Merge branch 'dc/DC-141' into dc/DC-142

dashcaddy-api/__tests__/network-people-store.test.js

@@ -0,0 +1,275 @@
+/**
+ * Tests for network-people-store (DC-141).
+ * Coverage:
+ *   - CRUD: upsert/get/update/delete/list round-trips
+ *   - atomicity: tmp+rename writes (no torn file), cache coherence
+ *   - first-person-admin rule: first person gets groups ['Admin'] +
+ *     protectedAt; later people do not
+ *   - last-admin guard: single active admin throws; passes when a second
+ *     active admin exists; throws again when the other admins are blocked
+ *   - findByProviderUserId match + miss
+ *   - corruption recovery: bad JSON restarts empty, .bak written
+ */
+
+'use strict';
+
+const fs = require('fs');
+const path = require('path');
+const os = require('os');
+const {
+  createPeopleStore,
+  LastAdminError,
+  ADMIN_GROUP,
+} = require('../src/security/network-people-store');
+
+function _tmpDir() {
+  return fs.mkdtempSync(path.join(os.tmpdir(), 'dashcaddy-peopletest-'));
+}
+
+function _cleanup(dir) {
+  try { fs.rmSync(dir, { recursive: true, force: true }); } catch {}
+}
+
+function _admin(name, opts = {}) {
+  return {
+    displayName: name,
+    providerUserId: opts.puid || `puid-${name}`,
+    ...opts,
+  };
+}
+
+describe('network-people-store: CRUD', () => {
+  let dir, store;
+  beforeEach(() => { dir = _tmpDir(); store = createPeopleStore({ dataDir: dir }); });
+  afterEach(() => _cleanup(dir));
+
+  test('empty store lists zero people', async () => {
+    const list = await store.listPeople();
+    expect(list).toEqual([]);
+  });
+
+  test('upsert creates a person with defaults', async () => {
+    // Seed a bootstrap admin first so the subject is a NON-first person
+    // (first-person behavior is covered in its own describe block).
+    await store.upsertPerson({ displayName: 'Owner', providerUserId: 'ts-0' });
+    const p = await store.upsertPerson({ displayName: 'Alice', providerUserId: 'ts-1' });
+    expect(p.id).toBeTruthy();
+    expect(p.displayName).toBe('Alice');
+    expect(p.providerUserId).toBe('ts-1');
+    expect(Array.isArray(p.groups)).toBe(true);
+    expect(Array.isArray(p.devices)).toBe(true);
+    expect(p.status).toBe('active');
+    expect(p.createdAt).toBeTruthy();
+    expect(p.protectedAt).toBe(null);
+  });
+
+  test('getPerson returns stored person; null for unknown id', async () => {
+    const p = await store.upsertPerson({ displayName: 'Alice', providerUserId: 'ts-1' });
+    const got = await store.getPerson(p.id);
+    expect(got.id).toBe(p.id);
+    expect(await store.getPerson('nope')).toBe(null);
+  });
+
+  test('upsertPerson merges by id (update path)', async () => {
+    const p = await store.upsertPerson({ displayName: 'Alice', providerUserId: 'ts-1' });
+    const p2 = await store.upsertPerson({ id: p.id, displayName: 'Alice II', groups: ['Friends'] });
+    expect(p2.id).toBe(p.id);
+    expect(p2.displayName).toBe('Alice II');
+    expect(p2.providerUserId).toBe('ts-1'); // retained
+    expect(p2.createdAt).toBe(p.createdAt); // retained
+    expect(p2.groups).toEqual(['Friends']);
+    const list = await store.listPeople();
+    expect(list).toHaveLength(1); // merged, not duplicated
+  });
+
+  test('updatePerson patches only provided fields', async () => {
+    const p = await store.upsertPerson({ displayName: 'Bob', providerUserId: 'ts-2', groups: ['G'] });
