openvibers/openvibe.food Commits

Food: account export and deletion (ADR-033) — a person's plans and pantry are exported on network.account.export_requested and deleted whole on network.account.deleted (openvibe-sdk/account-data, SDK v0.36.0), with /internal/events loopback-only and the two subscriptions created at boot

OP OpenVibers committed 8 Oct 2026 · fec2331f5b · 14 files, +308 −16





Changes
ddiff --git a/.env.example b/.env.example
iindex 0681e74..7ca1574 100644
---- a/.env.example
++++ b/.env.example
@@@ -24,6 +24,13 @@ OV_OAUTH_CLIENT_SECRET=
  # OV_OAUTH_REDIRECT_URI=https://openvibe.food/auth/callback
  # FOOD_AUDIENCE=openvibe.food
  
++# OpenVibe.Events → Food (ADR-033 account export and deletion): the secret signs a delivery (comma-separated for
++# rotation, 32+ characters each; unset makes POST /internal/events answer 503); the url is where the two subscriptions
++# are created at boot (off when unset); FOOD_EVENTS_SUBSCRIBE=0 turns that off.
++FOOD_EVENTS_SECRET=
++FOOD_EVENTS_URL=
++#FOOD_EVENTS_ENDPOINT=http://127.0.0.1:4970/internal/events
++
  # OpenStreetMap, the two services "food near you" stands on (server/food/places.js). Both are open data under ODbL 1.0
  # with published usage policies; server/food/upstream.js paces every call (one a second per host) and caches every
  # answer for FOOD_GEO_CACHE_TTL_MS. Tests point these at a stand-in (test/helpers/osm.js); never at the public hosts.
ddiff --git a/README.md b/README.md
iindex 4c260e2..058c9f3 100644
---- a/README.md
++++ b/README.md
@@@ -100,6 +100,28 @@ test:pg` runs the same suite through PostgreSQL and PgBouncer (see [.github/work
  - Register the service and its capabilities in **OpenVibe.Contracts** (`contracts-service: food` in CI) and with
    **OpenVibe.Services** before the first deploy.
  
++## Account export and deletion
++
++A person's account at OpenVibe.Network can be exported and deleted, and every service holding their rows answers its
++part (ADR-033). Food receives `network.account.export_requested` and `network.account.deleted` at `POST /internal/events`
++(loopback only) — the two tables are mapped in [server/identity/account-data.js](server/identity/account-data.js), and
++the boot-time subscriptions are created by [server/events-consumer.js](server/events-consumer.js):
++
++- **Exported:** the plans a person saved (`plans.json`) and their pantry (`pantry.json`), pushed to
++  `POST /internal/account-exports/:id/parts` with this service's own token. Nothing here is a secret — Food stores no
++  token, key or credential.
++- **Erased:** both tables hold the person's own rows and nothing anyone else's page hangs under them, so they are
++  deleted whole and nothing is kept. Food then confirms with `POST /internal/account-deletions/:id/confirmations` and
++  the counts.
++- **Anonymized:** nothing. There is no row Food keeps that was written by this person for another person to read.
++
++The Nominatim/Overpass cache (`food_geo_cache`) is keyed by the query, not by a person, and is neither exported nor
++erased.
++
++Environment: `FOOD_EVENTS_SECRET` (comma-separated for rotation, 32+ characters each; unset makes the route answer
++503), `FOOD_EVENTS_URL` (or `EVENTS_URL`) is where the two subscriptions are created at boot (off when unset), and
++`FOOD_EVENTS_ENDPOINT` overrides the loopback endpoint; `FOOD_EVENTS_SUBSCRIBE=0` turns the boot-time subscription off.
++
  ## Security (threat notes)
  
  Reporting a vulnerability: [SECURITY.md](SECURITY.md).
@@@ -117,6 +139,6 @@ Part of the [OpenVibe network](https://openvibe.network). Built in the open by [
  
