seamless-cli 0.10.1 → 0.11.0

package/verify/docker-compose.verify.yml

@@ -9,7 +9,7 @@
 #   SEAMLESS_ADAPTER_DIR  absolute path to the express adapter source
 #   API_SERVICE_TOKEN     shared secret between API and adapter
 #   JWKS_KID              key id the adapter expects (must match the API's active kid)
-#   SEAMLESS_BOOTSTRAP_SECRET  bearer secret for POST /bootstrap/admin-invite
+#   OWNER_EMAIL           tenant owner; this email gets the admin role at signup
 
 name: seamless-verify
 
@@ -72,8 +72,9 @@ services:
       DB_PASSWORD: seamless
       DB_NAME: seamless_auth
       API_SERVICE_TOKEN: ${API_SERVICE_TOKEN}
-      SEAMLESS_BOOTSTRAP_ENABLED: 'true'
-      SEAMLESS_BOOTSTRAP_SECRET: ${SEAMLESS_BOOTSTRAP_SECRET}
+      # The first admin comes from the OWNER_EMAIL grant at signup, so the
+      # harness can assert admin promotion without a separate invite flow.
+      OWNER_EMAIL: ${OWNER_EMAIL}
       # OAuth: a single "mock" provider backed by the harness's in-process OIDC.
       # authorizationUrl is browser/harness-visible (localhost); token/userInfo are
       # called server-side from the container, so they go via host.docker.internal.

package/verify/harness/api/ownerAdmin.spec.ts

@@ -0,0 +1,24 @@
+import { OWNER_EMAIL } from '../lib/env';
+import { expect, test } from '../lib/fixtures';
+import { registerEmail, requestEmailOtp, verifyEmailOtp } from '../lib/flows';
+
+test.describe('owner admin (api)', () => {
+  // The owner address is fixed in the stack's OWNER_EMAIL before boot, so this
+  // spec registers that exact email rather than the actor fixture's random one.
+  test('registering the owner email grants the admin role at signup', async ({ actor }) => {
+    const ephemeral = await registerEmail(actor.ctx, OWNER_EMAIL);
+    const code = await requestEmailOtp(actor.ctx, ephemeral);
+
+    const res = await verifyEmailOtp(actor.ctx, ephemeral, code);
+    expect(res.ok(), `verify-email-otp -> ${res.status()} ${await res.text()}`).toBeTruthy();
+
+    const body = await res.json();
+    expect(body.token, 'session access token').toBeTruthy();
+
+    const roles = (body.roles ?? []) as string[];
+    expect(
+      roles.includes('admin'),
+      `owner signup grants the admin role (got ${JSON.stringify(roles)})`,
+    ).toBeTruthy();
+  });
+});

package/verify/harness/lib/env.ts

@@ -11,10 +11,9 @@ export const MOCK_OIDC_PORT = Number(process.env.SEAMLESS_MOCK_OIDC_PORT ?? 9000
 export const API_SERVICE_TOKEN =
   process.env.SEAMLESS_API_SERVICE_TOKEN ?? 'verify-dev-service-token';
 
-// Must match the API's SEAMLESS_BOOTSTRAP_SECRET so the harness can mint the
-// first admin invite (bootstrap-promotion flow).
-export const BOOTSTRAP_SECRET =
-  process.env.SEAMLESS_BOOTSTRAP_SECRET ?? 'verify-dev-bootstrap-secret';
+// Must match the API's OWNER_EMAIL so the harness can assert that registering
+// the tenant owner grants the admin role at signup.
+export const OWNER_EMAIL = process.env.SEAMLESS_OWNER_EMAIL ?? 'owner@verify.local';
 
 // Non-production seam: makes the API return OTP / magic-link tokens in the
 // response `delivery` object instead of sending real email/SMS.

package/verify/harness/lib/flows.ts

@@ -1,6 +1,6 @@
 import { APIRequestContext, expect } from '@playwright/test';
 
