@aiquants/daily-report 0.13.0 → 0.14.0

package/src/server/service.spec.ts

@@ -4,7 +4,7 @@ import { describe, expect, it } from "vitest"
 import { createEpochStore, SqlResultCache } from "./cache"
 import { defineDailyReportSchema } from "./schema"
 import { createDailyReportService, type DailyReportDb, type DailyReportHubRow, formatDateValue } from "./service"
-import { buildVisibleSourceTypeCondition, normalizeVisibleSourceTypes } from "./visibility"
+import { buildVisibleSourceTypeCondition, DailyReportViewerScope } from "./visibility"
 
 /**
  * Security regression tests for audit-actor masking in mapHubRecord.
@@ -147,6 +147,9 @@ const baseHub = (over: Partial<DailyReportHubRow>): DailyReportHubRow => ({
     ...over,
 })
 
+/** テストが「絞り込みなし」を意図していることを 1 箇所で表明する束縛。 */
+const UNRESTRICTED_SCOPE = DailyReportViewerScope.unrestricted("unit test: no viewer restriction under test")
+
 const makeService = (rows: unknown[], withAttachmentCodec = false, options: { selectQueue?: unknown[][] } = {}) => {
     const epochs = createEpochStore(undefined)
     const cache = new SqlResultCache({ defaultTtlMs: 60_000 }, epochs)
@@ -181,7 +184,7 @@ const makeService = (rows: unknown[], withAttachmentCodec = false, options: { se
 describe("mapHubRecord audit-actor masking (security)", () => {
     it("数値の updatedBy / createdBy (= 生内部 ID) は encodeUserId で難読化される", async () => {
         const svc = makeService([{ hub: baseHub({ createdBy: "8", updatedBy: "8" }), internal: null, creatorName: null }])
-        const [r] = await svc.getDailyReportsByBusinessDate("2099-01-05", { forceRefresh: true })
+        const [r] = await svc.getDailyReportsByBusinessDate(UNRESTRICTED_SCOPE, "2099-01-05", { forceRefresh: true })
         // 生 ID "8" がそのまま出ないこと (漏洩防止の核心)
         expect(r.updatedBy).toBe("ENC8")
         expect(r.updatedBy).not.toBe("8")
@@ -193,7 +196,7 @@ describe("mapHubRecord audit-actor masking (security)", () => {
 
     it("表示名 (creatorName) がある場合はマスクせず表示名を優先する", async () => {
         const svc = makeService([{ hub: baseHub({ createdBy: "8", updatedBy: "8" }), internal: null, creatorName: "山田太郎" }])
-        const [r] = await svc.getDailyReportsByBusinessDate("2099-01-05", { forceRefresh: true })
+        const [r] = await svc.getDailyReportsByBusinessDate(UNRESTRICTED_SCOPE, "2099-01-05", { forceRefresh: true })
         expect(r.author).toBe("山田太郎")
         expect(r.employeeName).toBe("山田太郎")
         // updatedBy は表示名解決を持たないため常にマスク
@@ -202,14 +205,14 @@ describe("mapHubRecord audit-actor masking (security)", () => {
 
     it("非数値の監査値 (レガシー氏名/システム文字列) はそのまま通す", async () => {
         const svc = makeService([{ hub: baseHub({ createdBy: "system-import", updatedBy: "batch" }), internal: null, creatorName: null }])
-        const [r] = await svc.getDailyReportsByBusinessDate("2099-01-05", { forceRefresh: true })
+        const [r] = await svc.getDailyReportsByBusinessDate(UNRESTRICTED_SCOPE, "2099-01-05", { forceRefresh: true })
         expect(r.author).toBe("system-import")
         expect(r.updatedBy).toBe("batch")
     })
 