  <!-- versions:start -->
  - openvibe-contracts: v0.116.0
--- openvibe-sdk: v0.35.2
++- openvibe-sdk: v0.36.0
  - openvibe-shared: v2.15.0
  <!-- versions:end -->
ddiff --git a/STATUS.json b/STATUS.json
iindex c3efed1..4de6f9f 100644
---- a/STATUS.json
++++ b/STATUS.json
@@@ -7,11 +7,11 @@
    "port": "4970",
    "domain": "openvibe.food",
    "contracts": "openvibe-contracts v0.115.0",
--  "sdk": "openvibe-sdk v0.35.2",
++  "sdk": "openvibe-sdk v0.36.0",
    "shared": "openvibe-shared v2.14.0",
    "packages": [
      "openvibe-contracts v0.115.0",
--    "openvibe-sdk v0.35.2",
++    "openvibe-sdk v0.36.0",
      "openvibe-shared v2.14.0"
    ],
    "summary": "OpenVibe.Food — What should we eat? Food near you (food banks, pantries and budget grocery stores from OpenStreetMap, paced and cached to stay inside the OSM usage policies), a deterministic meal planner with a shopping list and an estimated cost, a 42-item food database with nutrition per serving and per 100 g, and a pantry with a plain 'what can I make' against ten basic recipes. Server-rendered pages, an API at /api/v1, per-caller limits on the place search, and a test suite that never calls the internet.",
@@@ -26,7 +26,8 @@
      "Discovery: the sitemap carries every food page, /near, /plan and /foods; llms.txt and llms-full.txt list the same set; a pantry and a saved plan are never crawled",
      "Capabilities (food.place.read, food.food.read, food.plan.read|write, food.pantry.read|write) and per-caller limits, with the tightest budget on the place search because it spends OpenStreetMap's shared request budget",
      "Tests with a stand-in Nominatim and Overpass: results and attribution, the one-request-a-second queue, cache hits, escaping of an OSM name, the search's per-caller limit, the plan's arithmetic, the pantry match, signed-in saves and anonymous refusals",
--    "Sign-in with OpenVibe.Network (PKCE S256, httpOnly session cookies), the OpenVibe Frame, PostgreSQL migrations applied at boot, deploy files"
++    "Sign-in with OpenVibe.Network (PKCE S256, httpOnly session cookies), the OpenVibe Frame, PostgreSQL migrations applied at boot, deploy files",
++    "Account export and deletion (ADR-033): the plans and the pantry a person saved are exported to OpenVibe.Network on network.account.export_requested and deleted whole on network.account.deleted, with the counts confirmed back; the two Events topics are subscribed at boot (server/identity/account-data.js)"
    ],
    "notYet": [
      "Delivery-price comparison across delivery apps, and meal kits and boxes (the manifests' other pillars)",
ddiff --git a/deploy/nginx/openvibe.food.conf b/deploy/nginx/openvibe.food.conf
iindex 5795808..94d94d6 100644
---- a/deploy/nginx/openvibe.food.conf
++++ b/deploy/nginx/openvibe.food.conf
@@@ -99,6 +99,10 @@ server {
      # ── Prometheus metrics: host-local scrapers only (http://127.0.0.1:4970/metrics) ──
      location = /metrics { return 404; }
  
