@things-factory/auth-base 10.1.106 → 10.1.111

package/tests/access-request-db.test.ts

@@ -100,6 +100,7 @@ describe('asking', () => {
     expect(request).toMatchObject({ state: 'PENDING', category: 'warehouse', privilege: 'mutation', count: 1, reason: 'inbound from today' })
     expect(context.notify).toHaveBeenCalledTimes(1)
     expect([...context.notify.mock.calls[0][0].receivers].sort()).toEqual([owner.id, park.id].sort())
+    expect(context.notify.mock.calls[0][0].url).toBe(`access-requests?id=${request.id}`)
   })
 
   it('★ asking again adds to the pending one - no second row, nobody told again', async () => {
@@ -125,7 +126,7 @@ describe('asking', () => {
   })
 
   it('a privilege nobody declared is not asked for', async () => {
-    await expect(access.requestAccess({ category: 'nothing', privilege: 'here' }, contextOf(kim))).rejects.toMatchObject({
+    await expect(access.requestAccess({ category: 'nothing', privilege: 'here', reason: 'x' }, contextOf(kim))).rejects.toMatchObject({
       code: 'access-request-unknown-privilege'
     })
   })
@@ -155,7 +156,9 @@ describe('deciding', () => {
 
     expect(decided).toMatchObject({ state: 'GRANTED', grantedRole: { id: inbound.id } })
     expect(await holds(kim, 'warehouse', 'mutation')).toBe(true)
-    expect(context.notify).toHaveBeenCalledWith(expect.objectContaining({ receivers: [kim.id], title: 'access-request.notify.granted.title' }))
+    expect(context.notify).toHaveBeenCalledWith(
+      expect.objectContaining({ receivers: [kim.id], title: 'access-request.notify.granted.title', url: 'my-access-requests' })
+    )
   })
 
   it('★ deny keeps the reason and tells the requester', async () => {
@@ -217,7 +220,7 @@ describe('deciding', () => {
 
   it('★ a grant closes the same person\'s other requests it now answers', async () => {
     const first = await access.requestAccess(ASK, contextOf(kim))
-    const second = await access.requestAccess({ category: 'warehouse', privilege: 'query' }, contextOf(kim))
+    const second = await access.requestAccess({ category: 'warehouse', privilege: 'query', reason: 'checking stock' }, contextOf(kim))
     await access.decideAccessRequest({ requestId: first.id, decision: 'GRANT', roleId: manager.id }, contextOf(owner))
 
