Phase 3 — Meta + TikTok Adapters

A. Meta adapter ───────┐
                       ├──▶ C. Multi-account selection ──▶ D. Tool matrix widening
B. TikTok adapter ─────┘
        │
        ├──▶ E. Refresh edge-case typing (refactors Google adapter too)
        │
        └──▶ F. Connection-status endpoint
                                                G. GDPR erasure (depends on revoke + DEK destroy from Phase 2)
H. Tests run alongside everything

META_APP_ID:                z.string().min(1),
META_OAUTH_REDIRECT_URI:    z.string().url(),
META_AUTH_ENDPOINT:         z.string().url().default('https://www.facebook.com/v21.0/dialog/oauth'),
META_TOKEN_ENDPOINT:        z.string().url().default('https://graph.facebook.com/v21.0/oauth/access_token'),
META_GRAPH_VERSION:         z.string().default('v21.0'),
META_SCOPES:                z.string().default('ads_read,business_management'),

import { and, eq } from 'drizzle-orm';
import { db } from '../../db/index.js';
import { platformCredentials } from '../../db/schema.js';
import { encryptToken, decryptToken } from '../../security/credentials.service.js';
import { loadSecret } from '../../security/secrets.loader.js';
import { config } from '../../config.js';
import { writeAuditEvent } from '../../security/audit-log.service.js';
import { TokenRevokedError, ScopeMissingError } from '../errors.js'; // §E
 
const REFRESH_WHEN_REMAINING_SECONDS = 7 * 24 * 3600; // re-exchange when <7 days left
 
export async function exchangeAuthCode(tenantId: string, code: string, _codeVerifier: string): Promise<void> {
  const appSecret = (await loadSecret('META_APP_SECRET' as never)).toString('utf8');
 
  // Step 1: code → short-lived user token
  const shortUrl = new URL(config.META_TOKEN_ENDPOINT);
  shortUrl.searchParams.set('client_id',     config.META_APP_ID);
  shortUrl.searchParams.set('client_secret', appSecret);
  shortUrl.searchParams.set('redirect_uri',  config.META_OAUTH_REDIRECT_URI);
  shortUrl.searchParams.set('code',          code);
  const shortRes = await fetch(shortUrl.toString());
  if (!shortRes.ok) throw new Error(`meta_short_token_failed: ${shortRes.status}`);
  const shortJson = (await shortRes.json()) as { access_token: string };
 
  // Step 2: short-lived → long-lived (~60d)
  const longUrl = new URL(config.META_TOKEN_ENDPOINT);
  longUrl.searchParams.set('grant_type',        'fb_exchange_token');
  longUrl.searchParams.set('client_id',         config.META_APP_ID);
  longUrl.searchParams.set('client_secret',     appSecret);
  longUrl.searchParams.set('fb_exchange_token', shortJson.access_token);
  const longRes = await fetch(longUrl.toString());
  if (!longRes.ok) throw new Error(`meta_long_token_failed: ${longRes.status}`);
  const longJson = (await longRes.json()) as { access_token: string; expires_in: number };
 
  // Step 3: verify granted scopes
  const debugRes = await fetch(`https://graph.facebook.com/${config.META_GRAPH_VERSION}/debug_token?input_token=${longJson.access_token}&access_token=${config.META_APP_ID}|${appSecret}`);
  const debugJson = (await debugRes.json()) as { data: { scopes: string[]; expires_at: number } };
  const required = config.META_SCOPES.split(',');
  const missing = required.filter(s => !debugJson.data.scopes.includes(s));
  if (missing.length > 0) throw new ScopeMissingError('meta', missing);
 
  const accessEnc  = await encryptToken(tenantId, longJson.access_token);
  // Meta has no separate refresh_token — we re-exchange the long-lived token itself.
  await db.insert(platformCredentials).values({
    tenantId, platform: 'meta', accountId: '',
    accessTokenEnc:  accessEnc,
    refreshTokenEnc: accessEnc,                       // same blob; semantics: source for re-exchange
    tokenExpiresAt:  new Date(debugJson.data.expires_at * 1000),
    scopes:          debugJson.data.scopes,
  }).onConflictDoUpdate({
    target: [platformCredentials.tenantId, platformCredentials.platform],
    set: {
      accessTokenEnc: accessEnc, refreshTokenEnc: accessEnc,
      tokenExpiresAt: new Date(debugJson.data.expires_at * 1000),
      scopes: debugJson.data.scopes, updatedAt: new Date(),
    },
  });
}
 
export async function ensureValidToken(tenantId: string): Promise<string> {
  const [row] = await db.select().from(platformCredentials)
    .where(and(eq(platformCredentials.tenantId, tenantId), eq(platformCredentials.platform, 'meta')));
  if (!row) throw new Error('no_meta_credentials');
 
  const remaining = (row.tokenExpiresAt!.getTime() - Date.now()) / 1000;
  if (remaining > REFRESH_WHEN_REMAINING_SECONDS) {
    return decryptToken(tenantId, row.accessTokenEnc);
  }
 
