("old admission ran"); return "" }); code == "" {
-					t.Fatal("admitted old actor")
-				}
-			}
-			if actor, code := p.Resolve(context.Background(), c); code != ErrSuspended || actor.valid {
-				t.Fatal("mismatch admitted", code)
-			}
-			if len(cohort.keys) != 3 || len(cohort.identities) != 1 || findGrant(&r.store, other.ID).State != GrantActive {
-				t.Fatal("wrong invalidation scope")
-			}
-			// Fresh consent after complete Q creates a new ID; no revoked record revives.
-			fresh := relaxedConsent(t, a, r, p, v, c, ScopePersonal)
-			if fresh.ID == gs[0].ID || fresh.Owner == old.Principal() {
-				t.Fatal("old grant revived")
-			}
-		})
-	}
-}
-func TestRelaxedInvalidationFailureKeepsFence(t *testing.T) {
-	for _, failure := range []string{"commit", "drain", "Q save"} {
-		t.Run(failure, func(t *testing.T) {
-			a, r, p, f, v, cohort, c := relaxedFixture(t)
-			g := relaxedConsent(t, a, r, p, v, c, ScopePersonal)
-			switch failure {
-			case "commit":
-				r.fail = ErrCommitUncertain
-			case "drain":
-				cohort.fail = ErrCleanupRequired
-			case "Q save":
-				r.qFailure = ErrUnavailable
-			}
-			setRelaxedIdentity(f, RelaxedIdentity{UID: 1002, Username: "alice"})
-			if actor, code := p.Resolve(context.Background(), c); code != ErrCleanupRequired || actor.valid {
-				t.Fatal("false R/Q", code)
-			}
-			if code := a.WithGrantAdmission(GrantAdmission{relaxedActorWithoutResolve(g), g.ID, g.Revision, ActionRead, g.LastValidated, true}, func(Grant, NativeActor) Code { t.Fatal("failed invalidation admitted"); return "" }); code == "" {
-				t.Fatal("fence lost")
-			}
-			if failure != "commit" && findGrant(&r.store, g.ID).State != GrantRevoked {
-				t.Fatal("lost durable R")
-			}
-			if actor, code := p.Resolve(context.Background(), c); code == "" || actor.valid {
-				t.Fatal("failure cleared itself")
-			}
-		})
-	}
-}
-func relaxedActorWithoutResolve(g Grant) NativeActor {
-	return NativeActor{account: LocalAccount{Principal: g.Owner, Enabled: true, UID: 1001, GID: 100, Username: "alice", CheckedAt: time.Unix(1700000000, 0)}, valid: true}
-}
-func TestRelaxedRevalidateCredentialsCancellationAndAging(t *testing.T) {
-	_, _, p, f, _, _, c := relaxedFixture(t)
-	old := relaxedActor(t, p, c)
-	f.groups.Groups = []uint32{}
-	if _, code := p.Revalidate(context.Background(), c, old); code != ErrStale {
-		t.Fatal(code)
-	}
-	f.groups.Groups = []uint32{101, 105}
-	f.account.PrimaryGID++
-	f.groups.PrimaryGID++
-	if _, code := p.Revalidate(context.Background(), c, old); code != ErrStale {
-		t.Fatal("GID should stale credentials", code)
-	}
-	f.account.PrimaryGID--
-	f.groups.PrimaryGID--
-	ctx, cancel := context.WithCancel(context.Background())
-	f.afterApp = cancel
-	if _, code := p.Resolve(ctx, c); code != ErrCanceled {
-		t.Fatal(code)
-	}
-	f.afterApp = func() {
-		now := p.now()
-		p.now = func() time.Time { return now.Add(NativeProofFreshness + time.Nanosecond) }
-	}
-	if _, code := p.Resolve(context.Background(), c); code != ErrStale {
-		t.Fatal("extended old session proof", code)
-	}
-}
-
-func TestRelaxedPrincipalDecoderAndLegacyIsolation(t *testing.T) {
-	a, r, p, _, v, _, c := relaxedFixture(t)
-	g := relaxedConsent(t, a, r, p, v, c, ScopePersonal)
-	for _, change := range []func(*Principal){
-		func(p *Principal) { p.IdentityBasis = "" }, func(p *Principal) { p.IdentityBasis = "managed-enrollment" },
-		func(p *Principal) { p.UID = 0 }, func(p *Principal) { p.Username = "" }, func(p *Principal) { p.Username = "../other" },
-	} {
-		next := cloneAuthorityStore(r.store)
-		change(&next.Grants[0].Owner)
-		next.Grants[0].Issuer = next.Grants[0].Owner
-		if _, code := DecodeGrantStore(bytes.NewReader(mustRelaxedJSON(t, next))); code == "" {
-			t.Fatal("malformed S1R principal accepted")
-		}
-	}
-	// Old schema-1 records retain their strict semantics and cannot be silently
-	// promoted into a relaxed grant by interpreting a digest as an account ID.