     it("空 / null の監査値は null になる (生値の漏れなし)", async () => {
         const svc = makeService([{ hub: baseHub({ createdBy: "", updatedBy: "" }), internal: null, creatorName: null }])
-        const [r] = await svc.getDailyReportsByBusinessDate("2099-01-05", { forceRefresh: true })
+        const [r] = await svc.getDailyReportsByBusinessDate(UNRESTRICTED_SCOPE, "2099-01-05", { forceRefresh: true })
         expect(r.updatedBy).toBeNull()
         expect(r.author).toBe("") // author は非 null 契約のため空文字
     })
@@ -289,14 +292,14 @@ describe("添付ファイルの認可付き取得", () => {
             epochs,
             draftLabelName: "draft",
         })
-        expect(await svc.getAttachmentForUser(1, 8, null)).toBeNull()
+        expect(await svc.getAttachmentForUser(UNRESTRICTED_SCOPE, 1, 8)).toBeNull()
     })
 
     it("認可述語が閲覧者の所有と下書き非該当を OR で結び、論理削除も除外する", async () => {
         // これがこの機能の唯一の認可境界。述語そのものを SQL 文字列として固定する
         // (モックは行を絞れないので、生成される WHERE 句を直接表明するしかない)
         const svc = makeService([{ fileName: "a.png", filePath: "gcs://b/a.png", fileType: "image/png", fileSize: 1 }])
-        await svc.getAttachmentForUser(11, 8, null)
+        await svc.getAttachmentForUser(UNRESTRICTED_SCOPE, 11, 8)
 
         // 最後のクエリが添付の認可判定 (直前は下書きラベルの解決)
         const recorded = svc.__queries.at(-1)
@@ -313,7 +316,7 @@ describe("添付ファイルの認可付き取得", () => {
 
     it("認可判定の束縛値が入れ替わっていないこと (添付 ID と閲覧者 ID)", async () => {
         const svc = makeService([])
-        await svc.getAttachmentForUser(777, 42, null)
+        await svc.getAttachmentForUser(UNRESTRICTED_SCOPE, 777, 42)
         expect(svc.__queries.at(-1)?.whereParams).toEqual([777, 42])
     })
 
@@ -323,15 +326,15 @@ describe("添付ファイルの認可付き取得", () => {
         const draftPredicate = (sql: string): boolean => /\[user_id\] = @par\d+\) or \(\(\[draft_label\]\.\[hub_id\] is null\)/.test(sql)
 
         const byDate = makeService([])
-        await byDate.getDailyReportsByBusinessDateByExternalId("2099-01-05", "ext", { forceRefresh: true }, null)
+        await byDate.getDailyReportsByBusinessDateByExternalId(UNRESTRICTED_SCOPE, "2099-01-05", "ext", { forceRefresh: true })
         expect(byDate.__queries.some((q) => q.whereSql !== null && draftPredicate(q.whereSql))).toBe(true)
 
         const byId = makeService([])
-        await byId.getDailyReportDetailById(1, 8, { forceRefresh: true }, null)
+        await byId.getDailyReportDetailById(UNRESTRICTED_SCOPE, 1, 8, { forceRefresh: true })
         expect(byId.__queries.some((q) => q.whereSql !== null && draftPredicate(q.whereSql))).toBe(true)
 
         const byAttachment = makeService([])
-        await byAttachment.getAttachmentForUser(1, 8, null)
+        await byAttachment.getAttachmentForUser(UNRESTRICTED_SCOPE, 1, 8)
         expect(byAttachment.__queries.some((q) => q.whereSql !== null && draftPredicate(q.whereSql))).toBe(true)
     })
 
