@things-factory/auth-base 10.1.106 → 10.1.107

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@things-factory/auth-base",
-  "version": "10.1.106",
+  "version": "10.1.107",
   "main": "dist-server/index.js",
   "browser": "dist-client/index.js",
   "things-factory": true,
@@ -48,5 +48,5 @@
     "passport-jwt": "^4.0.0",
     "passport-local": "^1.0.0"
   },
-  "gitHead": "8d78c14708420773ec32d18b8dd44c300771c44d"
+  "gitHead": "65a3d5889e687d8122a65f029b926b1a4769d1c0"
 }

package/tests/access-assistant-db.test.ts

@@ -0,0 +1,155 @@
+/**
+ * What the assistant reads to draft access decisions (ADR-0103 decision 6).
+ *
+ * Two facts are held here. The read tool answers only this domain, only to someone who may decide, never the
+ * caller's own requests. And a pending request handed over as the screen's context does not reach the model's
+ * prompt - which is why the tool exists; if that ever changes, this file says so.
+ */
+import { registryAssistantChat } from '../../ai-client-base/server/service/assistant/registry-assistant'
+import { clearToolRegistry, registerToolCategory } from '../../ai-client-base/server/service/tool-registry/index.js'
+
+import { closeAuthDatabase, Domain, getRepository, openAuthDatabase, resetAuthDatabase } from './db'
+import { loadCompiled } from './compiled'
+
+import uiEn from '../../auth-ui/translations/en.json'
+import uiKo from '../../auth-ui/translations/ko.json'
+
+const { Role } = loadCompiled('service/role/role')
+const { Privilege } = loadCompiled('service/privilege/privilege')
+const { User } = loadCompiled('service/user/user')
+const { DomainOwner } = loadCompiled('service/domain-owner/domain-owner')
+const { AccessRequest } = loadCompiled('service/access-request/access-request')
+const access = loadCompiled('controllers/access-request')
+const assistant = loadCompiled('ai-entry/access-assistant')
+const targets = loadCompiled('ai-entry/access-entry-targets')
+
+let domain: any
+let other: any
+let kim: any
+let lee: any
+let park: any
+let owner: any
+let worker: any
+let otherAdmin: any
+
+async function makeUser(name: string, domains: any[], roles: any[] = []) {
+  return await getRepository(User).save({
+    username: name, email: `${name}@example.com`, name, salt: User.generateSalt(), status: 'activated', domains, roles
+  })
+}
+
+const ask = (user: any, privilege = 'mutation', inDomain = domain) =>
+  access.requestAccess({ category: 'warehouse', privilege, reason: 'needed for work' }, { state: { domain: inDomain, user, afterCommit: [] } } as any)
+
+beforeAll(async () => {
+  await openAuthDatabase()
+})
+
+afterAll(async () => {
+  await closeAuthDatabase()
+})
+
+beforeEach(async () => {
+  await resetAuthDatabase()
+  ;(process as any).domainOwnerGranted = async (d: any, u: any) =>
+    !!(await getRepository(DomainOwner).findOne({ where: { domain: { id: d.id }, user: { id: u.id } } }))
+  ;(process as any).superUserGranted = async () => false
+
+  domain = await getRepository(Domain).findOneBy({ id: (await getRepository(Domain).save({ name: 'Plant A', subdomain: 'plant-a' })).id })
+  other = await getRepository(Domain).findOneBy({ id: (await getRepository(Domain).save({ name: 'Other', subdomain: 'other' })).id })
+
+  const mutation = await getRepository(Privilege).save({ name: 'mutation', category: 'warehouse' })
+  await getRepository(Privilege).save({ name: 'query', category: 'warehouse' })
+  const grant = await getRepository(Privilege).save({ name: 'mutation', category: 'user' })
+  await getRepository(Role).save({ name: 'inbound', domain, privileges: [mutation] })
+  const admins = await getRepository(Role).save({ name: 'admins', domain, privileges: [grant] })
+  const otherAdmins = await getRepository(Role).save({ name: 'admins', domain: other, privileges: [grant] })
+
+  kim = await makeUser('kim', [domain])
+  lee = await makeUser('lee', [domain])
+  park = await makeUser('park', [domain], [admins])