++    # ── OpenVibe.Events' delivery route: loopback only (POST /internal/events) ──
++    # Events posts to http://127.0.0.1:4970/internal/events directly. Never proxied from outside (ADR-033).
++    location /internal/ { return 404; }
++
      # ── Pages, docs, robots.txt, sitemap, static assets ─────
      location / {
          proxy_pass http://127.0.0.1:4970;
ddiff --git a/migrations/0003_account_data.sql b/migrations/0003_account_data.sql
nnew file mode 100644
iindex 0000000..cfa3d44
---- /dev/null
++++ b/migrations/0003_account_data.sql
@@@ -0,0 +1,13 @@
++-- phase: expand
++-- OpenVibe.Food: the receipts of the ADR-033 account export and deletion deliveries this service applied
++-- (openvibe-sdk/account-data's ACCOUNT_DATA_SCHEMA), so a redelivered export or deletion changes nothing.
++-- The row holds an export_id or deletion_id, the subject and the counts sent to Network; it is not a secret.
++
++CREATE TABLE IF NOT EXISTS account_data_events (
++    id TEXT PRIMARY KEY,
++    kind TEXT NOT NULL,
++    subject TEXT NOT NULL,
++    outcome JSONB,
++    applied_at TIMESTAMPTZ NOT NULL DEFAULT now(),
++    sent_at TIMESTAMPTZ
++);
ddiff --git a/package-lock.json b/package-lock.json
iindex c7628cd..66508e2 100644
---- a/package-lock.json
++++ b/package-lock.json
@@@ -16,7 +16,7 @@
          "helmet": "^8.1.0",
          "iovalkey": "^0.4.0",
          "openvibe-contracts": "https://codeload.github.com/OpenVibers/OpenVibe.Contracts/tar.gz/refs/tags/v0.116.0",
--        "openvibe-sdk": "https://codeload.github.com/OpenVibers/OpenVibe.SDK/tar.gz/refs/tags/v0.35.2",
++        "openvibe-sdk": "https://codeload.github.com/OpenVibers/OpenVibe.SDK/tar.gz/refs/tags/v0.36.0",
          "openvibe-shared": "https://codeload.github.com/OpenVibers/OpenVibe.Shared/tar.gz/refs/tags/v2.15.0",
          "pg": "^8.23.0"
        },
@@@ -887,9 +887,9 @@
        }
      },
      "node_modules/openvibe-sdk": {
--      "version": "0.35.2",
--      "resolved": "https://codeload.github.com/OpenVibers/OpenVibe.SDK/tar.gz/refs/tags/v0.35.2",
--      "integrity": "sha512-HudKZJK3lZ9i0+yRdMrz9pJmIrYNTN8AFqbHFCz5jDCF68CfZwUJQyhE61pHODzGRyTvUi4DtAzkd0WEzIWx/g==",
++      "version": "0.36.0",
++      "resolved": "https://codeload.github.com/OpenVibers/OpenVibe.SDK/tar.gz/refs/tags/v0.36.0",
++      "integrity": "sha512-mb+VvCuFH3KnMw4LWvqMDEoF93rNEb+eQi8HfT6mj+RPN5eQFWMcc/DCqJ3L0Yzjr99tQ08+DLwaYdZDIlfD0A==",
        "license": "MIT",
        "engines": {
          "node": ">=20"
ddiff --git a/package.json b/package.json
iindex 282b6ea..c5c9acb 100644
---- a/package.json
++++ b/package.json
@@@ -23,7 +23,7 @@
      "helmet": "^8.1.0",
      "iovalkey": "^0.4.0",
      "openvibe-contracts": "https://codeload.github.com/OpenVibers/OpenVibe.Contracts/tar.gz/refs/tags/v0.116.0",
--    "openvibe-sdk": "https://codeload.github.com/OpenVibers/OpenVibe.SDK/tar.gz/refs/tags/v0.35.2",
++    "openvibe-sdk": "https://codeload.github.com/OpenVibers/OpenVibe.SDK/tar.gz/refs/tags/v0.36.0",
      "openvibe-shared": "https://codeload.github.com/OpenVibers/OpenVibe.Shared/tar.gz/refs/tags/v2.15.0",
      "pg": "^8.23.0"
    },
ddiff --git a/server/app.js b/server/app.js
iindex 0523742..b03b6d0 100644
---- a/server/app.js
++++ b/server/app.js
@@@ -33,6 +33,8 @@ const { createApi } = require('./http/api');
  const { createPageRoutes } = require('./http/pages');
  const { createServiceReadiness } = require('./observability');
  const { createCallerLimits } = require('./http/caller-limits');
++const accountDataLib = require('./identity/account-data');
++const { createNetworkSender } = require('openvibe-sdk/account-data');
  const { assetVersion, send } = require('./render/layout');
  const { html } = require('./render/html');
  
@@@ -41,7 +43,7 @@ const VERSION = require('../package.json').version;
  
  /**
   * opts: config, store, now (clock), fetchImpl (Network), log, limitsNow, callerLimits (false: count nobody,
-- * tests only), valkey
++ * tests only), valkey, accountSend (a stand-in for Network's internal routes; tests only)
   */
  async function createApp(opts = {}) {
      const config = opts.config || configLib.load();
@@@ -60,6 +62,18 @@ async function createApp(opts = {}) {
      // Drop expired geocode/area answers; an expired row is ignored anyway, this only keeps the table small.
      Promise.resolve(foodStore.cachePrune(s)).catch((err) => log.warn('[OpenVibe.Food] geo cache prune:', err && err.message));
  
