cursedbelt 2.7.0 → 3.0.0

package/src/server/services/accountService.spec.ts

@@ -1,721 +0,0 @@
-/**
- * `AccountService` — the concrete `resolveIdentity` (02 §1).
- *
- * Proves the value the seam had none of: under a LOCAL store an unlock resolves
- * to the bootstrap OWNER (carrying `infra:write`); under a SAAS store it resolves
- * to the login-established session's membership, re-read from the store so a role
- * change or a revocation is honored on the next resolve; and with no session it
- * resolves to `null` (the unlock is rejected, the guard stays locked).
- */
-import { Database } from 'bun:sqlite';
-import { afterEach, beforeEach, describe, expect, it } from 'bun:test';
-import { assertCcPragmas, getTxnLifetimeGuard, runNamespacedMigrations } from 'cwip/sqlite';
-import { createRowSigner, mintMachineIntegrityKey } from 'cwip/guard';
-import type { Argon2idDeriver } from 'cwip/guard';
-import { CC_REGISTRY_MIGRATIONS, createRegistryIdentityStore, type RegistryIdentityStore } from 'cwip/cc-registry';
-import type { CCRole, CCUserClaims } from '../../core/session/claims';
-import { createSessionSigner } from '../guard/sessionSigner';
-import { createAccountService } from './accountService';
-
-let db: Database;
-let identity: RegistryIdentityStore;
-
-const bytes = (value: string): Uint8Array => new TextEncoder().encode(value);
-const allZero = (buffer: Uint8Array): boolean => buffer.every((b) => b === 0);
-
-// A deterministic, PASSWORD-SENSITIVE argon2id stand-in — the verifier is only
-// meaningful if the derived key depends on the password.
-const stubDeriver: Argon2idDeriver = ({ password, salt, keyLength }) => {
-  const out = new Uint8Array(keyLength);
-  for (let i = 0; i < keyLength; i += 1)
-    out[i] = ((password[i % password.length] ?? 0) ^ (salt[i % salt.length] ?? 0) ^ (i & 0xff)) & 0xff;
-  return out;
-};
-
-/** An account service with everything the §2 auth methods need. */
-const authService = (profile: 'local' | 'saas' = 'saas') =>
-  createAccountService({ identity, profile, signer: createSessionSigner({ ttlSeconds: 300 }), deriver: stubDeriver });
-
-const claimsFor = (over: Partial<CCUserClaims> = {}): CCUserClaims => ({
-  tenantId: 't_acme',
-  userId: 'u_ann',
-  role: 'MEMBER',
-  permissions: [],
-  privateScope: true,
-  exp: 4_102_444_800, // year 2100 — never expired in these unit tests
-  jti: 'jti_test',
-  ...over,
-});
-
-beforeEach(() => {
-  db = new Database(':memory:');
-  assertCcPragmas(db);
-  runNamespacedMigrations(db, CC_REGISTRY_MIGRATIONS, { namespace: 'registry' });
-  identity = createRegistryIdentityStore(db, {
-    signer: createRowSigner({ integrityKey: mintMachineIntegrityKey() }),
-    now: () => '2026-07-25T00:00:00.000Z',
-  });
-});
-
-afterEach(() => {
-  getTxnLifetimeGuard(db)?.dispose();
-  db.close();
-});
-
-describe('AccountService.resolveIdentity — local', () => {
-  it('resolves the bootstrap OWNER identity carrying infra:write and audit:read', async () => {
-    const service = createAccountService({ identity, profile: 'local' });
-    const resolved = await service.resolveIdentity();
-    expect(resolved).toEqual({
-      tenantId: 't_local',
-      userId: 'u_local',
-      role: 'OWNER',
-      // The EFFECTIVE grant (02 §3): the OWNER role's own permissions UNION the
-      // membership's explicit `infra:write`. Before the role table existed this
-      // was the explicit grant alone, which is why RBAC-on locked everyone out.
-      // `audit:read` joined the OWNER row in D27 — the single-user local model
-      // has exactly one person, and they are the one entitled to the trail.
-      permissions: ['audit:read', 'infra:write', 'knowledge:delete', 'knowledge:write'],
-    });
-  });
-
-  it('is idempotent and ignores currentClaims (there is no login locally)', async () => {
-    const service = createAccountService({
-      identity,
-      profile: 'local',
-      currentClaims: () => claimsFor({ role: 'VIEWER', permissions: [] }),
-    });
-    // A second resolve returns the SAME owner — a repeated unlock is not a repeated write.
-    expect(await service.resolveIdentity()).toEqual(await service.resolveIdentity());
-    expect((await service.resolveIdentity())?.role).toBe('OWNER');
-  });
-
-  it('returns a defensive copy of the permission grant', async () => {
-    const service = createAccountService({ identity, profile: 'local' });
-    const resolved = await service.resolveIdentity();
-    if (!resolved) throw new Error('local resolveIdentity must never be null');
-    (resolved.permissions as string[]).push('mutated');
-    // The next resolve is unaffected — the stored grant was copied, not aliased.