+  owner = await makeUser('owner', [domain])
+  worker = await makeUser('worker', [domain])
+  otherAdmin = await makeUser('otheradmin', [other], [otherAdmins])
+  await getRepository(DomainOwner).save({ domain, user: owner })
+})
+
+afterEach(() => {
+  delete (process as any).domainOwnerGranted
+  delete (process as any).superUserGranted
+})
+
+describe('listPendingAccessRequests', () => {
+  it('★ a decider reads this domain\'s waiting requests with the roles that grant each', async () => {
+    await ask(kim)
+    const answer = await assistant.pendingRequestsToDecide({ domain, user: park })
+    expect(answer.requests).toEqual([
+      expect.objectContaining({ requester: 'kim', privilege: 'warehouse:mutation', roles: [{ name: 'inbound', privilegeCount: 1 }] })
+    ])
+  })
+
+  it('★ another domain\'s requests are not read - even by a decider there', async () => {
+    await ask(kim)
+    const there = await assistant.pendingRequestsToDecide({ domain: other, user: otherAdmin })
+    expect(there.requests).toEqual([])
+  })
+
+  it('★ someone who may not decide is refused - nothing is read', async () => {
+    await ask(kim)
+    expect(await assistant.pendingRequestsToDecide({ domain, user: worker })).toEqual({ refused: 'not-a-decider' })
+  })
+
+  it('★ the caller\'s own requests are left out - they cannot decide them', async () => {
+    await ask(kim)
+    await ask(owner, 'query')
+    const answer = await assistant.pendingRequestsToDecide({ domain, user: owner })
+    expect(answer.requests.map((r: any) => r.requester)).toEqual(['kim'])
+  })
+
+  it('decided and expired requests are left out', async () => {
+    const decided = await ask(kim)
+    await access.decideAccessRequest({ requestId: decided.id, decision: 'DENY', reason: 'no' }, { state: { domain, user: park, afterCommit: [] } } as any)
+    const late = await ask(lee)
+    await getRepository(AccessRequest).update({ id: late.id }, { expiresAt: new Date(Date.now() - 1000) })
+    expect((await assistant.pendingRequestsToDecide({ domain, user: park })).requests).toEqual([])
+  })
+})
+
+describe('the declarations fit together', () => {
+  afterEach(() => clearToolRegistry())
+
+  it('the category registers, the mode names it and the decision target, the words exist', () => {
+    const category = assistant.accessToolCategory()
+    expect(() => registerToolCategory(category)).not.toThrow()
+    const mode = assistant.accessAssistantMode()
+    expect(mode.toolCategories).toEqual([category.name])
+    expect(mode.entryTargets).toEqual([targets.AUTH_ACCESS_DECISION])
+    expect(mode.subjects).toEqual([assistant.ACCESS_REQUESTS_SUBJECT])
+    for (const dict of [uiEn, uiKo] as Record<string, string>[])
+      for (const key of [mode.labelKey, mode.placeholderKey]) expect([key, typeof dict[key]]).toEqual([key, 'string'])
+  })
+
+  it('★ requests handed over as the screen\'s context do not reach the model\'s prompt - the tool is how it reads them', async () => {
+    registerToolCategory(assistant.accessToolCategory())
+    const seen: any[] = []
+    const client = {
+      chatWithTools: async (messages: any, tools: any[], options: any) => {
+        seen.push({ messages, tools, options })
+        return { text: 'ok', toolCalls: [], stopReason: 'end_turn' }
+      }
+    }
+    await registryAssistantChat({
+      client,
+      messages: [{ role: 'user', content: 'sort out the access requests' }],
+      systemPrompt: assistant.accessAssistantMode().systemPrompt,
+      toolCategories: [assistant.AUTH_ACCESS_TOOLS],
+      hostContext: { pendingRequests: ['MARKER-kim-warehouse-mutation'] },
+      state: { domain, user: park },
+      toolAccess: async () => true
+    } as any)
+
+    expect(JSON.stringify(seen[0].options)).not.toContain('MARKER-kim')
+    expect(JSON.stringify(seen[0].messages)).not.toContain('MARKER-kim')
+    expect(seen[0].tools.map((t: any) => t.name)).toEqual(['listPendingAccessRequests'])
+  })
+})

