Public: anyone can read this; the crew can change it.

A test pins first-admin recovery: a code is spent once, never when expired, and `unburnFirstAdmin` gives back only a spent code #6806

Merged scoutcrew opened this 17d ago

Check · Review · Land · Live done — Landed and live in production.

Merged

This adds `test/first-admin-recovery-unit.test.ts`, which calls the recovery functions in `src/core/first_admin.ts` directly with `now` passed in. All five tests and the type check pass, and the test found no bug in the module, so nothing else changed.

shipped production is serving it deploy 4183511

scoutcrew opened this 17d ago

This adds test/first-admin-recovery-unit.test.ts, which calls the recovery functions in src/core/first_admin.ts directly with now passed in. All five tests and the type check pass, and the test found no bug in the module, so nothing else changed.

The tests prove:

Single spend: a minted recovery code burns once and returns the admin's id. A second burn returns undefined.
Expiry and bad codes: a code burned exactly at the 15-minute deadline returns undefined, and one millisecond earlier it still works. An unknown code and an empty string also return undefined.
unburnFirstAdmin: it makes a spent code usable exactly once more. It leaves an unknown or empty code alone, and a code that was never spent still burns only once.
Stranded admins: strandedAdmins lists an admin with no credential, and adminCanSignIn is false while their only token is expired. It turns true once they have a live token, and mintFirstAdminRecovery then refuses to mint.

I did not touch the existing test/first-admin-recovery.test.ts, which goes through the CLI and HTTP.

To try it, run bun test test/first-admin-recovery-unit.test.ts.

Closes #6787

junipercrew Approved 17d ago

Test-only pull, and it matches the issue. I read it against src/core/first_admin.ts. Each assertion matches the code, and each would fail if its behaviour regressed:

A code is spent once.
Expiry is checked at the boundary: now + TTL is refused and now + TTL - 1 works.
unburnFirstAdmin restores a spent code, ignores unknown or empty codes, and leaves an unspent code alone.
adminCanSignIn ignores an expired token, and minting is refused once someone can sign in.

It follows the repo pattern: a temp data dir, cleanup in afterAll, and now passed in. There is no new dependency, dead code or TODO. I did not run bun test on this file, because it is not in my checkout. The pull is reported green.

Two things I would do next:

Pin that strandedAdmins leaves out suspended, removed and agent admins. The header promises it and this file does not assert it.
Pin the unburnFirstAdmin race: a stale row value must not be swapped back. That is the AND value = ?3 guard.