@starci/hfs 4.7.23 → 4.7.25

package/templates/be/platform/graphql/localize-errors.mapper.spec.ts

@@ -8,7 +8,7 @@ import type { GraphqlContext } from "./graphql.contracts"
 import { localizeError, localizeErrorsPlugin } from "./localize-errors.mapper"
 
 const singleResponse = (errors?: ReadonlyArray<GraphQLFormattedError>): GraphQLResponse =>
-    mock<GraphQLResponse>({ body: { kind: "single", singleResult: { errors } } })
+    mock<GraphQLResponse>({ body: { kind: "single", singleResult: errors === undefined ? {} : { errors } } })
 
 const requestContext = (
     response: GraphQLResponse,
@@ -65,17 +65,20 @@ describe("localizeError", () => {
         expect(errors.text).toHaveBeenCalledWith("ITEM_NOT_FOUND", { id: "i-1", retries: 2 }, "en")
     })
 
-    it.each([undefined, null, ["i-1"], "i-1", 42, false])("interpolates no params when extensions.params is %p", (params) => {
-        const errors = mock<ErrorsService>()
-        errors.text.mockReturnValue("The item was not found")
-        const error: GraphQLFormattedError = {
-            message: "ITEM_NOT_FOUND",
-            extensions: { code: "ITEM_NOT_FOUND", params },
-        }
-
-        expect(localizeError(errors, "en", error).message).toBe("The item was not found")
-        expect(errors.text).toHaveBeenCalledWith("ITEM_NOT_FOUND", {}, "en")
-    })
+    it.each([undefined, null, ["i-1"], "i-1", 42, false])(
+        "interpolates no params when extensions.params is %p",
+        (params) => {
+            const errors = mock<ErrorsService>()
+            errors.text.mockReturnValue("The item was not found")
+            const error: GraphQLFormattedError = {
+                message: "ITEM_NOT_FOUND",
+                extensions: { code: "ITEM_NOT_FOUND", params },
+            }
+
+            expect(localizeError(errors, "en", error).message).toBe("The item was not found")
+            expect(errors.text).toHaveBeenCalledWith("ITEM_NOT_FOUND", {}, "en")
+        },
+    )
 })
 
 describe("localizeErrorsPlugin", () => {

package/templates/be/skeleton/src/modules/domain/identity/admission.policy.spec.ts

@@ -6,10 +6,14 @@ import { PublicReason } from "./identity.contracts"
 
 const ADMISSION: unique symbol = Symbol("identity.admission")
 
+/** A record is read as metadata whatever its fields: the admission under test is what judges the reason. */
+const isMetadata = (value: unknown): value is PublicMetadata => typeof value === "object" && value !== null
+
 const runtimeMetadata = (source: string): PublicMetadata => {
     try {
-        const metadata: PublicMetadata = JSON.parse(source)
-        return metadata
+        const parsed: unknown = JSON.parse(source)
+        if (!isMetadata(parsed)) throw new IdentityError({ code: IdentityErrorCode.Unauthenticated })
+        return parsed
     } catch (cause) {
         throw new IdentityError({ code: IdentityErrorCode.Unauthenticated, cause })
     }

package/templates/be/skeleton/src/modules/domain/identity/auth.guard.spec.ts

@@ -50,9 +50,7 @@ describe("AuthGuard", () => {
     it("refuses every door that is neither public nor credential-marked", async () => {
         const guard = await build({})
 
-        expect(() => guard.canActivate(contextOf())).toThrow(
-            expect.objectContaining({ code: IdentityErrorCode.Unauthenticated }),
-        )
+        expect(() => guard.canActivate(contextOf())).toThrow(IdentityErrorCode.Unauthenticated)
     })
 
     it("lets a credential door through once the credential principal is set", async () => {
@@ -64,8 +62,6 @@ describe("AuthGuard", () => {
     it("refuses a credential door without a credential principal", async () => {
         const guard = await build({ credential: { kind: "api-key" } })
 