@@ -340,7 +343,7 @@ describe("添付ファイルの認可付き取得", () => {
         // 意図的な緩和であり、返すのは ID・営業日・ソース種別だけで本文も添付も含まない。
         // 「3 経路と同一」ではないことを明示的に固定し、無自覚な差分と区別する
         const byIds = makeService([])
-        await byIds.getDailyReportIdsByExternalId("ext", { forceRefresh: true }, null)
+        await byIds.getDailyReportIdsByExternalId(UNRESTRICTED_SCOPE, "ext", { forceRefresh: true })
         const idsWhere = byIds.__queries.map((q) => q.whereSql ?? "").find((sql) => sql.includes("[draft_label].[hub_id] is null"))
         expect(idsWhere).toBeDefined()
         expect(idsWhere).toContain("[user_id] is null")
@@ -350,7 +353,7 @@ describe("添付ファイルの認可付き取得", () => {
         // `draftLabelNames` には取込元ごとの下書き名を複数注入できる。1 個の ID でしか結合しないと
         // 2 つ目の下書きラベルが付いた日報が誰にでも可視になる
         const svc = makeService([{ id: 11 }, { id: 22 }])
-        await svc.getAttachmentForUser(1, 8, null)
+        await svc.getAttachmentForUser(UNRESTRICTED_SCOPE, 1, 8)
         // 結合条件は where ではなく leftJoin の ON 側に載る
         const joinParams = svc.__queries.flatMap((q) => q.joinParams)
         expect(joinParams).toContain(11)
@@ -404,19 +407,19 @@ describe("コメント操作の整合性チェック", () => {
     it("addComment は存在しない日報に対して Not Found を投げる (孤児コメントを作らない)", async () => {
         // hub 取得が空 = 存在しない日報。以前は hub 未取得でもフォールスルーして INSERT していた
         const svc = makeService([])
-        await expect(svc.addComment(8, 999, "本文", "2099-01-05", "tmp", null)).rejects.toThrow("Not Found")
+        await expect(svc.addComment(UNRESTRICTED_SCOPE, 8, 999, "本文", "2099-01-05", "tmp")).rejects.toThrow("Not Found")
     })
 
     it("addComment は論理削除済みの日報を拒否する", async () => {
         const svc = makeService([{ sourceType: "Internal", deletedAt: "2099-01-06 00:00:00", userId: 8 }])
-        await expect(svc.addComment(8, 1, "本文", "2099-01-05", "tmp", null)).rejects.toThrow("Not Found")
+        await expect(svc.addComment(UNRESTRICTED_SCOPE, 8, 1, "本文", "2099-01-05", "tmp")).rejects.toThrow("Not Found")
     })
 
     it("deleteComment は reportHubId がコメントの実所属と一致しないと Not Found を投げる", async () => {
         // コメントは hubId=100 に属するのに、呼び出しは reportHubId=999 を渡している。
         // 不一致のまま進むと無関係な日報のキャッシュ無効化と SSE 配信を起こすため拒否する
         const svc = makeService([{ id: 5, hubId: 100, userId: 8, body: "x", createdAt: "2099-01-05 00:00:00", createdBy: "8", updatedAt: "2099-01-05 00:00:00", updatedBy: "8" }])
-        await expect(svc.deleteComment(8, 999, 5, "2099-01-05", "tmp", null)).rejects.toThrow("Not Found")
+        await expect(svc.deleteComment(UNRESTRICTED_SCOPE, 8, 999, 5, "2099-01-05", "tmp")).rejects.toThrow("Not Found")
     })
 
     it("addComment: 公開済み日報のコメントは全員配信 (recipientRawUserId 無し)", async () => {
@@ -428,7 +431,7 @@ describe("コメント操作の整合性チェック", () => {
                 [{ displayName: "山田" }], // コメント投稿者名
             ],
         })
-        await svc.addComment(8, 1, "本文", "2099-01-05", "tmp", null)
+        await svc.addComment(UNRESTRICTED_SCOPE, 8, 1, "本文", "2099-01-05", "tmp")
         const sse = (svc as unknown as { __sse: Record<string, unknown>[] }).__sse
         const add = sse.find((m) => m.type === "comment-add")
         expect(add).toBeDefined()
@@ -444,7 +447,7 @@ describe("コメント操作の整合性チェック", () => {
                 [{ displayName: "山田" }], // 投稿者名
             ],
         })
-        await svc.addComment(8, 1, "秘密の下書きコメント", "2099-01-05", "tmp", null)
+        await svc.addComment(UNRESTRICTED_SCOPE, 8, 1, "秘密の下書きコメント", "2099-01-05", "tmp")
         const sse = (svc as unknown as { __sse: Record<string, unknown>[] }).__sse
         const add = sse.find((m) => m.type === "comment-add")
         expect(add?.recipientRawUserId).toBe(8)
@@ -555,9 +558,9 @@ describe("formatDateValue (Intl-free rewrite equivalence)", () => {
 
 describe("区分 (sourceType) 可視性フィルタ", () => {
     /** テスト用の可視集合 (NI と kintone のみ許可)。 */
-    const restricted = normalizeVisibleSourceTypes(["NI", "kintone"])
+    const restricted = DailyReportViewerScope.restrictTo(["NI", "kintone"])
     /** 全拒否の可視集合 (権限なし・リゾルバ例外時と同じ状態)。 */
-    const denyAll = normalizeVisibleSourceTypes([])
+    const denyAll = DailyReportViewerScope.restrictTo([])
 