-import { BOOTSTRAP_SECRET, EXTERNAL_DELIVERY } from './env';
+import { EXTERNAL_DELIVERY } from './env';
 
 export interface SessionTokens {
   token: string; // signed access token
@@ -43,41 +43,6 @@ export async function registerWithPhone(
   return body.token as string;
 }
 
-/**
- * Mint the one-time bootstrap admin invite (returns the raw invite token via
- * the external-delivery seam). Only succeeds before any admin exists — the API
- * gates re-use with 410, so this assumes a fresh DB (what `seamless verify` runs).
- */
-export async function createBootstrapInvite(
-  ctx: APIRequestContext,
-  email: string,
-): Promise<string> {
-  const res = await ctx.post('/internal/bootstrap/admin-invite', {
-    headers: { Authorization: `Bearer ${BOOTSTRAP_SECRET}`, ...EXTERNAL_DELIVERY },
-    data: { email },
-  });
-  expect(res.ok(), `bootstrap invite -> ${res.status()} ${await res.text()}`).toBeTruthy();
-  const token = (await res.json())?.data?.token;
-  expect(token, 'bootstrap invite returns a token via external delivery').toBeTruthy();
-  return String(token);
-}
-
-/** Register a user carrying a bootstrap invite token; returns the ephemeral token. */
-export async function registerWithBootstrapToken(
-  ctx: APIRequestContext,
-  email: string,
-  bootstrapToken: string,
-): Promise<string> {
-  const res = await ctx.post('/registration/register', {
-    headers: EXTERNAL_DELIVERY,
-    data: { email, bootstrapToken },
-  });
-  expect(res.ok(), `register ${email} -> ${res.status()} ${await res.text()}`).toBeTruthy();
-  const body = await res.json();
-  expect(body.token, 'register returns an ephemeral token').toBeTruthy();
-  return body.token as string;
-}
-
 /** Generate a phone OTP and return the raw code via the external-delivery seam. */
 export async function requestPhoneOtp(ctx: APIRequestContext, ephemeral: string): Promise<string> {
   const res = await ctx.get('/otp/generate-phone-otp', {

package/verify/harness/playwright.config.ts

@@ -18,12 +18,17 @@ export default defineConfig({
     ['junit', { outputFile: 'results/junit.xml' }],
     ['html', { outputFolder: 'results/html', open: 'never' }],
   ],
+  // Each project scopes itself with testDir, not testMatch. A testMatch regex is
+  // applied to the absolute path, so `/api\/.*\.spec\.ts$/` also matched every
+  // adapter and react spec whenever the checkout lived under a directory
+  // containing "api/" (the seamless-auth-api conformance run does exactly that),
+  // pulling browser specs into a project with no baseURL.
   projects: [
-    { name: 'api', testMatch: /api\/.*\.spec\.ts$/ },
-    { name: 'adapter', testMatch: /adapter\/.*\.spec\.ts$/ },
+    { name: 'api', testDir: './api' },
+    { name: 'adapter', testDir: './adapter' },
     {
       name: 'react',
-      testMatch: /react\/.*\.spec\.ts$/,
+      testDir: './react',
       use: { ...devices['Desktop Chrome'], baseURL: REACT_URL },
     },
   ],