-    expect((await service.resolveIdentity())?.permissions).toEqual([
-      'audit:read',
-      'infra:write',
-      'knowledge:delete',
-      'knowledge:write',
-    ]);
-  });
-});
-
-describe('AccountService.resolveIdentity — saas', () => {
-  const seedMember = async (
-    role: 'OWNER' | 'ADMIN' | 'MEMBER' | 'VIEWER' = 'MEMBER',
-    permissions: string[] = [],
-  ): Promise<void> => {
-    await identity.createTenant({ tenantId: 't_acme', title: 'Acme' });
-    await identity.createUser({ userId: 'u_ann', email: 'ann@acme.test' });
-    await identity.createMembership({ tenantId: 't_acme', userId: 'u_ann', role, permissions });
-  };
-
-  it('resolves the login-established session, re-reading the authoritative membership', async () => {
-    await seedMember('ADMIN', ['knowledge:write']);
-    const service = createAccountService({
-      identity,
-      profile: 'saas',
-      // The token froze VIEWER/no-perms; the store says ADMIN/knowledge:write — the
-      // store wins, so a promotion is honored on the next resolve without a re-mint.
-      currentClaims: () => claimsFor({ role: 'VIEWER', permissions: [] }),
-    });
-    expect(await service.resolveIdentity()).toEqual({
-      tenantId: 't_acme',
-      userId: 'u_ann',
-      role: 'ADMIN',
-      // ADMIN's own permissions ∪ the explicit grant (which ADMIN already implies).
-      permissions: ['knowledge:delete', 'knowledge:write'],
-    });
-  });
-
-  it('returns null when there is no session (guard stays locked)', async () => {
-    await seedMember();
-    const service = createAccountService({ identity, profile: 'saas', currentClaims: () => null });
-    expect(await service.resolveIdentity()).toBeNull();
-  });
-
-  it('returns null when the session has no accessor at all', async () => {
-    const service = createAccountService({ identity, profile: 'saas' });
-    expect(await service.resolveIdentity()).toBeNull();
-  });
-
-  it('rejects a session whose membership was revoked since the token was minted', async () => {
-    await seedMember('MEMBER');
-    const service = createAccountService({ identity, profile: 'saas', currentClaims: () => claimsFor() });
-    expect((await service.resolveIdentity())?.role).toBe('MEMBER');
-    // Membership suspended after login — the still-valid token no longer resolves.
-    await identity.setMembershipStatus('t_acme', 'u_ann', 'suspended');
-    expect(await service.resolveIdentity()).toBeNull();
-  });
-
-  it('returns null for a session whose membership never existed', async () => {
-    const service = createAccountService({ identity, profile: 'saas', currentClaims: () => claimsFor() });
-    expect(await service.resolveIdentity()).toBeNull();
-  });
-});
-
-describe('AccountService.signup + login (02 §2)', () => {
-  it('signup (saas) creates a user + tenant + OWNER membership on the one KDF', async () => {
-    const svc = authService('saas');
-    const view = await svc.signup({ email: 'ann@acme.test', password: bytes('sup3r-secret'), tenantTitle: 'Acme' });
-    expect(view.role).toBe('OWNER');
-    expect(view.email).toBe('ann@acme.test');
-    const user = await identity.getUserByEmail('ann@acme.test');
-    expect(user?.hasPassword).toBe(true);
-    expect((await identity.getMembership(view.tenantId, view.userId))?.role).toBe('OWNER');
-  });
-
-  it('login verifies the password and mints a session carrying the membership role', async () => {
-    const svc = authService('saas');
-    const view = await svc.signup({ email: 'ann@acme.test', password: bytes('sup3r-secret') });
-    const { token, claims } = await svc.login({ email: 'ann@acme.test', password: bytes('sup3r-secret') });
-    expect(typeof token).toBe('string');
-    expect(claims.userId).toBe(view.userId);
-    expect(claims.tenantId).toBe(view.tenantId);
-    expect(claims.role).toBe('OWNER');
-    expect(claims.privateScope).toBe(false); // login establishes identity, not a reveal
-  });
-
-  it('rejects a wrong password AND an unknown email with the SAME typed 401 (no enumeration)', async () => {
-    const svc = authService('saas');
-    await svc.signup({ email: 'ann@acme.test', password: bytes('sup3r-secret') });
-    await expect(svc.login({ email: 'ann@acme.test', password: bytes('wrong-secret') })).rejects.toMatchObject({
-      code: 'LOGIN_REJECTED',
-      status: 401,
-    });
-    await expect(svc.login({ email: 'nobody@acme.test', password: bytes('anything-here') })).rejects.toMatchObject({
-      code: 'LOGIN_REJECTED',
-      status: 401,
-    });
-  });
-
-  it('refuses a duplicate email', async () => {
-    const svc = authService('saas');
-    await svc.signup({ email: 'ann@acme.test', password: bytes('sup3r-secret') });
-    await expect(svc.signup({ email: 'ann@acme.test', password: bytes('another-one') })).rejects.toMatchObject({
-      code: 'EMAIL_IN_USE',
-      status: 409,
-    });
-  });
-
-  it('CONSUMES the password buffer on signup and on login', async () => {
-    const svc = authService('saas');
-    const p1 = bytes('sup3r-secret');
-    await svc.signup({ email: 'ann@acme.test', password: p1 });
-    expect(allZero(p1)).toBe(true);
-    const p2 = bytes('sup3r-secret');
-    await svc.login({ email: 'ann@acme.test', password: p2 });
-    expect(allZero(p2)).toBe(true);
-  });
-
-  it('login without a signer fails loudly (no unverifiable token)', async () => {
-    // Seed a user with a signer-equipped service, then attempt login on one without.