     /** 区分述語を含む最後のクエリを取り出す。 */
     const lastQueryWithSourceType = (svc: { __queries: { whereSql: string | null; whereParams: unknown[] }[] }) => svc.__queries.filter((q) => (q.whereSql ?? "").includes("[source_type]")).at(-1)
@@ -565,7 +568,7 @@ describe("区分 (sourceType) 可視性フィルタ", () => {
     describe("読み取り経路への述語注入", () => {
         it("ID 一覧 (全量) の WHERE に畳み込み済みトークンの IN 述語が載る", async () => {
             const svc = makeService([])
-            await svc.getDailyReportIdsByExternalId("ext", { forceRefresh: true }, restricted)
+            await svc.getDailyReportIdsByExternalId(restricted, "ext", { forceRefresh: true })
 
             const recorded = lastQueryWithSourceType(svc)
             // レンダリングは大文字 LOWER( なので大小文字を厳密に一致させる
@@ -578,7 +581,7 @@ describe("区分 (sourceType) 可視性フィルタ", () => {
 
         it("ID 一覧 (先頭ページ) にも同一の述語が載る", async () => {
             const svc = makeService([])
-            await svc.getDailyReportIdsFirstPageByExternalId("ext", 200, restricted)
+            await svc.getDailyReportIdsFirstPageByExternalId(restricted, "ext", 200)
 
             const recorded = lastQueryWithSourceType(svc)
             expect(recorded?.whereSql).toContain("LOWER(")
@@ -587,7 +590,7 @@ describe("区分 (sourceType) 可視性フィルタ", () => {
 
         it("営業日別一覧の WHERE に述語が載る", async () => {
             const svc = makeService([])
-            await svc.getDailyReportsByBusinessDateByExternalId("2099-01-05", "ext", { forceRefresh: true }, restricted)
+            await svc.getDailyReportsByBusinessDateByExternalId(restricted, "2099-01-05", "ext", { forceRefresh: true })
 
             const recorded = lastQueryWithSourceType(svc)
             expect(recorded?.whereSql).toContain("LOWER(")
@@ -596,16 +599,42 @@ describe("区分 (sourceType) 可視性フィルタ", () => {
 
         it("詳細取得の WHERE に述語が載る", async () => {
             const svc = makeService([])
-            await svc.getDailyReportDetailById(1, 8, { forceRefresh: true }, restricted)
+            await svc.getDailyReportDetailById(restricted, 1, 8, { forceRefresh: true })
 
             const recorded = lastQueryWithSourceType(svc)
             expect(recorded?.whereSql).toContain("LOWER(")
             expect(recorded?.whereParams).toEqual(expect.arrayContaining(["kintone", "ni"]))
         })
 
+        it("管理用の営業日別一覧も区分でゲートされる (docstring の警告だけに頼らない)", async () => {
+            // v0.14.0 でゲート対象へ昇格した経路。ここが無いと、述語・短絡・ダイジェストを
+            // すべて剥がしても既存テスト (無制限スコープのみ) は緑のまま通ってしまう
+            const svc = makeService([])
+            await svc.getDailyReportsByBusinessDate(restricted, "2099-01-05", { forceRefresh: true })
+
+            const recorded = lastQueryWithSourceType(svc)
+            expect(recorded?.whereSql).toContain("LOWER(")
+            expect(recorded?.whereParams).toEqual(expect.arrayContaining(["kintone", "ni"]))
+        })
+
+        it("管理用の営業日別一覧も全拒否では DB を引かない", async () => {
+            const svc = makeService([])
+            expect(await svc.getDailyReportsByBusinessDate(denyAll, "2099-01-05", { forceRefresh: true })).toEqual([])
+            expect(svc.__queries).toHaveLength(0)
+        })
+
+        it("管理用の営業日別一覧も可視集合ごとにキャッシュが隔離される", async () => {
+            const svc = makeService([])
+            await svc.getDailyReportsByBusinessDate(DailyReportViewerScope.restrictTo(["ni"]), "2099-01-05", {})
+            const afterFirst = svc.__queries.length
+            await svc.getDailyReportsByBusinessDate(DailyReportViewerScope.restrictTo(["kintone"]), "2099-01-05", {})
+
+            expect(svc.__queries.length).toBeGreaterThan(afterFirst)
+        })
+
         it("添付の認可述語にも載る (一覧だけ絞って添付から抜ける穴を塞ぐ)", async () => {
             const svc = makeService([{ fileName: "a.png", filePath: "gcs://b/a.png", fileType: null, fileSize: 1 }])
-            await svc.getAttachmentForUser(11, 8, restricted)
+            await svc.getAttachmentForUser(restricted, 11, 8)
 