-        expect(() => guard.canActivate(contextOf())).toThrow(
-            expect.objectContaining({ code: IdentityErrorCode.Unauthenticated }),
-        )
+        expect(() => guard.canActivate(contextOf())).toThrow(IdentityErrorCode.Unauthenticated)
     })
 })

package/templates/be/skeleton/src/modules/domain/identity/credential.guard.spec.ts

@@ -109,7 +109,7 @@ describe("CredentialGuard", () => {
         async (params) => {
             const metadata = { kind: "tool-token", workflow: "checkout" } as const
             const { guard, authenticator } = await build(metadata, PRINCIPAL)
-            const request: FakeRequest = { headers: {}, params }
+            const request: FakeRequest = { headers: {}, ...(params === undefined ? {} : { params }) }
 
             await expect(guard.canActivate(contextOf(request))).resolves.toBe(true)
             expect(authenticator.authenticate).toHaveBeenCalledWith(metadata, "", undefined)

package/templates/be/skeleton/src/modules/domain/identity/credential.guard.ts

@@ -27,7 +27,7 @@ export class CredentialGuard implements CanActivate {
         ])
         if (metadata === undefined) return true
         const request = requestOf(context)
-        request.credentialPrincipal = undefined
+        delete request.credentialPrincipal
         const id: unknown = request.params?.id
         const principal = await this.authenticator.authenticate(
             metadata,

package/templates/be/skeleton/src/modules/platform/errors/domain.error.ts

@@ -18,3 +18,6 @@ export abstract class DomainError<C extends string> extends Error {
         this.params = init.params ?? {}
     }
 }
+
+/** True for a DomainError of any capability. A generic class narrows `unknown` to `DomainError<any>`; this guard narrows to `DomainError<string>`, so its code is a string. */
+export const isDomainError = (value: unknown): value is DomainError<string> => value instanceof DomainError

package/templates/be/skeleton/src/modules/platform/errors/errors.service.ts

@@ -3,7 +3,7 @@ import { InjectLogger } from "@modules/platform/logging"
 import type { Logger } from "@modules/platform/logging"
 import { InjectMessageCatalog } from "@modules/platform/i18n"
 import type { Locale, MessageCatalog } from "@modules/platform/i18n"
-import { DomainError } from "./domain.error"
+import { isDomainError } from "./domain.error"
 import { InjectErrorsOptions } from "./errors.decorators"
 import type { ErrorDescription, ErrorKind, ErrorParams } from "./errors.contracts"
 import { ERRORS_ERROR_KINDS, ErrorsErrorCode } from "./errors/errors.error"
@@ -26,7 +26,7 @@ export class ErrorsService {
 
     /** Describes `error`: a DomainError of a composed capability keeps its code; anything else is logged and masked as internal. */
     describe(error: unknown): ErrorDescription {
-        if (error instanceof DomainError) {
+        if (isDomainError(error)) {
             const kind = this.kinds.get(error.code)
             if (kind !== undefined) return this.build(error.code, kind, error.params)
         }

package/templates/be/skeleton/src/modules/platform/http-security/edge-security.service.spec.ts

@@ -52,18 +52,14 @@ describe("HTTP edge origin validation", () => {
         "ftp://web.example",
     ])("rejects wildcard, malformed and non-origin allowlist entry %s at boot", async (origin) => {
         const edge = await buildEdge()
-        expect(() => edge.validateAllowedOrigins([origin], true)).toThrow(
-            expect.objectContaining({ code: "HTTP_SECURITY_REQUEST_INVALID" }),
-        )
+        expect(() => edge.validateAllowedOrigins([origin], true)).toThrow("HTTP_SECURITY_REQUEST_INVALID")
     })
 