package/tests/access-entry-targets-db.test.ts

@@ -0,0 +1,138 @@
+/**
+ * The access request's AI 입력 declarations (ADR-0103 decision 4).
+ *
+ * The model drafts and a person presses; the card's check is the review the list screen asks. That last point is
+ * what this file holds above all: the card's findings for a decision equal `reviewDecision` for the same decision.
+ *
+ * The declarations are read from the compiled package so their check reaches the same entities as the database.
+ * The assistant's own validation is asked through its source file, which needs only `graphql`.
+ */
+import { parse } from 'graphql'
+
+import { clearEntryTargets, declareEntryTarget } from '../../ai-assistant/server/service/data-entry/entry-target'
+
+import { closeAuthDatabase, Domain, getRepository, openAuthDatabase, resetAuthDatabase } from './db'
+import { loadCompiled } from './compiled'
+
+import uiEn from '../../auth-ui/translations/en.json'
+import uiKo from '../../auth-ui/translations/ko.json'
+
+const { Role } = loadCompiled('service/role/role')
+const { Privilege } = loadCompiled('service/privilege/privilege')
+const { User } = loadCompiled('service/user/user')
+const access = loadCompiled('controllers/access-request')
+const targets = loadCompiled('ai-entry/access-entry-targets')
+
+const rootFields = (document: string) =>
+  ((parse(document).definitions[0] as any).selectionSet.selections as any[]).map(one => one.name.value)
+
+const row = (values: Record<string, unknown>, index = 0) => ({ index, values, sources: [], issues: [] })
+
+describe('the declarations', () => {
+  afterEach(() => clearEntryTargets())
+
+  it('are accepted by the assistant as declared', () => {
+    for (const target of targets.accessEntryTargets()) expect(() => declareEntryTarget(target)).not.toThrow()
+  })
+
+  it('★ the decision card writes through decideAccessRequest - the person presses it; nothing else is a door', () => {
+    const decision = targets.accessDecisionEntryTarget()
+    expect(rootFields(decision.mutation)).toEqual(['decideAccessRequest'])
+    expect(rootFields(decision.fields.find((f: any) => f.name === 'request').reference.query)).toEqual(['accessRequests'])
+    expect(rootFields(targets.accessRequestEntryTarget().mutation)).toEqual(['requestAccess'])
+  })
+
+  it('a denial carries no role, a grant carries its role id', () => {
+    expect(targets.decisionOf(row({ request: { id: 'q' }, decision: 'DENY', role: { id: 'r' }, reason: 'no' }))).toEqual({
+      requestId: 'q',
+      decision: 'DENY',
+      roleId: undefined,
+      reason: 'no'
+    })
+    expect(targets.decisionOf(row({ request: { id: 'q' }, decision: 'GRANT', role: { id: 'r' } })).roleId).toBe('r')
+  })
+
+  it('a request is named by person or privilege; only pending ones; several stay several', () => {
+    const items = [
+      { id: '1', state: 'PENDING', category: 'warehouse', privilege: 'mutation', requester: { name: '김민수' } },
+      { id: '2', state: 'PENDING', category: 'board', privilege: 'query', requester: { name: '김민지' } },
+      { id: '3', state: 'GRANTED', category: 'warehouse', privilege: 'mutation', requester: { name: '김민수' } }
+    ]
+    expect(targets.requestsNamed(items, '김민수').map((r: any) => r.id)).toEqual(['1'])
+    expect(targets.requestsNamed(items, '김민').map((r: any) => r.id)).toEqual(['1', '2'])
+    expect(targets.requestsNamed(items, 'board:query').map((r: any) => r.label)).toEqual(['김민지 · board:query'])
+  })
+
+  it('every word the card shows is in the screen words', () => {
+    const decision = targets.accessDecisionEntryTarget()
+    const keys = [