-    await authService('saas').signup({ email: 'ann@acme.test', password: bytes('sup3r-secret') });
-    const noSigner = createAccountService({ identity, profile: 'saas', deriver: stubDeriver });
-    await expect(noSigner.login({ email: 'ann@acme.test', password: bytes('sup3r-secret') })).rejects.toMatchObject({
-      code: 'ACCOUNT_SIGNER_MISSING',
-    });
-  });
-
-  it('signup (local) adds a MEMBER of t_local', async () => {
-    const svc = authService('local');
-    const view = await svc.signup({ email: 'bo@home.test', password: bytes('local-secret') });
-    expect(view.tenantId).toBe('t_local');
-    expect(view.role).toBe('MEMBER');
-  });
-});
-
-describe('AccountService.changePassword (02 §2)', () => {
-  it('self-change re-authenticates with the current password, then the new one logs in', async () => {
-    const svc = authService('saas');
-    const view = await svc.signup({ email: 'ann@acme.test', password: bytes('old-secret-12') });
-
-    // Wrong current → typed 401, password NOT changed.
-    await expect(
-      svc.changePassword({ claims: claimsFor({ userId: view.userId, tenantId: view.tenantId, role: 'OWNER' }) }, view.userId, {
-        current: bytes('WRONG-current'),
-        next: bytes('new-secret-34'),
-      }),
-    ).rejects.toMatchObject({ code: 'CURRENT_PASSWORD_REJECTED', status: 401 });
-
-    // Correct current → re-sealed; the new password logs in and the old one does not.
-    await svc.changePassword({ claims: claimsFor({ userId: view.userId, tenantId: view.tenantId, role: 'OWNER' }) }, view.userId, {
-      current: bytes('old-secret-12'),
-      next: bytes('new-secret-34'),
-    });
-    const { claims } = await svc.login({ email: 'ann@acme.test', password: bytes('new-secret-34') });
-    expect(claims.userId).toBe(view.userId);
-    await expect(svc.login({ email: 'ann@acme.test', password: bytes('old-secret-12') })).rejects.toMatchObject({
-      code: 'LOGIN_REJECTED',
-    });
-  });
-
-  it('an ADMIN/OWNER resets another account without its current password; a non-admin cannot', async () => {
-    const svc = authService('saas');
-    const bob = await svc.signup({ email: 'bob@acme.test', password: bytes('bob-secret-12') });
-
-    // A VIEWER who is not the target is refused.
-    await expect(
-      svc.changePassword({ claims: claimsFor({ userId: 'u_someone', role: 'VIEWER' }) }, bob.userId, {
-        next: bytes('hijack-secret'),
-      }),
-    ).rejects.toMatchObject({ code: 'PERMISSION_DENIED', status: 403 });
-
-    // An OWNER resets bob without bob's current password; bob logs in with the new one.
-    await svc.changePassword({ claims: claimsFor({ userId: 'u_admin', role: 'OWNER' }) }, bob.userId, {
-      next: bytes('reset-secret-99'),
-    });
-    const { claims } = await svc.login({ email: 'bob@acme.test', password: bytes('reset-secret-99') });
-    expect(claims.userId).toBe(bob.userId);
-  });
-
-  it('CONSUMES both password buffers on a self-change', async () => {
-    const svc = authService('saas');
-    const view = await svc.signup({ email: 'ann@acme.test', password: bytes('old-secret-12') });
-    const current = bytes('old-secret-12');
-    const next = bytes('new-secret-34');
-    await svc.changePassword({ claims: claimsFor({ userId: view.userId, tenantId: view.tenantId, role: 'OWNER' }) }, view.userId, {
-      current,
-      next,
-    });
-    expect(allZero(current)).toBe(true);
-    expect(allZero(next)).toBe(true);
-  });
-});
-
-/* ------------------- tenant lifecycle & RBAC admin (02 §3) ---------------- */
-
-/**
- * The claims a REAL login would produce for `view`, so an admin call is scoped
- * exactly as the route would scope it. Never hand-forged privileges: the tests
- * below assert what the SERVICE decides from the store, and passing inflated
- * claims would prove the opposite of what they claim to prove.