  // Re-exchange the long-lived token. If Meta says the token is invalid, surface as TokenRevokedError.
  const appSecret = (await loadSecret('META_APP_SECRET' as never)).toString('utf8');
  const current = await decryptToken(tenantId, row.accessTokenEnc);
  const url = new URL(config.META_TOKEN_ENDPOINT);
  url.searchParams.set('grant_type',        'fb_exchange_token');
  url.searchParams.set('client_id',         config.META_APP_ID);
  url.searchParams.set('client_secret',     appSecret);
  url.searchParams.set('fb_exchange_token', current);
 
  const res = await fetch(url.toString());
  if (res.status === 400 || res.status === 401) {
    await writeAuditEvent('oauth.token_refreshed', 'failure', { tenantId, platform: 'meta', status: res.status });
    throw new TokenRevokedError('meta');
  }
  if (!res.ok) throw new Error(`meta_token_refresh_failed: ${res.status}`);
  const json = (await res.json()) as { access_token: string; expires_in: number };
 
  const enc = await encryptToken(tenantId, json.access_token);
  await db.update(platformCredentials)
    .set({ accessTokenEnc: enc, refreshTokenEnc: enc, tokenExpiresAt: new Date(Date.now() + json.expires_in * 1000), updatedAt: new Date() })
    .where(and(eq(platformCredentials.tenantId, tenantId), eq(platformCredentials.platform, 'meta')));
  await writeAuditEvent('oauth.token_refreshed', 'success', { tenantId, platform: 'meta' });
  return json.access_token;
}

export async function listAdAccounts(tenantId: string): Promise<{ id: string; name: string }[]> {
  const token = await ensureValidToken(tenantId);
  const res = await fetch(
    `https://graph.facebook.com/${config.META_GRAPH_VERSION}/me/adaccounts?fields=account_id,name&access_token=${token}`
  );
  if (!res.ok) throw new Error(`meta_list_accounts_failed: ${res.status}`);
  const json = (await res.json()) as { data: { account_id: string; name: string }[] };
  return json.data.map(a => ({ id: `act_${a.account_id}`, name: a.name }));
}

const RANGE_PRESET: Record<DateRange, string> = {
  last_7_days:  'last_7d',
  last_30_days: 'last_30d',
  last_90_days: 'last_90d',
};
 
async function queryInsights(tenantId: string, accountId: string, params: {
  range: DateRange;
  fields: string[];
  level?: 'account' | 'campaign' | 'adset' | 'ad';
  breakdowns?: string[];
}) {
  const token = await ensureValidToken(tenantId);
  const url = new URL(`https://graph.facebook.com/${config.META_GRAPH_VERSION}/${accountId}/insights`);
  url.searchParams.set('access_token',  token);
  url.searchParams.set('date_preset',   RANGE_PRESET[params.range]);
  url.searchParams.set('fields',        params.fields.join(','));
  url.searchParams.set('level',         params.level ?? 'campaign');
  if (params.breakdowns) url.searchParams.set('breakdowns', params.breakdowns.join(','));
  url.searchParams.set('limit',         '500');
 
  const all: unknown[] = [];
  let next: string | null = url.toString();
  while (next) {
    const res = await fetch(next);
    if (res.status === 400 || res.status === 401) {
      const body = await res.json().catch(() => ({}));
      if ((body as any)?.error?.code === 190) throw new TokenRevokedError('meta'); // OAuthException
      throw new Error(`meta_insights_failed: ${res.status}`);
    }
    const json = (await res.json()) as { data: unknown[]; paging?: { next?: string } };
    all.push(...json.data);
    next = json.paging?.next ?? null;
  }
  return all;
}
 
export const queryAccountHealth = (t: string, a: string, r: DateRange) =>
  queryInsights(t, a, { range: r, fields: ['spend', 'purchase_roas', 'cost_per_action_type', 'ctr', 'clicks', 'impressions'], level: 'campaign' });
 
export const querySearchTermWaste = (t: string, a: string, r: DateRange) =>
  queryInsights(t, a, { range: r, fields: ['spend', 'actions'], level: 'ad', breakdowns: ['publisher_platform', 'placement'] });
 
// queryAuctionInsights, queryBudgetSplit, queryWeeklyAnomaly — same shape, different fields/level.
// queryQualityScore + queryPmaxBreakdown stay Google-only — no Meta equivalent.

