From f3748b4c340a275614bc1c6dac182f330f926852 Mon Sep 17 00:00:00 2001
From: SirLouen <sir.louen@gmail.com>
Date: Wed, 14 Oct 2026 07:22:26 +0200
Subject: [PATCH 1/4] feat(gonsole/auth/sqlite): require gonsole/auth 0.8.0

---
 gonsole/auth/sqlite/CHANGELOG.md |  6 ++++++
 gonsole/auth/sqlite/go.mod       |  8 +-------
 gonsole/auth/sqlite/go.sum       | 28 ++--------------------------
 3 files changed, 9 insertions(+), 33 deletions(-)

diff --git a/gonsole/auth/sqlite/CHANGELOG.md b/gonsole/auth/sqlite/CHANGELOG.md
index 2594b8a..c2211a7 100644
--- a/gonsole/auth/sqlite/CHANGELOG.md
+++ b/gonsole/auth/sqlite/CHANGELOG.md
@@ -8,6 +8,12 @@ v0.x, minor releases may contain breaking changes.
 
 Releases of this module are tagged `gonsole/auth/sqlite/vX.Y.Z`.
 
+## [Unreleased]
+
+### Changed
+
+- **Breaking.** Requires `gonsole/auth` 0.8.0, so the module no longer requires pgx or `authkit/postgres`.
+
 ## [0.1.0] - 2026-10-12
 