+    const u = await store.updatePerson(p.id, { displayName: 'Bobby' });
+    expect(u.displayName).toBe('Bobby');
+    expect(u.groups).toEqual(['G']); // untouched by patch
+    expect(await store.updatePerson('nope', { displayName: 'x' })).toBe(null);
+  });
+
+  test('updatePerson cannot change id', async () => {
+    const p = await store.upsertPerson({ displayName: 'Bob', providerUserId: 'ts-2' });
+    const u = await store.updatePerson(p.id, { id: 'evil', displayName: 'B' });
+    expect(u.id).toBe(p.id);
+    const list = await store.listPeople();
+    expect(list).toHaveLength(1);
+  });
+
+  test('deletePerson removes; false for unknown id', async () => {
+    const p = await store.upsertPerson({ displayName: 'Bob', providerUserId: 'ts-2' });
+    expect(await store.deletePerson(p.id)).toBe(true);
+    expect(await store.getPerson(p.id)).toBe(null);
+    expect(await store.deletePerson(p.id)).toBe(false);
+  });
+
+  test('returned persons are copies (mutating them does not corrupt store)', async () => {
+    await store.upsertPerson({ displayName: 'Owner', providerUserId: 'ts-0' }); // bootstrap admin
+    const p = await store.upsertPerson({ displayName: 'Alice', providerUserId: 'ts-1' });
+    p.groups.push('Hacked');
+    const fresh = await store.getPerson(p.id);
+    expect(fresh.groups).toEqual([]);
+  });
+});
+
+describe('network-people-store: persistence + atomicity', () => {
+  let dir, store;
+  beforeEach(() => { dir = _tmpDir(); store = createPeopleStore({ dataDir: dir }); });
+  afterEach(() => _cleanup(dir));
+
+  test('people survive a new store instance (round-trip through disk)', async () => {
+    const p = await store.upsertPerson({ displayName: 'Alice', providerUserId: 'ts-1' });
+    const store2 = createPeopleStore({ dataDir: dir });
+    const got = await store2.getPerson(p.id);
+    expect(got.displayName).toBe('Alice');
+    expect(got.groups).toEqual(p.groups);
+  });
+
+  test('write is tmp+rename: no leftover tmp files after save', async () => {
+    await store.upsertPerson({ displayName: 'Alice', providerUserId: 'ts-1' });
+    const files = fs.readdirSync(dir).filter(f => f.includes('.tmp-'));
+    expect(files).toEqual([]);
+    expect(fs.existsSync(path.join(dir, 'network-people.json'))).toBe(true);
+  });
+
+  test('file contents are complete JSON (never torn)', async () => {
+    await store.upsertPerson({ displayName: 'Alice', providerUserId: 'ts-1' });
+    await store.upsertPerson({ displayName: 'Bob', providerUserId: 'ts-2' });
+    const raw = JSON.parse(fs.readFileSync(path.join(dir, 'network-people.json'), 'utf8'));
+    expect(Object.keys(raw.people)).toHaveLength(2);
+  });
+
+  test('rapid sequential writes are all durable (mutex serialization)', async () => {
+    const names = ['a', 'b', 'c', 'd', 'e', 'f', 'g', 'h'];
+    await Promise.all(names.map(n => store.upsertPerson({ displayName: n, providerUserId: `p-${n}` })));
+    const list = await store.listPeople();
+    expect(list).toHaveLength(names.length);
+    const raw = JSON.parse(fs.readFileSync(path.join(dir, 'network-people.json'), 'utf8'));
+    expect(Object.keys(raw.people)).toHaveLength(names.length);
+  });
+
+  test('corrupt file: store recovers empty and writes .bak', async () => {
+    await store.upsertPerson({ displayName: 'Alice', providerUserId: 'ts-1' });
