gunnar-server 3.0.0

//! **The owner's enterprise list, end to end over the REAL plane and stores**
//! (2026-10-05): the account admin's audit log, the operator's aggregates
//! (and nothing else) unless the account admin approves a look, and the name
//! filter — driven through the gRPC services exactly as the console and the
//! CLI reach them, with a real P-256 passkey for every login (the identity
//! core's, IDENTITY-HOST) and an approver's core session that stepped up.

use std::sync::Arc;

use gunnar_grpc::auth::PersonSession;
use gunnar_grpc::{
    AccessService, AccountsService, Caller, ClansService, ControlPlane, EnterpriseService,
    EventBus, ReposService, ServerConfig, ServiceContext,
};
use gunnar_proto::access_server::Access as _;
use gunnar_proto::accounts_server::Accounts as _;
use gunnar_proto::clans_server::Clans as _;
use gunnar_proto::enterprise_server::Enterprise as _;
use gunnar_proto::repos_server::Repos as _;
use gunnar_proto::*;
use gunnar_server::control_plane::CoreControlPlane;
use gunnar_server::stores::ServerStores;
use p256::ecdsa::signature::Signer as _;
use tonic::{Code, Request};

const RP_ID: &str = "console.example";
const ORIGIN: &str = "https://console.example";

fn person(id: &str) -> Caller {
    Caller {
        principal_id: id.to_owned(),
        fingerprint: format!("SHA256:{id}"),
        machine: false,
        authenticated: true,
    }
}

fn machine(id: &str) -> Caller {
    Caller {
        machine: true,
        ..person(id)
    }
}

fn authed<T>(caller: &Caller, body: T) -> Request<T> {
    let mut r = Request::new(body);
    r.extensions_mut().insert(caller.clone());
    r
}

fn unhex(text: &str) -> Vec<u8> {
    (0..text.len())
        .step_by(2)
        .map(|i| u8::from_str_radix(&text[i..i + 2], 16).unwrap())
        .collect()
}

fn unb64(text: &str) -> Vec<u8> {
    gunnar_grpc::webauthn::from_b64url(text).expect("base64url")
}

/// A call from `caller`'s core session, stepped up (a fresh user-verified touch).
fn stepped<T>(caller: &Caller, body: T) -> Request<T> {
    let mut r = authed(caller, body);
    r.extensions_mut().insert(PersonSession {
        stepped_up: true,
        stepped_up_at_unix_ms: None,
    });
    r
}

fn sha256(bytes: &[u8]) -> Vec<u8> {
    unhex(&gunnar_grpc::webauthn::sha256_hex(bytes))
}

/// One authenticator: a P-256 key, its id and its counter.
struct Passkey {
    key: p256::ecdsa::SigningKey,
    id: Vec<u8>,
    counter: std::cell::Cell<u32>,
}

impl Passkey {
    fn new(seed: u8, id: &str) -> Passkey {
        Passkey {
            key: p256::ecdsa::SigningKey::from_slice(&[seed; 32]).expect("a scalar"),
            id: id.as_bytes().to_vec(),
            counter: std::cell::Cell::new(0),
        }
    }

    fn public(&self) -> Vec<u8> {
        self.key
            .verifying_key()
            .to_sec1_point(false)
            .as_bytes()
            .to_vec()
    }

    /// What a browser hands back for `navigator.credentials.get` over
    /// `challenge`: (clientDataJSON, authenticatorData, signature), user
    /// present and verified, the counter moved.
    fn get(&self, challenge: &[u8]) -> (Vec<u8>, Vec<u8>, Vec<u8>) {
        self.counter.set(self.counter.get() + 1);
        let client_data = format!(
            r#"{{"type":"webauthn.get","challenge":"{}","origin":"{ORIGIN}","crossOrigin":false}}"#,
            gunnar_grpc::webauthn::b64url(challenge)
        )
        .into_bytes();
        let mut auth_data = sha256(RP_ID.as_bytes());
        auth_data.push(0x01 | 0x04);
        auth_data.extend_from_slice(&self.counter.get().to_be_bytes());
        let mut message = auth_data.clone();
        message.extend_from_slice(&sha256(&client_data));
        let signature: p256::ecdsa::Signature = self.key.sign(&message);
        (
            client_data,
            auth_data,
            signature.to_der().as_bytes().to_vec(),
        )
    }
}

struct World {
    _dir: tempfile::TempDir,
    stores: Arc<ServerStores>,
    plane: Arc<CoreControlPlane>,
    ctx: ServiceContext,
    identity: Arc<gunnar_grpc::identity::GunnarIdentity>,
    relay: Caller,
    op: Caller,
    acme: Caller,
    bob: Caller,
    acme_key: Passkey,
    bob_key: Passkey,
}

/// The estate: `op` the operator (a person, server Admin) with its own
/// account and repository; `nordisk` a namespace nobody owns (the operator's
/// forge); `acme` a customer with a private `site`, a public `www` and an
/// employee `bob`; the console's relay `gunnar-ui`.
fn world() -> World {
    let dir = tempfile::tempdir().expect("tempdir");
    let stores = Arc::new(ServerStores::open(dir.path()).expect("stores"));
    let plane = Arc::new(CoreControlPlane::new(Arc::clone(&stores)));
    let control: Arc<dyn ControlPlane> = plane.clone();
    let identity = gunnar_server::identity::build(
        dir.path(),
        Arc::clone(&control),
        &ServerConfig::default(),
        false,
    );
    let ctx = ServiceContext::new(
        control,
        Arc::new(EventBus::new(64)),
        ServerConfig::default(),
    )
    .with_identity(Arc::clone(&identity));
    plane
        .add_principal("gunnar-ui", "gunnar-ui", PrincipalKind::Machine)
        .expect("relay");
    plane
        .grant("gunnar-ui", "", "", GrantLevel::Admin)
        .expect("the relay is a server admin");
    plane
        .add_principal("op", "op", PrincipalKind::User)
        .expect("the operator");
    plane
        .grant("op", "", "", GrantLevel::Admin)
        .expect("the operator is a server admin");
    plane
        .add_principal("acme", "acme", PrincipalKind::User)
        .expect("a customer");
    let w = World {
        _dir: dir,
        stores,
        plane,
        ctx,
        identity,
        relay: machine("gunnar-ui"),
        op: person("op"),
        acme: person("acme"),
        bob: person("bob"),
        acme_key: Passkey::new(11, "acme-yubikey"),
        bob_key: Passkey::new(12, "bob-yubikey"),
    };
    let rt = tokio::runtime::Builder::new_current_thread()
        .enable_all()
        .build()
        .unwrap();
    rt.block_on(async {
        w.create(&w.op, "op", "notes", Visibility::Private)
            .await
            .expect("the operator's own repository");
        w.repos()
            .create_namespace(authed(
                &w.op,
                CreateNamespaceRequest {
                    name: "nordisk".into(),
                    description: String::new(),
                },
            ))
            .await
            .expect("the operator's forge namespace");
        w.create(&w.op, "nordisk", "gunnar", Visibility::Private)
            .await
            .expect("nordisk/gunnar");
        w.create(&w.acme, "acme", "site", Visibility::Private)
            .await
            .expect("acme/site");
        w.create(&w.acme, "acme", "www", Visibility::Public)
            .await
            .expect("acme/www");
        w.accounts()
            .enroll_employee(authed(
                &w.acme,
                EnrollEmployeeRequest {
                    account: "acme".into(),
                    id: "bob".into(),
                    name: "Bob".into(),
                    ..Default::default()
                },
            ))
            .await
            .expect("acme enrolls bob");
    });
    w.plane
        .add_credential(
            "acme",
            &w.acme_key.id,
            &w.acme_key.public(),
            "acme's YubiKey",
            0,
        )
        .expect("acme's passkey");
    w.plane
        .add_credential(
            "bob",
            &w.bob_key.id,
            &w.bob_key.public(),
            "bob's YubiKey",
            0,
        )
        .expect("bob's passkey");
    w
}