             const recorded = lastQueryWithSourceType(svc)
             expect(recorded?.whereSql).toContain("LOWER(")
@@ -614,7 +643,7 @@ describe("区分 (sourceType) 可視性フィルタ", () => {
 
         it("外部 ID 経由の詳細取得は可視集合をそのまま透過する (ここで null へ潰さない)", async () => {
             const svc = makeService([])
-            await svc.getDailyReportDetailByIdByExternalId(1, "ext", { forceRefresh: true }, restricted)
+            await svc.getDailyReportDetailByIdByExternalId(restricted, 1, "ext", { forceRefresh: true })
 
             const recorded = lastQueryWithSourceType(svc)
             expect(recorded?.whereParams).toEqual(expect.arrayContaining(["kintone", "ni"]))
@@ -622,9 +651,9 @@ describe("区分 (sourceType) 可視性フィルタ", () => {
 
         it("無制限 (null) では述語が一切現れない (現行互換の回帰ガード)", async () => {
             const svc = makeService([])
-            await svc.getDailyReportIdsByExternalId("ext", { forceRefresh: true }, null)
-            await svc.getDailyReportsByBusinessDateByExternalId("2099-01-05", "ext", { forceRefresh: true }, null)
-            await svc.getDailyReportDetailById(1, 8, { forceRefresh: true }, null)
+            await svc.getDailyReportIdsByExternalId(UNRESTRICTED_SCOPE, "ext", { forceRefresh: true })
+            await svc.getDailyReportsByBusinessDateByExternalId(UNRESTRICTED_SCOPE, "2099-01-05", "ext", { forceRefresh: true })
+            await svc.getDailyReportDetailById(UNRESTRICTED_SCOPE, 1, 8, { forceRefresh: true })
 
             expect(svc.__queries.every((q) => !(q.whereSql ?? "").includes("[source_type]"))).toBe(true)
         })
@@ -634,11 +663,11 @@ describe("区分 (sourceType) 可視性フィルタ", () => {
         it("読み取り 5 経路すべてが問い合わせ無しで空を返す", async () => {
             const svc = makeService([{ fileName: "a.png", filePath: "gcs://b/a.png", fileType: null, fileSize: 1 }], true)
 
-            expect(await svc.getDailyReportIdsByExternalId("ext", { forceRefresh: true }, denyAll)).toEqual([])
-            expect(await svc.getDailyReportIdsFirstPageByExternalId("ext", 200, denyAll)).toEqual([])
-            expect(await svc.getDailyReportsByBusinessDateByExternalId("2099-01-05", "ext", { forceRefresh: true }, denyAll)).toEqual([])
-            expect(await svc.getDailyReportDetailById(1, 8, { forceRefresh: true }, denyAll)).toBeNull()
-            expect(await svc.getAttachmentForUser(11, 8, denyAll)).toBeNull()
+            expect(await svc.getDailyReportIdsByExternalId(denyAll, "ext", { forceRefresh: true })).toEqual([])
+            expect(await svc.getDailyReportIdsFirstPageByExternalId(denyAll, "ext", 200)).toEqual([])
+            expect(await svc.getDailyReportsByBusinessDateByExternalId(denyAll, "2099-01-05", "ext", { forceRefresh: true })).toEqual([])
+            expect(await svc.getDailyReportDetailById(denyAll, 1, 8, { forceRefresh: true })).toBeNull()
+            expect(await svc.getAttachmentForUser(denyAll, 11, 8)).toBeNull()
 