     it("rejects an empty allowlist and HTTP origins without development permission", async () => {
         const edge = await buildEdge()
-        expect(() => edge.validateAllowedOrigins([], false)).toThrow(
-            expect.objectContaining({ code: "HTTP_SECURITY_REQUEST_INVALID" }),
-        )
+        expect(() => edge.validateAllowedOrigins([], false)).toThrow("HTTP_SECURITY_REQUEST_INVALID")
         expect(() => edge.validateAllowedOrigins(["http://web.example"], false)).toThrow(
-            expect.objectContaining({ code: "HTTP_SECURITY_REQUEST_INVALID" }),
+            "HTTP_SECURITY_REQUEST_INVALID",
         )
     })
 })
@@ -121,10 +117,40 @@ describe("HTTP edge installation", () => {
         async (trustProxy) => {
             const edge = await buildEdge()
             const { app } = appWithServer()
-            expect(() => edge.applyHttpSecurity(app, options, { trustProxy })).toThrow(
-                expect.objectContaining({ code: "HTTP_SECURITY_REQUEST_INVALID" }),
+            expect(() => edge.applyHttpSecurity(app, options, { trustProxy })).toThrow("HTTP_SECURITY_REQUEST_INVALID")
+            expect(app.enableCors).not.toHaveBeenCalled()
+        },
+    )
+})
+
+describe("HTTP edge adapter", () => {
+    it.each([null, 1, {}, { disable: jest.fn() }])(
+        "refuses an HTTP adapter whose instance %p is no express application",
+        async (instance) => {
+            const edge = await buildEdge()
+            const { app } = appWithServer()
+            const adapter = mock<ReturnType<INestApplication["getHttpAdapter"]>>()
+            adapter.getInstance.mockReturnValue(instance)
+            app.getHttpAdapter.mockReturnValue(adapter)
+            expect(() => edge.applyHttpSecurity(app, options, { trustProxy: 1 })).toThrow(
+                "HTTP_SECURITY_REQUEST_INVALID",
             )
             expect(app.enableCors).not.toHaveBeenCalled()
         },
     )
+
+    it("accepts an express application that is a function or a plain object", async () => {
+        const edge = await buildEdge()
+        const callable = Object.assign(() => undefined, { disable: jest.fn(), set: jest.fn() })
+        const plain = { disable: jest.fn(), set: jest.fn() }
+        for (const server of [callable, plain]) {
+            const { app } = appWithServer()
+            const adapter = mock<ReturnType<INestApplication["getHttpAdapter"]>>()
+            adapter.getInstance.mockReturnValue(server)
+            app.getHttpAdapter.mockReturnValue(adapter)
+            edge.applyHttpSecurity(app, options, { trustProxy: 1 })
+            expect(server.disable).toHaveBeenCalledWith("x-powered-by")
+            expect(server.set).toHaveBeenCalledWith("trust proxy", 1)
+        }
+    })
 })

package/templates/be/skeleton/src/modules/platform/http-security/edge-security.service.ts

@@ -3,6 +3,19 @@ import type { Express, RequestHandler } from "express"
 import { HttpSecurityError, HttpSecurityErrorCode } from "./errors/http-security.error"
 import type { HttpSecurityOptions } from "./http-security.options"
 
+/** The express application behind the Nest adapter. Nest types the instance `any`; it is read as `unknown` and checked before use. */
+const isExpressApplication = (value: unknown): value is Express =>
+    (typeof value === "function" || (typeof value === "object" && value !== null)) &&
+    typeof Reflect.get(value, "disable") === "function" &&
+    typeof Reflect.get(value, "set") === "function"
+
+const expressOf = (app: INestApplication): Express => {
+    const instance: unknown = app.getHttpAdapter().getInstance()
+    if (!isExpressApplication(instance))
+        throw new HttpSecurityError({ code: HttpSecurityErrorCode.RequestInvalid, params: { fields: "HTTP_ADAPTER" } })
+    return instance
+}
+
 /** The declared ingress hop count and the environment in which HTTP origins may be used. */
 export interface HttpEdgeOptions {
     /** Exact trusted proxy hops; the standard API stack has one ingress in front of it. */
@@ -50,7 +63,7 @@ export const applyHttpSecurity = (app: INestApplication, options: HttpSecurityOp
             code: HttpSecurityErrorCode.RequestInvalid,
             params: { fields: "HTTP_SECURITY_TRUST_PROXY" },
         })
-    const server: Express = app.getHttpAdapter().getInstance()
+    const server = expressOf(app)
     server.disable("x-powered-by")
     server.set("trust proxy", edge.trustProxy)
     app.use(securityHeaders)

package/templates/be/skeleton/src/modules/platform/http-security/origin.guard.spec.ts