 ### Added
diff --git a/gonsole/auth/sqlite/go.mod b/gonsole/auth/sqlite/go.mod
index 8072aeb..660fe77 100644
--- a/gonsole/auth/sqlite/go.mod
+++ b/gonsole/auth/sqlite/go.mod
@@ -6,7 +6,7 @@ require (
 	github.com/gopherium/framework/dbkit v0.2.0
 	github.com/gopherium/framework/dbkit/sqlite v0.1.0
 	github.com/gopherium/framework/gonsole v0.7.0
-	github.com/gopherium/framework/gonsole/auth v0.7.0
+	github.com/gopherium/framework/gonsole/auth v0.8.0
 	github.com/gopherium/gouncer v0.4.0
 	github.com/gopherium/gouncer/authkit/sqlite v0.1.0
 )
@@ -15,11 +15,6 @@ require (
 	github.com/dustin/go-humanize v1.0.1 // indirect
 	github.com/google/uuid v1.6.0 // indirect
 	github.com/gopherium/gouncer/authkit v0.19.0 // indirect
-	github.com/gopherium/gouncer/authkit/postgres v0.13.0 // indirect
-	github.com/jackc/pgpassfile v1.0.0 // indirect
-	github.com/jackc/pgservicefile v0.0.0-20240606120523-5a60cdf6a761 // indirect
-	github.com/jackc/pgx/v5 v5.10.0 // indirect
-	github.com/jackc/puddle/v2 v2.2.2 // indirect
 	github.com/mattn/go-isatty v0.0.24 // indirect
 	github.com/mfridman/interpolate v0.0.2 // indirect
 	github.com/ncruces/go-strftime v1.0.0 // indirect
@@ -30,7 +25,6 @@ require (
 	golang.org/x/crypto v0.54.0 // indirect
 	golang.org/x/sync v0.23.0 // indirect
 	golang.org/x/sys v0.48.0 // indirect
-	golang.org/x/text v0.41.0 // indirect
 	modernc.org/libc v1.77.1 // indirect
 	modernc.org/mathutil v1.7.1 // indirect
 	modernc.org/memory v1.12.1 // indirect
diff --git a/gonsole/auth/sqlite/go.sum b/gonsole/auth/sqlite/go.sum
index 4c8da0b..bb8a445 100644
--- a/gonsole/auth/sqlite/go.sum
+++ b/gonsole/auth/sqlite/go.sum
@@ -1,10 +1,7 @@
-github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/dustin/go-humanize v1.0.1 h1:GzkhY7T5VNhEkwH0PVJgjz+fX1rhBrR7pRT3mDkpeCY=
 github.com/dustin/go-humanize v1.0.1/go.mod h1:Mu1zIs6XwVuF/gI1OepvI0qD18qycQx+mFykh5fBlto=
-github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
-github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU=
 github.com/google/pprof v0.0.0-20260802141513-ef3492d7dac3 h1:LMLX+LgTNWpfvCBdFebv6EsYotImrt/Ppc5cXIriCSo=
 github.com/google/pprof v0.0.0-20260802141513-ef3492d7dac3/go.mod h1:jl5iWTm0/hd5PjEYEOuwAJ57L/CibdZfrqZ5XA5GrCk=
 github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
@@ -15,36 +12,22 @@ github.com/gopherium/framework/dbkit/sqlite v0.1.0 h1:NmfcEuhlV5/SpqqZHHeN1qtA6F
 github.com/gopherium/framework/dbkit/sqlite v0.1.0/go.mod h1:43gIZC9JkU/PeAvKLVjEubbe6TOz+1rjIANf615QEOI=
 github.com/gopherium/framework/gonsole v0.7.0 h1:JluS72WcE6LXcBihJB+5zdhX7IUiLZxv0g059z8T3/U=
 github.com/gopherium/framework/gonsole v0.7.0/go.mod h1:6ZLlrT2q5W8Pk2BrD7WgorL6b68nx2n2OX1Rg8FKwAo=
-github.com/gopherium/framework/gonsole/auth v0.7.0 h1:e1s0LJlLK2zPmrzexzMix7pkiTIXqRe0bd83MzYsRiE=
-github.com/gopherium/framework/gonsole/auth v0.7.0/go.mod h1:t9PxTMk18NqcoXgxokdUQnOvNPYfcW2HXVjx8fPxei0=
+github.com/gopherium/framework/gonsole/auth v0.8.0 h1:WddQbi5eRQs98tTR8qx2bLg8clDeW99Kz6mM1T03pvQ=
+github.com/gopherium/framework/gonsole/auth v0.8.0/go.mod h1:Lms8wUhRpxvQd3M8kv1tpMS9Pox0Qh/M+1j4HjLq8PE=
 github.com/gopherium/gouncer v0.4.0 h1:dkbCD5oeYuuzR961UKGsAvnTvF8vTstlFbN94rP4TvI=
 github.com/gopherium/gouncer v0.4.0/go.mod h1:WwPOu8LyRikot0EODySSu46zaHcWTPbl5nOes4I3H2U=
 github.com/gopherium/gouncer/authkit v0.19.0 h1:4TPPakAHNmqG0H+7c62YomNgDfd7uRbuccIXvbdutKc=
 github.com/gopherium/gouncer/authkit v0.19.0/go.mod h1:oJP/pk0xnXA4HhOlFoqm4lh9ulScCUbgGeLFrquZ6g8=
-github.com/gopherium/gouncer/authkit/postgres v0.13.0 h1:9uN7xZirufk0osM/LxMj0K1L8ZZ5MrUBsSFze/SuurA=
-github.com/gopherium/gouncer/authkit/postgres v0.13.0/go.mod h1:wnA/EmvSqV3w8n3L4EYTejY1bnYjP7Cd7O+sRtf9bkw=
 github.com/gopherium/gouncer/authkit/sqlite v0.1.0 h1:pyPOkXVy5CzYR+tTkqL/6FuVcwBKf9FXCZe2XDcgwl0=