             // 短絡しているので DB は一度も引かれない
             expect(svc.__queries).toHaveLength(0)
@@ -647,7 +676,7 @@ describe("区分 (sourceType) 可視性フィルタ", () => {
         it("条件生成器自体も fail-close する (呼び出し側の短絡が漏れても認可は反転しない)", () => {
             // 空集合を「制限なし」と解釈すると添付が全区分ダウンロード可能になる。
             // 短絡を迂回しても 1 = 0 が残ることを、生成 SQL で直接固定する
-            const condition = buildVisibleSourceTypeCondition(tables.hub.sourceType, denyAll)
+            const condition = buildVisibleSourceTypeCondition(tables.hub.sourceType, denyAll.visible)
             expect(condition).toBeDefined()
             expect(dialect.sqlToQuery(condition as SQL).sql).toContain("1 = 0")
         })
@@ -656,32 +685,32 @@ describe("区分 (sourceType) 可視性フィルタ", () => {
     describe("キャッシュの可視集合ダイジェスト隔離", () => {
         it("正規化後に等価な可視集合はキャッシュを再利用する (性能無退行)", async () => {
             const svc = makeService([])
-            await svc.getDailyReportIdsByExternalId("ext", {}, normalizeVisibleSourceTypes(["NI"]))
+            await svc.getDailyReportIdsByExternalId(DailyReportViewerScope.restrictTo(["NI"]), "ext", {})
             const afterFirst = svc.__queries.length
-            await svc.getDailyReportIdsByExternalId("ext", {}, normalizeVisibleSourceTypes([" ni "]))
+            await svc.getDailyReportIdsByExternalId(DailyReportViewerScope.restrictTo([" ni "]), "ext", {})
 
             expect(svc.__queries.length).toBe(afterFirst)
         })
 
         it("異なる可視集合は別バケットになる (別権限へ他人の結果を配らない)", async () => {
             const svc = makeService([])
-            await svc.getDailyReportIdsByExternalId("ext", {}, normalizeVisibleSourceTypes(["ni"]))
+            await svc.getDailyReportIdsByExternalId(DailyReportViewerScope.restrictTo(["ni"]), "ext", {})
             const afterFirst = svc.__queries.length
-            await svc.getDailyReportIdsByExternalId("ext", {}, normalizeVisibleSourceTypes(["kintone"]))
+            await svc.getDailyReportIdsByExternalId(DailyReportViewerScope.restrictTo(["kintone"]), "ext", {})
 
             expect(svc.__queries.length).toBeGreaterThan(afterFirst)
         })
 
         it("営業日別と詳細でも可視集合ごとに隔離される", async () => {
             const svc = makeService([])
-            await svc.getDailyReportsByBusinessDateByExternalId("2099-01-05", "ext", {}, normalizeVisibleSourceTypes(["ni"]))
+            await svc.getDailyReportsByBusinessDateByExternalId(DailyReportViewerScope.restrictTo(["ni"]), "2099-01-05", "ext", {})
             const afterDateFirst = svc.__queries.length
-            await svc.getDailyReportsByBusinessDateByExternalId("2099-01-05", "ext", {}, normalizeVisibleSourceTypes(["kintone"]))
+            await svc.getDailyReportsByBusinessDateByExternalId(DailyReportViewerScope.restrictTo(["kintone"]), "2099-01-05", "ext", {})
             expect(svc.__queries.length).toBeGreaterThan(afterDateFirst)
 
-            await svc.getDailyReportDetailById(1, 8, {}, normalizeVisibleSourceTypes(["ni"]))
+            await svc.getDailyReportDetailById(DailyReportViewerScope.restrictTo(["ni"]), 1, 8, {})
             const afterDetailFirst = svc.__queries.length
-            await svc.getDailyReportDetailById(1, 8, {}, normalizeVisibleSourceTypes(["kintone"]))
+            await svc.getDailyReportDetailById(DailyReportViewerScope.restrictTo(["kintone"]), 1, 8, {})
             expect(svc.__queries.length).toBeGreaterThan(afterDetailFirst)
         })
     })
@@ -711,13 +740,13 @@ describe("区分 (sourceType) 可視性フィルタ", () => {
                     isRead: false,
                 },
             ])
-            await svc.getDailyReportDetailById(1, 8, {}, restricted)
+            await svc.getDailyReportDetailById(restricted, 1, 8, {})
 