impl World {
    fn repos(&self) -> ReposService {
        ReposService::new(self.ctx.clone())
    }
    fn accounts(&self) -> AccountsService {
        AccountsService::new(self.ctx.clone())
    }
    fn access(&self) -> AccessService {
        AccessService::new(self.ctx.clone())
    }
    fn enterprise(&self) -> EnterpriseService {
        EnterpriseService::new(self.ctx.clone())
    }
    fn clans(&self) -> ClansService {
        ClansService::new(self.ctx.clone())
    }

    async fn log_of(&self, who: &Caller, account: &str) -> Result<AuditLogResponse, tonic::Status> {
        self.enterprise()
            .audit_log(authed(
                who,
                AuditLogRequest {
                    account: account.into(),
                    filter: None,
                    page_size: 200,
                    before_seq: None,
                },
            ))
            .await
            .map(|r| r.into_inner())
    }

    async fn create(
        &self,
        who: &Caller,
        ns: &str,
        repo: &str,
        visibility: Visibility,
    ) -> Result<Repo, tonic::Status> {
        self.repos()
            .create(authed(
                who,
                CreateRepoRequest {
                    path: Some(RepoPath::new(ns, repo)),
                    visibility: visibility as i32,
                    ..Default::default()
                },
            ))
            .await
            .map(|r| r.into_inner().repo.expect("a repo"))
    }

    /// A machine's creation challenge, relayed.
    async fn challenge(&self) -> Vec<u8> {
        self.access()
            .machine_challenge(authed(&self.relay, MachineChallengeRequest::default()))
            .await
            .expect("the relay gets a challenge")
            .into_inner()
            .challenge
    }

    /// A passkey login through the identity core, as the console relays it.
    fn login(&self, key: &Passkey) -> Result<nornir_identity::LoggedIn, nornir_identity::Refused> {
        let c = self.identity.login_start(&nornir_identity::Relay {
            rp_id: RP_ID.into(),
            origin: ORIGIN.into(),
            client: None,
        })?;
        let challenge = unb64(&c.challenge);
        let (client_data_json, authenticator_data, signature) = key.get(&challenge);
        self.identity.login_finish(nornir_identity::Assertion {
            ceremony_id: c.id,
            credential_id: key.id.clone(),
            client_data_json,
            authenticator_data,
            signature,
            rp_id: RP_ID.into(),
            origin: ORIGIN.into(),
        })
    }

    async fn log(&self, who: &Caller, kinds: &[&str]) -> Result<AuditLogResponse, tonic::Status> {
        self.enterprise()
            .audit_log(authed(
                who,
                AuditLogRequest {
                    account: "acme".into(),
                    filter: Some(AuditFilter {
                        kinds: kinds.iter().map(|k| k.to_string()).collect(),
                        ..Default::default()
                    }),
                    page_size: 200,
                    before_seq: None,
                },
            ))
            .await
            .map(|r| r.into_inner())
    }

    async fn listed(&self, who: &Caller, namespace: &str) -> Vec<String> {
        let mut names: Vec<String> = self
            .repos()
            .list(authed(
                who,
                ListReposRequest {
                    namespace: namespace.into(),
                    ..Default::default()
                },
            ))
            .await
            .expect("a listing")
            .into_inner()
            .repos
            .into_iter()
            .filter_map(|r| r.path.map(|p| format!("{}/{}", p.namespace, p.repo)))
            .collect();
        names.sort();
        names
    }

    async fn get(&self, who: &Caller, ns: &str, repo: &str) -> Result<Repo, tonic::Status> {
        self.repos()
            .get(authed(
                who,
                GetRepoRequest {
                    path: Some(RepoPath::new(ns, repo)),
                },
            ))
            .await
            .map(|r| r.into_inner().repo.expect("a repo"))
    }
}

fn kinds(log: &AuditLogResponse) -> Vec<String> {
    log.entries
        .iter()
        .map(|e| format!("{}:{}:{}", e.kind, e.actor_role, e.outcome))
        .collect()
}

// ── 1. the audit log ────────────────────────────────────────────────────────

/// ★ **Everything security-relevant in the account is in its log, read by
/// its admin and nobody else**: logins (and a refused one), the member added,
/// the invite, the visibility a member tried and the admin made, the
/// repositories — hash-chained, newest first, filtered, and exported.
#[tokio::test(flavor = "multi_thread")]
async fn the_account_admin_reads_every_security_event_and_nobody_else_does() {
    let w = tokio::task::spawn_blocking(world).await.unwrap();
    w.login(&w.bob_key).expect("bob logs in");
    // A refused login: a replayed counter.
    w.bob_key.counter.set(0);
    assert!(
        w.login(&w.bob_key).is_err(),
        "a counter that went back is refused"
    );
    let acme = w
        .identity
        .vouched_session("acme", true)
        .expect("acme's session")
        .token;
    w.identity
        .invite(
            &acme,
            nornir_identity::InviteAsk {
                person: Some("bob".into()),
                ..Default::default()
            },
        )
        .expect("acme invites bob to another device");
    let refused = w
        .repos()
        .set_visibility(authed(
            &w.bob,
            SetVisibilityRequest {
                path: Some(RepoPath::new("acme", "site")),
                visibility: Visibility::Public as i32,
            },
        ))
        .await
        .expect_err("a member may not make a repository public");
    assert_eq!(refused.code(), Code::PermissionDenied);
    w.repos()
        .set_visibility(authed(
            &w.acme,
            SetVisibilityRequest {
                path: Some(RepoPath::new("acme", "site")),
                visibility: Visibility::Public as i32,
            },
        ))
        .await
        .expect("the account admin may");

    let log = w.log(&w.acme, &[]).await.expect("the admin reads the log");
    let seen = kinds(&log);
    for want in [
        "repo.created:admin:ok",
        "member.added:admin:ok",
        "login:member:ok",
        "invite.created:admin:ok",
        "visibility.changed:member:refused",
        "visibility.changed:admin:ok",
    ] {
        assert!(
            seen.iter().any(|s| s == want),
            "{want} is not in the log: {seen:#?}"
        );
    }
    // The refused login names bob (nornir-identity 0.2.1), so bob's account has it again, as
    // the old Access.WebLogin wrote it.
    assert!(
        seen.iter().any(|s| s == "login:member:refused"),
        "the refused login is not in the log: {seen:#?}"
    );
    let refused = log
        .entries
        .iter()
        .find(|e| e.kind == "login" && e.outcome == "refused")
        .unwrap();
    assert_eq!(
        (refused.actor.as_str(), refused.target.as_str()),
        ("bob", "passkey"),
        "{refused:?}"
    );
    assert!(
        !seen.iter().any(|s| s.starts_with("repo.created:operator")),
        "the operator's own repositories are not acme's: {seen:#?}"
    );
    assert_eq!(
        log.entries.first().map(|e| e.kind.as_str()),
        Some("visibility.changed"),
        "newest first"
    );
    let chain = log
        .chain
        .as_ref()
        .expect("the first page says whether the chain holds");
    assert!(chain.holds, "{chain:?}");
    assert_eq!(chain.tip_hash, log.entries[0].hash);
    assert_eq!(log.retention_days, 365, "a year by default");
    let made_public = log
        .entries
        .iter()
        .find(|e| e.kind == "visibility.changed" && e.outcome == "ok")
        .unwrap();
    assert_eq!(made_public.detail, "private → public");
    assert_eq!(made_public.target, "acme/site");