-	legacy, code := DecodeGrantStore(bytes.NewReader(dataFixture(t, "grant-store")))
-	if code != "" {
-		t.Fatal(code)
-	}
-	actor := relaxedActor(t, p, c)
-	proof := GrantAdmission{actor, g.ID, g.Revision, ActionRead, g.LastValidated, true}
-	proof.Actor.account.Principal = legacy.Grants[0].Owner
-	if code := a.WithGrantAdmission(proof, func(Grant, NativeActor) Code { t.Fatal("legacy principal admitted into relaxed authority"); return "" }); code == "" {
-		t.Fatal("lost identity-basis gate")
-	}
-}
-func TestRelaxedDisableAndAppRevokeInvalidatePreviouslyGrantedUser(t *testing.T) {
-	for _, what := range []string{"disabled", "deleted", "lookup denied", "App checker denied", "App revoke"} {
-		t.Run(what, func(t *testing.T) {
-			a, r, p, f, v, cohort, c := relaxedFixture(t)
-			g := relaxedConsent(t, a, r, p, v, c, ScopePersonal)
-			switch what {
-			case "lookup denied":
-				f.accountCode = ErrDenied
-			case "App checker denied":
-				f.appCode = ErrDenied
-			case "disabled":
-				f.account.Enabled = false
-			case "deleted":
-				f.account.Exists = false
-			case "App revoke":
-				f.app.Allowed = false
-			}
-			if actor, code := p.Resolve(context.Background(), c); code != ErrDenied || actor.valid {
-				t.Fatal(code)
-			}
-			if findGrant(&r.store, g.ID).State != GrantRevoked || len(cohort.keys) != 1 || len(cohort.identities) != 1 {
-				t.Fatal("old authority survived observation")
-			}
-			f.account.Enabled = true
-			f.accountCode = ""
-			f.appCode = ""
-			f.account.Exists = true
-			f.app.Allowed = true
-			if actor := relaxedActor(t, p, c); actor.Principal() == g.Owner {
-				t.Fatal("restore revived old actor generation")
-			}
-			if findGrant(&r.store, g.ID).State != GrantRevoked {
-				t.Fatal("restore un-revoked grant")
-			}
-		})
-	}
-}
-func TestRelaxedSwappedSessionDoesNotRevokeOtherUsersGrants(t *testing.T) {
-	a, r, p, f, v, _, c := relaxedFixture(t)
-	old := relaxedActor(t, p, c)
-	mine := relaxedConsent(t, a, r, p, v, c, ScopePersonal)
-	setRelaxedIdentity(f, RelaxedIdentity{UID: 2001, Username: "bob"})
-	other := relaxedConsent(t, a, r, p, v, c, ScopePersonal)
-	if actor, code := p.Revalidate(context.Background(), c, old); code != ErrSuspended || actor.valid {
-		t.Fatal("cross-user snapshot accepted", code)
-	}
-	if findGrant(&r.store, mine.ID).State != GrantRevoked || findGrant(&r.store, other.ID).State != GrantActive {
-		t.Fatal("wrong account revoked")
-	}
-	if relaxedActor(t, p, c).Principal() != other.Owner {
-		t.Fatal("foreign identity generation changed")
-	}
-}
-
-func TestRelaxedNegativeAccountObservationRevokesRecordedIdentity(t *testing.T) {
-	for _, kind := range []string{"canonical rename", "deleted without tuple"} {
-		t.Run(kind, func(t *testing.T) {
-			a, r, p, f, v, cohort, c := relaxedFixture(t)
-			g := relaxedConsent(t, a, r, p, v, c, ScopePersonal)
-			old := g.Owner
-			want := ErrSuspended
-			if kind == "canonical rename" {
-				f.account.Identity.Username = "alice-renamed"
-			} else {
-				f.account.Exists = false
-				f.account.Identity = RelaxedIdentity{}
-				f.account.PrimaryGIDKnown = false
-				want = ErrDenied
-			}
-			if actor, code := p.Resolve(context.Background(), c); code != want || actor.valid {
-				t.Fatalf("code=%q want=%q", code, want)
-			}
-			if findGrant(&r.store, g.ID).State != GrantRevoked || len(cohort.keys) != 1 || len(cohort.identities) != 1 || cohort.identities[0] != relaxedPrincipalIdentity(old) {
-				t.Fatal("negative account observation left old grants or operation identity alive")
-			}
-		})
-	}
-}