-            await svc.setStarStatus(8, 1, "2099-01-05", true, "tmp", null)
+            await svc.setStarStatus(UNRESTRICTED_SCOPE, 8, 1, "2099-01-05", true, "tmp")
             // ❗ 基準はミューテーション「後」に取る。前に取ると setStarStatus 自身が発行する
             //    2 本の select だけで閾値を満たしてしまい、無効化が壊れていても通ってしまう
             const afterMutation = svc.__queries.length
-            await svc.getDailyReportDetailById(1, 8, {}, restricted)
+            await svc.getDailyReportDetailById(restricted, 1, 8, {})
 
             // 接頭辞無効化が効いていなければキャッシュヒットで再クエリが 1 本も出ない
             expect(svc.__queries.length).toBeGreaterThan(afterMutation)
@@ -747,12 +776,12 @@ describe("区分 (sourceType) 可視性フィルタ", () => {
                     isRead: false,
                 },
             ])
-            await svc.getDailyReportDetailById(1, 8, {}, restricted)
+            await svc.getDailyReportDetailById(restricted, 1, 8, {})
 
-            await svc.setReadStatus(8, 1, "2099-01-05", true, "tmp", null)
+            await svc.setReadStatus(UNRESTRICTED_SCOPE, 8, 1, "2099-01-05", true, "tmp")
             // 基準はミューテーション後 (理由は setStarStatus のテストと同じ)
             const afterMutation = svc.__queries.length
-            await svc.getDailyReportDetailById(1, 8, {}, restricted)
+            await svc.getDailyReportDetailById(restricted, 1, 8, {})
 
             expect(svc.__queries.length).toBeGreaterThan(afterMutation)
         })
@@ -761,11 +790,11 @@ describe("区分 (sourceType) 可視性フィルタ", () => {
             // detail 側だけ接頭辞化しても date 側が完全一致のままなら、営業日別一覧が
             // 古いスター状態を配り続ける。両者を別々の表明で固定する
             const svc = makeService([{ hub: baseHub({ id: 1 }), internal: null, isStarred: false, isRead: false, creatorName: "山田" }])
-            await svc.getDailyReportsByBusinessDateByExternalId("2099-01-05", "ext", {}, restricted)
+            await svc.getDailyReportsByBusinessDateByExternalId(restricted, "2099-01-05", "ext", {})
 
-            await svc.setStarStatus(8, 1, "2099-01-05", true, "tmp", null)
+            await svc.setStarStatus(UNRESTRICTED_SCOPE, 8, 1, "2099-01-05", true, "tmp")
             const afterMutation = svc.__queries.length
-            await svc.getDailyReportsByBusinessDateByExternalId("2099-01-05", "ext", {}, restricted)
+            await svc.getDailyReportsByBusinessDateByExternalId(restricted, "2099-01-05", "ext", {})
 
             expect(svc.__queries.length).toBeGreaterThan(afterMutation)
         })
@@ -777,11 +806,11 @@ describe("区分 (sourceType) 可視性フィルタ", () => {
             // 行を返さないモックでも create は完走する (詳細が null なら SSE を出さないだけ)。
             // 検証対象は「無効化が走ったか」なので、これで十分かつ流れの変化に強い
             const svc = makeService([])
-            await svc.getDailyReportIdsByExternalId("ext", {}, restricted)
+            await svc.getDailyReportIdsByExternalId(restricted, "ext", {})
 
             await svc.createDailyReport(8, "2099-01-05", "tmp")
             const afterCreate = svc.__queries.length
-            await svc.getDailyReportIdsByExternalId("ext", {}, restricted)
+            await svc.getDailyReportIdsByExternalId(restricted, "ext", {})
 