+    fs.writeFileSync(path.join(dir, 'network-people.json'), '{corrupted!!');
+    const store2 = createPeopleStore({ dataDir: dir });
+    const list = await store2.listPeople();
+    expect(list).toEqual([]);
+    expect(fs.existsSync(path.join(dir, 'network-people.json.bak'))).toBe(true);
+  });
+});
+
+describe('network-people-store: first-person-admin rule', () => {
+  let dir, store;
+  beforeEach(() => { dir = _tmpDir(); store = createPeopleStore({ dataDir: dir }); });
+  afterEach(() => _cleanup(dir));
+
+  test('first person created gets Admin group + protectedAt', async () => {
+    const first = await store.upsertPerson({ displayName: 'Sami', providerUserId: 'ts-owner' });
+    expect(first.groups).toEqual([ADMIN_GROUP]);
+    expect(first.protectedAt).toBeTruthy();
+    expect(new Date(first.protectedAt).getTime()).not.toBeNaN();
+  });
+
+  test('second person created does NOT get Admin/protectedAt', async () => {
+    await store.upsertPerson({ displayName: 'Sami', providerUserId: 'ts-owner' });
+    const second = await store.upsertPerson({ displayName: 'Friend', providerUserId: 'ts-2' });
+    expect(second.groups).toEqual([]);
+    expect(second.protectedAt).toBe(null);
+  });
+
+  test('rule applies only to a truly empty store (delete-then-create does not re-trigger)', async () => {
+    const first = await store.upsertPerson({ displayName: 'Sami', providerUserId: 'ts-owner' });
+    const second = await store.upsertPerson({ displayName: 'Friend', providerUserId: 'ts-2' });
+    await store.deletePerson(first.id);
+    const third = await store.upsertPerson({ displayName: 'Late', providerUserId: 'ts-3' });
+    expect(second.groups).toEqual([]);
+    expect(third.groups).toEqual([]);
+    expect(third.protectedAt).toBe(null);
+  });
+});
+
+describe('network-people-store: last-admin guard', () => {
+  let dir, store;
+  beforeEach(() => { dir = _tmpDir(); store = createPeopleStore({ dataDir: dir }); });
+  afterEach(() => _cleanup(dir));
+
+  test('throws LastAdminError for the only active admin', async () => {
+    const solo = await store.upsertPerson(_admin('Sami')); // bootstrap admin
+    await expect(store.assertNotLastAdmin(solo.id)).rejects.toBeInstanceOf(LastAdminError);
+  });
+
+  test('passes when a second active admin exists', async () => {
+    const a = await store.upsertPerson(_admin('Sami'));
+    const b = await store.upsertPerson(_admin('Deputy'));
+    await store.updatePerson(b.id, { groups: [ADMIN_GROUP] });
+    await expect(store.assertNotLastAdmin(a.id)).resolves.toBeUndefined();
+    await expect(store.assertNotLastAdmin(b.id)).resolves.toBeUndefined();
+  });
+
+  test('throws when the other admins are blocked (only one active left)', async () => {
+    const a = await store.upsertPerson(_admin('Sami'));
+    const b = await store.upsertPerson(_admin('Deputy'));
+    await store.updatePerson(b.id, { groups: [ADMIN_GROUP] });
+    // Block every admin except a.
+    await store.updatePerson(b.id, { status: 'blocked' });
+    await expect(store.assertNotLastAdmin(a.id)).rejects.toBeInstanceOf(LastAdminError);
+    // The blocked admin himself is not protected by the guard (he's not
+    // an ACTIVE admin of consequence — but he IS still the last *listed*
+    // admin member; the guard protects active access, so blocking b again
+    // is fine).