 github.com/gopherium/gouncer/authkit/sqlite v0.1.0/go.mod h1:Rd+jedhpfi4GaQ34RrdmlqQgIvVB4FHN4ftGCAa+gfs=
 github.com/hashicorp/golang-lru/v2 v2.0.7 h1:a+bsQ5rvGLjzHuww6tVxozPZFVghXaHOwFs4luLUK2k=
 github.com/hashicorp/golang-lru/v2 v2.0.7/go.mod h1:QeFd9opnmA6QUJc5vARoKUSoFhyfM2/ZepoAG6RGpeM=
-github.com/jackc/pgpassfile v1.0.0 h1:/6Hmqy13Ss2zCq62VdNG8tM1wchn8zjSGOBJ6icpsIM=
-github.com/jackc/pgpassfile v1.0.0/go.mod h1:CEx0iS5ambNFdcRtxPj5JhEz+xB6uRky5eyVu/W2HEg=
-github.com/jackc/pgservicefile v0.0.0-20240606120523-5a60cdf6a761 h1:iCEnooe7UlwOQYpKFhBabPMi4aNAfoODPEFNiAnClxo=
-github.com/jackc/pgservicefile v0.0.0-20240606120523-5a60cdf6a761/go.mod h1:5TJZWKEWniPve33vlWYSoGYefn3gLQRzjfDlhSJ9ZKM=
-github.com/jackc/pgx/v5 v5.10.0 h1:VhSvgU2jSli8o3AqIEOTJr7rZwAEUVo4E4XhR94Zfr0=
-github.com/jackc/pgx/v5 v5.10.0/go.mod h1:mal1tBGAFfLHvZzaYh77YS/eC6IX9OWbRV1QIIM0Jn4=
-github.com/jackc/puddle/v2 v2.2.2 h1:PR8nw+E/1w0GLuRFSmiioY6UooMp6KJv0/61nB7icHo=
-github.com/jackc/puddle/v2 v2.2.2/go.mod h1:vriiEXHvEE654aYKXXjOvZM39qJ0q+azkZFrfEOc3H4=
 github.com/mattn/go-isatty v0.0.24 h1:tGZZoVgT/KiqK1c8ocVLeDS8BSWMRd47J3Lbz7vsReI=
 github.com/mattn/go-isatty v0.0.24/go.mod h1:nMCL3Zebbrt45jsMDgnfIwz6ydEQApk5oEI3HqDio6A=
 github.com/mfridman/interpolate v0.0.2 h1:pnuTK7MQIxxFz1Gr+rjSIx9u7qVjf5VOoM/u6BbAxPY=
 github.com/mfridman/interpolate v0.0.2/go.mod h1:p+7uk6oE07mpE/Ik1b8EckO0O4ZXiGAfshKBWLUM9Xg=
 github.com/ncruces/go-strftime v1.0.0 h1:HMFp8mLCTPp341M/ZnA4qaf7ZlsbTc+miZjCLOFAw7w=
 github.com/ncruces/go-strftime v1.0.0/go.mod h1:Fwc5htZGVVkseilnfgOVb9mKy6w1naJmn9CehxcKcls=
-github.com/pashagolub/pgxmock/v4 v4.9.0 h1:itlO8nrVRnzkdMBXLs8pWUyyB2PC3Gku0WGIj/gGl7I=
-github.com/pashagolub/pgxmock/v4 v4.9.0/go.mod h1:9L57pC193h2aKRHVyiiE817avasIPZnPwPlw3JczWvM=
-github.com/peterldowns/pgtestdb v0.1.1 h1:+hBCD1DcbKeg5Sfg0G+5WNIy/Cm0ORgwMkF4ygihrmU=
-github.com/peterldowns/pgtestdb v0.1.1/go.mod h1:yVWInWV0dxvmLdL2ao3nXDzWZ9+G6EhJ4gRwvI1Ozeg=
 github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
 github.com/pressly/goose/v3 v3.27.2 h1:FjKNzcmMdGrQlSIu5alMSmakQtJFBgtw+A0bb1p/LC8=
@@ -53,9 +36,6 @@ github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec h1:W09IVJc94
 github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec/go.mod h1:qqbHyh8v60DhA7CoWK5oRCqLrMHRGoxYCSS9EjAz6Eo=
 github.com/sethvargo/go-retry v0.3.0 h1:EEt31A35QhrcRZtrYFDTBg91cqZVnFL2navjDrah2SE=
 github.com/sethvargo/go-retry v0.3.0/go.mod h1:mNX17F0C/HguQMyMyJxcnU471gOZGxCLyYaFyAZraas=
-github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
-github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI=
-github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
 github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U=
 github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=
 go.uber.org/multierr v1.11.0 h1:blXXJkSxSSfBVBlC76pxqeO+LN3aDfLQo+309xJstO0=
@@ -68,12 +48,8 @@ golang.org/x/sync v0.23.0 h1:KameEIfc1IkluZyXWLn39Wd4tURc6GbCiISGiZm2bQk=
 golang.org/x/sync v0.23.0/go.mod h1:sUUOizhqBxiL6pEWpqNLUiaJn1ShEbZ6BBqskPbjZm0=
 golang.org/x/sys v0.48.0 h1:bbX/i/6MgT9BVLM9RT1thmxL04yeTAhbEz4SyadbXoo=
 golang.org/x/sys v0.48.0/go.mod h1:hNLxWAXmnKAxqDtdwIYC4bM9oQPEecfsnNMuSxOs3og=
-golang.org/x/text v0.41.0 h1:vz/seA0lnX87Othu2f/0L24RcgrXD9/YFTSuGjj3rH8=
-golang.org/x/text v0.41.0/go.mod h1:jvf1O8ajNzZqhSrQBPbutR/EB83Cc0CFrezNQIwbb5M=
 golang.org/x/tools v0.50.0 h1:c2ifzfcuY7L90lZ2aKd8S4K2NpASF08SZx9ZuJkHmSU=
 golang.org/x/tools v0.50.0/go.mod h1:7ulVMw3831Mwi5EZD6RomGyffr4VFjuNYXf2BbCEAV0=
-gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
-gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
 gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
 gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
 modernc.org/cc/v4 v4.29.7 h1:q+NXGJ0bK3b4TXFYQQVr9pYETGnmwFWkrUzJnMya/Tg=