    // Filtered: the visibility family only.
    let vis = w.log(&w.acme, &["visibility"]).await.unwrap();
    assert_eq!(vis.entries.len(), 2, "{:#?}", kinds(&vis));

    // Nobody else reads it: not the member, not the operator.
    for who in [&w.bob, &w.op] {
        let err = w
            .log(who, &[])
            .await
            .expect_err("only the account's admins");
        assert_eq!(
            err.code(),
            Code::PermissionDenied,
            "{}: {err:?}",
            who.principal_id
        );
        assert!(err.message().contains("account admin"), "{}", err.message());
    }

    // Exported, and the export is itself in the log.
    let csv = w
        .enterprise()
        .export_audit_log(authed(
            &w.acme,
            ExportAuditLogRequest {
                account: "acme".into(),
                format: AuditExportFormat::Csv as i32,
                ..Default::default()
            },
        ))
        .await
        .expect("a CSV")
        .into_inner();
    let text = String::from_utf8(csv.body).unwrap();
    assert!(
        text.starts_with("seq,at_utc,kind,actor,actor_role,target,detail,outcome,hash\n"),
        "{text}"
    );
    assert_eq!(csv.entries as usize, log.entries.len());
    assert!(
        csv.file_name.starts_with("audit-acme-") && csv.file_name.ends_with(".csv"),
        "{}",
        csv.file_name
    );
    let json = w
        .enterprise()
        .export_audit_log(authed(
            &w.acme,
            ExportAuditLogRequest {
                account: "acme".into(),
                format: AuditExportFormat::Json as i32,
                ..Default::default()
            },
        ))
        .await
        .expect("JSON")
        .into_inner();
    assert_eq!(json.content_type, "application/json");
    let after = w.log(&w.acme, &["audit"]).await.unwrap();
    assert_eq!(
        after.entries.len(),
        2,
        "both exports are entries: {:#?}",
        kinds(&after)
    );
    let err = w
        .enterprise()
        .export_audit_log(authed(
            &w.op,
            ExportAuditLogRequest {
                account: "acme".into(),
                ..Default::default()
            },
        ))
        .await
        .expect_err("the operator exports nothing");
    assert_eq!(err.code(), Code::PermissionDenied);
}

// ── 2. the operator sees aggregates only ───────────────────────────────────

/// ★ **The operator principal gets totals, never names**: its listings skip
/// what is inside a customer's account (a public repository excepted, as for
/// any outsider), a named read is refused, and so is every act of the account
/// admin's — while `Aggregates` counts all of it.
#[tokio::test(flavor = "multi_thread")]
async fn the_operator_principal_gets_aggregates_only() {
    let w = tokio::task::spawn_blocking(world).await.unwrap();
    assert_eq!(
        w.listed(&w.op, "").await,
        vec!["acme/www", "nordisk/gunnar", "op/notes"],
        "the operator's listing: its own, the forge's, and acme's PUBLIC repository only"
    );
    assert!(
        w.listed(&w.acme, "")
            .await
            .contains(&"acme/site".to_owned()),
        "acme sees its own"
    );
    assert_eq!(
        w.listed(&w.op, "acme").await,
        vec!["acme/www"],
        "inside acme: the public subset"
    );
    let err = w
        .get(&w.op, "acme", "site")
        .await
        .expect_err("a private repository by name");
    assert_eq!(err.code(), Code::PermissionDenied);
    w.get(&w.op, "nordisk", "gunnar")
        .await
        .expect("the operator's own forge is the operator's");

    let principals: Vec<String> = w
        .access()
        .list_principals(authed(&w.op, ListPrincipalsRequest::default()))
        .await
        .expect("the operator lists principals")
        .into_inner()
        .principals
        .into_iter()
        .map(|p| p.id)
        .collect();
    assert!(
        principals.contains(&"acme".to_owned()),
        "an account's own name is how the operator addresses it"
    );
    assert!(
        !principals.contains(&"bob".to_owned()),
        "a member's name is not the operator's: {principals:?}"
    );
    let creds = w
        .access()
        .list_credentials(authed(&w.op, ListCredentialsRequest::default()))
        .await
        .expect("credentials")
        .into_inner()
        .credentials;
    assert!(
        creds
            .iter()
            .all(|c| c.principal_id != "bob" && !c.label.contains("bob")),
        "a member's passkey names nobody: {creds:?}"
    );
    assert!(
        creds.iter().any(|c| c.principal_id == "acme"),
        "the account's own person is how it is recovered: {creds:?}"
    );
    assert_eq!(
        creds.len(),
        2,
        "every passkey is still offered at login, a member's by id alone: {creds:?}"
    );

    let err = w
        .accounts()
        .list_employees(authed(
            &w.op,
            ListEmployeesRequest {
                account: "acme".into(),
            },
        ))
        .await
        .expect_err("the members of acme");
    assert_eq!(err.code(), Code::PermissionDenied);
    let err = w
        .repos()
        .set_visibility(authed(
            &w.op,
            SetVisibilityRequest {
                path: Some(RepoPath::new("acme", "site")),
                visibility: Visibility::Public as i32,
            },
        ))
        .await
        .expect_err("only the account admin makes things public — the operator neither");
    assert_eq!(err.code(), Code::PermissionDenied);
    assert!(err.message().contains("account admin"), "{}", err.message());
    let err = w
        .create(&w.op, "acme", "planted", Visibility::Private)
        .await
        .expect_err("nor creates inside");
    assert_eq!(err.code(), Code::PermissionDenied);

    let totals = w
        .enterprise()
        .aggregates(authed(&w.op, AggregatesRequest {}))
        .await
        .expect("the operator's totals")
        .into_inner();
    assert_eq!(
        totals.accounts, 2,
        "acme and the operator's own: {totals:?}"
    );
    assert_eq!(totals.enterprise_accounts, 1);
    assert_eq!(totals.members, 1);
    assert_eq!(
        totals.repos, 4,
        "the whole estate: acme's two, op/notes and the forge's nordisk/gunnar: {totals:?}"
    );
    assert_eq!(totals.public_repos, 1);
    assert_eq!(
        totals.operator_repos, 1,
        "nordisk/gunnar, the operator's share of the four"
    );
    assert_eq!(
        totals.health == "ok",
        totals.health_alarms == 0,
        "{totals:?}"
    );
    let err = w
        .enterprise()
        .aggregates(authed(&w.bob, AggregatesRequest {}))
        .await
        .expect_err("a member is no operator");
    assert_eq!(err.code(), Code::PermissionDenied);
}

