T5: OAuth and the client API over HTTP

96 integration tests through PrivaPubHost, the real pipeline end to end:
- OAuth: the token's subject is the persona, and neither the token response,
  verify_credentials nor the stored token entries name the root. A wrong password shows
  an error and sets no login cookie; a login without the antiforgery token is a 400; the
  return address never leaves the site; deny answers access_denied with no code; another
  root's persona re-renders the choice with no code; a banned root is sent back to the
  login and a code issued before the ban buys no token; force_login asks again; a code
  works once and its reuse revokes the token it bought; password and refresh_token
  grants are refused; a client_credentials token gets 401 on user routes; a read-only
  token gets 403 with a Mastodon error on POST /api/v1/statuses; follow covers
  read:follows; revoke works; the login and authorize pages send their CSP and no-store;
  the 11th /oauth/login from one address in a minute is a 429.
- Accounts: sign-up, duplicates in any case, invalid models answer 400 with a message,
  login and logout, recovery email, settings, password change, invitation sign-up and
  login (refusing a persona named after the login), recovery without an email, through
  an unreachable mail server, with a wrong and with a valid code, token refresh, the 11th
  sign-up from one address, expired, garbage and foreign-key JWTs.
- Personas: a rootId in the body is ignored, the username regex and reserved names hold,
  personas and groups share ReservedName, an update delivers Update{Person} to followers,
  PublishedOn and the id's day fall within two weeks before creation, the list holds only
  one's own personas, another root's persona cannot be updated.
- Groups: communities and circles are created, joining takes the code and the password,
  members leave and owners cannot, a remote follow request becomes a member only on
  approval, a circle never shows in lookup, account by id, v2 search or /@name, and its
  /flock and /wardens answer 404 unsigned and to non-members, 200 to a member's signed GET.
- Moderation (Exclusive, it suspends localhost): ban, unban and remove; non-admins get
  403; reports are listed without the reporter and resolved; domain blocks are inserted,
  listed and deleted, bad domains refused, and a suspended server's delivery is answered
  202 and kept nowhere; the data endpoints.
- AdminCommands: exit codes 0, 1 and 2 and the resulting policies.

Fixed:
- A banned or removed root kept using /clientapi with its JWT until it expired: only /api
  re-checked the root. JwtEvents.TokenValidated now loads the root and fails the request
  when it is banned or deleted, and takes the policy claims from the database, so a
  demoted admin loses admin at once (and a promoted one gains it).
- The 401 and 403 bodies JwtEvents writes were PascalCase while every other /clientapi
  answer is camelCase; they now use the web defaults.
- /clientapi/user/sniff/again (token refresh) answered an empty 200; it now answers a
  fresh JwtUser, like login.
- Password recovery answered SMTP reply codes as HTTP statuses (421, 454, 554, and 550 for
  an invalid address); a mail server failure is now 503 and an invalid address 400.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01ELjqpznMFMNrJoJUj6K5p2

PrivaPub.Tests/Infrastructure/AdminCommandsTests.cs

@@ -0,0 +1,99 @@
+using MongoDB.Entities;
+
+using PrivaPub.ClientModels;
+using PrivaPub.Infrastructure.Cli;
+using PrivaPub.Models.User;
+using PrivaPub.Tests.Support;
+using PrivaPub.Tests.Support.Host;
+
+using System.Net;
+
+namespace PrivaPub.Tests.Infrastructure
+{
+	[Trait("Category", "Integration")]
+	public sealed class AdminCommandsTests : IAsyncLifetime
+	{
+		PrivaPubHost _host;
+
+		public async ValueTask InitializeAsync()
+		{
+			Assert.SkipUnless(MongoFixture.Enabled, MongoFixture.Skip);
+			_host = await PrivaPubHost.Shared();
+		}
+
+		public ValueTask DisposeAsync() => ValueTask.CompletedTask;
+
+		static async Task<List<string>> StoredPolicies(Root root) =>
+			(await DB.Default.Find<RootUser>().MatchID(root.Id).ExecuteFirstAsync(TestContext.Current.CancellationToken)).Policies.Order().ToList();
+
+		async Task<HttpStatusCode> AdminRoute(Root root)
+		{
+			using var client = _host.As(root.Jwt);
+			return (await client.GetAsync("/clientapi/admin/domainblocks/list", TestContext.Current.CancellationToken)).StatusCode;
+		}
+
+		[Fact]
+		public async Task Promote_makes_an_admin_and_a_moderator()
+		{
+			var root = await _host.SignUp("promote");
+
+			Assert.Equal(0, await AdminCommands.Run(new[] { "promote", root.UserName.ToUpperInvariant() }));
+			Assert.Equal(0, await AdminCommands.Run(new[] { "promote", root.UserName }));
+
+			Assert.Equal(new[] { Policies.IsAdmin, Policies.IsModerator, Policies.IsUser }.Order(), await StoredPolicies(root));
+		}
+
+		[Fact]
+		public async Task Demote_leaves_a_plain_user()
+		{
+			var root = await _host.SignUp("demote");
+			Assert.Equal(0, await AdminCommands.Run(new[] { "promote", root.UserName }));
+
+			Assert.Equal(0, await AdminCommands.Run(new[] { "demote", root.UserName }));
+			Assert.Equal(0, await AdminCommands.Run(new[] { "demote", root.UserName }));
+
+			Assert.Equal(new[] { Policies.IsUser }, await StoredPolicies(root));
+		}
+
+		[Fact]
+		public async Task An_unknown_root_exits_1()
+		{
+			Assert.Equal(1, await AdminCommands.Run(new[] { "promote", $"nobody{Guid.NewGuid():N}" }));
+			Assert.Equal(1, await AdminCommands.Run(new[] { "demote", $"nobody{Guid.NewGuid():N}" }));
+		}
+
+		public static TheoryData<string[]> Misuses() => new()
+		{
+			Array.Empty<string>(),
+			new[] { "promote" },
+			new[] { "promote", "a", "b" },
+			new[] { "delete", "a" },
+			new[] { "PROMOTE", "a" }
+		};
+
+		[Theory]
+		[MemberData(nameof(Misuses))]
+		public async Task Misuse_exits_2(string[] args)
+		{
+			Assert.Equal(2, await AdminCommands.Run(args));
+		}
+
+		[Fact]
+		public async Task A_token_follows_its_roots_policies_at_once()
+		{
+			var root = await _host.SignUp("policies");
+			Assert.Equal(HttpStatusCode.Forbidden, await AdminRoute(root));
+
+			Assert.Equal(0, await AdminCommands.Run(new[] { "promote", root.UserName }));
+			Assert.Equal(HttpStatusCode.OK, await AdminRoute(root));
+			using (var client = _host.As(root.Jwt))
+			{
+				var refreshed = await (await client.GetAsync("/clientapi/user/sniff/again", TestContext.Current.CancellationToken)).JsonBody();
+				Assert.Contains(Policies.IsAdmin, refreshed["policies"]!.AsArray().Select(p => p!.GetValue<string>()));
+			}
+
+			Assert.Equal(0, await AdminCommands.Run(new[] { "demote", root.UserName }));
+			Assert.Equal(HttpStatusCode.Forbidden, await AdminRoute(root));
+		}
+	}
+}