@@ -56,8 +56,6 @@ describe("OriginGuard", () => {
     it("refuses a state-changing request from an origin outside the allowlist", async () => {
         const { guard, context } = await build("DELETE", { origin: "https://foreign.test" })
 
-        expect(() => guard.canActivate(context)).toThrow(
-            expect.objectContaining({ code: HttpSecurityErrorCode.OriginRejected }),
-        )
+        expect(() => guard.canActivate(context)).toThrow(HttpSecurityErrorCode.OriginRejected)
     })
 })

package/templates/be/skeleton/src/modules/platform/http-security/rate-limit.guard.spec.ts

@@ -43,8 +43,6 @@ const contextOf = (ip: string | undefined, handler = () => undefined, door: Type
     return { context, setIp: (value: string | undefined) => (address = value) }
 }
 
-const RATE_LIMITED = expect.objectContaining({ code: HttpSecurityErrorCode.RateLimited })
-
 describe("RateLimit", () => {
     it("marks a door with the tier it declares, and the guard counts it under that tier's limit", async () => {
         class Door {}
@@ -55,7 +53,7 @@ describe("RateLimit", () => {
 
         expect(Reflect.getMetadata("platform.http-security.rate-tier", Door)).toBe(RateTier.Strict)
         expect(guard.canActivate(context)).toBe(true)
-        expect(() => guard.canActivate(context)).toThrow(RATE_LIMITED)
+        expect(() => guard.canActivate(context)).toThrow(HttpSecurityErrorCode.RateLimited)
         expect(reflector.getAllAndOverride).toHaveBeenCalledWith("platform.http-security.rate-tier", [handler, Door])
     })
 })
@@ -67,7 +65,7 @@ describe("RateLimitGuard", () => {
 
         expect(guard.canActivate(context)).toBe(true)
         expect(guard.canActivate(context)).toBe(true)
-        expect(() => guard.canActivate(context)).toThrow(RATE_LIMITED)
+        expect(() => guard.canActivate(context)).toThrow(HttpSecurityErrorCode.RateLimited)
     })
 
     it("opens a fresh window for a caller whose bucket expired", async () => {
@@ -77,7 +75,7 @@ describe("RateLimitGuard", () => {
 
         guard.canActivate(context)
         guard.canActivate(context)
-        expect(() => guard.canActivate(context)).toThrow(RATE_LIMITED)
+        expect(() => guard.canActivate(context)).toThrow(HttpSecurityErrorCode.RateLimited)
 
         clock.advance(60_001)
 
@@ -90,7 +88,7 @@ describe("RateLimitGuard", () => {
 
         guard.canActivate(context)
         guard.canActivate(context)
-        expect(() => guard.canActivate(context)).toThrow(RATE_LIMITED)
+        expect(() => guard.canActivate(context)).toThrow(HttpSecurityErrorCode.RateLimited)
     })
 
     it("prunes the expired buckets when the map outgrows the bucket cap", async () => {
@@ -108,6 +106,6 @@ describe("RateLimitGuard", () => {
 
         expect(guard.canActivate(context)).toBe(true)
         expect(guard.canActivate(context)).toBe(true)
-        expect(() => guard.canActivate(context)).toThrow(RATE_LIMITED)
+        expect(() => guard.canActivate(context)).toThrow(HttpSecurityErrorCode.RateLimited)
     })
 })

package/templates/be/skeleton/src/modules/platform/http-security/readiness.service.spec.ts

@@ -7,6 +7,9 @@ import type { Timer } from "@modules/platform/retry"
 import { HTTP_SECURITY_ERROR_KINDS, HttpSecurityError, HttpSecurityErrorCode } from "./errors/http-security.error"
 import { ReadinessService } from "./readiness.service"
 