- */
-const scopeFor = (view: { userId: string; tenantId: string; role: CCRole }) => ({
-  claims: claimsFor({ userId: view.userId, tenantId: view.tenantId, role: view.role }),
-});
-
-/** An OWNER of `t_acme` plus a service that mints/revokes through one signer. */
-const seedTenant = async (): Promise<{
-  svc: ReturnType<typeof createAccountService>;
-  signer: ReturnType<typeof createSessionSigner>;
-  owner: { userId: string; tenantId: string; role: CCRole; email?: string };
-}> => {
-  const signer = createSessionSigner({ ttlSeconds: 300 });
-  const svc = createAccountService({ identity, profile: 'saas', signer, deriver: stubDeriver });
-  const owner = await svc.signup({ email: 'ann@acme.test', password: bytes('owner-secret-1'), tenantTitle: 'Acme' });
-  return { svc, signer, owner };
-};
-
-/** Join `email` to the owner's tenant at `role`, through the REAL invite path. */
-const joinViaInvite = async (
-  svc: ReturnType<typeof createAccountService>,
-  owner: { userId: string; tenantId: string; role: CCRole },
-  email: string,
-  role: CCRole,
-): Promise<{ userId: string; tenantId: string; role: CCRole }> => {
-  const invitation = await svc.inviteMember(scopeFor(owner), owner.tenantId, { email, role });
-  const account = await svc.signup({ email, password: bytes(`${email}-secret`), inviteToken: invitation.token });
-  return { userId: account.userId, tenantId: account.tenantId, role: account.role };
-};
-
-describe('AccountService.signup — the launch gate (D33)', () => {
-  const gatedService = (signupMode: 'open' | 'invite' | 'closed') =>
-    createAccountService({
-      identity,
-      profile: 'saas',
-      signer: createSessionSigner({ ttlSeconds: 300 }),
-      deriver: stubDeriver,
-      signupMode,
-    });
-
-  it('closed refuses BEFORE any store read, zeroizing the password', async () => {
-    const svc = gatedService('closed');
-    const password = bytes('sup3r-secret');
-    await expect(svc.signup({ email: 'ann@acme.test', password })).rejects.toMatchObject({
-      code: 'SIGNUP_CLOSED',
-      status: 403,
-    });
-    expect(allZero(password)).toBe(true);
-    expect(await identity.getUserByEmail('ann@acme.test')).toBeNull();
-  });
-
-  it('closed means CLOSED — a valid invitation does not open it', async () => {
-    // Issue a real invitation while the door is open, then close it.
-    const open = gatedService('open');
-    const owner = await open.signup({ email: 'ann@acme.test', password: bytes('owner-secret-1'), tenantTitle: 'Acme' });
-    const invitation = await open.inviteMember(
-      { claims: claimsFor({ userId: owner.userId, tenantId: owner.tenantId, role: owner.role }) },
-      owner.tenantId,
-      { email: 'bo@acme.test', role: 'MEMBER' },
-    );
-    await expect(
-      gatedService('closed').signup({
-        email: 'bo@acme.test',
-        password: bytes('bo-secret-123'),
-        inviteToken: invitation.token,
-      }),
-    ).rejects.toMatchObject({ code: 'SIGNUP_CLOSED', status: 403 });
-  });
-
-  it('invite refuses a token-less signup without leaking whether the email exists', async () => {
-    const svc = gatedService('invite');
-    const password = bytes('sup3r-secret');
-    // The email genuinely does not exist — the refusal must be the GATE's, not
-    // an email-shaped answer a prober could differentiate.
-    await expect(svc.signup({ email: 'nobody@acme.test', password })).rejects.toMatchObject({
-      code: 'SIGNUP_INVITE_ONLY',
-      status: 403,
-    });
-    expect(allZero(password)).toBe(true);
-  });
-
-  it('invite admits a real invitation through the normal path', async () => {
-    const open = gatedService('open');
-    const owner = await open.signup({ email: 'ann@acme.test', password: bytes('owner-secret-1'), tenantTitle: 'Acme' });
-    const invitation = await open.inviteMember(
-      { claims: claimsFor({ userId: owner.userId, tenantId: owner.tenantId, role: owner.role }) },
-      owner.tenantId,
-      { email: 'bo@acme.test', role: 'VIEWER' },
-    );
-    const bo = await gatedService('invite').signup({
-      email: 'bo@acme.test',
-      password: bytes('bo-secret-123'),
-      inviteToken: invitation.token,
-    });
-    expect(bo.tenantId).toBe(owner.tenantId);
-    expect(bo.role).toBe('VIEWER');
-  });
-});
-
-describe('AccountService — RBAC administration (02 §3)', () => {
-  it('an invited account joins the INVITER’s tenant at the INVITED role, not one it named', async () => {
-    const { svc, owner } = await seedTenant();
-    const invitation = await svc.inviteMember(scopeFor(owner), owner.tenantId, { email: 'bo@acme.test', role: 'VIEWER' });
-    expect(invitation.token.length).toBeGreaterThan(20);
-
-    // The invitee ASKS for OWNER of their own new tenant; the invitation decides.