             // 無効化が効いていなければキャッシュヒットで再クエリは 0 本になる
             expect(svc.__queries.length).toBeGreaterThan(afterCreate)
@@ -791,27 +820,27 @@ describe("区分 (sourceType) 可視性フィルタ", () => {
     describe("ミューテーションの区分ゲート", () => {
         it("addComment は不可視区分の日報を Not Found で拒否する", async () => {
             const svc = makeService([{ sourceType: "Internal", deletedAt: null, userId: 8 }])
-            await expect(svc.addComment(8, 1, "本文", "2099-01-05", "tmp", restricted)).rejects.toThrow("Not Found")
+            await expect(svc.addComment(restricted, 8, 1, "本文", "2099-01-05", "tmp")).rejects.toThrow("Not Found")
         })
 
         it("setStarStatus は不可視区分を Not Found で拒否する", async () => {
             const svc = makeService([{ sourceType: "Internal", deletedAt: null }])
-            await expect(svc.setStarStatus(8, 1, "2099-01-05", true, "tmp", restricted)).rejects.toThrow("Not Found")
+            await expect(svc.setStarStatus(restricted, 8, 1, "2099-01-05", true, "tmp")).rejects.toThrow("Not Found")
         })
 
         it("setReadStatus は不可視区分を Not Found で拒否する", async () => {
             const svc = makeService([{ sourceType: "Internal", deletedAt: null }])
-            await expect(svc.setReadStatus(8, 1, "2099-01-05", true, "tmp", restricted)).rejects.toThrow("Not Found")
+            await expect(svc.setReadStatus(restricted, 8, 1, "2099-01-05", true, "tmp")).rejects.toThrow("Not Found")
         })
 
         it("setStarStatus は存在しない hubId を Not Found で拒否する (存在オラクルの是正)", async () => {
             const svc = makeService([])
-            await expect(svc.setStarStatus(8, 999, "2099-01-05", true, "tmp", null)).rejects.toThrow("Not Found")
+            await expect(svc.setStarStatus(UNRESTRICTED_SCOPE, 8, 999, "2099-01-05", true, "tmp")).rejects.toThrow("Not Found")
         })
 
         it("setReadStatus は論理削除済みの日報を Not Found で拒否する", async () => {
             const svc = makeService([{ sourceType: "Internal", deletedAt: "2099-01-06 00:00:00" }])
-            await expect(svc.setReadStatus(8, 1, "2099-01-05", true, "tmp", null)).rejects.toThrow("Not Found")
+            await expect(svc.setReadStatus(UNRESTRICTED_SCOPE, 8, 1, "2099-01-05", true, "tmp")).rejects.toThrow("Not Found")
         })
 
         it("deleteComment は所有者チェックより先に区分ゲートを適用する (403/404 の存在オラクル回避)", async () => {
@@ -820,7 +849,7 @@ describe("区分 (sourceType) 可視性フィルタ", () => {
             const svc = makeService([], false, {
                 selectQueue: [[{ id: 5, hubId: 1, userId: 99, body: "x", createdAt: "2099-01-05 00:00:00", createdBy: "99", updatedAt: "2099-01-05 00:00:00", updatedBy: "99" }], [{ userId: 99, sourceType: "Internal" }]],
             })
-            await expect(svc.deleteComment(8, 1, 5, "2099-01-05", "tmp", restricted)).rejects.toThrow("Not Found")
+            await expect(svc.deleteComment(restricted, 8, 1, 5, "2099-01-05", "tmp")).rejects.toThrow("Not Found")
         })
     })
 
@@ -829,7 +858,7 @@ describe("区分 (sourceType) 可視性フィルタ", () => {
             const svc = makeService([], false, {
                 selectQueue: [[{ sourceType: "Internal", deletedAt: null, userId: 8 }], [{ id: 10 }], [], [{ displayName: "山田" }]],
             })
-            await svc.addComment(8, 1, "本文", "2099-01-05", "tmp", null)
+            await svc.addComment(UNRESTRICTED_SCOPE, 8, 1, "本文", "2099-01-05", "tmp")
 
             const add = svc.__sse.find((m) => m.type === "comment-add")
             expect(add?.sourceType).toBe("Internal")