     expect((await getRepository(AccessRequest).findOneBy({ id: second.id })).state).toBe('GRANTED')
@@ -234,3 +237,81 @@ describe('the review as the screen asks it', () => {
     expect(issues.map((i: any) => i.code).sort()).toEqual(['decider-lacks-it', 'role-grants-admin', 'role-grants-more', 'smaller-role-exists'])
   })
 })
+
+describe('asking is not a reflex (questions Q9)', () => {
+  it('★ no reason, no request - blank is no reason', async () => {
+    for (const reason of [undefined, '', '   ']) {
+      await expect(access.requestAccess({ ...ASK, reason }, contextOf(kim))).rejects.toMatchObject({ code: 'access-request-needs-reason' })
+    }
+    expect(await getRepository(AccessRequest).count()).toBe(0)
+  })
+
+  it('★ denied lately: the same words are refused, new words are taken', async () => {
+    const first = await access.requestAccess(ASK, contextOf(kim))
+    await access.decideAccessRequest({ requestId: first.id, decision: 'DENY', reason: 'IT only' }, contextOf(park))
+
+    await expect(access.requestAccess(ASK, contextOf(kim))).rejects.toMatchObject({
+      code: 'access-request-same-reason-as-denied',
+      params: { reason: 'IT only' }
+    })
+    const again = await access.requestAccess({ ...ASK, reason: 'moved to the inbound team this week' }, contextOf(kim))
+    expect(again.state).toBe('PENDING')
+  })
+
+  it('a denial older than seven days holds nothing against the same words', async () => {
+    const first = await access.requestAccess(ASK, contextOf(kim))
+    await access.decideAccessRequest({ requestId: first.id, decision: 'DENY', reason: 'not now' }, contextOf(park))
+    await getRepository(AccessRequest).update({ id: first.id }, { decidedAt: new Date(Date.now() - 8 * 24 * 60 * 60 * 1000) })
+    expect((await access.requestAccess(ASK, contextOf(kim))).state).toBe('PENDING')
+  })
+
+  it('★ the popup can say how many people a request reaches - not who', async () => {
+    const { AccessRequestQuery } = loadCompiled('service/access-request/access-request-query')
+    expect(await new AccessRequestQuery().accessRequestDeciderCount(contextOf(kim))).toBe(2)
+    expect(await new AccessRequestQuery().accessRequestDeciderCount(contextOf(park))).toBe(1)
+  })
+})
+
+describe('found in review (2026-10-02)', () => {
+  const { AccessRequestQuery } = loadCompiled('service/access-request/access-request-query')
+
+  it('★ the list is this domain\'s only - asking for the parent\'s with inherited: Only reads nothing', async () => {
+    await access.requestAccess(ASK, contextOf(kim))
+    const savedChild = await getRepository(Domain).save({ name: 'Plant A-1', subdomain: 'plant-a-1', parent: domain })
+    const child = await getRepository(Domain).findOneBy({ id: savedChild.id })
+    const childAdmin = await makeUser('childadmin', [child])
+    const answer = await new AccessRequestQuery().accessRequests({ inherited: 'Only' } as any, { state: { domain: child, user: childAdmin } } as any)
+    expect(answer.items).toEqual([])
+  })
+
+  it('★ ask, withdraw, ask again: one row, and the deciders are told once', async () => {
+    const first = contextOf(kim)
+    const request = await access.requestAccess(ASK, first)
+    await commit(first)
+    await access.withdrawAccessRequest(request.id, contextOf(kim))
+    const again = contextOf(kim)
+    const back = await access.requestAccess({ ...ASK, reason: 'needed after all' }, again)
+    await commit(again)
+
+    expect(back.id).toBe(request.id)
+    expect(back.state).toBe('PENDING')
+    expect(await getRepository(AccessRequest).count()).toBe(1)
+    expect(first.notify).toHaveBeenCalledTimes(1)
+    expect(again.notify).not.toHaveBeenCalled()
+  })
+
+  it('★ a decision may name a parent domain\'s role - the scope the list screen offers', async () => {
+    const savedChild = await getRepository(Domain).save({ name: 'Plant A-2', subdomain: 'plant-a-2', parent: domain })
+    const child = await getRepository(Domain).findOneBy({ id: savedChild.id })
+    const found = await new AccessRequestQuery().assignableRolesNamed('inbound', { state: { domain: child, user: owner } } as any)
+    expect(found.map((r: any) => r.id)).toEqual([inbound.id])
+    expect(await new AccessRequestQuery().assignableRolesNamed('inbou', { state: { domain: child, user: owner } } as any)).toEqual([])
+  })
+
+  it('my requests carry their domain and requester - non-null fields are loaded', async () => {
+    await access.requestAccess(ASK, contextOf(kim))
+    const [mine] = await new AccessRequestQuery().myAccessRequests(contextOf(kim))
+    expect(mine.domain?.id).toBe(domain.id)
+    expect(mine.requester?.id).toBe(kim.id)
+  })
+})