/// ★ **The totals are the WHOLE estate's** (round 5.3; the owner on test2
/// 2026-10-08: "Repositories 0 (0 public) · Storage used 0 B · Room held —"
/// over seven repositories, ~205 MB, in the operator's `nordisk`, a namespace
/// no account owns). A public repository there and a pack pushed into it move
/// the repositories, the public count and the storage used — numbers, never
/// names — and `operator_repos` stays the operator's share of `repos`.
#[tokio::test(flavor = "multi_thread")]
async fn the_totals_count_the_whole_estate_the_operators_own_namespaces_too() {
    let w = tokio::task::spawn_blocking(world).await.unwrap();
    w.create(&w.op, "nordisk", "site", Visibility::Public)
        .await
        .expect("a public repository in the operator's forge");
    // About 256 KiB of pack into nordisk/gunnar, and the namespace's own
    // measure once its indexes have landed (three equal readings in a row).
    let path = gunnar_core::RepoRef::new("nordisk", "gunnar").expect("legal");
    let stored = tokio::task::spawn_blocking({
        let (stores, plane) = (Arc::clone(&w.stores), Arc::clone(&w.plane));
        move || {
            let repo = stores
                .catalog()
                .get(&path)
                .expect("read")
                .expect("nordisk/gunnar exists");
            let handle = stores.repo_store(&repo).expect("open");
            let mut pb = gunnar_store::conformance::pack::PackBuilder::new(handle.hash_kind());
            pb.object(gix_object::Kind::Blob, vec![b'n'; 256 << 10]);
            handle
                .serve()
                .put_pack(&pb.build().expect("pack").bytes)
                .expect("put_pack");
            drop(handle);
            stores.close_repo(&path);
            let read = || {
                let row = &plane.usage(Some("nordisk")).expect("usage")[0];
                row.pack_bytes.saturating_add(row.lfs_bytes)
            };
            let (mut last, mut same) = (read(), 0);
            for _ in 0..100 {
                std::thread::sleep(std::time::Duration::from_millis(300));
                let now = read();
                same = if now == last { same + 1 } else { 0 };
                last = now;
                if same >= 3 {
                    break;
                }
            }
            last
        }
    })
    .await
    .unwrap();
    assert!(stored > 0, "the pack is measured in nordisk");

    let totals = w
        .enterprise()
        .aggregates(authed(&w.op, AggregatesRequest {}))
        .await
        .expect("the operator's totals")
        .into_inner();
    assert_eq!(
        totals.repos, 5,
        "acme's two, op/notes, nordisk/gunnar and nordisk/site: {totals:?}"
    );
    assert_eq!(
        totals.public_repos, 2,
        "acme/www and nordisk/site: {totals:?}"
    );
    assert_eq!(
        totals.operator_repos, 2,
        "nordisk's two, already inside the five: {totals:?}"
    );
    assert!(
        totals.stored_bytes >= stored,
        "the storage used leaves the operator's forge out: {} < {stored} in nordisk alone",
        totals.stored_bytes
    );
    let everything: u64 = w
        .plane
        .usage(None)
        .expect("every namespace's usage")
        .iter()
        .map(|r| r.pack_bytes.saturating_add(r.lfs_bytes))
        .sum();
    assert_eq!(
        totals.stored_bytes, everything,
        "the storage used is every namespace's, pack and LFS"
    );
    assert_eq!(
        totals.accounts, 2,
        "accounts are still people: acme and the operator's own, never the forge"
    );
}

// ── 2b. the look the account admin grants ──────────────────────────────────

/// ★ **An explicit, time-limited, audited grant through the Approve flow**:
/// the operator asks; the account admin approves with a fresh step-up of
/// THEIR OWN passkey and the request's code; the operator reads (never
/// writes) until the admin ends it; every step is in the account's log.
#[tokio::test(flavor = "multi_thread")]
async fn the_account_admin_approves_a_look_with_a_step_up_and_ends_it() {
    let w = tokio::task::spawn_blocking(world).await.unwrap();
    let asked = w
        .enterprise()
        .request_operator_access(authed(
            &w.op,
            RequestOperatorAccessRequest {
                account: "acme".into(),
                reason: "ticket 4711: a push hangs".into(),
                minutes: 30,
            },
        ))
        .await
        .expect("the operator asks")
        .into_inner()
        .request
        .unwrap();
    assert_eq!(asked.state, OperatorAccessState::Pending as i32);
    assert!(
        w.get(&w.op, "acme", "site").await.is_err(),
        "asking is not having"
    );
    let err = w
        .enterprise()
        .request_operator_access(authed(
            &w.bob,
            RequestOperatorAccessRequest {
                account: "acme".into(),
                reason: "x".into(),
                minutes: 30,
            },
        ))
        .await
        .expect_err("only an operator asks");
    assert_eq!(err.code(), Code::PermissionDenied);

    let pending = w
        .enterprise()
        .list_operator_access(authed(
            &w.acme,
            ListOperatorAccessRequest {
                account: "acme".into(),
            },
        ))
        .await
        .expect("acme sees the request")
        .into_inner()
        .requests;
    assert_eq!(pending.len(), 1);
    assert_eq!(pending[0].reason, "ticket 4711: a push hangs");

    let approve = |who: &Caller, code: &str, fresh: bool| {
        let body = ApproveOperatorAccessRequest {
            request_id: asked.request_id.clone(),
            code: code.into(),
            minutes: 0,
        };
        if fresh {
            stepped(who, body)
        } else {
            authed(who, body)
        }
    };
    let err = w
        .enterprise()
        .approve_operator_access(approve(&w.acme, &asked.code, false))
        .await
        .expect_err("no step-up");
    assert_eq!(err.code(), Code::PermissionDenied, "{err:?}");
    assert!(err.message().contains("[stepup]"), "{err:?}");
    let err = w
        .enterprise()
        .approve_operator_access(approve(&w.acme, "XXX-000", true))
        .await
        .expect_err("the wrong code");
    assert_eq!(err.code(), Code::FailedPrecondition, "{err:?}");
    let err = w
        .enterprise()
        .approve_operator_access(approve(&w.bob, &asked.code, true))
        .await
        .expect_err("a member decides nothing");
    assert_eq!(err.code(), Code::PermissionDenied, "{err:?}");
    let err = w
        .enterprise()
        .approve_operator_access(approve(&w.op, &asked.code, true))
        .await
        .expect_err("nor the operator itself");
    assert_eq!(err.code(), Code::PermissionDenied, "{err:?}");

    let approved = w
        .enterprise()
        .approve_operator_access(approve(&w.acme, &asked.code, true))
        .await
        .expect("acme approves")
        .into_inner()
        .request
        .unwrap();
    assert_eq!(approved.state, OperatorAccessState::Approved as i32);
    assert!(approved.granted_until_unix_ms > gunnar_core::now_ms() + 25 * 60_000);
    let err = w
        .enterprise()
        .approve_operator_access(approve(&w.acme, &asked.code, true))
        .await
        .expect_err("decided");
    assert_ne!(err.code(), Code::Ok);