From de9344cd5ff88ffc9ebda9d34329a79045a25f0c Mon Sep 17 00:00:00 2001
From: SirLouen <sir.louen@gmail.com>
Date: Wed, 14 Oct 2026 07:22:27 +0200
Subject: [PATCH 2/4] feat(gonsole/auth/postgres): require gonsole/auth 0.8.0
 and answer record times in UTC

---
 gonsole/auth/postgres/CHANGELOG.md    | 10 ++++
 gonsole/auth/postgres/go.mod          |  2 +-
 gonsole/auth/postgres/go.sum          |  4 +-
 gonsole/auth/postgres/lineage_test.go | 67 --------------------------
 gonsole/auth/postgres/parity_test.go  | 68 ---------------------------
 gonsole/auth/postgres/program_test.go | 25 +++-------
 gonsole/auth/postgres/record_test.go  | 34 ++++++++++++++
 gonsole/auth/postgres/records.go      |  3 +-
 gonsole/auth/postgres/records_test.go | 30 ++++++++++++
 9 files changed, 86 insertions(+), 157 deletions(-)
 delete mode 100644 gonsole/auth/postgres/lineage_test.go
 delete mode 100644 gonsole/auth/postgres/parity_test.go

diff --git a/gonsole/auth/postgres/CHANGELOG.md b/gonsole/auth/postgres/CHANGELOG.md
index 9d32b3e..e37e77e 100644
--- a/gonsole/auth/postgres/CHANGELOG.md
+++ b/gonsole/auth/postgres/CHANGELOG.md
@@ -8,6 +8,16 @@ v0.x, minor releases may contain breaking changes.
 
 Releases of this module are tagged `gonsole/auth/postgres/vX.Y.Z`.
 
+## [Unreleased]
+
+### Changed
+
+- **Breaking.** Requires `gonsole/auth` 0.8.0.
+
+### Fixed
+
+- The record store answers each record's time in UTC, so `account:records -json` prints a UTC time, as on SQLite.
+
 ## [0.1.0] - 2026-10-12
 
