feat: drop the 2.8 columns, moves and aliases kept for a downgrade

src/backend/tests/plugins/ctx-auth-login.test.ts

@@ -199,7 +199,7 @@ beforeEach(() => {
 });
 
 describe("a plugin's external identity", () => {
-  it("carries the 2.8 identifier, role map and logout claims into core", async () => {
+  it("carries the role map and logout claims into core", async () => {
     setup();
     const identity = await getLoginMethod("corp-sso")!.callback!(
       fakeRequest() as never,
@@ -211,7 +211,6 @@ describe("a plugin's external identity", () => {
     expect(result.kind).toBe("session");
 
     const [user] = [...h.state.users.values()];
-    expect(user).toMatchObject({ oidcIdentifier: "sub-1", ssoProviderId: 3 });
     expect(h.state.identities).toContainEqual(
       expect.objectContaining({ providerId: "3", subject: "sub-1" }),
     );
@@ -219,9 +218,7 @@ describe("a plugin's external identity", () => {
     expect(h.manager.generateJWTToken).toHaveBeenCalledWith(
       user.id,
       expect.objectContaining({
-        ssoProviderId: 3,
-        oidcSub: "sub-1",
-        oidcSid: "sid-1",
+        externalSession: { providerId: 3, sub: "sub-1", sid: "sid-1" },
       }),
     );
   });
@@ -238,29 +235,6 @@ describe("a plugin's external identity", () => {
     expect(mapped).not.toHaveProperty("unlockError", "spoofed");
     expect(mapped.rateLimitUsername).toBeUndefined();
   });
-
-  it("finds a 2.8 user by the old identifier and links the identity", async () => {
-    h.state.users.set("u-1", {
-      id: "u-1",
-      username: "Alice",
-      passwordHash: "",
-      isAdmin: false,
-      isOidc: true,
-      oidcIdentifier: "sub-1",
-    });
-    setup();
-    const identity = await getLoginMethod("corp-sso")!.callback!(
-      fakeRequest() as never,
-    );
-    await runLogin(fakeRequest() as never, identity, {
-      methodId: "corp-sso",
-      rememberMe: false,
-    });
-    expect(h.state.users.size).toBe(1);
-    expect(h.state.identities).toContainEqual(
-      expect.objectContaining({ userId: "u-1", providerId: "3" }),
-    );
-  });
 });
 
 describe("ctx.auth.completeRedirectLogin", () => {
@@ -306,7 +280,7 @@ describe("the other ctx.auth helpers", () => {
     const { auth } = setup();
     expect(await auth.revokeSessions({ providerId: 3, sid: "sid-1" })).toBe(1);
     expect(h.manager.revokeSessionsByExternalSession).toHaveBeenCalledWith({
-      ssoProviderId: 3,
+      providerId: 3,
       sub: null,
       sid: "sid-1",
     });
@@ -402,8 +376,13 @@ describe("form methods and the external second factor setting", () => {
       username: "Bob",
       passwordHash: "",
       isAdmin: false,
-      isOidc: true,
-      oidcIdentifier: "ldap:4:bob",
+    });
+    h.state.identities.push({
+      id: 1,
+      userId: "u-bob",
+      providerId: "ldap:4",
+      subject: "bob",
+      email: null,
     });
     h.state.factors.push({
       userId: "u-bob",

src/backend/tests/plugins/ctx-hosts.test.ts

@@ -474,7 +474,7 @@ describe("ctx.hosts", () => {
         password: "secret",
         key: "PRIVATE",
         autostartPassword: "x",
-        terminalConfig: '{"keepaliveInterval":5,"fontSize":14}',
+        sshOptions: '{"keepaliveInterval":5}',
         enableDocker: true,
         jumpHosts: "[]",
       },

src/backend/tests/plugins/security/auth.test.ts

@@ -107,7 +107,6 @@ function addUser(overrides: Record<string, unknown> = {}) {
     username: "alice",
     passwordHash: bcrypt.hashSync(PASSWORD, 4),
     isAdmin: false,
-    isOidc: false,
     ...overrides,
   };
   h.state.users.set(user.id as string, user as never);
@@ -196,7 +195,6 @@ describe("external sign-in cannot claim another account", () => {
     email: null,
     name: "Alice",
     legacyIdentifier: "shared-id",
-    ssoProviderId: 3,
   };
 
