@things-factory/auth-base 10.1.181 → 10.1.183

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@things-factory/auth-base",
-  "version": "10.1.181",
+  "version": "10.1.183",
   "main": "dist-server/index.js",
   "browser": "dist-client/index.js",
   "things-factory": true,
@@ -49,5 +49,5 @@
     "passport-jwt": "^4.0.0",
     "passport-local": "^1.0.0"
   },
-  "gitHead": "a4387dbc9c5be49ac7bd0e85a59fbcd650f47138"
+  "gitHead": "c36684e0db8353f5f4523ed55111df3154bae19e"
 }

package/tests/role-users-gate.test.ts

@@ -0,0 +1,22 @@
+import { buildSchema } from 'type-graphql'
+
+import { loadCompiled } from './compiled'
+
+/**
+ * Reading roles does not list who holds them (ADR-0139).
+ *
+ * The `user:query` gate stood on `RoleQuery.users`, a field resolver, while `Role` declared `users` itself - and
+ * type-graphql keeps the declaration's directives, so the gate was never in the served schema: `role:query` alone listed
+ * every role's people. It now stands on the declaration; this reads the schema that is served, not the source.
+ */
+const { schema: declared } = loadCompiled('service/index')
+const { privilegeDirectiveResolver, privilegeOfField } = loadCompiled('service/privilege/privilege-directive')
+
+describe("a role's people", () => {
+  it('★ Role.users asks user:query in the served schema', async () => {
+    const schema = await buildSchema({ resolvers: declared.resolverClasses, validate: false })
+    privilegeDirectiveResolver(schema, { modules: [] })
+    const gate = privilegeOfField('Role', 'users')
+    expect([gate.known, gate['gate']?.category, gate['gate']?.privilege]).toEqual([true, 'user', 'query'])
+  })
+})