TIKTOK_CLIENT_KEY:          z.string().min(1),
TIKTOK_OAUTH_REDIRECT_URI:  z.string().url(),
TIKTOK_AUTH_ENDPOINT:       z.string().url().default('https://business-api.tiktok.com/portal/auth'),
TIKTOK_TOKEN_ENDPOINT:      z.string().url().default('https://business-api.tiktok.com/open_api/v1.3/oauth2/access_token/'),
TIKTOK_REFRESH_ENDPOINT:    z.string().url().default('https://business-api.tiktok.com/open_api/v1.3/oauth2/refresh_token/'),
TIKTOK_API_VERSION:         z.string().default('v1.3'),

const REFRESH_SKEW_SECONDS = 600; // 10 min
 
export async function exchangeAuthCode(tenantId: string, code: string, _codeVerifier: string): Promise<void> {
  const appSecret = (await loadSecret('TIKTOK_APP_SECRET' as never)).toString('utf8');
  const res = await fetch(config.TIKTOK_TOKEN_ENDPOINT, {
    method: 'POST',
    headers: { 'content-type': 'application/json' },
    body: JSON.stringify({
      app_id:      config.TIKTOK_CLIENT_KEY,
      secret:      appSecret,
      auth_code:   code,
      grant_type:  'authorization_code',
    }),
  });
  if (!res.ok) throw new Error(`tiktok_token_failed: ${res.status}`);
  const env = (await res.json()) as { code: number; message: string; data: {
    access_token: string; refresh_token: string; access_token_expire_in: number; refresh_token_expire_in: number; scope: string[];
  } };
  if (env.code !== 0) throw new Error(`tiktok_token_failed: ${env.message}`);
 
  const accessEnc  = await encryptToken(tenantId, env.data.access_token);
  const refreshEnc = await encryptToken(tenantId, env.data.refresh_token);
  await db.insert(platformCredentials).values({
    tenantId, platform: 'tiktok', accountId: '',
    accessTokenEnc: accessEnc, refreshTokenEnc: refreshEnc,
    tokenExpiresAt: new Date(Date.now() + env.data.access_token_expire_in * 1000),
    scopes: env.data.scope,
  }).onConflictDoUpdate({
    target: [platformCredentials.tenantId, platformCredentials.platform],
    set: { accessTokenEnc: accessEnc, refreshTokenEnc: refreshEnc,
           tokenExpiresAt: new Date(Date.now() + env.data.access_token_expire_in * 1000),
           scopes: env.data.scope, updatedAt: new Date() },
  });
}
 
export async function ensureValidToken(tenantId: string): Promise<string> {
  const [row] = await db.select().from(platformCredentials)
    .where(and(eq(platformCredentials.tenantId, tenantId), eq(platformCredentials.platform, 'tiktok')));
  if (!row) throw new Error('no_tiktok_credentials');
 
  if ((row.tokenExpiresAt!.getTime() - Date.now()) / 1000 > REFRESH_SKEW_SECONDS) {
    return decryptToken(tenantId, row.accessTokenEnc);
  }
 
  const refresh = await decryptToken(tenantId, row.refreshTokenEnc!);
  const appSecret = (await loadSecret('TIKTOK_APP_SECRET' as never)).toString('utf8');
  const res = await fetch(config.TIKTOK_REFRESH_ENDPOINT, {
    method: 'POST',
    headers: { 'content-type': 'application/json' },
    body: JSON.stringify({
      app_id: config.TIKTOK_CLIENT_KEY, secret: appSecret,
      refresh_token: refresh, grant_type: 'refresh_token',
    }),
  });
  const env = (await res.json()) as { code: number; message: string; data?: { access_token: string; refresh_token: string; access_token_expire_in: number } };
  // TikTok returns code 40105 for revoked / invalid refresh tokens.
  if (env.code === 40105 || env.code === 40104) {
    await writeAuditEvent('oauth.token_refreshed', 'failure', { tenantId, platform: 'tiktok', code: env.code });
    throw new TokenRevokedError('tiktok');
  }
  if (env.code !== 0 || !env.data) throw new Error(`tiktok_refresh_failed: ${env.message}`);
 