 ### Added
diff --git a/gonsole/auth/postgres/go.mod b/gonsole/auth/postgres/go.mod
index c86f8c3..3a65104 100644
--- a/gonsole/auth/postgres/go.mod
+++ b/gonsole/auth/postgres/go.mod
@@ -6,7 +6,7 @@ require (
 	github.com/gopherium/framework/dbkit v0.1.0
 	github.com/gopherium/framework/dbkit/postgres v0.3.0
 	github.com/gopherium/framework/gonsole v0.6.1
-	github.com/gopherium/framework/gonsole/auth v0.7.0
+	github.com/gopherium/framework/gonsole/auth v0.8.0
 	github.com/gopherium/gouncer v0.4.0
 	github.com/gopherium/gouncer/authkit/postgres v0.13.0
 	github.com/jackc/pgx/v5 v5.10.0
diff --git a/gonsole/auth/postgres/go.sum b/gonsole/auth/postgres/go.sum
index a884cda..55989b2 100644
--- a/gonsole/auth/postgres/go.sum
+++ b/gonsole/auth/postgres/go.sum
@@ -13,8 +13,8 @@ github.com/gopherium/framework/dbkit/postgres v0.3.0 h1:W9SoXXu9Y3YRum5vIG10iBHl
 github.com/gopherium/framework/dbkit/postgres v0.3.0/go.mod h1:ZUsvp2lOkhX+08sstBErt+jN6FM5HkhxV7hXgToRd+A=
 github.com/gopherium/framework/gonsole v0.6.1 h1:yi0te8BDJLuotbrd24bQDMWSJ0KgIhSIAfOjF0jpDnQ=
 github.com/gopherium/framework/gonsole v0.6.1/go.mod h1:n0aJzbwPGPryrWKZ8WzDVub+6R+GUBzeHSzvhMvZR64=
-github.com/gopherium/framework/gonsole/auth v0.7.0 h1:e1s0LJlLK2zPmrzexzMix7pkiTIXqRe0bd83MzYsRiE=
-github.com/gopherium/framework/gonsole/auth v0.7.0/go.mod h1:t9PxTMk18NqcoXgxokdUQnOvNPYfcW2HXVjx8fPxei0=
+github.com/gopherium/framework/gonsole/auth v0.8.0 h1:WddQbi5eRQs98tTR8qx2bLg8clDeW99Kz6mM1T03pvQ=
+github.com/gopherium/framework/gonsole/auth v0.8.0/go.mod h1:Lms8wUhRpxvQd3M8kv1tpMS9Pox0Qh/M+1j4HjLq8PE=
 github.com/gopherium/gouncer v0.4.0 h1:dkbCD5oeYuuzR961UKGsAvnTvF8vTstlFbN94rP4TvI=
 github.com/gopherium/gouncer v0.4.0/go.mod h1:WwPOu8LyRikot0EODySSu46zaHcWTPbl5nOes4I3H2U=
 github.com/gopherium/gouncer/authkit v0.19.0 h1:4TPPakAHNmqG0H+7c62YomNgDfd7uRbuccIXvbdutKc=
diff --git a/gonsole/auth/postgres/lineage_test.go b/gonsole/auth/postgres/lineage_test.go
deleted file mode 100644
index 3d9efbb..0000000
--- a/gonsole/auth/postgres/lineage_test.go
+++ /dev/null
@@ -1,67 +0,0 @@
-// SPDX-License-Identifier: Apache-2.0
-
-package postgres_test
-
-import (
-	"context"
-	"testing"
-
-	"github.com/gopherium/framework/gonsole"
-	"github.com/gopherium/framework/gonsole/auth"
-)
-
-const (
-	// versionsLookup lists the applied versions of both version tables on one line.
-	versionsLookup = "SELECT (SELECT string_agg(version_id || ':' || is_applied, ',' ORDER BY id) " +
-		"FROM auth.goose_db_version) || ' ' || (SELECT string_agg(version_id || ':' || is_applied, ',' ORDER BY id) " +
-		"FROM gonsole.goose_db_version)"
-	// plantRecord stores one record past every record store.
-	plantRecord = "INSERT INTO gonsole.records (id, actor, command, args, flags) VALUES " +
-		"('019a0000-0000-7000-8000-000000000001', 'admin@example.com', 'account:disable', '[]', '{}')"
-	// oneRecord answers whether gonsole.records holds exactly one row.
-	oneRecord = "SELECT count(*) = 1 FROM gonsole.records"
-)
-
-// text returns the single text lookup answers on db.
-func (db testDB) text(lookup string) string {
-	db.t.Helper()
-	conn := db.dial()
-	defer func() { _ = conn.Close(context.Background()) }()
-	var value string
-	if err := conn.QueryRow(db.t.Context(), lookup).Scan(&value); err != nil {
-		db.t.Fatalf("%s: %v", lookup, err)
-	}
-	return value
-}
-
-func TestAProgramThatSwitchesStepsAppliesNothingTwice(t *testing.T) {
-	t.Parallel()
-
-	core := []gonsole.Step{auth.Migration(), auth.RecordMigration()}
-	for _, tc := range []struct {
-		name   string
-		first  []gonsole.Step
-		second []gonsole.Step
-	}{
-		{"from gonsole/auth to the module", core, steps()},
-		{"from the module to gonsole/auth", steps(), core},
-	} {
-		t.Run(tc.name, func(t *testing.T) {
-			t.Parallel()
-
-			db := empty(t)
-			db.apply(tc.first...)
-			db.run(plantRecord)
-			before := db.text(versionsLookup)
-
-			db.apply(tc.second...)
-
-			if after := db.text(versionsLookup); after != before {
-				t.Errorf("the version tables read %q after the other steps, want %q as before", after, before)
-			}
-			if !db.found(oneRecord) {
-				t.Error("the planted record is gone after the other steps, want it kept")
-			}
-		})
-	}
-}
diff --git a/gonsole/auth/postgres/parity_test.go b/gonsole/auth/postgres/parity_test.go
deleted file mode 100644
index a8766f4..0000000
--- a/gonsole/auth/postgres/parity_test.go
+++ /dev/null
@@ -1,68 +0,0 @@
-// SPDX-License-Identifier: Apache-2.0
-
-package postgres_test
-
-import (
-	"regexp"
-	"testing"
-
-	"github.com/gopherium/framework/gonsole/auth"
-	"github.com/gopherium/framework/gonsole/testkit"
-)
-
-var (
-	// stamps matches the times a line prints.
-	stamps = regexp.MustCompile(`\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(\.\d+)?(Z|[+-]\d{2}:\d{2})`)
-	// ids matches the UUIDs a line prints.
-	ids = regexp.MustCompile(`[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}`)
-)
-
-// answer is what one line answered, its times and ids cut.
-type answer struct {
-	// code is the exit code.
-	code int
-	// stdout is what the line printed.
-	stdout string
-	// stderr is what the line printed as failure.
-	stderr string
-}
-
-// cut returns the answer of result with each time and id replaced by a placeholder.
-func cut(result testkit.Result) answer {
-	clean := func(text string) string { return ids.ReplaceAllString(stamps.ReplaceAllString(text, "<time>"), "<id>") }
-	return answer{code: result.Code, stdout: clean(result.Stdout), stderr: clean(result.Stderr)}
-}
-
-func TestEveryLineAnswersAsGonsoleAuthDoesWithNoStoresBuilder(t *testing.T) {
-	t.Parallel()
-
-	core := program(empty(t).address, testConfig(nil), auth.Migration(), auth.RecordMigration())
-	module := moduleProgram(empty(t))
-	asAdmin := []string{"-yes", "-as", "admin@example.com"}
-
-	for _, line := range []struct {
-		stdin string
-		args  []string
-	}{
-		{"", []string{"migrate"}},
-		{demoPassword + "\n", []string{"account:create-admin", "-email", "admin@example.com", "-name", "Maria Perez",
-			"-role", "admin"}},
-		{demoPassword + "\n", []string{"account:create-admin", "-email", "author@example.com", "-name", "Maria Perez",
-			"-role", "author"}},
-		{"", append([]string{"account:grant-role", "-role", "editor"}, asAdmin...)},
-		{"", []string{"account:list"}},
-		{"", append([]string{"account:role", "author@example.com", "editor"}, asAdmin...)},
-		{"", append([]string{"account:disable", "author@example.com"}, asAdmin...)},
-		{"", []string{"account:role", "admin@example.com", "editor", "-yes", "-as", "author@example.com"}},
-		{"", []string{"account:records"}},
-		{"", []string{"account:records", "-json"}},
-	} {
-		want := cut(testkit.Run(t, core, line.stdin, line.args...))
-
-		got := cut(testkit.Run(t, module, line.stdin, line.args...))
-
-		if got != want {
-			t.Errorf("%v answers %+v through the module, want %+v as gonsole/auth answers", line.args, got, want)
-		}
-	}
-}
diff --git a/gonsole/auth/postgres/program_test.go b/gonsole/auth/postgres/program_test.go
index d132335..bb8dcd4 100644
--- a/gonsole/auth/postgres/program_test.go
+++ b/gonsole/auth/postgres/program_test.go
@@ -22,35 +22,24 @@ var vocabulary = auth.Roles{
 	Capabilities: map[string][]string{"admin": {"manage_users"}},
 }
 