    // The look: reads, never writes, never the log.
    w.get(&w.op, "acme", "site")
        .await
        .expect("the approved look reads");
    assert!(w.listed(&w.op, "").await.contains(&"acme/site".to_owned()));
    let err = w
        .repos()
        .set_visibility(authed(
            &w.op,
            SetVisibilityRequest {
                path: Some(RepoPath::new("acme", "site")),
                visibility: Visibility::Public as i32,
            },
        ))
        .await
        .expect_err("a look writes nothing");
    assert_eq!(err.code(), Code::PermissionDenied);
    assert_eq!(
        w.log(&w.op, &[])
            .await
            .expect_err("the log stays the admins'")
            .code(),
        Code::PermissionDenied
    );

    let ended = w
        .enterprise()
        .revoke_operator_access(authed(
            &w.acme,
            RevokeOperatorAccessRequest {
                request_id: asked.request_id.clone(),
            },
        ))
        .await
        .expect("acme ends it")
        .into_inner()
        .request
        .unwrap();
    assert_eq!(ended.state, OperatorAccessState::Revoked as i32);
    assert!(w.get(&w.op, "acme", "site").await.is_err(), "ended");

    let log = w.log(&w.acme, &["operator_access"]).await.unwrap();
    assert_eq!(
        kinds(&log),
        vec![
            "operator_access.revoked:admin:ok",
            "operator_access.approved:admin:ok",
            "operator_access.requested:operator:ok"
        ],
    );
    assert!(
        log.entries[2].detail.contains("ticket 4711"),
        "{:?}",
        log.entries[2]
    );
}

// ── 3. the name filter ──────────────────────────────────────────────────────

/// ★ **An offensive name is refused with a sentence and the account admin is
/// told; a borderline one waits for the account admin — not the operator —
/// and passes once allowed; reserved names are not a person's; the lists are
/// gunnar's configuration.**
#[tokio::test(flavor = "multi_thread")]
async fn a_name_the_filter_stops_is_refused_held_or_allowed_by_the_account_admin() {
    let w = tokio::task::spawn_blocking(world).await.unwrap();
    let err = w
        .create(&w.acme, "acme", "fuck-this", Visibility::Private)
        .await
        .expect_err("an offensive name");
    assert_eq!(err.code(), Code::InvalidArgument);
    assert!(
        err.message().contains("refused")
            && err.message().to_lowercase().contains("choose another name"),
        "{}",
        err.message()
    );
    assert!(
        !err.message()
            .to_lowercase()
            .contains("contains a word \"fuck"),
        "the word is not repeated back"
    );
    assert!(
        w.get(&w.acme, "acme", "fuck-this").await.is_err(),
        "nothing was made"
    );
    let err = w
        .create(&w.acme, "acme", "sh1t_h3ad", Visibility::Private)
        .await
        .expect_err("leet");
    assert_eq!(err.code(), Code::InvalidArgument);

    let err = w
        .create(&w.acme, "acme", "porn-filter", Visibility::Private)
        .await
        .expect_err("held");
    assert_eq!(err.code(), Code::FailedPrecondition);
    assert!(
        err.message().contains("account admin's review"),
        "{}",
        err.message()
    );
    let queue = w
        .enterprise()
        .list_name_reviews(authed(
            &w.acme,
            ListNameReviewsRequest {
                account: "acme".into(),
            },
        ))
        .await
        .expect("acme's queue")
        .into_inner();
    assert_eq!(queue.pending, 1, "{queue:?}");
    assert_eq!(
        queue.reviews.len(),
        3,
        "the two refusals are noted too: {queue:?}"
    );
    let held = queue
        .reviews
        .iter()
        .find(|r| r.state == "pending")
        .unwrap()
        .clone();
    for who in [&w.op, &w.bob] {
        let err = w
            .enterprise()
            .decide_name_review(authed(
                who,
                DecideNameReviewRequest {
                    account: "acme".into(),
                    id: held.id.clone(),
                    allow: true,
                },
            ))
            .await
            .expect_err("only the account admin decides");
        assert_eq!(err.code(), Code::PermissionDenied, "{}", who.principal_id);
    }
    w.enterprise()
        .decide_name_review(authed(
            &w.acme,
            DecideNameReviewRequest {
                account: "acme".into(),
                id: held.id.clone(),
                allow: true,
            },
        ))
        .await
        .expect("acme allows it");
    w.create(&w.acme, "acme", "porn-filter", Visibility::Private)
        .await
        .expect("allowed in acme now");

    // A member named as staff is not made.
    let err = w
        .accounts()
        .enroll_employee(authed(
            &w.acme,
            EnrollEmployeeRequest {
                account: "acme".into(),
                id: "support".into(),
                name: "support".into(),
                ..Default::default()
            },
        ))
        .await
        .expect_err("a reserved name");
    assert_eq!(err.code(), Code::InvalidArgument);
    assert!(err.message().contains("reserved"), "{}", err.message());
    // A signup relayed by a machine is held to the reserved names; the
    // operator (a person) names the estate's own.
    let err = w
        .access()
        .add_principal(authed(
            &w.relay,
            AddPrincipalRequest {
                name: "administrator".into(),
                kind: PrincipalKind::User as i32,
                id: String::new(),
            },
        ))
        .await
        .expect_err("a machine relaying a signup");
    assert_eq!(err.code(), Code::InvalidArgument);
    w.access()
        .add_principal(authed(
            &w.op,
            AddPrincipalRequest {
                name: "security".into(),
                kind: PrincipalKind::User as i32,
                id: String::new(),
            },
        ))
        .await
        .expect("the operator names a staff account");

    let log = w.log(&w.acme, &["name"]).await.unwrap();
    let seen = kinds(&log);
    for want in [
        "name.refused:admin:refused",
        "name.held:admin:refused",
        "name.allowed:admin:ok",
    ] {
        assert!(seen.iter().any(|s| s == want), "{want}: {seen:#?}");
    }

    // The lists are gunnar's, set by a server admin, read by anyone it asks.
    let mut lists = w
        .enterprise()
        .get_name_lists(authed(&w.op, GetNameListsRequest {}))
        .await
        .expect("the lists")
        .into_inner();
    assert!(!lists.blocked.is_empty() && !lists.reserved.is_empty());
    lists.blocked.push("frobnicate".into());
    w.enterprise()
        .set_name_lists(authed(
            &w.op,
            SetNameListsRequest {
                lists: Some(lists.clone()),
            },
        ))
        .await
        .expect("the operator sets the lists");
    let err = w
        .create(&w.acme, "acme", "frobnicate-all", Visibility::Private)
        .await
        .expect_err("the new word");
    assert_eq!(err.code(), Code::InvalidArgument);
    let err = w
        .enterprise()
        .set_name_lists(authed(&w.acme, SetNameListsRequest { lists: Some(lists) }))
        .await
        .expect_err("an account admin does not set the server's lists");
    assert_eq!(err.code(), Code::PermissionDenied);
    let checked = w
        .enterprise()
        .check_name(authed(
            &w.bob,
            CheckNameRequest {
                kind: "repo".into(),
                name: "f\u{0430}ggot-list".into(),
                account: "acme".into(),
            },
        ))
        .await
        .expect("anyone authenticated asks")
        .into_inner();
    assert_eq!(checked.verdict, "blocked", "a Cyrillic а is still a");
}