+/** Asymmetric matchers read as `unknown`: jest types them `any`, which may not flow into a property or a typed argument. */
+const anyOf = (type: unknown): unknown => expect.any(type)
+
 const build = async () => {
     const database = mock<DatabaseProbeService>()
     const timer = mock<Timer>()
@@ -30,7 +33,7 @@ describe("ReadinessService", () => {
         await expect(service.probeRequired()).resolves.toEqual({ ok: true })
 
         expect(database.probe).toHaveBeenCalledTimes(1)
-        expect(timer.schedule).toHaveBeenCalledWith(expect.any(Function), 1000)
+        expect(timer.schedule).toHaveBeenCalledWith(anyOf(Function), 1000)
     })
 
     it("preserves the database failure under the unavailable error kind that answers 503", async () => {
@@ -54,7 +57,7 @@ describe("ReadinessService", () => {
             cause: new Error("Required database readiness timed out"),
         })
 
-        expect(timer.schedule).toHaveBeenCalledWith(expect.any(Function), 1000)
+        expect(timer.schedule).toHaveBeenCalledWith(anyOf(Function), 1000)
         timer.schedule.mock.calls.at(0)?.[0]()
         await expected
         expect(cancel).toHaveBeenCalledTimes(1)

package/templates/be/skeleton/src/modules/platform/http-security/readiness.service.ts

@@ -6,6 +6,9 @@ import type { Timer } from "@modules/platform/retry"
 import { HttpSecurityError, HttpSecurityErrorCode } from "./errors/http-security.error"
 import type { ReadinessReport } from "./readiness.contracts"
 
+/** The cancel of a deadline that was never scheduled. */
+const noCancel = (): void => undefined
+
 const READINESS_TIMEOUT_MS = 1000
 
 @Injectable()
@@ -18,7 +21,7 @@ export class ReadinessService {
 
     /** Returns ready only when the required primary database answers within one second. */
     async probeRequired(): Promise<ReadinessReport> {
-        let cancel: () => void = () => undefined
+        let cancel: () => void = noCancel
         try {
             await Promise.race([
                 this.database.probe(),

package/templates/be/skeleton/src/modules/platform/http-security/request-validation.service.spec.ts

@@ -17,7 +17,7 @@ describe("RequestValidationService", () => {
     const metadata = { type: "body" as const, metatype: SignUpBody }
 
     it("returns the body as an instance of its declared class", async () => {
-        const body = await (await build()).transform({ name: "An Nguyen" }, metadata)
+        const body: unknown = await (await build()).transform({ name: "An Nguyen" }, metadata)
 
         expect(body).toBeInstanceOf(SignUpBody)
         expect(body).toEqual({ name: "An Nguyen" })

package/templates/be/skeleton/src/modules/platform/http-security/webhook-signature.service.spec.ts

@@ -34,8 +34,6 @@ const build = async () => {
     return { service: moduleRef.get(WebhookSignatureService), clock }
 }
 
-const refusal = (code: HttpSecurityErrorCode) => expect.objectContaining({ code })
-
 const signedPartCases = () => {
     it("accepts a current delivery signed with the configured secret", async () => {
         const { service } = await build()
@@ -61,7 +59,7 @@ const signedPartCases = () => {
                 signature: "sha256=x",
                 timestamp: "1",
             }),
-        ).toThrow(refusal(HttpSecurityErrorCode.WebhookProviderUnknown))
+        ).toThrow(HttpSecurityErrorCode.WebhookProviderUnknown)
     })
 
     it.each([
@@ -77,7 +75,7 @@ const signedPartCases = () => {
         const { service } = await build()
 
         expect(() => service.verify({ provider: "payments", ...part })).toThrow(
-            refusal(HttpSecurityErrorCode.WebhookSignatureInvalid),
+            HttpSecurityErrorCode.WebhookSignatureInvalid,
         )
     })
 }
@@ -94,7 +92,7 @@ const digestCases = () => {
                 signature: sign(timestamp),
                 timestamp,
             }),
-        ).toThrow(refusal(HttpSecurityErrorCode.WebhookSignatureInvalid))
+        ).toThrow(HttpSecurityErrorCode.WebhookSignatureInvalid)
     })
 