+      decision.labelKey,
+      targets.accessRequestEntryTarget().labelKey,
+      ...[...decision.fields, ...targets.accessRequestEntryTarget().fields].map((f: any) => f.labelKey),
+      'access-request.decision.grant',
+      'access-request.decision.deny',
+      'access-request.issue.not-by-role'
+    ]
+    for (const dict of [uiEn, uiKo] as Record<string, string>[]) for (const key of keys) expect([key, typeof dict[key]]).toEqual([key, 'string'])
+  })
+})
+
+describe('the card says what the screen says', () => {
+  let domain: any
+  let kim: any
+  let park: any
+  let inbound: any
+  let manager: any
+
+  beforeAll(async () => {
+    await openAuthDatabase()
+  })
+
+  afterAll(async () => {
+    await closeAuthDatabase()
+  })
+
+  beforeEach(async () => {
+    await resetAuthDatabase()
+    const saved = await getRepository(Domain).save({ name: 'Plant A', subdomain: 'plant-a' })
+    domain = await getRepository(Domain).findOneBy({ id: saved.id })
+    const mutation = await getRepository(Privilege).save({ name: 'mutation', category: 'warehouse' })
+    const query = await getRepository(Privilege).save({ name: 'query', category: 'warehouse' })
+    const grant = await getRepository(Privilege).save({ name: 'mutation', category: 'user' })
+    inbound = await getRepository(Role).save({ name: 'inbound', domain, privileges: [mutation] })
+    manager = await getRepository(Role).save({ name: 'manager', domain, privileges: [mutation, query, grant] })
+    const admins = await getRepository(Role).save({ name: 'admins', domain, privileges: [grant] })
+    const make = (name: string, roles: any[]) =>
+      getRepository(User).save({ username: name, email: `${name}@example.com`, name, salt: User.generateSalt(), status: 'activated', domains: [domain], roles })
+    kim = await make('kim', [])
+    park = await make('park', [admins])
+  })
+
+  const state = (user: any) => ({ domain, user })
+
+  it('★ the card\'s findings are reviewDecision\'s, for grant and for deny', async () => {
+    const request = await access.requestAccess({ category: 'warehouse', privilege: 'mutation', reason: 'inbound' }, { state: { ...state(kim), afterCommit: [] } } as any)
+    const rows = [
+      row({ request: { id: request.id }, decision: 'GRANT', role: { id: manager.id } }, 0),
+      row({ request: { id: request.id }, decision: 'GRANT', role: { id: inbound.id } }, 1),
+      row({ request: { id: request.id }, decision: 'DENY', reason: '' }, 2)
+    ]
+
+    const card = await targets.accessDecisionEntryTarget().check(rows, { state: state(park) })
+
+    for (const [index, one] of rows.entries()) {
+      const screen = await access.reviewDecision(targets.decisionOf(one), { state: state(park) } as any)
+      expect(card[index].map((issue: any) => [issue.code, issue.blocking])).toEqual(screen.map((issue: any) => [issue.code, issue.blocking]))
+    }
+    expect(card[0].map((issue: any) => issue.code)).toContain('role-grants-admin')
+    expect(card[2].map((issue: any) => issue.code)).toEqual(['deny-needs-reason'])
+  })
+
+  it('★ the request card refuses what the door would - already held', async () => {
+    const lee = await getRepository(User).save({
+      username: 'lee', email: 'lee@example.com', name: 'lee', salt: User.generateSalt(), status: 'activated', domains: [domain], roles: [inbound]
+    })
+    const [issues] = await targets.accessRequestEntryTarget().check([row({ category: 'warehouse', privilege: 'mutation' })], { state: state(lee) })
+    expect(issues).toEqual([expect.objectContaining({ code: 'already-holds', blocking: true })])
+  })
+})