// ── 1b. an approval (machine enrolment) in the approver's account log ─────

/// ★ **"Approvals (machine enrolment)"**: a kit asks for a machine
/// credential, the operator — a person, server admin — approves it with a
/// fresh touch of their own passkey; the approval (and a refusal) is in the
/// OPERATOR's own account log, by the operator, naming the machine.
#[tokio::test(flavor = "multi_thread")]
async fn a_machine_enrolment_approval_is_in_the_approvers_account_log() {
    let w = tokio::task::spawn_blocking(world).await.unwrap();
    let op_key = Passkey::new(13, "op-yubikey");
    w.plane
        .add_credential("op", &op_key.id, &op_key.public(), "op's YubiKey", 0)
        .expect("op's passkey");
    let kits = [
        Passkey::new(14, "kit-oden-key"),
        Passkey::new(15, "kit-dwarf-key"),
    ];
    let ask = |machine: &'static str, challenge: Vec<u8>| {
        let kit = if machine == "kit-oden" {
            &kits[0]
        } else {
            &kits[1]
        };
        RequestMachineEnrolmentRequest {
        machine: machine.to_owned(),
        label: format!("installer kit on {machine}"),
        server_level: GrantLevel::Admin as i32,
        credential_id: kit.id.clone(),
        public_key: kit.public(),
        client_data_json: format!(
            r#"{{"type":"webauthn.create","challenge":"{}","origin":"{ORIGIN}","crossOrigin":false}}"#,
            gunnar_grpc::webauthn::b64url(&challenge)
        )
        .into_bytes(),
        rp_id: RP_ID.to_owned(),
        origin: ORIGIN.to_owned(),
        sign_count: 0,
        attestation_object: gunnar_grpc::webauthn::attestation_none(RP_ID, &kit.id, &kit.public(), 0),
    }
    };
    let held = w
        .access()
        .request_machine_enrolment(authed(&w.relay, ask("kit-oden", w.challenge().await)))
        .await
        .expect("the kit asks, relayed")
        .into_inner()
        .request
        .unwrap();
    w.access()
        .approve_machine_enrolment(stepped(
            &w.op,
            ApproveMachineEnrolmentRequest {
                request_id: held.request_id.clone(),
                code: held.code.clone(),
                server_level: GrantLevel::Unspecified as i32,
            },
        ))
        .await
        .expect("the operator approves with its own touch");
    let refused = w
        .access()
        .request_machine_enrolment(authed(&w.relay, ask("kit-dwarf", w.challenge().await)))
        .await
        .expect("a second kit asks")
        .into_inner()
        .request
        .unwrap();
    w.access()
        .refuse_machine_enrolment(authed(
            &w.op,
            RefuseMachineEnrolmentRequest {
                request_id: refused.request_id.clone(),
            },
        ))
        .await
        .expect("the operator refuses it");

    let log = w
        .enterprise()
        .audit_log(authed(
            &w.op,
            AuditLogRequest {
                account: "op".into(),
                filter: Some(AuditFilter {
                    kinds: vec!["approval".into()],
                    ..Default::default()
                }),
                page_size: 10,
                before_seq: None,
            },
        ))
        .await
        .expect("the operator reads its OWN account's log")
        .into_inner();
    let seen: Vec<String> = log
        .entries
        .iter()
        .map(|e| format!("{}:{}:{}:{}", e.kind, e.actor, e.actor_role, e.target))
        .collect();
    assert_eq!(
        seen,
        vec![
            "approval.machine_refused:op:admin:kit-dwarf",
            "approval.machine:op:admin:kit-oden"
        ],
        "{seen:#?}"
    );
    assert!(
        log.entries[1].detail.contains(&held.code),
        "{:?}",
        log.entries[1]
    );
    // acme's log knows nothing of it.
    let acme = w.log(&w.acme, &["approval"]).await.unwrap();
    assert!(acme.entries.is_empty(), "{:?}", kinds(&acme));
}

// ── 4. clans are accounts to the enterprise list ──────────────────────────

/// ★ **A CLAN is an account to the enterprise list** (follow-ups of the
/// clans + audit merge, 2026-10-05): a clan's namespace is behind the
/// operator's shield like an account's (its repositories are not the
/// operator's to list or read, and `Aggregates` counts them inside the
/// accounts, not as the operator's); every clan verb is in the clan's own
/// audit log, which its admin reads — and the account that acted has it in
/// its own; and `Clans.Create` passes the name filter as a namespace does.
#[tokio::test(flavor = "multi_thread")]
async fn a_clan_is_an_account_to_the_enterprise_list() {
    let w = tokio::task::spawn_blocking(world).await.unwrap();
    for id in ["carol", "dave"] {
        w.plane
            .add_principal(id, id, PrincipalKind::User)
            .expect("an ordinary account");
    }
    let (carol, dave) = (person("carol"), person("dave"));
    // The name filter: an offensive clan name is refused, and nothing is made.
    let err = w
        .clans()
        .create(authed(
            &carol,
            CreateClanRequest {
                name: "fuck-crew".into(),
                contribution_bytes: 0,
            },
        ))
        .await
        .expect_err("an offensive clan name");
    assert_eq!(err.code(), Code::InvalidArgument, "{err:?}");
    assert!(
        w.plane.namespace("fuck-crew").unwrap().is_none(),
        "a refused clan left a namespace"
    );
    w.clans()
        .create(authed(
            &carol,
            CreateClanRequest {
                name: "fellows".into(),
                contribution_bytes: 0,
            },
        ))
        .await
        .expect("a clean clan name");
    w.clans()
        .invite(authed(
            &carol,
            InviteToClanRequest {
                clan: "fellows".into(),
                principal_id: "dave".into(),
            },
        ))
        .await
        .expect("carol invites dave");
    w.clans()
        .accept(authed(
            &dave,
            AcceptClanInviteRequest {
                clan: "fellows".into(),
                contribution_bytes: 0,
            },
        ))
        .await
        .expect("dave joins");
    w.clans()
        .set_admin(authed(
            &carol,
            SetClanAdminRequest {
                clan: "fellows".into(),
                principal_id: "dave".into(),
                admin: true,
            },
        ))
        .await
        .expect("carol makes dave an admin");
    w.clans()
        .set_contribution(authed(
            &dave,
            SetClanContributionRequest {
                clan: "fellows".into(),
                contribution_bytes: 0,
            },
        ))
        .await
        .expect("dave sets what he gives");
    w.create(&dave, "fellows", "plans", Visibility::Private)
        .await
        .expect("a member makes a private repository");

    // The operator's shield: the clan's repositories are not the operator's.
    assert!(
        !w.listed(&w.op, "")
            .await
            .contains(&"fellows/plans".to_owned()),
        "the operator lists a clan's repository"
    );
    let err = w
        .get(&w.op, "fellows", "plans")
        .await
        .expect_err("a clan's private repository by name");
    assert_eq!(err.code(), Code::PermissionDenied, "{err:?}");
    let totals = w
        .enterprise()
        .aggregates(authed(&w.op, AggregatesRequest {}))
        .await
        .expect("totals")
        .into_inner();
    assert_eq!(
        totals.operator_repos, 1,
        "a clan's repository is not the operator's: {totals:?}"
    );
    assert_eq!(
        totals.repos, 5,
        "the whole estate: acme's two, op/notes, nordisk/gunnar and fellows/plans: {totals:?}"
    );