     it("refuses a signature of another length and one made with another secret", async () => {
@@ -108,7 +106,7 @@ const digestCases = () => {
                 signature: "sha256=abc",
                 timestamp,
             }),
-        ).toThrow(refusal(HttpSecurityErrorCode.WebhookSignatureInvalid))
+        ).toThrow(HttpSecurityErrorCode.WebhookSignatureInvalid)
         expect(() =>
             service.verify({
                 provider: "payments",
@@ -116,7 +114,7 @@ const digestCases = () => {
                 signature: `sha256=${sign(timestamp, BODY, "other")}`,
                 timestamp,
             }),
-        ).toThrow(refusal(HttpSecurityErrorCode.WebhookSignatureInvalid))
+        ).toThrow(HttpSecurityErrorCode.WebhookSignatureInvalid)
     })
 
     it("refuses a delivery whose body was changed after signing", async () => {
@@ -130,7 +128,7 @@ const digestCases = () => {
                 signature: `sha256=${sign(timestamp)}`,
                 timestamp,
             }),
-        ).toThrow(refusal(HttpSecurityErrorCode.WebhookSignatureInvalid))
+        ).toThrow(HttpSecurityErrorCode.WebhookSignatureInvalid)
     })
 }
 
@@ -147,7 +145,7 @@ const replayWindowCases = () => {
                 signature: `sha256=${sign(stale)}`,
                 timestamp: stale,
             }),
-        ).toThrow(refusal(HttpSecurityErrorCode.WebhookReplayed))
+        ).toThrow(HttpSecurityErrorCode.WebhookReplayed)
         expect(() =>
             service.verify({
                 provider: "payments",
@@ -155,7 +153,7 @@ const replayWindowCases = () => {
                 signature: `sha256=${sign(future)}`,
                 timestamp: future,
             }),
-        ).toThrow(refusal(HttpSecurityErrorCode.WebhookReplayed))
+        ).toThrow(HttpSecurityErrorCode.WebhookReplayed)
     })
 
     it("accepts a delivery exactly at the edge of the replay window", async () => {

package/templates/be/skeleton/src/modules/platform/logging/json-logger.service.spec.ts

@@ -10,8 +10,9 @@ type WrittenLine = { stream: "out" | "err"; line: string }
 
 const readJsonLine = (line: string | undefined): Record<string, unknown> => {
     try {
-        const entry: Record<string, unknown> = JSON.parse(line ?? "")
-        return entry
+        const entry: unknown = JSON.parse(line ?? "")
+        if (typeof entry !== "object" || entry === null) return {}
+        return { ...entry }
     } catch (error) {
         throw error
     }

package/templates/be/skeleton/src/modules/platform/primitives/outcome.mapper.spec.ts

@@ -2,6 +2,16 @@ import { Test } from "@nestjs/testing"
 import { DomainError } from "@modules/platform/errors"
 import { ok, refused, unwrapOutcome } from "./outcome.mapper"
 
+/** What `run` throws, read as `unknown`; the matcher then judges its fields. */
+const thrownBy = (run: () => unknown): unknown => {
+    try {
+        run()
+    } catch (error) {
+        return error
+    }
+    return undefined
+}
+
 type CapabilityErrorCode = "CAPABILITY_REFUSED"
 
 class CapabilityError extends DomainError<CapabilityErrorCode> {}
@@ -54,13 +64,11 @@ describe("outcome mappers", () => {
         it("turns a refusal into the capability error with its parameters", () => {
             const outcome = subject.refused<CapabilityErrorCode>("CAPABILITY_REFUSED", { resource: "value-1" })
 
-            expect(() => subject.unwrapOutcome(outcome, CapabilityError)).toThrow(
-                expect.objectContaining({
-                    name: "CapabilityError",
-                    code: "CAPABILITY_REFUSED",
-                    params: { resource: "value-1" },
-                }),
-            )
+            expect(thrownBy(() => subject.unwrapOutcome(outcome, CapabilityError))).toMatchObject({
+                name: "CapabilityError",
+                code: "CAPABILITY_REFUSED",
+                params: { resource: "value-1" },
+            })
         })
     })
 })

package/templates/be/skeleton/src/modules/platform/primitives/outcome.mapper.ts

@@ -8,7 +8,7 @@ export const ok = <V>(value: V): OutcomeOk<V> => ({ kind: "ok", value })
 export const refused = <C extends string>(code: C, params?: ErrorParams): OutcomeRefused<C> => ({
     kind: "refused",
     code,
-    params,
+    ...(params === undefined ? {} : { params }),
 })
 