-// storesBuilder builds the stores of one call, as auth.Config.Stores does.
-type storesBuilder = func(ctx context.Context, call gonsole.Call) (auth.Stores, func(context.Context) error, error)
-
-// testConfig returns the account commands' configuration on the stores build makes, nil for gonsole/auth's own.
-func testConfig(build storesBuilder) auth.Config {
-	return auth.Config{
+// moduleProgram returns a program called myapp over db that runs on the module's stores and schema steps.
+func moduleProgram(db testDB) gonsole.Program {
+	cfg := auth.Config{
 		Roles:      func(context.Context, gonsole.Call) (auth.Roles, error) { return vocabulary, nil },
-		Capability: "manage_users", RecordTimeout: 5 * time.Second, RecordsLimit: 10, Stores: build,
+		Capability: "manage_users", RecordTimeout: 5 * time.Second, RecordsLimit: 10, Stores: postgres.Stores,
 	}
-}
-
-// program returns a program called myapp over the database at address, configured by cfg, with migrations.
-func program(address string, cfg auth.Config, migrations ...gonsole.Step) gonsole.Program {
+	settings := map[string]string{"MYAPP_DATABASE_URL": db.address}
 	return gonsole.Program{
 		Name:       "myapp",
-		Env:        gonsole.Env{Prefix: "MYAPP_", Getenv: testkit.Getenv(map[string]string{"MYAPP_DATABASE_URL": address})},
+		Env:        gonsole.Env{Prefix: "MYAPP_", Getenv: testkit.Getenv(settings)},
 		Database:   "DATABASE_URL",
-		Migrations: migrations,
+		Migrations: steps(),
 		Commands:   append(auth.Commands(cfg), auth.Records(cfg)),
 		Authorize:  auth.Authorize(cfg),
 		Record:     auth.Record(cfg),
 	}
 }
 
-// moduleProgram returns the program over db that runs on the module's stores and schema steps.
-func moduleProgram(db testDB) gonsole.Program {
-	return program(db.address, testConfig(postgres.Stores), steps()...)
-}
-
 // wantPrinted fails t unless out, which command printed, names every part.
 func wantPrinted(t *testing.T, command, out string, parts ...string) {
 	t.Helper()
diff --git a/gonsole/auth/postgres/record_test.go b/gonsole/auth/postgres/record_test.go
index 707e3d1..173605f 100644
--- a/gonsole/auth/postgres/record_test.go
+++ b/gonsole/auth/postgres/record_test.go
@@ -4,6 +4,7 @@ package postgres_test
 