   beforeEach(() => {
@@ -209,7 +207,7 @@ describe("external sign-in cannot claim another account", () => {
         external: true,
       }),
     );
-    h.state.settings.set("oidc_auto_provision", "true");
+    h.state.settings.set("external_auto_provision", "true");
   });
 
   async function signIn(identity: Record<string, unknown> = external) {
@@ -223,55 +221,21 @@ describe("external sign-in cannot claim another account", () => {
     return h.state.identities.find((row) => row.subject === "sub-1")?.userId;
   }
 
-  it("never links a local password account by its old identifier", async () => {
-    addUser({ id: "local", oidcIdentifier: "shared-id", isOidc: false });
-    await signIn();
-    expect(linkedTo()).not.toBe("local");
-  });
-
-  it("never links an account that already has an identity", async () => {
-    addUser({
-      id: "taken",
-      username: "bob",
-      passwordHash: "",
-      isOidc: true,
-      oidcIdentifier: "shared-id",
-    });
+  it("never links an account that has no identity for this provider", async () => {
+    addUser({ id: "local", username: "Alice" });
+    addUser({ id: "sso", username: "bob", passwordHash: "" });
     h.state.identities.push({
       id: 1,
-      userId: "taken",
+      userId: "sso",
       providerId: "9",
-      subject: "bob",
+      subject: "sub-1",
       email: null,
     });
     await signIn();
-    expect(linkedTo()).not.toBe("taken");
-  });
-
-  it("never links an account from a different provider", async () => {
-    addUser({
-      id: "other",
-      username: "bob",
-      passwordHash: "",
-      isOidc: true,
-      oidcIdentifier: "shared-id",
-      ssoProviderId: 7,
-    });
-    await signIn();
-    expect(linkedTo()).not.toBe("other");
-  });
-
-  it("still links a genuine 2.8 account on its first sign-in", async () => {
-    addUser({
-      id: "legacy",
-      username: "Alice",
-      passwordHash: "",
-      isOidc: true,
-      oidcIdentifier: "shared-id",
-      ssoProviderId: 3,
-    });
-    await signIn();
-    expect(linkedTo()).toBe("legacy");
+    expect(linkedTo()).not.toBe("local");
+    expect(
+      h.state.identities.find((row) => row.providerId === "3")?.userId,
+    ).not.toBe("sso");
   });
 
   it("never gives a new account a local user's username", async () => {
@@ -290,7 +254,6 @@ describe("external sign-in cannot claim another account", () => {
       id: "sso-user",
       username: "carol",
       passwordHash: "",
-      isOidc: true,
     });
     h.state.identities.push({
       id: 1,

src/backend/tests/plugins/settings-manifest.test.ts

@@ -398,7 +398,7 @@ describe("host field options", () => {
       host: { enableKey: "on", enableLabelKey: "k", fields, ...extra },
     });
 
-  it("accepts enableDefault, defaultFrom, shareRead and ownerOnly", () => {
+  it("accepts enableDefault, shareRead and ownerOnly", () => {
     expect(
       validateManifest(
         host(
@@ -407,7 +407,6 @@ describe("host field options", () => {
               key: "mode",
               type: "boolean",
               labelKey: "k",
-              defaultFrom: "defaultOn",
               shareRead: "edit",
               ownerOnly: true,
             },
@@ -418,7 +417,7 @@ describe("host field options", () => {
     ).toEqual([]);
   });
 
-  it("still accepts an old defaultFrom, but only as a string", () => {
+  it("rejects the removed defaultFrom", () => {
     expect(
       validateManifest(
         host([
@@ -429,11 +428,6 @@ describe("host field options", () => {
             defaultFrom: "missing",
           },
         ]),
-      ),
-    ).toEqual([]);
-    expect(
-      validateManifest(
-        host([{ key: "mode", type: "boolean", labelKey: "k", defaultFrom: 1 }]),
       ).join(),
     ).toMatch(/defaultFrom/);
   });