+    await expect(store.assertNotLastAdmin(b.id)).resolves.toBeUndefined();
+  });
+
+  test('removed admins also do not count as active', async () => {
+    const a = await store.upsertPerson(_admin('Sami'));
+    const b = await store.upsertPerson(_admin('Deputy'));
+    await store.updatePerson(b.id, { groups: [ADMIN_GROUP] });
+    await store.updatePerson(b.id, { status: 'removed' });
+    await expect(store.assertNotLastAdmin(a.id)).rejects.toBeInstanceOf(LastAdminError);
+  });
+
+  test('non-admins pass freely', async () => {
+    await store.upsertPerson(_admin('Sami'));
+    const user = await store.upsertPerson({ displayName: 'Pleb', providerUserId: 'ts-pleb' });
+    await expect(store.assertNotLastAdmin(user.id)).resolves.toBeUndefined();
+  });
+
+  test('unknown ids pass (nothing to protect)', async () => {
+    await expect(store.assertNotLastAdmin('ghost')).resolves.toBeUndefined();
+  });
+
+  test('LastAdminError carries code + personId', async () => {
+    const solo = await store.upsertPerson(_admin('Sami'));
+    try {
+      await store.assertNotLastAdmin(solo.id);
+      throw new Error('should have thrown');
+    } catch (err) {
+      expect(err).toBeInstanceOf(LastAdminError);
+      expect(err.code).toBe('DC_LAST_ADMIN');
+      expect(err.personId).toBe(solo.id);
+      expect(err.statusCode).toBe(409);
+    }
+  });
+});
+
+describe('network-people-store: findByProviderUserId', () => {
+  let dir, store;
+  beforeEach(() => { dir = _tmpDir(); store = createPeopleStore({ dataDir: dir }); });
+  afterEach(() => _cleanup(dir));
+
+  test('finds the person with that provider identity', async () => {
+    await store.upsertPerson({ displayName: 'Alice', providerUserId: 'ts-1234' });
+    const found = await store.findByProviderUserId('ts-1234');
+    expect(found).toBeTruthy();
+    expect(found.displayName).toBe('Alice');
+  });
+
+  test('returns null on miss and for empty/invalid input', async () => {
+    await store.upsertPerson({ displayName: 'Alice', providerUserId: 'ts-1234' });
+    expect(await store.findByProviderUserId('ts-9999')).toBe(null);
+    expect(await store.findByProviderUserId('')).toBe(null);
+    expect(await store.findByProviderUserId(null)).toBe(null);
+  });
+});

dashcaddy-api/__tests__/network-people.routes.test.js

@@ -0,0 +1,310 @@
+/**
+ * Route tests for network-people routes (DC-141).
+ * Coverage:
+ *   - contract for all verbs (GET list, GET one, POST, PATCH, DELETE, POST /sync)
+ *   - first-person-admin bootstrap through the API
+ *   - 404s for unknown ids
+ *   - validation errors (400) for bad bodies
+ *   - DELETE refuses the last active admin (409)
+ *   - sync: mocked provider merge, idempotency, protectedAt never
+ *     downgraded, blocked/removed not resurrected, missing registry →
+ *     clean inactive response
+ * Hermetic — supertest against an in-process express app, no network.