package/tests/access-request-pg.test.ts

@@ -0,0 +1,83 @@
+/**
+ * The access request under real concurrency - postgres only (`AUTH_TEST_PG`). sqlite holds one connection and
+ * cannot show two transactions racing (feedback: verify concurrency on postgres).
+ *
+ * Each call runs in its own transaction, as the `@transaction` door gives it.
+ */
+import { authDataSource, closeAuthDatabase, Domain, getRepository, openAuthDatabase, resetAuthDatabase } from './db'
+import { loadCompiled } from './compiled'
+
+const { Role } = loadCompiled('service/role/role')
+const { Privilege } = loadCompiled('service/privilege/privilege')
+const { User } = loadCompiled('service/user/user')
+const { AccessRequest } = loadCompiled('service/access-request/access-request')
+const access = loadCompiled('controllers/access-request')
+
+const onPostgres = process.env.AUTH_TEST_PG ? describe : describe.skip
+
+onPostgres('on postgres', () => {
+  let domain: any
+  let kim: any
+  let park: any
+  let owner: any
+  let inbound: any
+
+  const inTransaction = <T>(user: any, run: (context: any) => Promise<T>) =>
+    authDataSource().transaction(tx => run({ state: { domain, user, tx, afterCommit: [] }, t: (key: string) => key }))
+
+  beforeAll(async () => {
+    await openAuthDatabase()
+  })
+
+  afterAll(async () => {
+    await closeAuthDatabase()
+  })
+
+  beforeEach(async () => {
+    await resetAuthDatabase()
+    domain = await getRepository(Domain).findOneBy({ id: (await getRepository(Domain).save({ name: 'Plant A', subdomain: 'plant-a' })).id })
+    const mutation = await getRepository(Privilege).save({ name: 'mutation', category: 'warehouse' })
+    const grant = await getRepository(Privilege).save({ name: 'mutation', category: 'user' })
+    inbound = await getRepository(Role).save({ name: 'inbound', domain, privileges: [mutation] })
+    const admins = await getRepository(Role).save({ name: 'admins', domain, privileges: [grant] })
+    const make = (name: string, roles: any[] = []) =>
+      getRepository(User).save({ username: name, email: `${name}@example.com`, name, salt: User.generateSalt(), status: 'activated', domains: [domain], roles })
+    kim = await make('kim')
+    park = await make('park', [admins])
+    owner = await make('owner', [admins])
+  })
+
+  it('★ two people deciding at once, each in a transaction - exactly one wins, and the loser leaves nothing', async () => {
+    const request = await inTransaction(kim, context => access.requestAccess({ category: 'warehouse', privilege: 'mutation', reason: 'inbound' }, context))
+
+    const results = await Promise.allSettled([
+      inTransaction(owner, context => access.decideAccessRequest({ requestId: request.id, decision: 'DENY', reason: 'no' }, context)),
+      inTransaction(park, context => access.decideAccessRequest({ requestId: request.id, decision: 'GRANT', roleId: inbound.id }, context))
+    ])
+
+    expect(results.map(r => r.status).sort()).toEqual(['fulfilled', 'rejected'])
+    const stored = await getRepository(AccessRequest).findOne({ where: { id: request.id }, relations: ['grantedRole'] })
+    const holds = await User.hasPrivilege('mutation', 'warehouse', domain, kim)
+    /* The role is given exactly when the stored decision is a grant - a losing grant does not leave the role behind. */
+    expect(holds).toBe(stored.state === 'GRANTED')
+  })
+
+  it('★ a grant closes the requester\'s other requests it answers - read inside the transaction, not the default connection', async () => {
+    const query = await getRepository(Privilege).save({ name: 'query', category: 'warehouse' })
+    const both = await getRepository(Role).save({ name: 'both', domain, privileges: [query, await getRepository(Privilege).findOneBy({ name: 'mutation', category: 'warehouse' })] })
+    const first = await inTransaction(kim, context => access.requestAccess({ category: 'warehouse', privilege: 'mutation', reason: 'inbound' }, context))
+    const second = await inTransaction(kim, context => access.requestAccess({ category: 'warehouse', privilege: 'query', reason: 'stock' }, context))
+
+    await inTransaction(owner, context => access.decideAccessRequest({ requestId: first.id, decision: 'GRANT', roleId: both.id }, context))
+
+    expect((await getRepository(AccessRequest).findOneBy({ id: second.id })).state).toBe('GRANTED')
+  })
+
+  it('★ the same person asking twice at once - one pending request, not two', async () => {
+    await Promise.allSettled([
+      inTransaction(kim, context => access.requestAccess({ category: 'warehouse', privilege: 'mutation', reason: 'inbound' }, context)),
+      inTransaction(kim, context => access.requestAccess({ category: 'warehouse', privilege: 'mutation', reason: 'inbound' }, context))
+    ])
+    expect(await getRepository(AccessRequest).count({ where: { state: 'PENDING' } })).toBe(1)
+  })
+})