package/dist/commands/bootstrapAdmin.js

@@ -1,96 +0,0 @@
-import { intro, outro, text, confirm, spinner } from "@clack/prompts";
-import kleur from "kleur";
-import { extractFlag } from "../core/args.js";
-import { resolveBootstrapSecret } from "../core/bootstrapSecret.js";
-const DEFAULT_API_URL = "http://localhost:3000";
-// Bootstrap targets the app API (the SeamlessAuth server adapter), which is what
-// exposes /auth/internal/bootstrap/admin-invite and delivers the invite. That is a
-// different service from a login profile's auth-server URL, which does not serve
-// that route — so this resolves independently of any profile: an explicit
-// --api-url wins, then SEAMLESS_API_URL, then the local dev default.
-function resolveApiUrl(apiUrlFlag) {
-    return (apiUrlFlag?.trim() ||
-        process.env.SEAMLESS_API_URL?.trim() ||
-        DEFAULT_API_URL);
-}
-export async function runBootstrapAdmin(args = []) {
-    intro("Seamless Auth Bootstrap");
-    const { value: apiUrlFlag, rest } = extractFlag(args, "api-url");
-    let email = rest.find((a) => !a.startsWith("-"));
-    if (!email) {
-        email = (await text({
-            message: "Admin email address",
-            placeholder: "admin@example.com",
-            validate: (value) => {
-                if (!value || !value.includes("@")) {
-                    return "Enter a valid email address";
-                }
-            },
-        }));
-    }
-    const proceed = await confirm({
-        message: "Create bootstrap admin invite?",
-        initialValue: true,
-    });
-    if (!proceed) {
-        outro("Cancelled.");
-        return;
-    }
-    const apiUrl = resolveApiUrl(apiUrlFlag);
-    let secret = resolveBootstrapSecret();
-    if (secret) {
-        console.log(kleur.gray("Using bootstrap secret from local environment"));
-    }
-    else {
-        console.log("");
-        console.log(kleur.yellow("No bootstrap secret detected automatically."));
-        console.log("This may happen if the project is not initialized locally or running in production.");
-        secret = (await text({
-            message: "Bootstrap secret",
-            placeholder: "Enter your bootstrap secret",
-            validate: (value) => {
-                if (!value)
-                    return "Bootstrap secret is required";
-            },
-        }));
-    }
-    const s = spinner();
-    s.start("Creating bootstrap invite...");
-    try {
-        const res = await fetch(`${apiUrl}/auth/internal/bootstrap/admin-invite`, {
-            method: "POST",
-            headers: {
-                "Content-Type": "application/json",
-                Authorization: `Bearer ${secret}`,
-            },
-            body: JSON.stringify({ email }),
-        });
-        const data = await res.json();
-        if (!res.ok) {
-            s.stop("Failed");
-            console.error(kleur.red("Error creating bootstrap invite"));
-            console.error(data);
-            process.exit(1);
-        }
-        s.stop("Done");
-        console.log("");
-        if (data?.data?.url) {
-            console.log(kleur.bold("Registration URL"));
-            console.log(kleur.cyan(data.data.url));
-        }
-        else {
-            console.log(kleur.green(`Invite sent to ${email}`));
-        }
-        console.log("");
-        console.log("Next step:");
-        console.log("The invited user must complete registration to receive admin access.");
-        outro("Bootstrap complete.");
-    }
-    catch (err) {
-        s.stop("Failed");
-        console.error(kleur.red("Unexpected error"));
-        console.error(err.message);
-        process.exit(1);
-    }
-}
-//# sourceMappingURL=bootstrapAdmin.js.map