++    // Account export and deletion (ADR-033, ./identity/account-data.js): the two tables that hold a person's rows.
++    // The sender posts to Network's internal export/deletion routes with this service's own client-credentials token;
++    // a test injects a stand-in through opts.accountSend.
++    const accountData = accountDataLib.create({ db: s.db, log });
++    // Without a client secret the service has no way to push a part or a confirmation: the route still answers
++    // (bad signature, a forwarded request, no secret), and an event that really arrives asks Events to retry.
++    const accountSend = opts.accountSend || (config.oauth.clientSecret
++        ? createNetworkSender({ networkInternalUrl: config.networkInternalUrl, clientId: config.oauth.clientId, clientSecret: config.oauth.clientSecret, fetch: fetchImpl })
++        : async () => { throw new Error('OV_OAUTH_CLIENT_SECRET is not set: Food cannot answer account events'); });
++    ctx.accountData = accountData;
++    ctx.accountSend = accountSend;
++
      const app = express();
      app.disable('x-powered-by');
      app.set('trust proxy', config.trustProxy);
@@@ -111,6 +125,12 @@ async function createApp(opts = {}) {
      app.use('/auth', sso.routes());
      { const legal = require('openvibe-shared/legal'); app.get(legal.PATHS, legal.handler({ id: 'food', service: 'food', host: 'openvibe.food', name: 'OpenVibe.Food', profile: 'ugc' })); }
  
++    // ── OpenVibe.Events → this service (loopback only) ──────
++    // network.account.export_requested and network.account.deleted (ADR-033), answered by the SDK's consumer. It
++    // reads the raw body itself, so it is mounted before any body parser (there is none above it), and nginx answers
++    // 404 for /internal/ so this is reachable only on 127.0.0.1.
++    app.use('/internal/events', accountData.consumer({ secrets: config.events.secrets, send: accountSend, log }));
++
      // ── Static assets (content-hashed ?v= → immutable) ──────
      app.use('/shared', require('openvibe-shared/serve').handler());
      app.use(express.static(PUBLIC_DIR, {
ddiff --git a/server/config.js b/server/config.js
iindex 3113e29..f2444c7 100644
---- a/server/config.js
++++ b/server/config.js
@@@ -68,6 +68,16 @@ function load(env = process.env) {
              sessionAudience: env.OV_SESSION_AUDIENCE || 'openvibe.network',
          },
          cookies: { secure: env.COOKIE_SECURE ? env.COOKIE_SECURE === 'true' : isProduction },
++
++        // OpenVibe.Events → this service (server/events-consumer.js). The secret signs a delivery (comma-separated
++        // for rotation, 32+ characters each); unset turns POST /internal/events off (503). The url is where the
++        // network.account.export_requested and network.account.deleted subscriptions are created at boot, off when
++        // unset. Both topics are ADR-033: account export and deletion (server/identity/account-data.js).
++        events: {
++            secrets: String(env.FOOD_EVENTS_SECRET || '').split(',').map((x) => x.trim()).filter(Boolean),
++            url: trim(env.FOOD_EVENTS_URL || env.EVENTS_URL || ''),
++            endpoint: env.FOOD_EVENTS_ENDPOINT || '',
++        },
      };
  }
  