package/tests/access-request-review.test.ts

@@ -153,3 +153,11 @@ describe('helpers', () => {
     expect(effectiveState('GRANTED', new Date(0), NOW)).toBe('GRANTED')
   })
 })
+
+describe('the parent domain\'s role (ADR-0103 decision 8)', () => {
+  it('★ blocks when the decider does not decide in the parent, passes when they do', () => {
+    expect(codes(facts({ roleIsParents: true, deciderMayChangeParentRoles: false }))).toContain('⛔role-belongs-to-parent')
+    expect(codes(facts({ roleIsParents: true, deciderMayChangeParentRoles: true }))).not.toContain('⛔role-belongs-to-parent')
+    expect(codes(facts({ roleIsParents: false }))).not.toContain('⛔role-belongs-to-parent')
+  })
+})

package/tests/assignable-roles-db.test.ts

@@ -15,6 +15,8 @@ const { GrantedRole } = loadCompiled('service/granted-role/granted-role')
 const { User } = loadCompiled('service/user/user')
 const { UserMutation } = loadCompiled('service/user/user-mutation')
 const { assignRoles } = loadCompiled('utils/assignable-roles')
+const { DomainOwner } = loadCompiled('service/domain-owner/domain-owner')
+const { Privilege } = loadCompiled('service/privilege/privilege')
 
 let parent: any
 let child: any
@@ -80,7 +82,9 @@ describe('what a domain can put a person into', () => {
     await getRepository(GrantedRole).save({ role: granted, domain: child })
     const user = await makeUser([child], [])
 
-    const { added } = await assignRoles(user, { add: [own.id, inherited.id, granted.id] }, child)
+    const parentOwner = await makeUser([parent], [])
+    await getRepository(DomainOwner).save({ domain: parent, user: parentOwner })
+    const { added } = await assignRoles(user, { add: [own.id, inherited.id, granted.id] }, child, undefined, parentOwner)
 