    // The clan's own log, read by its admins and nobody else.
    let log = w
        .log_of(&carol, "fellows")
        .await
        .expect("the clan's admin reads the clan's log");
    let seen = kinds(&log);
    for want in [
        "clan.created:admin:ok",
        "clan.invited:admin:ok",
        "clan.joined:member:ok",
        "clan.admin_made:admin:ok",
        "clan.contribution:admin:ok",
        "repo.created:admin:ok",
    ] {
        assert!(
            seen.iter().any(|s| s == want),
            "{want} is not in the clan's log: {seen:#?}"
        );
    }
    for who in [&w.op, &w.acme] {
        let err = w
            .log_of(who, "fellows")
            .await
            .expect_err("only the clan's admins");
        assert_eq!(
            err.code(),
            Code::PermissionDenied,
            "{}: {err:?}",
            who.principal_id
        );
    }
    // The account that acted has it in its own log.
    let own = kinds(&w.log_of(&dave, "dave").await.expect("dave reads his own"));
    assert!(
        own.iter().any(|s| s == "clan.joined:admin:ok"),
        "dave's own log: {own:#?}"
    );
    let own = kinds(
        &w.log_of(&carol, "carol")
            .await
            .expect("carol reads her own"),
    );
    assert!(
        own.iter().any(|s| s == "clan.created:admin:ok"),
        "carol's own log: {own:#?}"
    );
}

/// ★ **A repository offered out of a clan is in the account logs** (clans
/// round 2 follow-up, 2026-10-06): `Clans.OfferRepo` and every answer to it
/// (`Clans.AnswerRepoOffer`: withdrawn by the clan's admin, declined or taken
/// by the account's) are in the clan's own log, in the offering admin's
/// account's, and in the receiving account's — once each, and in no other
/// account's.
#[tokio::test(flavor = "multi_thread")]
async fn a_repository_offered_out_of_a_clan_is_in_the_clans_the_offerers_and_the_receivers_logs() {
    let w = tokio::task::spawn_blocking(world).await.unwrap();
    for id in ["carol", "dave"] {
        w.plane
            .add_principal(id, id, PrincipalKind::User)
            .expect("an ordinary account");
    }
    let (carol, dave) = (person("carol"), person("dave"));
    w.clans()
        .create(authed(
            &carol,
            CreateClanRequest {
                name: "fellows".into(),
                contribution_bytes: 0,
            },
        ))
        .await
        .expect("carol makes the clan");
    w.create(&carol, "fellows", "plans", Visibility::Private)
        .await
        .expect("a clan's repository");
    let offer = |who: &Caller| {
        let who = who.clone();
        let clans = w.clans();
        async move {
            clans
                .offer_repo(authed(
                    &who,
                    OfferRepoRequest {
                        clan: "fellows".into(),
                        repo: "plans".into(),
                        account: "dave".into(),
                    },
                ))
                .await
                .map(|_| ())
        }
    };
    let answer = |who: &Caller, accept: bool| {
        let who = who.clone();
        let clans = w.clans();
        async move {
            clans
                .answer_repo_offer(authed(
                    &who,
                    AnswerRepoOfferRequest {
                        clan: "fellows".into(),
                        repo: "plans".into(),
                        accept,
                    },
                ))
                .await
                .map(|_| ())
        }
    };
    offer(&carol)
        .await
        .expect("carol offers fellows/plans to dave");
    answer(&carol, false).await.expect("carol withdraws it");
    offer(&carol).await.expect("offered again");
    answer(&dave, false).await.expect("dave declines it");
    offer(&carol).await.expect("offered a third time");
    answer(&dave, true).await.expect("dave takes it");

    const EVENTS: [&str; 4] = [
        "clan.repo_offered",
        "clan.repo_offer_withdrawn",
        "clan.repo_offer_declined",
        "clan.repo_moved",
    ];
    let count = |seen: &[String], kind: &str| {
        seen.iter()
            .filter(|s| s.split(':').next() == Some(kind) && s.ends_with(":ok"))
            .count()
    };
    for (reader, account, offered) in [
        (&carol, "fellows", 3),
        (&carol, "carol", 3),
        (&dave, "dave", 3),
    ] {
        let seen = kinds(
            &w.log_of(reader, account)
                .await
                .unwrap_or_else(|e| panic!("{account}'s log: {e:?}")),
        );
        assert_eq!(
            count(&seen, "clan.repo_offered"),
            offered,
            "three offers in {account}'s log: {seen:#?}"
        );
        for kind in &EVENTS[1..] {
            assert_eq!(
                count(&seen, kind),
                1,
                "{kind} once in {account}'s log: {seen:#?}"
            );
        }
    }
    let acme = kinds(&w.log_of(&w.acme, "acme").await.expect("acme's own"));
    for kind in EVENTS {
        assert_eq!(
            count(&acme, kind),
            0,
            "{kind} in an uninvolved account's log: {acme:#?}"
        );
    }
}

// ── 5. members (owner, 2026-10-07: a customer is an ACCOUNT that pays; its
//       members use its space, never buy, and get Write from its admin) ───────

/// ★ **WhoAmI says which account the caller acts in and what it is to it**,
/// over the real table: `acme` (one member, `bob`) is its admin, `bob` its
/// employee — never a namespace of his own — and `op`, who holds an account
/// of his own and no members, an individual. A console draws the buying doors
/// and the member's storage from this answer and nothing of its own.
#[tokio::test(flavor = "multi_thread")]
async fn who_am_i_names_the_account_and_the_callers_role_in_it() {
    let w = tokio::task::spawn_blocking(world).await.unwrap();
    let who = |caller: &Caller| {
        let access = w.access();
        let caller = caller.clone();
        async move {
            let me = access
                .who_am_i(authed(&caller, WhoAmIRequest {}))
                .await
                .expect("an answer")
                .into_inner();
            (me.account, me.account_role, me.account_admin)
        }
    };
    assert_eq!(
        who(&w.acme).await,
        ("acme".to_owned(), "admin".to_owned(), "acme".to_owned())
    );
    assert_eq!(
        who(&w.bob).await,
        ("acme".to_owned(), "employee".to_owned(), "acme".to_owned()),
        "a member acts in the account that enrolled him"
    );
    assert_eq!(
        who(&w.op).await,
        ("op".to_owned(), "individual".to_owned(), "op".to_owned())
    );
    assert_eq!(
        who(&w.relay).await,
        (String::new(), String::new(), String::new()),
        "a machine with no account of its own speaks for none"
    );
}