-    const bo = await svc.signup({
-      email: 'bo@acme.test',
-      password: bytes('bo-secret-123'),
-      role: 'OWNER',
-      tenantTitle: 'Bo Corp',
-      inviteToken: invitation.token,
-    });
-    expect(bo.tenantId).toBe(owner.tenantId);
-    expect(bo.role).toBe('VIEWER');
-  });
-
-  it('an invitation is single-use, email-bound and expiring', async () => {
-    const { svc, owner } = await seedTenant();
-    const invitation = await svc.inviteMember(scopeFor(owner), owner.tenantId, { email: 'bo@acme.test', role: 'MEMBER' });
-
-    // Issued to bo; cam cannot spend it.
-    await expect(
-      svc.signup({ email: 'cam@acme.test', password: bytes('cam-secret-12'), inviteToken: invitation.token }),
-    ).rejects.toMatchObject({ code: 'INVITATION_EMAIL_MISMATCH', status: 403 });
-    // A wrong token is the same 404 as no token at all (no probing oracle).
-    await expect(
-      svc.signup({ email: 'bo@acme.test', password: bytes('bo-secret-123'), inviteToken: 'not-a-real-token' }),
-    ).rejects.toMatchObject({ code: 'INVITATION_INVALID', status: 404 });
-
-    const bo = await svc.signup({ email: 'bo@acme.test', password: bytes('bo-secret-123'), inviteToken: invitation.token });
-    // Re-spending it through signup cannot even reach the invite check — the
-    // account it created now exists.
-    await expect(
-      svc.signup({ email: 'bo@acme.test', password: bytes('again-secret'), inviteToken: invitation.token }),
-    ).rejects.toMatchObject({ code: 'EMAIL_IN_USE', status: 409 });
-    // And a REMOVED member cannot walk back in on the same token: it is spent.
-    await svc.removeMember(scopeFor(owner), owner.tenantId, bo.userId);
-    await expect(svc.acceptInvitation(scopeFor(bo), invitation.token)).rejects.toMatchObject({
-      code: 'INVITATION_USED',
-      status: 409,
-    });
-
-    // An expired invitation is refused even though it was never used.
-    let clock = Date.parse('2026-07-25T00:00:00.000Z');
-    const timed = createAccountService({
-      identity,
-      profile: 'saas',
-      signer: createSessionSigner({ ttlSeconds: 300 }),
-      deriver: stubDeriver,
-      now: () => clock,
-    });
-    const short = await timed.inviteMember(scopeFor(owner), owner.tenantId, {
-      email: 'dee@acme.test',
-      role: 'MEMBER',
-      ttlMinutes: 10,
-    });
-    clock += 11 * 60_000;
-    await expect(
-      timed.signup({ email: 'dee@acme.test', password: bytes('dee-secret-12'), inviteToken: short.token }),
-    ).rejects.toMatchObject({ code: 'INVITATION_EXPIRED', status: 410 });
-  });
-
-  it('a VIEWER cannot administer anything, and an ADMIN cannot assign a role above their own', async () => {
-    const { svc, owner } = await seedTenant();
-    const viewer = await joinViaInvite(svc, owner, 'vic@acme.test', 'VIEWER');
-    const admin = await joinViaInvite(svc, owner, 'ada@acme.test', 'ADMIN');
-
-    // The admin surface starts at ADMIN — a VIEWER cannot even list.
-    await expect(svc.listMembers(scopeFor(viewer), owner.tenantId)).rejects.toMatchObject({
-      code: 'ROLE_REQUIRED',
-      status: 403,
-    });
-    // …nor promote themselves. This is the privilege-escalation probe.
-    await expect(
-      svc.updateMember(scopeFor(viewer), owner.tenantId, viewer.userId, { role: 'OWNER' }),
-    ).rejects.toMatchObject({ code: 'ROLE_REQUIRED', status: 403 });
-
-    // An ADMIN may run the tenant but may not mint an OWNER — only an OWNER can.
-    await expect(
-      svc.updateMember(scopeFor(admin), owner.tenantId, viewer.userId, { role: 'OWNER' }),
-    ).rejects.toMatchObject({ code: 'ROLE_ESCALATION_DENIED', status: 403 });
-    // …nor act on the OWNER above them.
-    await expect(
-      svc.updateMember(scopeFor(admin), owner.tenantId, owner.userId, { role: 'MEMBER' }),
-    ).rejects.toMatchObject({ code: 'ROLE_ESCALATION_DENIED', status: 403 });
-    // …nor grant a permission they do not themselves hold.