package/tests/access-request-db.test.ts

@@ -100,6 +100,7 @@ describe('asking', () => {
     expect(request).toMatchObject({ state: 'PENDING', category: 'warehouse', privilege: 'mutation', count: 1, reason: 'inbound from today' })
     expect(context.notify).toHaveBeenCalledTimes(1)
     expect([...context.notify.mock.calls[0][0].receivers].sort()).toEqual([owner.id, park.id].sort())
+    expect(context.notify.mock.calls[0][0].url).toBe(`access-requests?id=${request.id}`)
   })
 
   it('★ asking again adds to the pending one - no second row, nobody told again', async () => {
@@ -125,7 +126,7 @@ describe('asking', () => {
   })
 
   it('a privilege nobody declared is not asked for', async () => {
-    await expect(access.requestAccess({ category: 'nothing', privilege: 'here' }, contextOf(kim))).rejects.toMatchObject({
+    await expect(access.requestAccess({ category: 'nothing', privilege: 'here', reason: 'x' }, contextOf(kim))).rejects.toMatchObject({
       code: 'access-request-unknown-privilege'
     })
   })
@@ -155,7 +156,9 @@ describe('deciding', () => {
 
     expect(decided).toMatchObject({ state: 'GRANTED', grantedRole: { id: inbound.id } })
     expect(await holds(kim, 'warehouse', 'mutation')).toBe(true)
-    expect(context.notify).toHaveBeenCalledWith(expect.objectContaining({ receivers: [kim.id], title: 'access-request.notify.granted.title' }))
+    expect(context.notify).toHaveBeenCalledWith(
+      expect.objectContaining({ receivers: [kim.id], title: 'access-request.notify.granted.title', url: 'my-access-requests' })
+    )
   })
 
   it('★ deny keeps the reason and tells the requester', async () => {
@@ -217,7 +220,7 @@ describe('deciding', () => {
 
   it('★ a grant closes the same person\'s other requests it now answers', async () => {
     const first = await access.requestAccess(ASK, contextOf(kim))
-    const second = await access.requestAccess({ category: 'warehouse', privilege: 'query' }, contextOf(kim))
+    const second = await access.requestAccess({ category: 'warehouse', privilege: 'query', reason: 'checking stock' }, contextOf(kim))
     await access.decideAccessRequest({ requestId: first.id, decision: 'GRANT', roleId: manager.id }, contextOf(owner))
 
     expect((await getRepository(AccessRequest).findOneBy({ id: second.id })).state).toBe('GRANTED')
@@ -234,3 +237,37 @@ describe('the review as the screen asks it', () => {
     expect(issues.map((i: any) => i.code).sort()).toEqual(['decider-lacks-it', 'role-grants-admin', 'role-grants-more', 'smaller-role-exists'])
   })
 })
+
+describe('asking is not a reflex (questions Q9)', () => {
+  it('★ no reason, no request - blank is no reason', async () => {
+    for (const reason of [undefined, '', '   ']) {
+      await expect(access.requestAccess({ ...ASK, reason }, contextOf(kim))).rejects.toMatchObject({ code: 'access-request-needs-reason' })
+    }
+    expect(await getRepository(AccessRequest).count()).toBe(0)
+  })
+
+  it('★ denied lately: the same words are refused, new words are taken', async () => {
+    const first = await access.requestAccess(ASK, contextOf(kim))
+    await access.decideAccessRequest({ requestId: first.id, decision: 'DENY', reason: 'IT only' }, contextOf(park))
+
+    await expect(access.requestAccess(ASK, contextOf(kim))).rejects.toMatchObject({
+      code: 'access-request-same-reason-as-denied',
+      params: { reason: 'IT only' }
+    })
+    const again = await access.requestAccess({ ...ASK, reason: 'moved to the inbound team this week' }, contextOf(kim))
+    expect(again.state).toBe('PENDING')
+  })
+
+  it('a denial older than seven days holds nothing against the same words', async () => {
+    const first = await access.requestAccess(ASK, contextOf(kim))
+    await access.decideAccessRequest({ requestId: first.id, decision: 'DENY', reason: 'not now' }, contextOf(park))
+    await getRepository(AccessRequest).update({ id: first.id }, { decidedAt: new Date(Date.now() - 8 * 24 * 60 * 60 * 1000) })
+    expect((await access.requestAccess(ASK, contextOf(kim))).state).toBe('PENDING')
+  })
+
+  it('★ the popup can say how many people a request reaches - not who', async () => {
+    const { AccessRequestQuery } = loadCompiled('service/access-request/access-request-query')
+    expect(await new AccessRequestQuery().accessRequestDeciderCount(contextOf(kim))).toBe(2)
+    expect(await new AccessRequestQuery().accessRequestDeciderCount(contextOf(park))).toBe(1)
+  })
+})