/// ★ **The account admin gives a member Write on one of the account's
/// repositories, sees it, and takes it away — and Gunnar is what says only
/// the admin may.** The member cannot grant himself, cannot read the grants,
/// and the admin's listing covers the admin's own account and nothing else.
#[tokio::test(flavor = "multi_thread")]
async fn the_account_admin_gives_a_member_write_and_takes_it_away() {
    let w = tokio::task::spawn_blocking(world).await.unwrap();
    let write = |who: &Caller, principal: &str| {
        let access = w.access();
        let (who, principal) = (who.clone(), principal.to_owned());
        async move {
            access
                .grant(authed(
                    &who,
                    GrantRequest {
                        principal_id: principal,
                        namespace: "acme".into(),
                        repo: "site".into(),
                        level: GrantLevel::Write as i32,
                    },
                ))
                .await
                .map(|_| ())
        }
    };
    let listed = |who: &Caller, namespace: &str, repo: &str| {
        let access = w.access();
        let (who, namespace, repo) = (who.clone(), namespace.to_owned(), repo.to_owned());
        async move {
            access
                .list_grants(authed(
                    &who,
                    ListGrantsRequest {
                        principal_id: String::new(),
                        namespace,
                        repo,
                    },
                ))
                .await
                .map(|r| {
                    let mut rows: Vec<String> = r
                        .into_inner()
                        .grants
                        .into_iter()
                        .map(|g| {
                            format!("{}:{}/{}:{}", g.principal_id, g.namespace, g.repo, g.level)
                        })
                        .collect();
                    rows.sort();
                    rows
                })
        }
    };
    let (read, writes) = (GrantLevel::Read as i32, GrantLevel::Write as i32);

    // A member owns no account by his name: no namespace `bob` is his to
    // administer (the walkthrough's `ben` was offered one for New repository
    // and Import, and bought room for it).
    let own = w
        .access()
        .check(authed(
            &w.bob,
            CheckRequest {
                namespace: "bob".into(),
                repo: String::new(),
                level: GrantLevel::Admin as i32,
            },
        ))
        .await
        .expect("an answer")
        .into_inner();
    assert!(
        !own.allowed,
        "a member is no account's admin by his name: {own:?}"
    );

    // The member may not hand himself Write, nor read who holds what.
    let refused = write(&w.bob, "bob")
        .await
        .expect_err("a member grants nothing");
    assert_eq!(refused.code(), Code::PermissionDenied, "{refused:?}");
    let refused = listed(&w.bob, "acme", "")
        .await
        .expect_err("a member reads no grants");
    assert_eq!(refused.code(), Code::PermissionDenied, "{refused:?}");

    // The account admin sees what enrolment gave bob: Read on the account.
    assert_eq!(
        listed(&w.acme, "acme", "")
            .await
            .expect("the admin reads the account's grants"),
        [format!("bob:acme/:{read}")]
    );
    // …and gives him Write on one repository.
    write(&w.acme, "bob")
        .await
        .expect("the account admin grants Write");
    assert_eq!(
        listed(&w.acme, "acme", "site")
            .await
            .expect("one repository's"),
        [format!("bob:acme/site:{writes}")]
    );
    let may = w
        .access()
        .check(authed(
            &w.bob,
            CheckRequest {
                namespace: "acme".into(),
                repo: "site".into(),
                level: GrantLevel::Write as i32,
            },
        ))
        .await
        .expect("an answer")
        .into_inner();
    assert!(may.allowed, "bob may write acme/site now: {may:?}");

    // The admin's listing is the admin's OWN account: no other, and not the
    // whole table (a server admin's).
    for (namespace, why) in [("nordisk", "another namespace"), ("", "the whole table")] {
        let refused = listed(&w.acme, namespace, "").await.expect_err(why);
        assert_eq!(refused.code(), Code::PermissionDenied, "{why}: {refused:?}");
    }

    // Taken away again: back to the account's Read.
    w.access()
        .revoke(authed(
            &w.acme,
            RevokeRequest {
                principal_id: "bob".into(),
                namespace: "acme".into(),
                repo: "site".into(),
            },
        ))
        .await
        .expect("the account admin takes Write away");
    assert_eq!(
        listed(&w.acme, "acme", "site")
            .await
            .expect("one repository's"),
        Vec::<String>::new()
    );
    let may = w
        .access()
        .check(authed(
            &w.bob,
            CheckRequest {
                namespace: "acme".into(),
                repo: "site".into(),
                level: GrantLevel::Write as i32,
            },
        ))
        .await
        .expect("an answer")
        .into_inner();
    assert!(!may.allowed, "bob may no longer write acme/site: {may:?}");
    let log = kinds(&w.log(&w.acme, &["grant"]).await.expect("the admin's log"));
    for want in ["grant.added:admin:ok", "grant.revoked:admin:ok"] {
        assert!(
            log.iter().any(|s| s == want),
            "{want} is not in acme's log: {log:#?}"
        );
    }
}

/// ★ **Users the account's admin bought are added in the admin's name.** The
/// seller (monetize, at server scope) delivers a paid "Add users" order; the
/// account's log says the account's admin added the member — and who
/// delivered it, under which order — never "operator" reaching inside the
/// account (the walkthrough of 2026-10-07 read "alice (operator)" there: the
/// rig's box operator, whose key the bench monetize signs with).
#[tokio::test(flavor = "multi_thread")]
async fn users_the_admin_bought_are_added_in_the_admins_name() {
    let w = tokio::task::spawn_blocking(world).await.unwrap();
    let order = "gunnar/acme/2026-10-07+users=1";
    w.accounts()
        .enroll_employee(authed(
            &w.op,
            EnrollEmployeeRequest {
                account: "acme".into(),
                id: "carl".into(),
                name: "Carl".into(),
                order: order.into(),
                ..Default::default()
            },
        ))
        .await
        .expect("the seller delivers the paid order");
    let log = w
        .log(&w.acme, &["member.added"])
        .await
        .expect("the admin's log");
    let carl = log
        .entries
        .iter()
        .find(|e| e.target == "carl")
        .expect("carl's entry");
    assert_eq!(
        (carl.actor.as_str(), carl.actor_role.as_str()),
        ("acme", "admin"),
        "{carl:?}"
    );
    assert!(
        carl.detail.contains(order) && carl.detail.contains("delivered by op"),
        "the delivery is named: {carl:?}"
    );
}

/// ★ **Turning encryption on or off is in the account's audit log** (wiring
/// tracer B 2026-10-08), as a visibility change is: it decides what the
/// operator can be trusted with for every member, and turning it OFF was
/// written nowhere the account admin reads — only a tracing line on the box.
#[tokio::test(flavor = "multi_thread")]
async fn turning_encryption_on_or_off_is_in_the_accounts_audit_log() {
    let w = tokio::task::spawn_blocking(world).await.unwrap();
    let set = |on: bool| SetEncryptedRequest {
        path: Some(RepoPath::new("acme", "site")),
        encrypted: on,
    };
    let refused = w
        .repos()
        .set_encrypted(authed(&w.bob, set(true)))
        .await
        .expect_err("a member may not");
    assert_eq!(refused.code(), Code::PermissionDenied);
    w.repos()
        .set_encrypted(authed(&w.acme, set(true)))
        .await
        .expect("the account admin turns it on");
    w.repos()
        .set_encrypted(authed(&w.acme, set(false)))
        .await
        .expect("…and off");
    let log = w.log(&w.acme, &[]).await.expect("the admin reads the log");
    let seen = kinds(&log);
    for want in [
        "encrypted.changed:member:refused",
        "encrypted.changed:admin:ok",
    ] {
        assert!(
            seen.iter().any(|s| s == want),
            "{want} is not in the log: {seen:#?}"
        );
    }
    let off = log
        .entries
        .iter()
        .find(|e| e.kind == "encrypted.changed" && e.outcome == "ok")
        .expect("the newest");
    assert_eq!(
        off.detail, "encrypted → plaintext allowed",
        "newest first: the turn OFF"
    );
    assert_eq!(off.target, "acme/site");
}