@things-factory/auth-base 10.1.192 → 10.1.198

package/dist-server/utils/check-permission.d.ts

@@ -20,8 +20,14 @@ export type ProhibitedPrivilege = {
     privilege: string;
     by?: 'address' | 'license';
 };
+/**
+ * What opened a gate - the audit keeps it with every check (ADR-0141 §3.2), so a pass that rested on
+ * superuser is told from one a role gave.
+ */
+export type GrantBasis = 'role' | 'domain-owner' | 'superuser';
 export type PermissionJudgement = {
     permitted: true;
+    by?: GrantBasis;
 } | {
     permitted: false;
     because: RefusalCause;

package/dist-server/utils/check-permission.js

@@ -3,7 +3,11 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.judgePermission = judgePermission;
 exports.checkPermission = checkPermission;
 const user_js_1 = require("../service/user/user.js");
+/* A gate that declares nothing - nothing opened it. */
 const PERMITTED = { permitted: true };
+function granted(by) {
+    return { permitted: true, by };
+}
 function refused(because) {
     return { permitted: false, because };
 }
@@ -19,9 +23,18 @@ async function judgePermission(privilegeObject, user, domain, unsafeIP, prohibit
         return PERMITTED;
     }
     const { owner: domainOwnerGranted, super: superUserGranted, category, privilege } = privilegeObject;
-    /* Ownership as the gate has always asked it - `process` carries the answer (domain-authenticate-middleware installs it). */
-    const ownershipOpens = async () => !!((domainOwnerGranted && (await process.domainOwnerGranted(domain, user))) ||
-        (superUserGranted && (await process.superUserGranted(domain, user))));
+    /*
+     * Ownership as the gate has always asked it - `process` carries the answer (domain-authenticate-middleware
+     * installs it). Domain owner first, then superuser, as the `||` it replaces; it now says which one opened.
+     */
+    const ownershipBasis = async () => {
+        if (domainOwnerGranted && (await process.domainOwnerGranted(domain, user)))
+            return 'domain-owner';
+        if (superUserGranted && (await process.superUserGranted(domain, user)))
+            return 'superuser';
+        return null;
+    };
+    const ownershipOpens = async () => !!(await ownershipBasis());
     /*
      * From an unsafe address ownership never opened anything and was never asked. It is asked now only on the
      * way to a refusal, to tell "address" from "role" - and a missing answer is "no", so the gate refuses as it did.
@@ -42,7 +55,7 @@ async function judgePermission(privilegeObject, user, domain, unsafeIP, prohibit
                 return refused(prohibition.by ?? 'unknown');
             }
             if (await user_js_1.User.hasPrivilege(privilege, category, domain, user)) {
-                return PERMITTED;
+                return granted('role');
             }
             /* An owner without the role would pass from a safe address - what stopped them is where they are. */
             return refused((await ownershipWouldHaveOpened()) ? 'address' : 'role');
@@ -62,16 +75,18 @@ async function judgePermission(privilegeObject, user, domain, unsafeIP, prohibit
     else {
         if (!privilege || !category) {
             // privilege, category가 설정되지 않은 경우에는 ownership granted만을 적용한다.
-            return (await ownershipOpens()) ? PERMITTED : refused('ownership');
+            const basis = await ownershipBasis();
+            return basis ? granted(basis) : refused('ownership');
         }
-        if (await ownershipOpens()) {
-            return PERMITTED;
+        const basis = await ownershipBasis();
+        if (basis) {
+            return granted(basis);
         }
         const prohibition = prohibitionOf(prohibitedPrivileges, category, privilege);
         if (prohibition) {
             return refused(prohibition.by ?? 'unknown');
         }
-        return (await user_js_1.User.hasPrivilege(privilege, category, domain, user)) ? PERMITTED : refused('role');
+        return (await user_js_1.User.hasPrivilege(privilege, category, domain, user)) ? granted('role') : refused('role');
     }
 }
 async function checkPermission(privilegeObject, user, domain, unsafeIP, prohibitedPrivileges) {