+ */
+
+'use strict';
+
+const express = require('express');
+const request = require('supertest');
+const fs = require('fs');
+const path = require('path');
+const os = require('os');
+const { createPeopleStore, ADMIN_GROUP } = require('../src/security/network-people-store');
+const networkPeopleRoutes = require('../routes/network-people');
+
+function asyncHandler(fn) {
+  return (req, res, next) => Promise.resolve(fn(req, res, next)).catch(next);
+}
+
+function createApp({ peopleStore, networkRegistry } = {}) {
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'dashcaddy-peopleroutes-'));
+  const store = peopleStore || createPeopleStore({ dataDir: dir });
+  const factory = networkPeopleRoutes;
+  const router = factory({
+    peopleStore: store,
+    networkRegistry,
+    asyncHandler,
+    log: { info: () => {}, warn: () => {}, error: () => {} },
+  });
+  const app = express();
+  app.use(express.json());
+  app.use('/network/people', router);
+  app.use((err, _req, res, _next) => {
+    const status = err.statusCode || 500;
+    res.status(status).json({ success: false, error: err.message, code: err.code || null });
+  });
+  return { app, store, dir };
+}
+
+function _cleanup(dir) {
+  try { fs.rmSync(dir, { recursive: true, force: true }); } catch {}
+}
+
+function _mockRegistry(people) {
+  return {
+    getActiveProvider: () => ({
+      id: () => 'mock',
+      listPeople: () => Promise.resolve(people),
+    }),
+  };
+}
+
+describe('network-people routes: contract', () => {
+  let dir, app, store;
+  beforeEach(() => {
+    ({ app, store, dir } = createApp());
+  });
+  afterEach(() => _cleanup(dir));
+
+  test('GET / lists people', async () => {
+    await store.upsertPerson({ displayName: 'Alice', providerUserId: 'ts-1' });
+    const res = await request(app).get('/network/people');
+    expect(res.status).toBe(200);
+    expect(res.body.success).toBe(true);
+    expect(Array.isArray(res.body.data)).toBe(true);
+    expect(res.body.count).toBe(1);
+    expect(res.body.data[0].displayName).toBe('Alice');
+  });
+
+  test('GET /:id returns a person; 404 for unknown', async () => {
+    const p = await store.upsertPerson({ displayName: 'Alice', providerUserId: 'ts-1' });
+    const good = await request(app).get(`/network/people/${p.id}`);
+    expect(good.status).toBe(200);
+    expect(good.body.person.id).toBe(p.id);
+    const bad = await request(app).get('/network/people/ghost');
+    expect(bad.status).toBe(404);
+    expect(bad.body.success).toBe(false);
+  });
+
+  test('POST / creates a person (201)', async () => {
+    const res = await request(app)
+      .post('/network/people')
+      .send({ displayName: 'Alice', providerUserId: 'ts-1' });
+    expect(res.status).toBe(201);
+    expect(res.body.success).toBe(true);
+    expect(res.body.person.displayName).toBe('Alice');
+    expect(res.body.person.status).toBe('active');
+  });
+
+  test('POST / first person ever gets Admin group + protectedAt', async () => {
+    const res = await request(app)
+      .post('/network/people')
+      .send({ displayName: 'Sami', providerUserId: 'ts-owner' });
+    expect(res.status).toBe(201);
+    expect(res.body.person.groups).toEqual([ADMIN_GROUP]);
+    expect(res.body.person.protectedAt).toBeTruthy();
+    const second = await request(app)
+      .post('/network/people')
+      .send({ displayName: 'Friend', providerUserId: 'ts-2' });
+    expect(second.body.person.groups).toEqual([]);
+    expect(second.body.person.protectedAt).toBe(null);
+  });
+
+  test('POST / validation errors: missing displayName (400)', async () => {
+    const res = await request(app)
+      .post('/network/people')
+      .send({ providerUserId: 'ts-1' });
+    expect(res.status).toBe(400);
+    expect(res.body.success).toBe(false);
+    expect(res.body.error).toMatch(/displayName/);
+  });
+
+  test('POST / validation errors: missing providerUserId (400)', async () => {
+    const res = await request(app)