ddiff --git a/server/events-consumer.js b/server/events-consumer.js
nnew file mode 100644
iindex 0000000..c441b9e
---- /dev/null
++++ b/server/events-consumer.js
@@@ -0,0 +1,52 @@
++'use strict';
++
++/**
++ * OpenVibe.Events → Food. Food has no consumer of its own: the two topics it takes are account export and deletion
++ * (ADR-033), and POST /internal/events is answered by openvibe-sdk/account-data's own consumer, mounted in
++ * server/app.js over server/identity/account-data.js (the table map). What is left here is the boot-time half:
++ * startSubscriptions() creates the two subscriptions at Events if they are missing, idempotently, retried with
++ * backoff, and off when the URL or the secret is unset (QUEST_EVENTS_SUBSCRIBE=0 style: FOOD_EVENTS_SUBSCRIBE=0).
++ *
++ * The endpoint is this service's loopback /internal/events (Events posts to http://127.0.0.1:<port> directly; nginx
++ * answers 404 there), and the token is this service's own for audience openvibe.events with
++ * scope events.subscription.manage.
++ */
++const { serviceAuth } = require('openvibe-contracts');
++const { TOPICS } = require('./identity/account-data');
++
++/** Create any missing subscription for TOPICS at Events (idempotent; retried in the background at boot). */
++function startSubscriptions({ config, port, secret, eventsUrl = config.events.url, fetchImpl = globalThis.fetch, log = console }) {
++    if (!eventsUrl || !secret || !config.oauth.clientSecret || process.env.FOOD_EVENTS_SUBSCRIBE === '0') return null;
++    const base = String(eventsUrl).replace(/\/+$/, '');
++    const endpoint = config.events.endpoint || `http://127.0.0.1:${port}/internal/events`;
++    const tokens = serviceAuth.createTokenClient({ tokenUrl: `${config.networkInternalUrl}/oauth/token`, clientId: config.oauth.clientId, clientSecret: config.oauth.clientSecret, audience: 'openvibe.events', scope: 'events.subscription.manage', fetchImpl });
++    const call = async (method, path, body) => {
++        const res = await fetchImpl(`${base}${path}`, { method, headers: { Accept: 'application/json', ...(body ? { 'Content-Type': 'application/json' } : {}), ...(await tokens.authHeaders()) }, body: body ? JSON.stringify(body) : undefined, signal: AbortSignal.timeout(15000) });
++        const json = await res.json().catch(() => ({}));
++        return { status: res.status, ok: res.ok, body: json };
++    };
++    const attempt = async () => {
++        const listed = await call('GET', '/api/v1/subscriptions');
++        if (!listed.ok) throw new Error(`listing subscriptions: ${listed.status}`);
++        const mine = (listed.body.subscriptions || []).filter((s) => s.endpoint === endpoint);
++        for (const topic of TOPICS) {
++            if (mine.some((s) => s.topic_pattern === topic)) continue;
++            const r = await call('POST', '/api/v1/subscriptions', { topic_pattern: topic, endpoint, secret });
++            if (!r.ok && r.status !== 409) throw new Error(`subscribing to ${topic}: ${r.status} ${r.body.code || ''}`);
++            if (r.ok) log.log(`[Events consumer] subscription created: ${r.body.id} (${topic} → ${endpoint})`);
++        }
++    };
++    const delays = [0, 10_000, 60_000, 5 * 60_000, 15 * 60_000];
++    let i = 0;
++    let timer = null;
++    let stopped = false;
++    const run = () => { timer = null; if (stopped) return; attempt().catch((err) => {
++        if (stopped) return;
++        if (++i < delays.length) { timer = setTimeout(run, delays[i]); if (timer.unref) timer.unref(); } else log.warn('[Events consumer] subscriptions not created:', err.message);
++    }); };
++    timer = setTimeout(run, delays[0]); if (timer.unref) timer.unref();
++    // Graceful stop: no further attempts (they run again at the next start).
++    return { topics: TOPICS, endpoint, stop() { stopped = true; if (timer) clearTimeout(timer); timer = null; } };
++}
++
++module.exports = { startSubscriptions, TOPICS };
ddiff --git a/server/identity/account-data.js b/server/identity/account-data.js
nnew file mode 100644
iindex 0000000..42e3305
---- /dev/null
++++ b/server/identity/account-data.js
@@@ -0,0 +1,33 @@
++'use strict';
++
++/**
++ * Account export and deletion → Food (ADR-033; openvibe-sdk/account-data). Food holds two things a person made:
++ * a saved meal plan and their pantry list, both keyed `owner = user:usr_…` (server/http/principal.js builds the
++ * requester that way, server/food/store.js writes it). Both are the person's own — nothing anyone else hangs under
++ * them — so both are deleted whole and nothing is kept.
++ *
++ *   network.account.export_requested  the person's plans (plans.json) and pantry (pantry.json), newest first, pushed to
++ *                                     Network (POST /internal/account-exports/:id/parts) with this service's token.
++ *   network.account.deleted           the person's plans and pantry go, and Food confirms with counts.
++ *
++ * The Nominatim/Overpass cache (food_geo_cache) holds no person's rows: it is keyed by the query, not by a subject, so
++ * it is neither exported nor erased (see migrations/0002_food.sql). Nothing here is a secret: no token, key or
++ * credential is stored, so every column of both tables may be exported.
++ */
++const { createAccountData, TOPICS } = require('openvibe-sdk/account-data');
++
++/**
++ * The tables that hold a person's rows, with the value the subject column really stores. Meals plans and the pantry
++ * both store `user:usr_…` (server/food/store.js takes the owner straight from the principal's requester).
++ */
++const TABLES = [
++    { table: 'food_plans', subject: 'owner', value: (usr) => `user:${usr}`, file: 'plans.json' },
++    { table: 'food_pantry', subject: 'owner', value: (usr) => `user:${usr}`, file: 'pantry.json' },
++];
++
++/** The account-data handle for Food's store (server/db.js createStore). */
++function create({ db, note = 'A pantry row names a food by its slug in server/food/foods.js.', log = console } = {}) {
++    return createAccountData({ db, service: 'food', tables: TABLES, note, log });
++}
++
++module.exports = { create, TABLES, TOPICS };
ddiff --git a/server/index.js b/server/index.js
iindex 390c0a5..2e26506 100644
---- a/server/index.js
++++ b/server/index.js
@@@ -8,13 +8,14 @@ const { createApp } = require('./app');
  const { gracefulStop } = require('openvibe-sdk/service');
  