  const accessEnc  = await encryptToken(tenantId, env.data.access_token);
  const refreshEnc = await encryptToken(tenantId, env.data.refresh_token);
  await db.update(platformCredentials)
    .set({ accessTokenEnc: accessEnc, refreshTokenEnc: refreshEnc,
           tokenExpiresAt: new Date(Date.now() + env.data.access_token_expire_in * 1000),
           updatedAt: new Date() })
    .where(and(eq(platformCredentials.tenantId, tenantId), eq(platformCredentials.platform, 'tiktok')));
  await writeAuditEvent('oauth.token_refreshed', 'success', { tenantId, platform: 'tiktok' });
  return env.data.access_token;
}

// src/adapters/tiktok/customers.ts
export async function listAdvertisers(tenantId: string): Promise<{ id: string; name: string }[]> {
  const token = await ensureValidToken(tenantId);
  const appSecret = (await loadSecret('TIKTOK_APP_SECRET' as never)).toString('utf8');
  const url = `https://business-api.tiktok.com/open_api/${config.TIKTOK_API_VERSION}/oauth2/advertiser/get/?app_id=${config.TIKTOK_CLIENT_KEY}&secret=${appSecret}`;
  const res = await fetch(url, { headers: { 'Access-Token': token } });
  const env = (await res.json()) as { code: number; data: { list: { advertiser_id: string; advertiser_name: string }[] } };
  if (env.code !== 0) throw new Error('tiktok_list_advertisers_failed');
  return env.data.list.map(a => ({ id: a.advertiser_id, name: a.advertiser_name }));
}

CREATE UNIQUE INDEX platform_credentials_one_per_tenant_platform
  ON platform_credentials (tenant_id, platform);

fastify.get('/auth/:platform/accounts', async (req, reply) => {
  const P = z.object({ platform: z.enum(['google', 'meta', 'tiktok']) }).parse(req.params);
  if (!req.tenantId) return reply.code(401).send();
  const adapter = getAdapter(P.platform);
  const accounts = await adapter.listAccounts(req.tenantId); // new method on the interface
  return { platform: P.platform, accounts };
});
 
fastify.post('/auth/:platform/accounts/select', async (req, reply) => {
  const P = z.object({ platform: z.enum(['google', 'meta', 'tiktok']) }).parse(req.params);
  const B = z.object({ accountId: z.string().min(1) }).parse(req.body);
  if (!req.tenantId) return reply.code(401).send();
 
  // Validate the choice belongs to the tenant.
  const adapter = getAdapter(P.platform);
  const accounts = await adapter.listAccounts(req.tenantId);
  if (!accounts.some(a => a.id === B.accountId)) return reply.code(400).send({ error: 'account_not_accessible' });
 
  await db.update(platformCredentials)
    .set({ accountId: B.accountId, updatedAt: new Date() })
    .where(and(eq(platformCredentials.tenantId, req.tenantId), eq(platformCredentials.platform, P.platform)));
  return { status: 'account_selected', accountId: B.accountId };
});

listAccounts(tenantId: string): Promise<{ id: string; name: string }[]>;

// inside the helper, before readOrFetch:
if (!await ensureAccountSelected(ctx.tenantId, input.platform)) {
  return { error: 'account_not_selected', platform: input.platform } as const;
}

ALTER TABLE metric_cache
  ADD COLUMN account_id text NOT NULL DEFAULT '';
 
DROP INDEX metric_cache_key_idx;
CREATE UNIQUE INDEX metric_cache_key_idx
  ON metric_cache (tenant_id, platform, account_id, report_type, date_range_key);

export class NotImplementedError extends Error {
  constructor(public platform: string, public method: string) {
    super(`${method} not implemented for ${platform}`);
  }
}

export type AdapterErrorCode =
  | 'token_revoked'
  | 'scope_missing'
  | 'rate_limited'
  | 'account_not_accessible'
  | 'account_not_selected'
  | 'platform_unavailable';
 
export class AdapterError extends Error {
  constructor(public code: AdapterErrorCode, public platform: string, message?: string, public details?: unknown) {
    super(message ?? code);
  }
}
 