-    await expect(
-      svc.updateMember(scopeFor(admin), owner.tenantId, viewer.userId, { grants: ['infra:write'] }),
-    ).rejects.toMatchObject({ code: 'PERMISSION_ESCALATION_DENIED', status: 403 });
-    // …nor edit their OWN membership (the self-promotion path in disguise).
-    await expect(
-      svc.updateMember(scopeFor(admin), owner.tenantId, admin.userId, { grants: [] }),
-    ).rejects.toMatchObject({ code: 'SELF_ADMIN_DENIED', status: 403 });
-
-    // The OWNER can do what the ADMIN could not.
-    const promoted = await svc.updateMember(scopeFor(owner), owner.tenantId, viewer.userId, { role: 'ADMIN' });
-    expect(promoted.role).toBe('ADMIN');
-    expect(promoted.permissions).toEqual(['knowledge:delete', 'knowledge:write']);
-  });
-
-  it('the acting role is re-read from the STORE, so a demoted admin’s token is not an admin credential', async () => {
-    const { svc, owner } = await seedTenant();
-    const admin = await joinViaInvite(svc, owner, 'ada@acme.test', 'ADMIN');
-    await svc.updateMember(scopeFor(owner), owner.tenantId, admin.userId, { role: 'VIEWER' });
-
-    // `scopeFor(admin)` still SAYS ADMIN — exactly what a token minted before the
-    // demotion carries. Authorization comes from the membership row, so it fails.
-    await expect(svc.listMembers(scopeFor(admin), owner.tenantId)).rejects.toMatchObject({ code: 'ROLE_REQUIRED' });
-  });
-
-  it('a session for tenant A is not an admin credential for tenant B', async () => {
-    const { svc, owner } = await seedTenant();
-    const other = await svc.signup({ email: 'zed@other.test', password: bytes('zed-secret-12'), tenantTitle: 'Other' });
-    await expect(svc.listMembers(scopeFor(other), owner.tenantId)).rejects.toMatchObject({
-      code: 'CROSS_TENANT_DENIED',
-      status: 403,
-    });
-  });
-
-  it('a grant change REVOKES the target’s live sessions (a demotion that leaves the token alive is not a demotion)', async () => {
-    const { svc, signer, owner } = await seedTenant();
-    const member = await joinViaInvite(svc, owner, 'mel@acme.test', 'MEMBER');
-    const { token, claims } = await svc.login({ email: 'mel@acme.test', password: bytes('mel@acme.test-secret') });
-    expect(signer.verify(token).ok).toBe(true);
-    expect(claims.permissions).toContain('knowledge:write');
-
-    await svc.updateMember(scopeFor(owner), owner.tenantId, member.userId, { role: 'VIEWER' });
-    // The old token is dead NOW…
-    expect(signer.verify(token)).toEqual({ ok: false, failure: 'revoked' });
-    // …and the next login carries the new, narrower grant.
-    const next = await svc.login({ email: 'mel@acme.test', password: bytes('mel@acme.test-secret') });
-    expect(next.claims.role).toBe('VIEWER');
-    expect(next.claims.permissions).toEqual([]);
-  });
-
-  it('removing a member revokes their sessions and refuses the tenant’s last OWNER', async () => {
-    const { svc, signer, owner } = await seedTenant();
-    const member = await joinViaInvite(svc, owner, 'mel@acme.test', 'MEMBER');
-    const { token } = await svc.login({ email: 'mel@acme.test', password: bytes('mel@acme.test-secret') });
-
-    expect(await svc.removeMember(scopeFor(owner), owner.tenantId, member.userId)).toBe(true);
-    expect(signer.verify(token).ok).toBe(false);
-    expect(await identity.getMembership(owner.tenantId, member.userId)).toBeNull();
-
-    // An ownerless tenant can never be administered again — refuse the demotion
-    // and the removal that would create one.
-    const second = await joinViaInvite(svc, owner, 'oli@acme.test', 'ADMIN');
-    await expect(
-      svc.updateMember(scopeFor(second), owner.tenantId, owner.userId, { status: 'suspended' }),
-    ).rejects.toMatchObject({ code: 'ROLE_ESCALATION_DENIED' }); // an ADMIN cannot touch an OWNER at all
-    await svc.updateMember(scopeFor(owner), owner.tenantId, second.userId, { role: 'OWNER' });
-    // With a second OWNER in place, the first may now step down.