  /**
-- * The process stop (openvibe-sdk/service): the HTTP drain runs, then the JWKS refresher stops and the store closes.
-- * Exported so a test can inject `exit` and `signals: false`.
++ * The process stop (openvibe-sdk/service): the HTTP drain runs, then the timers clear, the Events subscriptions stop,
++ * the JWKS refresher stops and the store closes. Exported so a test can inject `exit` and `signals: false`. `extra` is
++ * what the product adds (the Events subscriptions); a test that passes none keeps the skeleton's order.
   */
--function createLifecycle({ server, ctx, exit, signals, timers = [] }) {
++function createLifecycle({ server, ctx, exit, signals, timers = [], extra = [] }) {
      return gracefulStop({
          name: 'OpenVibe.Food', server, deadlineExitCode: 0, exit, signals, deadlineMs: 10_000,
--        close: [() => { for (const t of timers) clearInterval(t); }, () => ctx.keys.client.stop(), () => ctx.s.close()],
++        close: [() => { for (const t of timers) clearInterval(t); }, () => ctx.keys.client.stop(), () => ctx.s.close(), ...extra],
      });
  }
  
@@@ -28,7 +29,11 @@ async function start() {
      server.keepAliveTimeout = 65_000;
      ctx.keys.client.start();
  
--    createLifecycle({ server, ctx });
++    // Subscribe to the two ADR-033 topics at OpenVibe.Events (idempotent; off without FOOD_EVENTS_URL and
++    // FOOD_EVENTS_SECRET). The consumer itself is mounted in server/app.js.
++    const subscriptions = require('./events-consumer').startSubscriptions({ config, port: config.port, secret: config.events.secrets[0] || '' });
++    const extra = [() => { if (subscriptions) subscriptions.stop(); }];
++    createLifecycle({ server, ctx, extra });
      return { server, ctx };
  }
  