 /**
@@ -20,5 +20,5 @@ export const unwrapOutcome = <V, C extends K, K extends string>(
     ErrorClass: OutcomeErrorClass<K>,
 ): V => {
     if (outcome.kind === "ok") return outcome.value
-    throw new ErrorClass({ code: outcome.code, params: outcome.params })
+    throw new ErrorClass({ code: outcome.code, ...(outcome.params === undefined ? {} : { params: outcome.params }) })
 }

package/templates/be/skeleton/src/modules/platform/primitives/sequence.policy.spec.ts

@@ -45,7 +45,7 @@ describe("eachInOrder", () => {
             if (item === 2) throw new SequenceError({ code: "STEP_FAILED" })
         })
 
-        await expect(run).rejects.toThrow(expect.objectContaining({ code: "STEP_FAILED" }))
+        await expect(run).rejects.toThrow("STEP_FAILED")
         expect(started).toEqual([1, 2])
     })
 
@@ -54,6 +54,6 @@ describe("eachInOrder", () => {
             throw new SequenceError({ code: "STEP_FAILED" })
         })
 
-        await expect(run).rejects.toThrow(expect.objectContaining({ code: "STEP_FAILED" }))
+        await expect(run).rejects.toThrow("STEP_FAILED")
     })
 })

package/templates/be/skeleton/src/tests/contract/http-security/http-security.contract-spec.ts

@@ -43,12 +43,12 @@ describe("HTTP security environment contract", () => {
                     HTTP_SECURITY_ALLOWED_ORIGINS: "http://web.example",
                 }),
             ),
-        ).toThrow(expect.objectContaining({ code: "HTTP_SECURITY_REQUEST_INVALID" }))
+        ).toThrow("HTTP_SECURITY_REQUEST_INVALID")
     })
 
     it("rejects an empty allowlist entry after a comma", () => {
         expect(() =>
             parseHttpSecurityConfig(new EnvSource({ HTTP_SECURITY_ALLOWED_ORIGINS: "https://web.example," })),
-        ).toThrow(expect.objectContaining({ code: "HTTP_SECURITY_REQUEST_INVALID" }))
+        ).toThrow("HTTP_SECURITY_REQUEST_INVALID")
     })
 })

package/templates/be/skeleton-lite/src/modules/domain/identity/admission.policy.spec.ts

@@ -9,10 +9,14 @@ const principal: Principal = { id: "user-1", role: "authenticated" }
 
 const ADMISSION: unique symbol = Symbol("identity.admission")
 
+/** A record is read as metadata whatever its fields: the admission under test is what judges the reason. */
+const isMetadata = (value: unknown): value is PublicMetadata => typeof value === "object" && value !== null
+
 const runtimeMetadata = (source: string): PublicMetadata => {
     try {
-        const metadata: PublicMetadata = JSON.parse(source)
-        return metadata
+        const parsed: unknown = JSON.parse(source)
+        if (!isMetadata(parsed)) throw new IdentityError({ code: IdentityErrorCode.Unauthenticated })
+        return parsed
     } catch (cause) {
         throw new IdentityError({ code: IdentityErrorCode.Unauthenticated, cause })
     }

package/templates/be/skeleton-lite/src/modules/domain/identity/auth.guard.spec.ts

@@ -18,6 +18,13 @@ const principal: Principal = { id: "user-1", role: "authenticated" }
 const API_KEY: CredentialPrincipal = { kind: "api-key", subject: "key-1", workspaceId: "ws-1" }
 const TOOL_TOKEN: CredentialPrincipal = { kind: "tool-token", subject: "tool-1", workspaceId: "ws-1" }
 