package/dist/commands/bootstrapAdmin.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"bootstrapAdmin.js","sourceRoot":"","sources":["../../src/commands/bootstrapAdmin.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,gBAAgB,CAAC;AACtE,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAC9C,OAAO,EAAE,sBAAsB,EAAE,MAAM,4BAA4B,CAAC;AAEpE,MAAM,eAAe,GAAG,uBAAuB,CAAC;AAEhD,iFAAiF;AACjF,mFAAmF;AACnF,iFAAiF;AACjF,0EAA0E;AAC1E,qEAAqE;AACrE,SAAS,aAAa,CAAC,UAAmB;IACxC,OAAO,CACL,UAAU,EAAE,IAAI,EAAE;QAClB,OAAO,CAAC,GAAG,CAAC,gBAAgB,EAAE,IAAI,EAAE;QACpC,eAAe,CAChB,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,OAAiB,EAAE;IACzD,KAAK,CAAC,yBAAyB,CAAC,CAAC;IAEjC,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE,GAAG,WAAW,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;IACjE,IAAI,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC;IAEjD,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,KAAK,GAAG,CAAC,MAAM,IAAI,CAAC;YAClB,OAAO,EAAE,qBAAqB;YAC9B,WAAW,EAAE,mBAAmB;YAChC,QAAQ,EAAE,CAAC,KAAK,EAAE,EAAE;gBAClB,IAAI,CAAC,KAAK,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;oBACnC,OAAO,6BAA6B,CAAC;gBACvC,CAAC;YACH,CAAC;SACF,CAAC,CAAW,CAAC;IAChB,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC;QAC5B,OAAO,EAAE,gCAAgC;QACzC,YAAY,EAAE,IAAI;KACnB,CAAC,CAAC;IAEH,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,KAAK,CAAC,YAAY,CAAC,CAAC;QACpB,OAAO;IACT,CAAC;IAED,MAAM,MAAM,GAAG,aAAa,CAAC,UAAU,CAAC,CAAC;IAEzC,IAAI,MAAM,GAAG,sBAAsB,EAAE,CAAC;IAEtC,IAAI,MAAM,EAAE,CAAC;QACX,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,+CAA+C,CAAC,CAAC,CAAC;IAC3E,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,6CAA6C,CAAC,CAAC,CAAC;QACzE,OAAO,CAAC,GAAG,CACT,qFAAqF,CACtF,CAAC;QAEF,MAAM,GAAG,CAAC,MAAM,IAAI,CAAC;YACnB,OAAO,EAAE,kBAAkB;YAC3B,WAAW,EAAE,6BAA6B;YAC1C,QAAQ,EAAE,CAAC,KAAK,EAAE,EAAE;gBAClB,IAAI,CAAC,KAAK;oBAAE,OAAO,8BAA8B,CAAC;YACpD,CAAC;SACF,CAAC,CAAW,CAAC;IAChB,CAAC;IAED,MAAM,CAAC,GAAG,OAAO,EAAE,CAAC;IACpB,CAAC,CAAC,KAAK,CAAC,8BAA8B,CAAC,CAAC;IAExC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,MAAM,uCAAuC,EAAE;YACxE,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,kBAAkB;gBAClC,aAAa,EAAE,UAAU,MAAM,EAAE;aAClC;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,CAAC;SAChC,CAAC,CAAC;QAEH,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;QAE9B,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YAEjB,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,iCAAiC,CAAC,CAAC,CAAC;YAC5D,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YAEpB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QAED,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAEf,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAEhB,IAAI,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC;YACpB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC,CAAC;YAC5C,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;QACzC,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,kBAAkB,KAAK,EAAE,CAAC,CAAC,CAAC;QACtD,CAAC;QAED,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChB,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QAC1B,OAAO,CAAC,GAAG,CACT,sEAAsE,CACvE,CAAC;QAEF,KAAK,CAAC,qBAAqB,CAAC,CAAC;IAC/B,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAClB,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAEjB,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC,CAAC;QAC7C,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAE3B,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;AACH,CAAC"}

package/dist/core/bootstrapSecret.js

@@ -1,39 +0,0 @@
-import fs from "fs";
-import path from "path";
-export function resolveBootstrapSecret() {
-    const root = process.cwd();
-    if (process.env.SEAMLESS_BOOTSTRAP_SECRET) {
-        return normalizeSecretValue(process.env.SEAMLESS_BOOTSTRAP_SECRET);
-    }
-    const rootEnv = path.join(root, ".env");
-    if (fs.existsSync(rootEnv)) {
-        const content = fs.readFileSync(rootEnv, "utf-8");
-        const match = content.match(/SEAMLESS_BOOTSTRAP_SECRET=(.*)/);
-        if (match)
-            return normalizeSecretValue(match[1]);
-    }
-    const authEnv = path.join(root, "auth", ".env");
-    if (fs.existsSync(authEnv)) {
-        const content = fs.readFileSync(authEnv, "utf-8");
-        const match = content.match(/SEAMLESS_BOOTSTRAP_SECRET=(.*)/);
-        if (match)
-            return normalizeSecretValue(match[1]);
-    }
-    const compose = path.join(root, "docker-compose.yml");
-    if (fs.existsSync(compose)) {
-        const content = fs.readFileSync(compose, "utf-8");
-        const match = content.match(/SEAMLESS_BOOTSTRAP_SECRET:\s*(.*)/);
-        if (match)
-            return normalizeSecretValue(match[1]);
-    }
-    return null;
-}
-function normalizeSecretValue(value) {
-    const trimmed = value.trim();
-    if ((trimmed.startsWith('"') && trimmed.endsWith('"')) ||
-        (trimmed.startsWith("'") && trimmed.endsWith("'"))) {
-        return trimmed.slice(1, -1);
-    }
-    return trimmed;
-}
-//# sourceMappingURL=bootstrapSecret.js.map