export class TokenRevokedError extends AdapterError {
  constructor(platform: string) { super('token_revoked', platform); }
}
export class ScopeMissingError extends AdapterError {
  constructor(platform: string, public missing: string[]) { super('scope_missing', platform, undefined, { missing }); }
}

try {
  const { data, cache } = await readOrFetch(/* ... */);
  await writeAuditEvent('mcp.tool_called', 'success', { /* ... */ });
  return { data, cache };
} catch (err) {
  if (err instanceof AdapterError) {
    await writeAuditEvent('mcp.tool_failed', 'failure', { tenantId: ctx.tenantId, tool: opts.name, code: err.code, platform: err.platform });
    return { error: err.code, platform: err.platform, ...(err.details ? { details: err.details } : {}) };
  }
  await writeAuditEvent('mcp.tool_failed', 'failure', { tenantId: ctx.tenantId, tool: opts.name, code: 'internal_error' });
  throw err; // propagate to Fastify error handler → 500
}

import type { FastifyPluginAsync } from 'fastify';
import { eq } from 'drizzle-orm';
import { db } from '../db/index.js';
import { platformCredentials, syncLog } from '../db/schema.js';
 
export const connectionsRoutes: FastifyPluginAsync = async (fastify) => {
  fastify.get('/tenant/connections', async (req, reply) => {
    if (!req.tenantId) return reply.code(401).send();
 
    const rows = await db.select({
      platform: platformCredentials.platform,
      accountId: platformCredentials.accountId,
      tokenExpiresAt: platformCredentials.tokenExpiresAt,
      scopes: platformCredentials.scopes,
      updatedAt: platformCredentials.updatedAt,
    }).from(platformCredentials).where(eq(platformCredentials.tenantId, req.tenantId));
 
    return {
      tenantId: req.tenantId,
      connections: rows.map(r => ({
        platform: r.platform,
        accountId: r.accountId || null,
        accountSelected: r.accountId !== '',
        tokenExpiresAt: r.tokenExpiresAt,
        scopes: r.scopes,
        lastUpdatedAt: r.updatedAt,
      })),
    };
  });
};

import { eq, sql } from 'drizzle-orm';
import { db } from '../db/index.js';
import { tenants, platformCredentials, metricCache, syncLog, auditLog, apiKeys } from '../db/schema.js';
import { destroyDek } from './credentials.service.js';
import { getAdapter } from '../adapters/registry.js';
import { writeAuditEvent } from './audit-log.service.js';
 
export async function deleteTenant(tenantId: string): Promise<void> {
  // Best-effort upstream revocation BEFORE wiping local state — we need the tokens to revoke.
  const creds = await db.select().from(platformCredentials).where(eq(platformCredentials.tenantId, tenantId));
  for (const c of creds) {
    try { await getAdapter(c.platform).revoke(tenantId); }
    catch { /* upstream may already be revoked; we still wipe locally */ }
  }
 
  await db.transaction(async (tx) => {
    await tx.delete(metricCache).where(eq(metricCache.tenantId, tenantId));
    await tx.delete(platformCredentials).where(eq(platformCredentials.tenantId, tenantId));
    await tx.delete(syncLog).where(eq(syncLog.tenantId, tenantId));
    await tx.delete(apiKeys).where(eq(apiKeys.tenantId, tenantId));
 
    // DEK destroyed AFTER credentials wiped — order matters for crash safety.
    await destroyDek(tenantId);
 
    // Audit log: anonymise rather than delete (architecture §9, GDPR vs. SOC 2 trade-off).
    await tx.update(auditLog)
      .set({ tenantId: null, metadata: sql`COALESCE(${auditLog.metadata}, '{}'::jsonb) - 'account_id' - 'accountId'` })
      .where(eq(auditLog.tenantId, tenantId));
 
    await tx.delete(tenants).where(eq(tenants.id, tenantId));
  });
  await writeAuditEvent('tenant.deleted', 'success', { tenantId }); // tenantId now refers to a deleted tenant; row remains as anonymised audit
}

fastify.delete('/admin/tenants/:tenantId', async (req, reply) => {
  if (req.headers['x-admin-token'] !== adminToken) return reply.code(401).send();
  const P = z.object({ tenantId: z.string().uuid() }).parse(req.params);
  await deleteTenant(P.tenantId);
  return reply.code(204).send();
});

[[ -f secrets/META_APP_SECRET     ]] || echo -n 'meta_test_secret'   > secrets/META_APP_SECRET
[[ -f secrets/TIKTOK_APP_SECRET   ]] || echo -n 'tiktok_test_secret' > secrets/TIKTOK_APP_SECRET

# 0. Phase 2 already up: tenants seeded, Google connected, server running.
# 1. Apply Phase 3 migrations (account_id on metric_cache, unique indexes, etc.)
npm run db:migrate
 
# 2. Connect Meta
curl -i -H "X-Api-Key: $KEY" http://127.0.0.1:3001/auth/meta/start
# → 302 to Facebook ... complete consent in browser ...
 