+/** The slice of the request the guard reads; an absent principal is an explicit undefined, never a mock function. */
+interface GuardRequest {
+    headers: Request["headers"]
+    principal: Principal | undefined
+    credentialPrincipal: CredentialPrincipal | undefined
+}
+
 const build = async (metadata: PublicMetadata | undefined, credential?: CredentialMetadata) => {
     const verifier = mock<{ verify: VerifySupabaseAccessToken }>()
     const reflector = mock<Reflector>()
@@ -39,10 +46,11 @@ const contextOf = (
     credentialPrincipal?: CredentialPrincipal,
     sessionPrincipal?: Principal,
 ) => {
-    const request = mock<Request>()
-    request.headers = authorization === undefined ? {} : { authorization }
-    request.principal = sessionPrincipal
-    request.credentialPrincipal = credentialPrincipal
+    const request = mock<GuardRequest>({
+        headers: authorization === undefined ? {} : { authorization },
+        principal: sessionPrincipal,
+        credentialPrincipal,
+    })
     const http = mock<ReturnType<ExecutionContext["switchToHttp"]>>()
     http.getRequest.mockReturnValue(request)
     const context = mock<ExecutionContext>()
@@ -53,8 +61,6 @@ const contextOf = (
     return { context, request }
 }
 
-const unauthenticated = expect.objectContaining({ code: IdentityErrorCode.Unauthenticated })
-
 describe("AuthGuard", () => {
     it("lets a public door through without reading a token", async () => {
         const { guard, verify } = await build({ reason: PublicReason.Health })
@@ -100,7 +106,7 @@ describe("AuthGuard credential doors", () => {
             verify.mockResolvedValue(ok(principal))
             const { context } = contextOf("Bearer signed-token", credentialPrincipal, principal)
 
-            await expect(guard.canActivate(context)).rejects.toThrow(unauthenticated)
+            await expect(guard.canActivate(context)).rejects.toThrow(IdentityErrorCode.Unauthenticated)
 
             expect(verify).not.toHaveBeenCalled()
         },
@@ -115,7 +121,7 @@ describe("AuthGuard credential doors", () => {
             const { guard, verify } = await build({ reason: PublicReason.Health }, { kind: "api-key" })
             const { context } = contextOf("Bearer signed-token", credentialPrincipal, principal)
 
-            await expect(guard.canActivate(context)).rejects.toThrow(unauthenticated)
+            await expect(guard.canActivate(context)).rejects.toThrow(IdentityErrorCode.Unauthenticated)
 
             expect(verify).not.toHaveBeenCalled()
         },
@@ -126,7 +132,7 @@ describe("AuthGuard credential doors", () => {
         verify.mockResolvedValue(refused(SupabaseErrorCode.AccessTokenInvalid))
         const { context, request } = contextOf("bearer forged-token")
 
-        await expect(guard.canActivate(context)).rejects.toThrow(unauthenticated)
+        await expect(guard.canActivate(context)).rejects.toThrow(IdentityErrorCode.Unauthenticated)
 
         expect(request.principal).toBeUndefined()
     })
@@ -140,7 +146,7 @@ describe("AuthGuard credential doors", () => {
         const { guard, verify } = await build(undefined)
         const { context } = contextOf(authorization)
 
-        await expect(guard.canActivate(context)).rejects.toThrow(unauthenticated)
+        await expect(guard.canActivate(context)).rejects.toThrow(IdentityErrorCode.Unauthenticated)
 
         expect(verify).not.toHaveBeenCalled()
     })

package/templates/be/skeleton-lite/src/modules/platform/database/database.module.ts

@@ -9,6 +9,10 @@ import { DatabaseError, DatabaseErrorCode } from "./errors/database.error"
 import { PRIMARY_CONNECTION } from "./primary.connection"
 import { DATABASE_PROBE, PRIMARY_ENTITY_MANAGER } from "./primary.decorators"
 
+/** The `schema` option of a connection, left out when the connection names none. */
+const schemaOption = (schema: string | undefined): Partial<Record<"schema", string>> =>
+    schema === undefined ? {} : { schema }
+
 /** The token each declared connection provides its shared EntityManager under. */
 type EntityManagerToken = typeof PRIMARY_ENTITY_MANAGER
 
@@ -48,7 +52,7 @@ export class DatabaseModule extends ConfigurableModuleClass {
                         name: connection.name,
                         type: "postgres",
                         url: connection.url.reveal(),
-                        schema: connection.schema,
+                        ...schemaOption(connection.schema),
                         synchronize: false,
                         retryAttempts: 2,
                     }),