+      .post('/network/people')
+      .send({ displayName: 'Alice' });
+    expect(res.status).toBe(400);
+    expect(res.body.error).toMatch(/providerUserId/);
+  });
+
+  test('POST / validation errors: groups not an array (400)', async () => {
+    const res = await request(app)
+      .post('/network/people')
+      .send({ displayName: 'Alice', providerUserId: 'ts-1', groups: 'Admin' });
+    expect(res.status).toBe(400);
+    expect(res.body.error).toMatch(/groups/);
+  });
+
+  test('PATCH /:id updates fields', async () => {
+    const p = await store.upsertPerson({ displayName: 'Bob', providerUserId: 'ts-2' });
+    const res = await request(app)
+      .patch(`/network/people/${p.id}`)
+      .send({ displayName: 'Bobby', groups: ['Friends'] });
+    expect(res.status).toBe(200);
+    expect(res.body.person.displayName).toBe('Bobby');
+    expect(res.body.person.groups).toEqual(['Friends']);
+  });
+
+  test('PATCH /:id 404 for unknown id; 400 for bad status', async () => {
+    const missing = await request(app).patch('/network/people/ghost').send({ displayName: 'X' });
+    expect(missing.status).toBe(404);
+    const p = await store.upsertPerson({ displayName: 'Bob', providerUserId: 'ts-2' });
+    const bad = await request(app)
+      .patch(`/network/people/${p.id}`)
+      .send({ status: 'zombie' });
+    expect(bad.status).toBe(400);
+    expect(bad.body.error).toMatch(/status/);
+  });
+
+  test('PATCH /:id 400 for bad displayName', async () => {
+    const p = await store.upsertPerson({ displayName: 'Bob', providerUserId: 'ts-2' });
+    const res = await request(app)
+      .patch(`/network/people/${p.id}`)
+      .send({ displayName: '' });
+    expect(res.status).toBe(400);
+  });
+
+  test('DELETE /:id deletes a person', async () => {
+    await store.upsertPerson({ displayName: 'Owner', providerUserId: 'ts-0' }); // bootstrap admin
+    const p = await store.upsertPerson({ displayName: 'Bob', providerUserId: 'ts-2' });
+    const res = await request(app).delete(`/network/people/${p.id}`);
+    expect(res.status).toBe(200);
+    expect(res.body.deleted).toBe(true);
+    expect(await store.getPerson(p.id)).toBe(null);
+  });
+
+  test('DELETE /:id 404 for unknown id', async () => {
+    const res = await request(app).delete('/network/people/ghost');
+    expect(res.status).toBe(404);
+  });
+
+  test('DELETE /:id refuses the last active admin (409)', async () => {
+    const solo = await store.upsertPerson({ displayName: 'Sami', providerUserId: 'ts-owner' });
+    expect(solo.groups).toEqual([ADMIN_GROUP]); // bootstrap admin
+    const res = await request(app).delete(`/network/people/${solo.id}`);
+    expect(res.status).toBe(409);
+    expect(res.body.success).toBe(false);
+    expect(res.body.error).toMatch(/last active admin/);
+    // Person is still there.
+    expect(await store.getPerson(solo.id)).toBeTruthy();
+  });
+
+  test('DELETE /:id succeeds when another active admin exists', async () => {
+    const a = await store.upsertPerson({ displayName: 'Sami', providerUserId: 'ts-owner' });
+    const b = await store.upsertPerson({ displayName: 'Deputy', providerUserId: 'ts-2' });
+    await store.updatePerson(b.id, { groups: [ADMIN_GROUP] });
+    const res = await request(app).delete(`/network/people/${a.id}`);
+    expect(res.status).toBe(200);
+  });
+});
+
+describe('network-people routes: sync', () => {
+  let dir, app, store;
+  afterEach(() => _cleanup(dir));
+
+  test('no networkRegistry → synced:false, no throw', async () => {
+    ({ app, store, dir } = createApp());
+    const res = await request(app).post('/network/people/sync');
+    expect(res.status).toBe(200);
+    expect(res.body.success).toBe(true);
+    expect(res.body.synced).toBe(false);
+    expect(res.body.added).toBe(0);
+  });
+
+  test('registry without getActiveProvider → synced:false', async () => {
+    ({ app, store, dir } = createApp({ networkRegistry: {} }));