-    const stepped = await svc.updateMember(
-      { claims: claimsFor({ userId: second.userId, tenantId: owner.tenantId, role: 'OWNER' }) },
-      owner.tenantId,
-      owner.userId,
-      { role: 'MEMBER' },
-    );
-    expect(stepped.role).toBe('MEMBER');
-  });
-
-  it('tenant rename is ADMIN, status is OWNER-only, and a suspension closes every session', async () => {
-    const { svc, signer, owner } = await seedTenant();
-    const admin = await joinViaInvite(svc, owner, 'ada@acme.test', 'ADMIN');
-    const { token } = await svc.login({ email: 'ada@acme.test', password: bytes('ada@acme.test-secret') });
-
-    expect((await svc.updateTenant(scopeFor(admin), owner.tenantId, { title: 'Acme Renamed' })).title).toBe('Acme Renamed');
-    await expect(svc.updateTenant(scopeFor(admin), owner.tenantId, { status: 'suspended' })).rejects.toMatchObject({
-      code: 'ROLE_REQUIRED',
-      status: 403,
-    });
-
-    const suspended = await svc.updateTenant(scopeFor(owner), owner.tenantId, { status: 'suspended' });
-    expect(suspended.status).toBe('suspended');
-    // Suspension must take the product away NOW, not at token expiry…
-    expect(signer.verify(token).ok).toBe(false);
-    // …and it must STAY away: a member of a suspended tenant cannot simply log
-    // back in. Revoking tokens without this is a suspension that suspends nothing.
-    await expect(svc.login({ email: 'ada@acme.test', password: bytes('ada@acme.test-secret') })).rejects.toMatchObject({
-      code: 'NO_ACTIVE_MEMBERSHIP',
-      status: 403,
-    });
-  });
-
-  it('an existing account accepts an invitation into a SECOND tenant', async () => {
-    const { svc, owner } = await seedTenant();
-    // Bo already has their own tenant from a plain signup.
-    const bo = await svc.signup({ email: 'bo@bo.test', password: bytes('bo-secret-123'), tenantTitle: 'Bo Corp' });
-    const invitation = await svc.inviteMember(scopeFor(owner), owner.tenantId, { email: 'bo@bo.test', role: 'MEMBER' });
-
-    const member = await svc.acceptInvitation(scopeFor(bo), invitation.token);
-    expect(member).toMatchObject({ tenantId: owner.tenantId, userId: bo.userId, role: 'MEMBER' });
-    // Re-spending the token is refused (the invitation is consumed BEFORE the
-    // membership is created, so a race cannot produce two memberships), and so
-    // is inviting someone who is already a member.
-    await expect(svc.acceptInvitation(scopeFor(bo), invitation.token)).rejects.toMatchObject({ code: 'INVITATION_USED' });
-    await expect(
-      svc.inviteMember(scopeFor(owner), owner.tenantId, { email: 'bo@bo.test', role: 'MEMBER' }),
-    ).rejects.toMatchObject({ code: 'ALREADY_A_MEMBER', status: 409 });
-  });
-
-  it('refuses a malformed patch with a typed 400 rather than a 500 (the body is untrusted JSON)', async () => {
-    const { svc, owner } = await seedTenant();
-    const member = await joinViaInvite(svc, owner, 'mel@acme.test', 'MEMBER');
-    const patch = (value: unknown) => svc.updateMember(scopeFor(owner), owner.tenantId, member.userId, value as never);
-
-    await expect(patch({ role: 'SUPERUSER' })).rejects.toMatchObject({ code: 'ROLE_INVALID', status: 400 });
-    // A string where an array belongs used to reach `.filter` as a 500.
-    await expect(patch({ grants: 'infra:write' })).rejects.toMatchObject({ code: 'GRANTS_INVALID', status: 400 });
-    await expect(patch({ grants: [1, 2] })).rejects.toMatchObject({ code: 'GRANTS_INVALID', status: 400 });
-    await expect(patch({ status: 'deleted-ish' })).rejects.toMatchObject({ code: 'MEMBER_STATUS_INVALID', status: 400 });
-    // …and the membership is untouched by any of them.
-    expect((await identity.getMembership(owner.tenantId, member.userId))?.role).toBe('MEMBER');
-  });
-
-  it('listMembers reports the EFFECTIVE grant beside the explicit one', async () => {
-    const { svc, owner } = await seedTenant();
-    const member = await joinViaInvite(svc, owner, 'mel@acme.test', 'MEMBER');
-    await svc.updateMember(scopeFor(owner), owner.tenantId, member.userId, { grants: ['knowledge:delete'] });
-
-    const members = await svc.listMembers(scopeFor(owner), owner.tenantId);
-    const mel = members.find((m) => m.userId === member.userId);
-    expect(mel?.email).toBe('mel@acme.test');
-    expect(mel?.grants).toEqual(['knowledge:delete']); // what an admin edits
-    expect(mel?.permissions).toEqual(['knowledge:delete', 'knowledge:write']); // what a session gets
-  });
-});
-
-describe('AccountService — multi-device sessions (02 §4)', () => {
-  /** Log `owner` in twice, as two named devices, through the REAL login path. */
-  const twoDevices = async (
-    svc: ReturnType<typeof createAccountService>,
-  ): Promise<{ laptop: CCUserClaims; phone: CCUserClaims }> => {
-    const laptop = await svc.login({
-      email: 'ann@acme.test',
-      password: bytes('owner-secret-1'),
-      deviceLabel: 'Ann’s laptop',
-    });
-    const phone = await svc.login({
-      email: 'ann@acme.test',
-      password: bytes('owner-secret-1'),
-      deviceLabel: 'Ann’s phone',
-    });
-    return { laptop: laptop.claims, phone: phone.claims };
-  };
-
-  it('lists this account’s live sessions with their device labels, flagging the calling one', async () => {
-    const { svc } = await seedTenant();
-    const { laptop, phone } = await twoDevices(svc);
-
-    const sessions = await svc.listSessions({ claims: laptop });
-    expect(sessions.map((s) => s.deviceLabel).sort()).toEqual(['Ann’s laptop', 'Ann’s phone']);
-    // Exactly one row is `current`, and it is the session that asked.
