db: enforce foreign keys, and ship the licence package.json claims

LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Profullstack, Inc. (dba moshcoding)
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

apps/pwa/src/db.mjs

@@ -13,6 +13,23 @@ if (config.db.url.startsWith("file:")) {
 
 export const db = createClient({ url: config.db.url, authToken: config.db.authToken });
 
+/**
+ * Turn on foreign keys.
+ *
+ * SQLite ignores every REFERENCES clause unless this is set, per connection —
+ * which means the `ON DELETE CASCADE` on moshpit_names.user_id,
+ * moshpit_name_purchases.user_id, moshpit_name_pins.user_id and sessions.user_id
+ * have all been decorative. Deleting a user left their names, purchases,
+ * published keys and sessions behind, pointing at a row that no longer exists.
+ *
+ * Fired once at import and not awaited: every later statement goes through the
+ * same client, and libSQL serialises on the connection, so the PRAGMA is on the
+ * wire before anything that depends on it. A failure is logged rather than
+ * thrown because the app is still usable without it — it just enforces less.
+ */
+db.execute("PRAGMA foreign_keys = ON")
+  .catch((error) => console.error("[db] could not enable foreign keys:", error.message));
+
 /** Run a statement; returns the raw result. */
 export const run = (sql, args = []) => db.execute({ sql, args });
 

apps/pwa/test/moshpit-terms.test.mjs

@@ -165,3 +165,39 @@ test("ending terms", { skip: installed ? false : "pwa dependencies not installed
     assert.equal(m.isExpired({ expires_at: Date.now() + 1000 }), false);
   });
 });
+
+test("deleting a user takes their rows with them", { skip: installed ? false : "pwa dependencies not installed" }, async (t) => {
+  const { migrate } = await import("../src/migrate.mjs");
+  await migrate();
+  const { run, all } = await import("../src/db.mjs");
+  const { randomBytes: rb } = await import("node:crypto");
+
+  await t.test("foreign keys are actually on", async () => {
+    // SQLite ignores every REFERENCES clause without this, per connection. The
+    // cascades in the schema were decorative for as long as it was unset.
+    assert.equal((await all("PRAGMA foreign_keys"))[0].foreign_keys, 1);
+  });
+
+  await t.test("names, pins and purchases follow the user out", async () => {
+    const uid = `u${rb(4).toString("hex")}`;
+    const tld = `fk${rb(4).toString("hex")}`;
+    const now = Date.now();
+    await run(`INSERT INTO users (id,email,created_at) VALUES (?,?,?)`, [uid, `${uid}@e.com`, now]);
+    await run(`INSERT INTO moshpit_tlds (tld,user_id,created_at) VALUES (?,?,?)`, [tld, uid, now]);
+    await run(`INSERT INTO moshpit_names (tld,label,user_id,created_at) VALUES (?,?,?,?)`, [tld, "a", uid, now]);
+    await run(`INSERT INTO moshpit_name_pins (tld,label,pin,kind,user_id,created_at) VALUES (?,?,?,?,?,?)`,
+      [tld, "a", "AAAA", "tls", uid, now]);
+
+    const mine = async (table) =>
+      (await all(`SELECT 1 FROM ${table} WHERE user_id = ?`, [uid])).length;
+    assert.equal(await mine("moshpit_names"), 1);
+    assert.equal(await mine("moshpit_name_pins"), 1);
+
+    await run(`DELETE FROM users WHERE id = ?`, [uid]);
+
+    // Orphans here are not cosmetic: a published key outliving its owner is a
+    // key nobody can revoke.
+    assert.equal(await mine("moshpit_names"), 0);
+    assert.equal(await mine("moshpit_name_pins"), 0);
+  });
+});