+    const res = await request(app).post('/network/people/sync');
+    expect(res.status).toBe(200);
+    expect(res.body.synced).toBe(false);
+  });
+
+  test('getActiveProvider returning undefined → synced:false', async () => {
+    ({ app, store, dir } = createApp({ networkRegistry: { getActiveProvider: () => undefined } }));
+    const res = await request(app).post('/network/people/sync');
+    expect(res.status).toBe(200);
+    expect(res.body.synced).toBe(false);
+  });
+
+  test('adds missing people and updates displayNames of existing', async () => {
+    ({ app, store, dir } = createApp({
+      networkRegistry: _mockRegistry([
+        { providerUserId: 'ts-1', displayName: 'Alice Updated' },
+        { providerUserId: 'ts-9', displayName: 'New Person' },
+      ]),
+    }));
+    await store.upsertPerson({ displayName: 'Alice', providerUserId: 'ts-1' });
+    const res = await request(app).post('/network/people/sync');
+    expect(res.status).toBe(200);
+    expect(res.body.synced).toBe(true);
+    expect(res.body.added).toBe(1);
+    expect(res.body.updated).toBe(1);
+    const list = await store.listPeople();
+    const alice = list.find(p => p.providerUserId === 'ts-1');
+    const newbie = list.find(p => p.providerUserId === 'ts-9');
+    expect(alice.displayName).toBe('Alice Updated');
+    expect(newbie.displayName).toBe('New Person');
+    expect(newbie.groups).toEqual([]);
+  });
+
+  test('idempotent: second sync changes nothing', async () => {
+    ({ app, store, dir } = createApp({
+      networkRegistry: _mockRegistry([
+        { providerUserId: 'ts-1', displayName: 'Alice' },
+        { providerUserId: 'ts-2', displayName: 'Bob' },
+      ]),
+    }));
+    const first = await request(app).post('/network/people/sync');
+    expect(first.body.added).toBe(2);
+    const second = await request(app).post('/network/people/sync');
+    expect(second.status).toBe(200);
+    expect(second.body.added).toBe(0);
+    expect(second.body.updated).toBe(0);
+    const list = await store.listPeople();
+    expect(list).toHaveLength(2);
+  });
+
+  test('never downgrades protectedAt on the bootstrap admin', async () => {
+    ({ app, store, dir } = createApp({
+      networkRegistry: _mockRegistry([
+        { providerUserId: 'ts-owner', displayName: 'Sami' },
+      ]),
+    }));
+    const owner = await store.upsertPerson({ displayName: 'Sami', providerUserId: 'ts-owner' });
+    expect(owner.protectedAt).toBeTruthy();
+    const before = owner.protectedAt;
+    await request(app).post('/network/people/sync');
+    await request(app).post('/network/people/sync');
+    const after = await store.getPerson(owner.id);
+    expect(after.protectedAt).toBe(before);
+    expect(after.groups).toEqual([ADMIN_GROUP]);
+  });
+
+  test('blocked/removed people are NOT resurrected by sync', async () => {
+    ({ app, store, dir } = createApp({
+      networkRegistry: _mockRegistry([
+        { providerUserId: 'ts-1', displayName: 'Blocked Person' },
+      ]),
+    }));
+    const p = await store.upsertPerson({ displayName: 'Blocked Person', providerUserId: 'ts-1' });
+    await store.updatePerson(p.id, { status: 'blocked' });
+    const res = await request(app).post('/network/people/sync');
+    expect(res.body.added).toBe(0);
+    expect(res.body.updated).toBe(0);
+    const after = await store.getPerson(p.id);
+    expect(after.status).toBe('blocked');
+    expect((await store.listPeople())).toHaveLength(1); // no duplicate either
+  });
+
+  test('skips malformed provider entries without failing the sync', async () => {
+    ({ app, store, dir } = createApp({
+      networkRegistry: _mockRegistry([
+        null,
+        { providerUserId: '', displayName: 'NoId' },
+        { providerUserId: 'ts-5', displayName: 'Good' },
+      ]),
+    }));
+    const res = await request(app).post('/network/people/sync');
+    expect(res.status).toBe(200);
+    expect(res.body.added).toBe(1);
+  });
+});