# 3. List Meta accounts and pick one
curl -H "X-Api-Key: $KEY" http://127.0.0.1:3001/auth/meta/accounts
# → {"accounts":[{"id":"act_123...","name":"Brand A"}, ...]}
curl -X POST -H "X-Api-Key: $KEY" -H "Content-Type: application/json" \
  -d '{"accountId":"act_123..."}' http://127.0.0.1:3001/auth/meta/accounts/select
# → {"status":"account_selected","accountId":"act_123..."}
 
# 4. Connect TikTok (same flow)
curl -i -H "X-Api-Key: $KEY" http://127.0.0.1:3001/auth/tiktok/start
# ... (browser) ...
curl -H "X-Api-Key: $KEY" http://127.0.0.1:3001/auth/tiktok/accounts
curl -X POST -H "X-Api-Key: $KEY" -H "Content-Type: application/json" \
  -d '{"accountId":"7000..."}' http://127.0.0.1:3001/auth/tiktok/accounts/select
 
# 5. Check tenant connection state
curl -H "X-Api-Key: $KEY" http://127.0.0.1:3001/tenant/connections
# → {connections:[{platform:"google",...},{platform:"meta",...},{platform:"tiktok",...}]}
 
# 6. Run get_account_health on all three platforms
for P in google meta tiktok; do
  curl -X POST http://127.0.0.1:3001/mcp -H "X-Api-Key: $KEY" -H "Content-Type: application/json" \
    -d "{\"jsonrpc\":\"2.0\",\"id\":1,\"method\":\"tools/call\",\"params\":{\"name\":\"get_account_health\",\"arguments\":{\"platform\":\"$P\",\"dateRange\":\"last_7_days\"}}}"
done
# → three responses, all "cache":"miss" first time, "cache":"hit" if you re-run
 
# 7. Run a not-supported combination — get_quality_score on Meta
curl -X POST http://127.0.0.1:3001/mcp -H "X-Api-Key: $KEY" -H "Content-Type: application/json" \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"get_quality_score","arguments":{"platform":"meta","dateRange":"last_7_days"}}}'
# → {"error":"unsupported_platform","platform":"meta"}
 
# 8. Simulate a revoked token: in Meta's UI, revoke the app's access for the tenant's user.
# Wait until the long-lived token would refresh, or force-clear tokenExpiresAt:
psql "..." -c "UPDATE platform_credentials SET token_expires_at = now() - interval '1 day' WHERE platform='meta';"
curl -X POST http://127.0.0.1:3001/mcp -H "X-Api-Key: $KEY" -H "Content-Type: application/json" \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"get_account_health","arguments":{"platform":"meta","dateRange":"last_7_days"}}}'
# → {"error":"token_revoked","platform":"meta"} + audit row mcp.tool_failed code:token_revoked
 
# 9. GDPR erasure
curl -i -X DELETE -H "x-admin-token: $ADMIN_TOKEN" http://127.0.0.1:3001/admin/tenants/$TENANT_ID
# → HTTP/1.1 204 No Content
psql "..." -c "SELECT count(*) FROM tenants WHERE id='$TENANT_ID';"               # → 0
psql "..." -c "SELECT count(*) FROM platform_credentials WHERE tenant_id='$TENANT_ID';"  # → 0
psql "..." -c "SELECT count(*) FROM tenant_deks WHERE tenant_id='$TENANT_ID';"   # → 0
psql "..." -c "SELECT count(*) FROM audit_log WHERE tenant_id='$TENANT_ID';"     # → 0
psql "..." -c "SELECT count(*) FROM audit_log WHERE tenant_id IS NULL;"          # → many (anonymised rows)
 
# 10. Confirm the deleted tenant's API key no longer authenticates
curl -X POST http://127.0.0.1:3001/mcp -H "X-Api-Key: $KEY" -H "Content-Type: application/json" \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"ping","arguments":{}}}'
# → 401