     expect(added.map((role: any) => role.name).sort()).toEqual(['operator', 'partner', 'viewer'])
     expect(await heldRoleNames(user)).toEqual(['operator', 'partner', 'viewer'])
@@ -139,3 +143,77 @@ describe('updateUserRoles goes through the same function', () => {
     expect(await heldRoleNames(user)).toEqual(['b'])
   })
 })
+
+describe('the parent domain\'s roles - only someone who decides there (ADR-0103 decision 8)', () => {
+  let parentRole: any
+  let childAdmin: any
+  let user: any
+
+  beforeEach(async () => {
+    const grant = await getRepository(Privilege).save({ name: 'mutation', category: 'user' })
+    const childAdmins = await getRepository(Role).save({ name: 'child-admins', domain: child, privileges: [grant] })
+    parentRole = await getRepository(Role).save({ name: 'hq-approver', domain: parent })
+    childAdmin = await makeUser([child], [childAdmins])
+    user = await makeUser([child], [])
+  })
+
+  it('★ a child domain\'s decider cannot give the parent\'s role - refused by name', async () => {
+    await expect(assignRoles(user, { add: [parentRole.id] }, child, undefined, childAdmin)).rejects.toMatchObject({
+      code: 'role-belongs-to-parent',
+      params: { roles: 'hq-approver' }
+    })
+    expect(await heldRoleNames(user)).toEqual([])
+  })
+
+  it('★ nor take it away', async () => {
+    const holder = await makeUser([child], [parentRole])
+    await expect(assignRoles(holder, { remove: [parentRole.id] }, child, undefined, childAdmin)).rejects.toMatchObject({ code: 'role-belongs-to-parent' })
+    expect(await heldRoleNames(holder)).toEqual(['hq-approver'])
+  })
+
+  it('★ the parent\'s owner can - from the child', async () => {
+    const parentOwner = await makeUser([parent], [])
+    await getRepository(DomainOwner).save({ domain: parent, user: parentOwner })
+    await assignRoles(user, { add: [parentRole.id] }, child, undefined, parentOwner)
+    expect(await heldRoleNames(user)).toEqual(['hq-approver'])
+  })
+
+  it('★ a holder of the role-giving privilege in the parent can', async () => {
+    const grant = await getRepository(Privilege).findOneBy({ name: 'mutation', category: 'user' })
+    const hqAdmins = await getRepository(Role).save({ name: 'hq-admins', domain: parent, privileges: [grant] })
+    const hqAdmin = await makeUser([parent, child], [hqAdmins])
+    await assignRoles(user, { add: [parentRole.id] }, child, undefined, hqAdmin)
+    expect(await heldRoleNames(user)).toEqual(['hq-approver'])
+  })
+
+  it('a parent role left as it was is no change - the user screen sends every shown role, nothing is refused', async () => {
+    const own = await getRepository(Role).save({ name: 'operator', domain: child })
+    const holder = await makeUser([child], [parentRole])
+    await assignRoles(holder, { add: [parentRole.id, own.id], remove: [parentRole.id, own.id] }, child, undefined, childAdmin)
+    expect(await heldRoleNames(holder)).toEqual(['hq-approver', 'operator'])
+  })
+
+  it('★ updateUserRoles carries the caller - a child admin adding the parent\'s role is refused', async () => {
+    const mutation = new UserMutation()
+    await expect(
+      mutation.updateUserRoles(user.username, [{ id: parentRole.id }], [{ id: parentRole.id }], { state: { domain: child, user: childAdmin }, t: (k: string) => k } as any)
+    ).rejects.toMatchObject({ code: 'role-belongs-to-parent' })
+  })
+
+  it('★ updateUserRoles carries the caller - the parent\'s owner adding it from the child passes', async () => {
+    const parentOwner = await makeUser([parent, child], [])
+    await getRepository(DomainOwner).save({ domain: parent, user: parentOwner })
+    await new UserMutation().updateUserRoles(user.username, [{ id: parentRole.id }], [{ id: parentRole.id }], {
+      state: { domain: child, user: parentOwner },
+      t: (k: string) => k
+    } as any)
+    expect(await heldRoleNames(user)).toEqual(['hq-approver'])
+  })
+
+  it('a granted role is the granting domain\'s delegation - a child decider assigns it', async () => {
+    const partnerRole = await getRepository(Role).save({ name: 'partner', domain: stranger })
+    await getRepository(GrantedRole).save({ role: partnerRole, domain: child })
+    await assignRoles(user, { add: [partnerRole.id] }, child, undefined, childAdmin)
+    expect(await heldRoleNames(user)).toEqual(['partner'])
+  })
+})

package/tests/privilege-directive.test.ts

@@ -312,3 +312,21 @@ describe('거절이 이유를 싣는다 (ADR-0103 결정 1)', () => {
     expect((result.errors![0].extensions as any).because).toBe('address')
   })
 })
+
+describe('거절이 무엇이 막혔는지도 싣는다 — 변경인가 조회인가 (질문지 Q9 · 4)', () => {
+  it('★ 조회가 막히면 operation: query', async () => {
+    const result = await run(buildSchema(), 'guardedBoard')
+    expect((result.errors![0].extensions as any).operation).toBe('query')
+  })
+
+  it('★ 변경이 막히면 operation: mutation — 사람이 누른 일이다', async () => {
+    const schema = privilegeDirectiveResolver(
+      makeExecutableSchema({
+        typeDefs: [privilegeDirectiveTypeDefs, 'type Query { ok: String } type Mutation { saveBoard: String @privilege(category: "board", privilege: "mutation") }'],
+        resolvers: { Query: { ok: () => 'ok' }, Mutation: { saveBoard: () => 'saved' } }
+      })
+    )
+    const result = await graphql({ schema, source: 'mutation { saveBoard }', contextValue: { state: { domain: DOMAIN, user: USER } } })
+    expect((result.errors![0].extensions as any)).toMatchObject({ because: 'role', operation: 'mutation' })
+  })
+})