-    expect(sessions.filter((s) => s.current).map((s) => s.jti)).toEqual([laptop.jti]);
-    // No credential rides the list — only handles.
-    expect(Object.keys(sessions[0] ?? {})).not.toContain('token');
-    expect(sessions.every((s) => s.tenantId === laptop.tenantId)).toBe(true);
-    expect(new Date(sessions[0]?.expiresAt ?? 0).getTime()).toBeGreaterThan(Date.now());
-    expect(phone.jti).not.toBe(laptop.jti);
-  });
-
-  it('ends ONE device without touching the other, and refuses a jti that is not the caller’s', async () => {
-    const { svc, signer, owner } = await seedTenant();
-    const { laptop, phone } = await twoDevices(svc);
-    const bo = await joinViaInvite(svc, owner, 'bo@acme.test', 'MEMBER');
-    const boSession = await svc.login({ email: 'bo@acme.test', password: bytes('bo@acme.test-secret') });
-
-    expect(await svc.endSession({ claims: laptop }, phone.jti)).toBe(true);
-    expect(signer.isRevoked(phone.jti)).toBe(true);
-    expect(signer.isRevoked(laptop.jti)).toBe(false);
-    // The ended session drops out of the panel rather than lingering as a dead row.
-    expect((await svc.listSessions({ claims: laptop })).map((s) => s.jti)).toEqual([laptop.jti]);
-
-    // Another account's live jti is NOT endable — the verb aims at yourself only.
-    expect(await svc.endSession({ claims: laptop }, boSession.claims.jti)).toBe(false);
-    expect(signer.isRevoked(boSession.claims.jti)).toBe(false);
-    expect(bo.userId).not.toBe(laptop.userId);
-  });
-
-  it('log out everywhere closes BOTH devices, including the calling one', async () => {
-    const { svc, signer } = await seedTenant();
-    const { laptop, phone } = await twoDevices(svc);
-
-    expect(await svc.logoutEverywhere({ claims: laptop })).toEqual({ revoked: 2 });
-    expect(signer.isRevoked(laptop.jti)).toBe(true);
-    expect(signer.isRevoked(phone.jti)).toBe(true);
-    expect(await svc.listSessions({ claims: laptop })).toEqual([]);
-  });
-
-  it('refresh exchanges the token: the new one carries the STORE’s grant, the old one is dead', async () => {
-    const { svc, signer, owner } = await seedTenant();
-    const { laptop } = await twoDevices(svc);
-    // A grant the token does not have yet — refresh re-reads it rather than
-    // freezing whatever login minted.
-    await identity.setMembershipPermissions(owner.tenantId, owner.userId, ['media:write']);
-
-    const refreshed = await svc.refreshSession({ claims: laptop });
-    expect(refreshed.claims.jti).not.toBe(laptop.jti);
-    expect(refreshed.claims.permissions).toContain('media:write');
-    expect(signer.verify(refreshed.token).ok).toBe(true);
-    // The exchanged token is revoked, so a stolen copy of it is worthless.
-    expect(signer.isRevoked(laptop.jti)).toBe(true);
-    // The device keeps its name across the exchange (one row, not a new "unknown").
-    const sessions = await svc.listSessions({ claims: refreshed.claims });
-    expect(sessions.find((s) => s.jti === refreshed.claims.jti)?.deviceLabel).toBe('Ann’s laptop');
-  });
-
-  it('a refresh never extends the private-mode reveal, and a suspended membership cannot refresh', async () => {
-    const { svc, owner } = await seedTenant();
-    const { laptop } = await twoDevices(svc);
-    // A session that unlocked private mode does not get to keep the reveal by
-    // rotating its token — the passphrase re-earns it.
-    const revealed = await svc.refreshSession({ claims: { ...laptop, privateScope: true } });
-    expect(revealed.claims.privateScope).toBe(false);
-
-    // Suspending the membership directly (not through updateMember, which would
-    // revoke first) proves refresh itself re-reads the store.
-    await identity.setMembershipStatus(owner.tenantId, owner.userId, 'suspended');
-    await expect(svc.refreshSession({ claims: revealed.claims })).rejects.toMatchObject({
-      code: 'MEMBERSHIP_INACTIVE',
-      status: 403,
-    });
-  });
-});