ddiff --git a/test/account-data.test.js b/test/account-data.test.js
nnew file mode 100644
iindex 0000000..db79b06
---- /dev/null
++++ b/test/account-data.test.js
@@@ -0,0 +1,125 @@
++'use strict';
++/**
++ * ADR-033: Food's part of an account export (plans and pantry) and of an account deletion, applied through the
++ * service's own /internal/events route with a stand-in Network. Real rows are made through the service's store, the
++ * signed delivery is answered by openvibe-sdk/account-data, and the part only ever carries person A's rows. A
++ * redelivery erases nothing twice, and the route refuses a bad signature and a forwarded request.
++ */
++const assert = require('assert');
++const http = require('http');
++const { boot, check, done } = require('./helpers/boot');
++const { createNetworkSender } = require('openvibe-sdk/account-data');
++const { signDeliveryHeaders } = require('openvibe-sdk/events');
++const foodStore = require('../server/food/store');
++
++const A = 'usr_01JZ0000000000000000000AAA';
++const B = 'usr_01JZ0000000000000000000BBB';
++const OLD = 'usr_01JZ0000000000000000000MRG';
++const EXP = 'exp_01JZ0000000000000000000EXP';
++const DEL = 'del_01JZ0000000000000000000DEX';
++// Fixture secrets, built so they never look like a real key to a scanner.
++const SECRET = `whsec_${'fixture'.repeat(6)}`;
++const WRONG = `whsec_${'mismatch'.repeat(5)}`;
++
++const exportEvent = { event_id: 'evt_01JZ0000000000000000000E01', event_type: 'network.account.export_requested', source: 'network', payload: { export_id: EXP, subject: A } };
++const deleteEvent = { event_id: 'evt_01JZ0000000000000000000D01', event_type: 'network.account.deleted', source: 'network', payload: { deletion_id: DEL, subject: A, aliases: [OLD] } };
++const bodyOf = (ev) => JSON.stringify({ event: ev, seq: 1 });
++
++/** A stand-in for Network's internal routes: the token endpoint, the export part and the deletion confirmation. */
++async function startNetworkStub({ partStatus = 201, confirmStatus = 201 } = {}) {
++    const calls = [];
++    const statusOf = (v) => (typeof v === 'function' ? v() : v);
++    const server = http.createServer((req, res) => {
++        const chunks = [];
++        req.on('data', (c) => chunks.push(c));
++        req.on('end', () => {
++            const raw = Buffer.concat(chunks);
++            const json = (status, obj) => { res.writeHead(status, { 'Content-Type': 'application/json' }); res.end(JSON.stringify(obj)); };
++            if (req.url === '/oauth/token') return json(200, { access_token: 'tok_food', token_type: 'Bearer', expires_in: 300, scope: 'openvibe.network' });
++            calls.push({ url: req.url, auth: req.headers.authorization, body: JSON.parse(raw.toString() || 'null') });
++            return json(req.url.includes('/parts') ? statusOf(partStatus) : statusOf(confirmStatus), {});
++        });
++    });
++    await new Promise((r) => server.listen(0, '127.0.0.1', r));
++    return { url: `http://127.0.0.1:${server.address().port}`, calls, close: () => new Promise((r) => server.close(r)) };
++}
++
++/** Make a plan and a pantry for one person, through the store the API writes with (server/food/store.js). */
++async function makeRows(t, subject, title) {
++    const s = t.ctx.s;
++    await foodStore.insertPlan(s, { id: s.newId('pln'), owner: `user:${subject}`, title, people: 2, days: 3, budget: null, plan: { days: [{ items: [title] }] }, created_at: s.iso() });
++    await foodStore.setPantry(s, `user:${subject}`, [title]);
++}
++
++(async () => {
++    await check('an export part carries only the person\'s plans and pantry, and no secret', async () => {
++        const stub = await startNetworkStub();
++        const sender = createNetworkSender({ networkInternalUrl: stub.url, clientId: 'food', clientSecret: 'food-secret' });
++        const t = await boot({ env: { FOOD_EVENTS_SECRET: SECRET }, accountSend: sender });
++        try {
++            await makeRows(t, A, 'person-a');
++            await makeRows(t, B, 'person-b');
++
++            const res = await t.get('/internal/events', { method: 'POST', body: bodyOf(exportEvent), headers: { 'Content-Type': 'application/json', ...signDeliveryHeaders(bodyOf(exportEvent), SECRET) } });
++            assert.strictEqual(res.status, 200);
++            assert.strictEqual(res.json().outcome, 'exported');
++
++            const part = stub.calls.find((c) => c.url === `/internal/account-exports/${EXP}/parts`);
++            assert.ok(part, 'the part was pushed to Network');
++            assert.strictEqual(part.auth, 'Bearer tok_food', 'with this service\'s own token');
++            assert.strictEqual(part.body.subject, A);
++            assert.deepStrictEqual(part.body.files.map((f) => f.name).sort(), ['pantry.json', 'plans.json']);