 import (
 	"context"
+	"encoding/json"
 	"fmt"
 	"io"
 	"strings"
@@ -77,3 +78,36 @@ func TestRecordEndsAtItsTimeout(t *testing.T) {
 		t.Fatalf("the record outlived its timeout of 200ms by %v, want it to end at the timeout", recordBound)
 	}
 }
+
+func TestAccountRecordsListsTheRecordInTextAndInUTCJSON(t *testing.T) {
+	t.Parallel()
+
+	db := seeded(t)
+	applied := testkit.Run(t, moduleProgram(db), "", "account:role", "author@example.com", "editor", "-yes",
+		"-as", "admin@example.com")
+	if applied.Code != gonsole.ExitDone {
+		t.Fatalf("account:role = %d with %q, want %d", applied.Code, applied.Stderr, gonsole.ExitDone)
+	}
+
+	listed := testkit.Run(t, moduleProgram(db), "", "account:records")
+	asJSON := testkit.Run(t, moduleProgram(db), "", "account:records", "-json")
+
+	var document struct {
+		Records []struct {
+			AppliedAt string `json:"applied_at"`
+			Actor     string `json:"actor"`
+			Command   string `json:"command"`
+		} `json:"records"`
+	}
+	if err := json.Unmarshal([]byte(asJSON.Stdout), &document); err != nil || len(document.Records) != 1 {
+		t.Fatalf("account:records -json printed %q, %v, want one record", asJSON.Stdout, err)
+	}
+	wantPrinted(t, "account:records", listed.Stdout, "admin@example.com", "account:role")
+	first := document.Records[0]
+	if first.Actor != "admin@example.com" || first.Command != "account:role" {
+		t.Errorf("account:records -json printed %+v, want the admin's role change", first)
+	}
+	if !strings.HasSuffix(first.AppliedAt, "Z") {
+		t.Errorf("account:records -json printed the time %q, want a UTC time", first.AppliedAt)
+	}
+}
diff --git a/gonsole/auth/postgres/records.go b/gonsole/auth/postgres/records.go
index 41b62db..bae8f4b 100644
--- a/gonsole/auth/postgres/records.go
+++ b/gonsole/auth/postgres/records.go
@@ -66,11 +66,12 @@ func (r recordStore) Latest(ctx context.Context, limit int) ([]auth.Entry, error
 	return held, nil
 }
 
-// scanned returns the entry of row, its arguments and flags decoded from their JSON.
+// scanned returns the entry of row in UTC, its arguments and flags decoded from their JSON.
 func scanned(row pgx.CollectableRow) (auth.Entry, error) {
 	var entry auth.Entry
 	err := row.Scan(&entry.ID, &entry.AppliedAt, &entry.Actor, &entry.AccountID, &entry.Command, &entry.Args,
 		&entry.Flags)
+	entry.AppliedAt = entry.AppliedAt.UTC()
 	return entry, err
 }
 
diff --git a/gonsole/auth/postgres/records_test.go b/gonsole/auth/postgres/records_test.go
index dc4efab..54a117a 100644
--- a/gonsole/auth/postgres/records_test.go
+++ b/gonsole/auth/postgres/records_test.go
@@ -3,8 +3,10 @@
 package postgres_test
 
 import (
+	"context"
 	"fmt"
 	"testing"
+	"time"
 
 	"github.com/gopherium/framework/gonsole/auth"
 	"github.com/gopherium/framework/gonsole/auth/postgres"
@@ -19,6 +21,18 @@ func roleChange() auth.Entry {
 		Args: []string{"maria@example.com", "editor"}, Flags: map[string]string{"yes": "true"}}
 }
 
+// text returns the single text lookup answers on db.
+func (db testDB) text(lookup string) string {
+	db.t.Helper()
+	conn := db.dial()
+	defer func() { _ = conn.Close(context.Background()) }()
+	var value string
+	if err := conn.QueryRow(db.t.Context(), lookup).Scan(&value); err != nil {
+		db.t.Fatalf("%s: %v", lookup, err)
+	}
+	return value
+}
+
 // mustInsert inserts entry through store and fails t when it errs.
 func mustInsert(t *testing.T, store auth.RecordStore, entry auth.Entry) {
 	t.Helper()
@@ -43,6 +57,22 @@ func TestALimitBelowZeroListsNoRecords(t *testing.T) {
 	}
 }
 
+func TestLatestAnswersEachTimeInUTC(t *testing.T) {
+	t.Parallel()
+
+	store := postgres.NewRecordStore(recorded(t).pool())
+	mustInsert(t, store, roleChange())
+
+	listed, err := store.Latest(t.Context(), 10)
+
+	if err != nil || len(listed) != 1 {
+		t.Fatalf("Latest() = %v, %v, want the one record", listed, err)
+	}
+	if at := listed[0].AppliedAt; at.Location() != time.UTC {
+		t.Errorf("Latest() answers the time %v in %v, want UTC", at, at.Location())
+	}
+}
+
 func TestARecordKeepsTheServersTimeOfItsInsert(t *testing.T) {
 	t.Parallel()
 

