refactor(core,objectql): ask main's one ban predicate instead of a second copy

#30287 landed isUserBanInForce and USER_BAN_FIELDS in security/user-ban.ts
while this branch carried its own; the hand-over and the reference check now
read that one, so a ban means one thing at every door.

Claude-Session: https://claude.ai/code/session_01Utp6CZavYYLh5k5r6jhgCF
Co-authored-by: Claude <noreply@anthropic.com>

Author: claude

packages/core/src/security/index.ts

@@ -544,7 +544,6 @@ export {
   USER_ASSIGNED_WORK_FIELD_CAP,
   USER_WORK_TRANSFER_ROW_CAP,
   USER_WORK_FAILURE_SAMPLE,
-  isUserBanInForce,
   userAssignedWorkFields,
   countUserAssignedWork,
   transferUserAssignedWork,

packages/core/src/security/user-assigned-work.test.ts

@@ -4,36 +4,12 @@ import { describe, it, expect } from 'vitest';
 import { assertEngineUpdateDispatch } from '@objectstack/metadata-core';
 import {
   countUserAssignedWork,
-  isUserBanInForce,
   transferUserAssignedWork,
   userAssignedWorkFields,
   UserWorkTransferRefusal,
   type UserWorkEngine,
 } from './user-assigned-work.js';
 
-const NOW = Date.parse('2026-11-05T12:00:00Z');
-
-describe('[#30205] isUserBanInForce', () => {
-  it('a ban with no expiry, or one still ahead, is in force', () => {
-    expect(isUserBanInForce({ banned: true }, NOW)).toBe(true);
-    expect(isUserBanInForce({ banned: true, ban_expires: null }, NOW)).toBe(true);
-    expect(isUserBanInForce({ banned: true, ban_expires: '2026-11-06T00:00:00Z' }, NOW)).toBe(true);
-    expect(isUserBanInForce({ banned: true, ban_expires: new Date(NOW + 1000) }, NOW)).toBe(true);
-  });
-
-  it('an expired ban, an unbanned user and a non-row are not', () => {
-    expect(isUserBanInForce({ banned: true, ban_expires: '2026-11-04T00:00:00Z' }, NOW)).toBe(false);
-    expect(isUserBanInForce({ banned: false }, NOW)).toBe(false);
-    expect(isUserBanInForce({ banned: null }, NOW)).toBe(false);
-    expect(isUserBanInForce({}, NOW)).toBe(false);
-    expect(isUserBanInForce(null, NOW)).toBe(false);
-  });
-
-  it('an expiry that does not parse cannot prove the ban lifted', () => {
-    expect(isUserBanInForce({ banned: true, ban_expires: 'not a date' }, NOW)).toBe(true);
-  });
-});
-
 const ticket = {
   name: 'ticket',
   fields: {

packages/core/src/security/user-assigned-work.ts

@@ -51,6 +51,7 @@
  */
 
 import { referenceTargetOf, unprovisionedInjectedColumns } from '@objectstack/spec/data';
+import { isUserBanInForce, USER_BAN_FIELDS } from './user-ban.js';
 
 /** The platform user object every user reference targets. */
 const USER_OBJECT = 'sys_user';
@@ -64,26 +65,6 @@ export const USER_WORK_TRANSFER_ROW_CAP = 500;
 /** At most this many failed rows are described per (object, field) pair. */
 export const USER_WORK_FAILURE_SAMPLE = 10;
 
-/**
- * Is this user row's ban in force?
- *
- * `banned` is `true` and the ban has no expiry, or one still in the future.
- * better-auth leaves `banned` true past `ban_expires` until the user's next
- * sign-in clears it, and such a user CAN sign in again, so an expired ban is
- * not in force. A row that is not an object, or has no `banned: true`, is not
- * banned.
- */
-export function isUserBanInForce(row: unknown, now: number = Date.now()): boolean {
-  if (!row || typeof row !== 'object') return false;
-  const { banned, ban_expires: expires } = row as { banned?: unknown; ban_expires?: unknown };
-  if (banned !== true) return false;
-  if (expires === null || expires === undefined || expires === '') return true;
-  const at = expires instanceof Date ? expires.getTime() : new Date(expires as string | number).getTime();
-  // An expiry that does not parse cannot prove the ban lifted.
-  if (Number.isNaN(at)) return true;
-  return at > now;
-}
-
 /** One user reference a record can hold work through. */
 export interface UserAssignedWorkField {
   object: string;
@@ -283,7 +264,7 @@ export async function transferUserAssignedWork(
   const elevated = { ...((context as object | undefined) ?? {}), isSystem: true };
   const [target] = await engine.find(USER_OBJECT, {
     where: { id: toUserId },
-    fields: ['id', 'banned', 'ban_expires'],
+    fields: [...USER_BAN_FIELDS],
     limit: 1,
     context: elevated,
   });

packages/objectql/src/engine-referential-integrity.ts

@@ -52,7 +52,7 @@
 
 import { referenceTargetOf, type EngineQueryOptions } from '@objectstack/spec/data';
 import type { ExecutionContext } from '@objectstack/spec/kernel';
-import { isUserBanInForce, keepsFlowWriteReferenceCheck } from '@objectstack/core';
+import { isUserBanInForce, keepsFlowWriteReferenceCheck, USER_BAN_FIELDS } from '@objectstack/core';
 import { ValidationError, buildFieldError } from './validation/record-validator.js';
 import type { ObjectQL } from './engine.js';
 
@@ -328,7 +328,7 @@ async function bannedUserIds(
   try {
     const rows = await this.find(BAN_CHECKED_USER_OBJECT, {
       where: { id: asked.length === 1 ? asked[0] : { $in: asked } },
-      fields: ['id', 'banned', 'ban_expires'],
+      fields: [...USER_BAN_FIELDS],
       context: { ...(context ?? {}), isSystem: true } as ExecutionContext,
     } as EngineQueryOptions) as Array<Record<string, unknown>>;
     const banned = new Set<string>();