++            const plans = part.body.files.find((f) => f.name === 'plans.json').content;
++            assert.strictEqual(plans.length, 1);
++            assert.strictEqual(plans[0].title, 'person-a');
++            assert.ok(!JSON.stringify(part.body).includes('person-b'), 'nobody else\'s rows');
++            assert.ok(!/token|secret|password/i.test(JSON.stringify(part.body)), 'no secret is exported');
++        } finally { await t.close(); await stub.close(); }
++    });
++
++    await check('a deletion erases the person and their aliases once, keeps someone else, and confirms with counts', async () => {
++        const stub = await startNetworkStub();
++        const sender = createNetworkSender({ networkInternalUrl: stub.url, clientId: 'food', clientSecret: 'food-secret' });
++        const t = await boot({ env: { FOOD_EVENTS_SECRET: SECRET }, accountSend: sender });
++        try {
++            await makeRows(t, A, 'person-a');
++            await makeRows(t, B, 'person-b');
++            const gone = async (subject) => await t.ctx.s.db.value('SELECT count(*)::int FROM food_plans WHERE owner = $1', [`user:${subject}`]);
++
++            const res = await t.get('/internal/events', { method: 'POST', body: bodyOf(deleteEvent), headers: { 'Content-Type': 'application/json', ...signDeliveryHeaders(bodyOf(deleteEvent), SECRET) } });
++            assert.strictEqual(res.status, 200);
++            assert.strictEqual(res.json().outcome, 'erased');
++            assert.strictEqual(await gone(A), 0, 'the person\'s plans are gone');
++            assert.strictEqual(await t.ctx.s.db.value('SELECT count(*)::int FROM food_pantry WHERE owner = $1', [`user:${A}`]), 0, 'the pantry is gone');
++            assert.strictEqual(await gone(B), 1, 'someone else\'s plan stays');
++
++            const confirmation = stub.calls.find((c) => c.url === `/internal/account-deletions/${DEL}/confirmations`);
++            assert.ok(confirmation, 'the confirmation was sent');
++            assert.deepStrictEqual(confirmation.body.erased, { food_plans: 1, food_pantry: 1 });
++            assert.deepStrictEqual(confirmation.body.retained, {});
++            assert.ok(!Number.isNaN(Date.parse(confirmation.body.completed_at)));
++
++            // A redelivery must not erase again: rows written after the deletion stay.
++            await makeRows(t, A, 'written-later');
++            const again = await t.get('/internal/events', { method: 'POST', body: bodyOf(deleteEvent), headers: { 'Content-Type': 'application/json', ...signDeliveryHeaders(bodyOf(deleteEvent), SECRET) } });
++            assert.strictEqual(again.status, 200);
++            assert.strictEqual(again.json().outcome, 'unchanged');
++            assert.strictEqual(await gone(A), 1, 'nothing was erased twice');
++        } finally { await t.close(); await stub.close(); }
++    });
++
++    await check('the internal route refuses a bad signature (401) and a forwarded request (403)', async () => {
++        const stub = await startNetworkStub();
++        const sender = createNetworkSender({ networkInternalUrl: stub.url, clientId: 'food', clientSecret: 'food-secret' });
++        const t = await boot({ env: { FOOD_EVENTS_SECRET: SECRET }, accountSend: sender });
++        try {
++            const bad = await t.get('/internal/events', { method: 'POST', body: bodyOf(exportEvent), headers: { 'Content-Type': 'application/json', ...signDeliveryHeaders(bodyOf(exportEvent), WRONG) } });
++            assert.strictEqual(bad.status, 401);
++
++            const forwarded = await t.get('/internal/events', { method: 'POST', body: bodyOf(exportEvent), headers: { 'Content-Type': 'application/json', 'X-Forwarded-For': '203.0.113.9', ...signDeliveryHeaders(bodyOf(exportEvent), SECRET) } });
++            assert.strictEqual(forwarded.status, 403);
++        } finally { await t.close(); await stub.close(); }
++    });
++
++    done();
++})();
ddiff --git a/test/helpers/boot.js b/test/helpers/boot.js
iindex 1bcb33e..a82cf58 100644
---- a/test/helpers/boot.js
++++ b/test/helpers/boot.js
@@@ -48,7 +48,7 @@ async function boot(opts = {}) {
      const { createStore } = require('../../server/db');
      const testdb = await require('./db').testDb();
      const store = createStore(testdb.db, { now: opts.now });
--    const built = await createApp({ config, store, log, limitsNow: opts.limitsNow, callerLimits: opts.callerLimits === true });
++    const built = await createApp({ config, store, log, limitsNow: opts.limitsNow, callerLimits: opts.callerLimits === true, accountSend: opts.accountSend });
      await built.ctx.keys.ensure();
      const server = await new Promise((resolve) => { const s = http.createServer(built.app); s.listen(0, '127.0.0.1', () => resolve(s)); });
      const base = `http://127.0.0.1:${server.address().port}`;