package/dist/core/bootstrapSecret.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"bootstrapSecret.js","sourceRoot":"","sources":["../../src/core/bootstrapSecret.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,IAAI,CAAC;AACpB,OAAO,IAAI,MAAM,MAAM,CAAC;AAExB,MAAM,UAAU,sBAAsB;IACpC,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;IAE3B,IAAI,OAAO,CAAC,GAAG,CAAC,yBAAyB,EAAE,CAAC;QAC1C,OAAO,oBAAoB,CAAC,OAAO,CAAC,GAAG,CAAC,yBAAyB,CAAC,CAAC;IACrE,CAAC;IAED,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACxC,IAAI,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QAC3B,MAAM,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAClD,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,gCAAgC,CAAC,CAAC;QAC9D,IAAI,KAAK;YAAE,OAAO,oBAAoB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IACnD,CAAC;IAED,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;IAChD,IAAI,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QAC3B,MAAM,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAClD,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,gCAAgC,CAAC,CAAC;QAC9D,IAAI,KAAK;YAAE,OAAO,oBAAoB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IACnD,CAAC;IAED,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,oBAAoB,CAAC,CAAC;IACtD,IAAI,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QAC3B,MAAM,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAElD,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,mCAAmC,CAAC,CAAC;QACjE,IAAI,KAAK;YAAE,OAAO,oBAAoB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IACnD,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,oBAAoB,CAAC,KAAa;IACzC,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAE7B,IACE,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;QAClD,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,EAClD,CAAC;QACD,OAAO,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAC9B,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC"}

package/verify/harness/api/adminBootstrap.spec.ts

@@ -1,34 +0,0 @@
-import { expect, test } from '../lib/fixtures';
-import {
-  createBootstrapInvite,
-  pollMagicLink,
-  registerWithBootstrapToken,
-  requestMagicLink,
-  verifyMagicLink,
-} from '../lib/flows';
-
-test.describe('admin bootstrap (api)', () => {
-  // The first-admin invite is single-use per DB (the API returns 410 once an
-  // admin exists), so this relies on the fresh DB `seamless verify` provisions.
-  test('invite -> register -> magic-link completion promotes the user to admin', async ({
-    actor,
-  }) => {
-    const inviteToken = await createBootstrapInvite(actor.ctx, actor.email);
-    const ephemeral = await registerWithBootstrapToken(actor.ctx, actor.email, inviteToken);
-
-    const { token } = await requestMagicLink(actor.ctx, ephemeral);
-    const verified = await verifyMagicLink(actor.ctx, token);
-    expect(verified.ok(), `verify -> ${verified.status()}`).toBeTruthy();
-
-    const completed = await pollMagicLink(actor.ctx, ephemeral);
-    expect(completed.status(), 'poll after verify issues a session').toBe(200);
-
-    const body = await completed.json();
-    expect(body.token, 'session access token').toBeTruthy();
-    const roles = (body.roles ?? []) as string[];
-    expect(
-      roles.includes('admin'),
-      `bootstrap promotion grants the admin role (got ${JSON.stringify(roles)})`,
-    ).toBeTruthy();
-  });
-});