@things-factory/auth-base 10.1.142 → 10.1.145

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@things-factory/auth-base",
-  "version": "10.1.142",
+  "version": "10.1.145",
   "main": "dist-server/index.js",
   "browser": "dist-client/index.js",
   "things-factory": true,
@@ -48,5 +48,5 @@
     "passport-jwt": "^4.0.0",
     "passport-local": "^1.0.0"
   },
-  "gitHead": "73522201151b0156168b0eeea15f2962cda0bd8f"
+  "gitHead": "1c33612ba31f51b9af59f9bc68751971097350a5"
 }

package/tests/privilege-sync-db.test.ts

@@ -0,0 +1,58 @@
+/**
+ * The privilege sync is boot-time writing, and boot-time writing takes its turn (shell `inBootTurn`).
+ *
+ * On sqlite every transaction shares one connection. Another module's boot transaction (work-shift's
+ * baseline) that began while the sync's insert was open failed with "cannot start a transaction within a
+ * transaction", and its rollback took the insert with it — so the same privilege was missing again on
+ * the next boot, and the collision repeated every boot (`contact/query`, operato-plant, 2026-10-10).
+ */
+import { inBootTurn } from '@things-factory/shell'
+
+import { closeAuthDatabase, Domain, getRepository, openAuthDatabase, resetAuthDatabase } from './db'
+import { loadCompiled } from './compiled'
+
+const { synchronizePrivileges } = loadCompiled('service/privilege/privilege-sync')
+const { Privilege } = loadCompiled('service/privilege/privilege')
+
+const pause = (ms: number) => new Promise(resolve => setTimeout(resolve, ms))
+
+beforeAll(async () => {
+  await openAuthDatabase()
+})
+
+beforeEach(async () => {
+  await resetAuthDatabase()
+})
+
+afterAll(async () => {
+  await closeAuthDatabase()
+})
+
+test('adds what is missing and leaves what is there', async () => {
+  await getRepository(Privilege).save({ category: 'contact', name: 'mutation' })
+
+  expect(await synchronizePrivileges([['contact', 'mutation'], ['contact', 'query']])).toEqual(['contact/query'])
+  expect(await getRepository(Privilege).countBy({ category: 'contact' })).toBe(2)
+})
+
+test('another boot job that fails does not take the sync with it', async () => {
+  const dataSource = await openAuthDatabase()
+
+  /*
+   * A boot job of another module, in its turn: it holds a transaction for a while and then fails. On
+   * sqlite TypeORM shares one query runner, so a save that starts meanwhile rides inside that
+   * transaction — and goes when it rolls back.
+   */
+  const other = inBootTurn(() =>
+    dataSource.transaction(async tx => {
+      await tx.getRepository(Domain).save({ name: 'boot-job', subdomain: 'boot-job' })
+      await pause(30)
+      throw new Error('the other boot job failed')
+    })
+  ).catch(() => undefined)
+  const sync = synchronizePrivileges([['contact', 'query']])
+
+  await Promise.all([other, sync])
+  expect(await getRepository(Domain).countBy({ subdomain: 'boot-job' })).toBe(0)
+  expect(await getRepository(Privilege).countBy({ category: 'contact', name: 'query' })).toBe(1)
+})