package/tests/access-request-pg.test.ts

@@ -0,0 +1,72 @@
+/**
+ * The access request under real concurrency - postgres only (`AUTH_TEST_PG`). sqlite holds one connection and
+ * cannot show two transactions racing (feedback: verify concurrency on postgres).
+ *
+ * Each call runs in its own transaction, as the `@transaction` door gives it.
+ */
+import { authDataSource, closeAuthDatabase, Domain, getRepository, openAuthDatabase, resetAuthDatabase } from './db'
+import { loadCompiled } from './compiled'
+
+const { Role } = loadCompiled('service/role/role')
+const { Privilege } = loadCompiled('service/privilege/privilege')
+const { User } = loadCompiled('service/user/user')
+const { AccessRequest } = loadCompiled('service/access-request/access-request')
+const access = loadCompiled('controllers/access-request')
+
+const onPostgres = process.env.AUTH_TEST_PG ? describe : describe.skip
+
+onPostgres('on postgres', () => {
+  let domain: any
+  let kim: any
+  let park: any
+  let owner: any
+  let inbound: any
+
+  const inTransaction = <T>(user: any, run: (context: any) => Promise<T>) =>
+    authDataSource().transaction(tx => run({ state: { domain, user, tx, afterCommit: [] }, t: (key: string) => key }))
+
+  beforeAll(async () => {
+    await openAuthDatabase()
+  })
+
+  afterAll(async () => {
+    await closeAuthDatabase()
+  })
+
+  beforeEach(async () => {
+    await resetAuthDatabase()
+    domain = await getRepository(Domain).findOneBy({ id: (await getRepository(Domain).save({ name: 'Plant A', subdomain: 'plant-a' })).id })
+    const mutation = await getRepository(Privilege).save({ name: 'mutation', category: 'warehouse' })
+    const grant = await getRepository(Privilege).save({ name: 'mutation', category: 'user' })
+    inbound = await getRepository(Role).save({ name: 'inbound', domain, privileges: [mutation] })
+    const admins = await getRepository(Role).save({ name: 'admins', domain, privileges: [grant] })
+    const make = (name: string, roles: any[] = []) =>
+      getRepository(User).save({ username: name, email: `${name}@example.com`, name, salt: User.generateSalt(), status: 'activated', domains: [domain], roles })
+    kim = await make('kim')
+    park = await make('park', [admins])
+    owner = await make('owner', [admins])
+  })
+
+  it('★ two people deciding at once, each in a transaction - exactly one wins, and the loser leaves nothing', async () => {
+    const request = await inTransaction(kim, context => access.requestAccess({ category: 'warehouse', privilege: 'mutation', reason: 'inbound' }, context))
+
+    const results = await Promise.allSettled([
+      inTransaction(owner, context => access.decideAccessRequest({ requestId: request.id, decision: 'DENY', reason: 'no' }, context)),
+      inTransaction(park, context => access.decideAccessRequest({ requestId: request.id, decision: 'GRANT', roleId: inbound.id }, context))
+    ])
+
+    expect(results.map(r => r.status).sort()).toEqual(['fulfilled', 'rejected'])
+    const stored = await getRepository(AccessRequest).findOne({ where: { id: request.id }, relations: ['grantedRole'] })
+    const holds = await User.hasPrivilege('mutation', 'warehouse', domain, kim)
+    /* The role is given exactly when the stored decision is a grant - a losing grant does not leave the role behind. */
+    expect(holds).toBe(stored.state === 'GRANTED')
+  })
+
+  it('★ the same person asking twice at once - one pending request, not two', async () => {
+    await Promise.allSettled([
+      inTransaction(kim, context => access.requestAccess({ category: 'warehouse', privilege: 'mutation', reason: 'inbound' }, context)),
+      inTransaction(kim, context => access.requestAccess({ category: 'warehouse', privilege: 'mutation', reason: 'inbound' }, context))
+    ])
+    expect(await getRepository(AccessRequest).count({ where: { state: 'PENDING' } })).toBe(1)
+  })
+})

