docs: reorder & testing

backend/internal/auth/auth_e2e_test.go

@@ -72,7 +72,7 @@ func startPostgres(t *testing.T) *sql.DB {
 	cfg.PrimaryDSN = scopedDSN
 	cfg.OperationTimeout = pgOpTO
 
-	db, err := pgshared.OpenPrimary(ctx, cfg)
+	db, err := pgshared.OpenPrimary(ctx, cfg, backendpg.NoObservabilityOptions()...)
 	if err != nil {
 		t.Fatalf("open primary: %v", err)
 	}
@@ -155,8 +155,7 @@ func (p *recordingPush) snapshot() []recordedPush {
 }
 
 // stubGeo implements auth.GeoService with no real lookups. The country
-// it returns is configurable per call via CountryForIP; LanguageForIP
-// returns "" so the auth flow exercises the "en" fallback path.
+// it returns is configurable per call via countryByIP.
 type stubGeo struct {
 	countryByIP map[string]string
 }
@@ -169,8 +168,6 @@ func (g *stubGeo) LookupCountry(sourceIP string) string {
 	return g.countryByIP[sourceIP]
 }
 
-func (g *stubGeo) LanguageForIP(_ string) string { return "" }
-
 func (g *stubGeo) SetDeclaredCountryAtRegistration(_ context.Context, _ uuid.UUID, _ string) error {
 	return nil
 }
@@ -279,7 +276,10 @@ func TestAuthEndToEnd(t *testing.T) {
 		t.Fatalf("GetSession user_id = %s, want %s", got.UserID, session.UserID)
 	}
 
-	revoked, err := svc.RevokeSession(ctx, session.DeviceSessionID)
+	revoked, err := svc.RevokeSession(ctx, session.DeviceSessionID, auth.RevokeContext{
+		ActorKind: auth.ActorKindUserSelf,
+		ActorID:   session.UserID.String(),
+	})
 	if err != nil {
 		t.Fatalf("RevokeSession: %v", err)
 	}
@@ -294,7 +294,10 @@ func TestAuthEndToEnd(t *testing.T) {
 		t.Fatalf("GetSession after revoke = %v, want ErrSessionNotFound", err)
 	}
 
-	again, err := svc.RevokeSession(ctx, session.DeviceSessionID)
+	again, err := svc.RevokeSession(ctx, session.DeviceSessionID, auth.RevokeContext{
+		ActorKind: auth.ActorKindUserSelf,
+		ActorID:   session.UserID.String(),
+	})
 	if err != nil {
 		t.Fatalf("idempotent RevokeSession: %v", err)
 	}
@@ -330,6 +333,49 @@ func TestSendEmailCodePermanentlyBlocked(t *testing.T) {
 	}
 }
 
+// TestConfirmEmailCodePermanentlyBlockedAfterSend covers the case where
+// an admin applies permanent_block in the window between send and
+// confirm. The send-time guard let the challenge through because the
+// account was unblocked at that moment; the confirm-time guard must
+// catch the late block and reject the registration.
+func TestConfirmEmailCodePermanentlyBlockedAfterSend(t *testing.T) {
+	db := startPostgres(t)
+	svc, mailer, _, _ := buildService(t, db)
+	ctx := context.Background()
+
+	const email = "blockedlater@example.test"
+
+	if _, err := db.Exec(`
+		INSERT INTO backend.accounts (
+			user_id, email, user_name, preferred_language, time_zone
+		) VALUES ($1, $2, $3, $4, $5)
+	`, uuid.New(), email, "Player-XXBLATER", "en", "UTC"); err != nil {
+		t.Fatalf("seed account: %v", err)
+	}
+
+	id, err := svc.SendEmailCode(ctx, email, "en", "", "")
+	if err != nil {
+		t.Fatalf("SendEmailCode: %v", err)
+	}
+	_, code, _ := mailer.snapshot()
+
+	if _, err := db.Exec(`
+		UPDATE backend.accounts SET permanent_block = true WHERE email = $1
+	`, email); err != nil {
+		t.Fatalf("apply permanent_block: %v", err)
+	}
+
+	_, err = svc.ConfirmEmailCode(ctx, auth.ConfirmInputs{
+		ChallengeID:     id,
+		Code:            code,
+		ClientPublicKey: randomKey(t),
+		TimeZone:        "UTC",
+	})
+	if !errors.Is(err, auth.ErrEmailPermanentlyBlocked) {
+		t.Fatalf("ConfirmEmailCode after block = %v, want ErrEmailPermanentlyBlocked", err)
+	}
+}
+
 func TestSendEmailCodeThrottleReusesChallenge(t *testing.T) {
 	db := startPostgres(t)
 	svc, mailer, _, _ := buildService(t, db)
@@ -468,7 +514,10 @@ func TestRevokeAllForUser(t *testing.T) {
 		deviceSessionIDs = append(deviceSessionIDs, sess.DeviceSessionID)
 	}
 
-	revoked, err := svc.RevokeAllForUser(ctx, userID)
+	revoked, err := svc.RevokeAllForUser(ctx, userID, auth.RevokeContext{
+		ActorKind: auth.ActorKindUserSelf,
+		ActorID:   userID.String(),
+	})
 	if err != nil {
 		t.Fatalf("RevokeAllForUser: %v", err)
 	}
@@ -485,7 +534,10 @@ func TestRevokeAllForUser(t *testing.T) {
 	}
 
 	// Idempotent: revoking again returns an empty slice.
-	again, err := svc.RevokeAllForUser(ctx, userID)
+	again, err := svc.RevokeAllForUser(ctx, userID, auth.RevokeContext{
+		ActorKind: auth.ActorKindUserSelf,
+		ActorID:   userID.String(),
+	})
 	if err != nil {
 		t.Fatalf("idempotent RevokeAllForUser: %v", err)
 	}