From c9ee6957bf717d38fbaadef33b583ed1f6e38f02 Mon Sep 17 00:00:00 2001
From: SirLouen <sir.louen@gmail.com>
Date: Wed, 14 Oct 2026 07:22:27 +0200
Subject: [PATCH 3/4] test(gonsole/auth/postgres): check that Authorize refuses
 each account it cannot let through

---
 gonsole/auth/postgres/authorize_test.go | 61 +++++++++++++++++++++++++
 1 file changed, 61 insertions(+)
 create mode 100644 gonsole/auth/postgres/authorize_test.go

diff --git a/gonsole/auth/postgres/authorize_test.go b/gonsole/auth/postgres/authorize_test.go
new file mode 100644
index 0000000..cccd8d2
--- /dev/null
+++ b/gonsole/auth/postgres/authorize_test.go
@@ -0,0 +1,61 @@
+// SPDX-License-Identifier: Apache-2.0
+
+package postgres_test
+
+import (
+	"testing"
+
+	"github.com/gopherium/framework/gonsole"
+	"github.com/gopherium/framework/gonsole/testkit"
+)
+
+func TestAuthorizeRefusesAnAccountItCannotLetThrough(t *testing.T) {
+	t.Parallel()
+
+	for _, tc := range []struct {
+		name, change, actor, stderr string
+	}{
+		{"a role that lacks the capability", "", "editor@example.com",
+			"myapp: the account editor@example.com holds the role editor, which lacks manage_users\n"},
+		{"a disabled account", "UPDATE auth.users SET disabled = true WHERE email = 'admin@example.com'",
+			"admin@example.com", "myapp: the account admin@example.com is disabled\n"},
+		{"an account never activated", "UPDATE auth.users SET confirmed = false WHERE email = 'admin@example.com'",
+			"admin@example.com", "myapp: the account admin@example.com was never activated\n"},
+		{"an account holding no role", "UPDATE auth.users SET role = '' WHERE email = 'author@example.com'",
+			"author@example.com", "myapp: the account author@example.com holds no role, so it lacks manage_users\n"},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			t.Parallel()
+			db := seeded(t)
+			if tc.change != "" {
+				db.run(tc.change)
+			}
+
+			got := testkit.Run(t, moduleProgram(db), "", "account:role", "author@example.com", "editor", "-yes",
+				"-as", tc.actor)
+
+			if got.Code != gonsole.ExitFailed || got.Stderr != tc.stderr {
+				t.Errorf("account:role as %s = %d with %q, want %d with %q", tc.actor, got.Code, got.Stderr,
+					gonsole.ExitFailed, tc.stderr)
+			}
+			if !db.found("SELECT count(*) = 0 FROM gonsole.records") {
+				t.Errorf("account:role as %s left a record, want none", tc.actor)
+			}
+		})
+	}
+}
+
+func TestAuthorizeLetsACapableAccountThrough(t *testing.T) {
+	t.Parallel()
+
+	db := seeded(t)
+
+	got := testkit.Run(t, moduleProgram(db), "", "account:role", "author@example.com", "editor", "-yes",
+		"-as", "admin@example.com")
+
+	role := db.text("SELECT role FROM auth.users WHERE email = 'author@example.com'")
+	if got.Code != gonsole.ExitDone || role != "editor" {
+		t.Errorf("account:role as the admin = %d with %q and the role %q, want %d and editor", got.Code, got.Stderr,
+			role, gonsole.ExitDone)
+	}
+}

From e23b2f030468bf4ca3e9a448564f0d8cc3927b7a Mon Sep 17 00:00:00 2001
From: SirLouen <sir.louen@gmail.com>
Date: Wed, 14 Oct 2026 07:40:58 +0200
Subject: [PATCH 4/4] docs(gonsole/auth/sqlite): say the build stops linking
 pgx, not that the graph drops it

---
 gonsole/auth/sqlite/CHANGELOG.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/gonsole/auth/sqlite/CHANGELOG.md b/gonsole/auth/sqlite/CHANGELOG.md
index c2211a7..5559bde 100644
--- a/gonsole/auth/sqlite/CHANGELOG.md
+++ b/gonsole/auth/sqlite/CHANGELOG.md
@@ -12,7 +12,7 @@ Releases of this module are tagged `gonsole/auth/sqlite/vX.Y.Z`.
 
 ### Changed
 
-- **Breaking.** Requires `gonsole/auth` 0.8.0, so the module no longer requires pgx or `authkit/postgres`.
+- **Breaking.** Requires `gonsole/auth` 0.8.0. The build no longer links pgx, and go.mod no longer lists pgx or `authkit/postgres`.
 
 ## [0.1.0] - 2026-10-12