package/translations/en.json

@@ -247,5 +247,8 @@
   "access-request.notify.granted.title": "access granted",
   "access-request.notify.granted.body": "you now have {privilege} (role: {role}).",
   "access-request.notify.denied.title": "access request denied",
-  "access-request.notify.denied.body": "{privilege}: {reason}"
+  "access-request.notify.denied.body": "{privilege}: {reason}",
+  "error.access-request-needs-reason": "write why you need it.",
+  "error.access-request-same-reason-as-denied": "this was denied lately for the same reason ({reason}). write what has changed.",
+  "error.role-belongs-to-parent": "{roles}: a role of the parent domain. only someone who decides roles there can give or take it."
 }

package/translations/ja.json

@@ -247,5 +247,8 @@
   "access-request.notify.granted.title": "権限が付与されました",
   "access-request.notify.granted.body": "{privilege} 権限が付与されました(ロール: {role})。",
   "access-request.notify.denied.title": "権限リクエストが拒否されました",
-  "access-request.notify.denied.body": "{privilege}: {reason}"
+  "access-request.notify.denied.body": "{privilege}: {reason}",
+  "error.access-request-needs-reason": "必要な理由を書いてください。",
+  "error.access-request-same-reason-as-denied": "同じ理由で最近拒否されました({reason})。何が変わったかを書いてください。",
+  "error.role-belongs-to-parent": "{roles}: 上位$t(term.domain)のロールです。その$t(term.domain)で権限を決める人だけが付与・解除できます。"
 }

package/translations/ko.json

@@ -247,5 +247,8 @@
   "access-request.notify.granted.title": "권한을 받았습니다",
   "access-request.notify.granted.body": "{privilege} 권한을 받았습니다(역할: {role}).",
   "access-request.notify.denied.title": "권한 요청이 거부되었습니다",
-  "access-request.notify.denied.body": "{privilege}: {reason}"
+  "access-request.notify.denied.body": "{privilege}: {reason}",
+  "error.access-request-needs-reason": "필요한 까닭을 적어 주세요.",
+  "error.access-request-same-reason-as-denied": "같은 까닭으로 최근에 거부되었습니다({reason}). 무엇이 달라졌는지 적어 주세요.",
+  "error.role-belongs-to-parent": "{roles}: 상위 $t(term.domain)의 역할입니다. 그 $t(term.domain)에서 권한을 정하는 사람만 주거나 뺄 수 있습니다."
 }

package/translations/ms.json

@@ -247,5 +247,8 @@
   "access-request.notify.granted.title": "akses diberikan",
   "access-request.notify.granted.body": "anda kini mempunyai {privilege} (peranan: {role}).",
   "access-request.notify.denied.title": "permintaan akses ditolak",
-  "access-request.notify.denied.body": "{privilege}: {reason}"
+  "access-request.notify.denied.body": "{privilege}: {reason}",
+  "error.access-request-needs-reason": "tulis sebab anda memerlukannya.",
+  "error.access-request-same-reason-as-denied": "ini ditolak baru-baru ini atas sebab yang sama ({reason}). tulis apa yang telah berubah.",
+  "error.role-belongs-to-parent": "{roles}: peranan $t(term.domain) induk. hanya mereka yang memutuskan peranan di sana boleh memberi atau menariknya."
 }

package/translations/zh.json

@@ -247,5 +247,8 @@
   "access-request.notify.granted.title": "权限已授予",
   "access-request.notify.granted.body": "您已获得 {privilege} 权限(角色: {role})。",
   "access-request.notify.denied.title": "权限请求被拒绝",
-  "access-request.notify.denied.body": "{privilege}: {reason}"
+  "access-request.notify.denied.body": "{privilege}: {reason}",
+  "error.access-request-needs-reason": "请填写需要的理由。",
+  "error.access-request-same-reason-as-denied": "最近以相同理由被拒绝({reason})。请写明有何变化。",
+  "error.role-belongs-to-parent": "{roles}: 上级$t(term.domain)的角色。只有在该$t(term.domain)负责权限的人才能授予或移除。"
 }