package/tests/privilege-directive.test.ts

@@ -312,3 +312,21 @@ describe('거절이 이유를 싣는다 (ADR-0103 결정 1)', () => {
     expect((result.errors![0].extensions as any).because).toBe('address')
   })
 })
+
+describe('거절이 무엇이 막혔는지도 싣는다 — 변경인가 조회인가 (질문지 Q9 · 4)', () => {
+  it('★ 조회가 막히면 operation: query', async () => {
+    const result = await run(buildSchema(), 'guardedBoard')
+    expect((result.errors![0].extensions as any).operation).toBe('query')
+  })
+
+  it('★ 변경이 막히면 operation: mutation — 사람이 누른 일이다', async () => {
+    const schema = privilegeDirectiveResolver(
+      makeExecutableSchema({
+        typeDefs: [privilegeDirectiveTypeDefs, 'type Query { ok: String } type Mutation { saveBoard: String @privilege(category: "board", privilege: "mutation") }'],
+        resolvers: { Query: { ok: () => 'ok' }, Mutation: { saveBoard: () => 'saved' } }
+      })
+    )
+    const result = await graphql({ schema, source: 'mutation { saveBoard }', contextValue: { state: { domain: DOMAIN, user: USER } } })
+    expect((result.errors![0].extensions as any)).toMatchObject({ because: 'role', operation: 'mutation' })
+  })
+})

package/translations/en.json

@@ -247,5 +247,7 @@
   "access-request.notify.granted.title": "access granted",
   "access-request.notify.granted.body": "you now have {privilege} (role: {role}).",
   "access-request.notify.denied.title": "access request denied",
-  "access-request.notify.denied.body": "{privilege}: {reason}"
+  "access-request.notify.denied.body": "{privilege}: {reason}",
+  "error.access-request-needs-reason": "write why you need it.",
+  "error.access-request-same-reason-as-denied": "this was denied lately for the same reason ({reason}). write what has changed."
 }

package/translations/ja.json

@@ -247,5 +247,7 @@
   "access-request.notify.granted.title": "権限が付与されました",
   "access-request.notify.granted.body": "{privilege} 権限が付与されました(ロール: {role})。",
   "access-request.notify.denied.title": "権限リクエストが拒否されました",
-  "access-request.notify.denied.body": "{privilege}: {reason}"
+  "access-request.notify.denied.body": "{privilege}: {reason}",
+  "error.access-request-needs-reason": "必要な理由を書いてください。",
+  "error.access-request-same-reason-as-denied": "同じ理由で最近拒否されました({reason})。何が変わったかを書いてください。"
 }

package/translations/ko.json

@@ -247,5 +247,7 @@
   "access-request.notify.granted.title": "권한을 받았습니다",
   "access-request.notify.granted.body": "{privilege} 권한을 받았습니다(역할: {role}).",
   "access-request.notify.denied.title": "권한 요청이 거부되었습니다",
-  "access-request.notify.denied.body": "{privilege}: {reason}"
+  "access-request.notify.denied.body": "{privilege}: {reason}",
+  "error.access-request-needs-reason": "필요한 까닭을 적어 주세요.",
+  "error.access-request-same-reason-as-denied": "같은 까닭으로 최근에 거부되었습니다({reason}). 무엇이 달라졌는지 적어 주세요."
 }

package/translations/ms.json

@@ -247,5 +247,7 @@
   "access-request.notify.granted.title": "akses diberikan",
   "access-request.notify.granted.body": "anda kini mempunyai {privilege} (peranan: {role}).",
   "access-request.notify.denied.title": "permintaan akses ditolak",
-  "access-request.notify.denied.body": "{privilege}: {reason}"
+  "access-request.notify.denied.body": "{privilege}: {reason}",
+  "error.access-request-needs-reason": "tulis sebab anda memerlukannya.",
+  "error.access-request-same-reason-as-denied": "ini ditolak baru-baru ini atas sebab yang sama ({reason}). tulis apa yang telah berubah."
 }

package/translations/zh.json

@@ -247,5 +247,7 @@
   "access-request.notify.granted.title": "权限已授予",
   "access-request.notify.granted.body": "您已获得 {privilege} 权限(角色: {role})。",
   "access-request.notify.denied.title": "权限请求被拒绝",
-  "access-request.notify.denied.body": "{privilege}: {reason}"
+  "access-request.notify.denied.body": "{privilege}: {reason}",
+  "error.access-request-needs-reason": "请填写需要的理由。",
+  "error.access-request-same-reason-as-denied": "最近以相同理由被拒绝({reason})。请写明有何变化。"
 }