package/dist-server/utils/check-permission.js.map

@@ -1 +1 @@
-{"version":3,"file":"check-permission.js","sourceRoot":"","sources":["../../server/utils/check-permission.ts"],"names":[],"mappings":";;AAqCA,0CA4EC;AAED,0CAQC;AAzHD,qDAA8C;AAqB9C,MAAM,SAAS,GAAwB,EAAE,SAAS,EAAE,IAAI,EAAE,CAAA;AAE1D,SAAS,OAAO,CAAC,OAAqB;IACpC,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,OAAO,EAAE,CAAA;AACtC,CAAC;AAED,SAAS,aAAa,CAAC,oBAAuD,EAAE,QAAgB,EAAE,SAAiB;IACjH,OAAO,CAAC,oBAAoB,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,QAAQ,IAAI,QAAQ,IAAI,EAAE,CAAC,SAAS,IAAI,SAAS,CAAC,CAAA;AACtG,CAAC;AAED;;;GAGG;AACI,KAAK,UAAU,eAAe,CACnC,eAAgC,EAChC,IAAU,EACV,MAAc,EACd,QAAkB,EAClB,oBAA4C;IAE5C,IAAI,CAAC,eAAe,EAAE,CAAC;QACrB,OAAO,SAAS,CAAA;IAClB,CAAC;IAED,MAAM,EAAE,KAAK,EAAE,kBAAkB,EAAE,KAAK,EAAE,gBAAgB,EAAE,QAAQ,EAAE,SAAS,EAAE,GAAG,eAAe,CAAA;IAEnG,4HAA4H;IAC5H,MAAM,cAAc,GAAG,KAAK,IAAI,EAAE,CAChC,CAAC,CAAC,CACA,CAAC,kBAAkB,IAAI,CAAC,MAAO,OAAe,CAAC,kBAAkB,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC;QACjF,CAAC,gBAAgB,IAAI,CAAC,MAAO,OAAe,CAAC,gBAAgB,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,CAC9E,CAAA;IAEH;;;OAGG;IACH,MAAM,wBAAwB,GAAG,KAAK,IAAI,EAAE;QAC1C,IAAI,CAAC;YACH,OAAO,MAAM,cAAc,EAAE,CAAA;QAC/B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAA;QACd,CAAC;IACH,CAAC,CAAA;IAED,IAAI,QAAQ,EAAE,CAAC;QACb,IAAI,SAAS,IAAI,QAAQ,EAAE,CAAC;YAC1B,8CAA8C;YAC9C,MAAM,WAAW,GAAG,aAAa,CAAC,oBAAoB,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAA;YAC5E,IAAI,WAAW,EAAE,CAAC;gBAChB,OAAO,OAAO,CAAC,WAAW,CAAC,EAAE,IAAI,SAAS,CAAC,CAAA;YAC7C,CAAC;YAED,IAAI,MAAM,cAAI,CAAC,YAAY,CAAC,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,CAAC;gBAC/D,OAAO,SAAS,CAAA;YAClB,CAAC;YAED,qGAAqG;YACrG,OAAO,OAAO,CAAC,CAAC,MAAM,wBAAwB,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,CAAA;QACzE,CAAC;QAED;;;;;;;;;WASG;QACH,OAAO,OAAO,CAAC,SAAS,CAAC,CAAA;IAC3B,CAAC;SAAM,CAAC;QACN,IAAI,CAAC,SAAS,IAAI,CAAC,QAAQ,EAAE,CAAC;YAC5B,8DAA8D;YAC9D,OAAO,CAAC,MAAM,cAAc,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,CAAA;QACpE,CAAC;QAED,IAAI,MAAM,cAAc,EAAE,EAAE,CAAC;YAC3B,OAAO,SAAS,CAAA;QAClB,CAAC;QAED,MAAM,WAAW,GAAG,aAAa,CAAC,oBAAoB,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAA;QAC5E,IAAI,WAAW,EAAE,CAAC;YAChB,OAAO,OAAO,CAAC,WAAW,CAAC,EAAE,IAAI,SAAS,CAAC,CAAA;QAC7C,CAAC;QAED,OAAO,CAAC,MAAM,cAAI,CAAC,YAAY,CAAC,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAA;IACnG,CAAC;AACH,CAAC;AAEM,KAAK,UAAU,eAAe,CACnC,eAAgC,EAChC,IAAU,EACV,MAAc,EACd,QAAkB,EAClB,oBAA4C;IAE5C,OAAO,CAAC,MAAM,eAAe,CAAC,eAAe,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,oBAAoB,CAAC,CAAC,CAAC,SAAS,CAAA;AACzG,CAAC","sourcesContent":["import { Domain } from '@things-factory/shell'\nimport { PrivilegeObject } from '../service/privilege/privilege.js'\nimport { User } from '../service/user/user.js'\n\n/**\n * Why a gate said no - what the person can do about it differs (ADR-0103 decision 1).\n *\n *  role       none of their roles holds category:privilege - a role can be given (an access request)\n *  address    refused from where they are: the domain's protected address list\n *  license    refused by what this installation is licensed for\n *  ownership  the declaration opens only to domain or system owners - no role gives it\n *  unknown    a prohibition that does not say where it came from - the reason is not made up\n */\nexport type RefusalCause = 'role' | 'address' | 'license' | 'ownership' | 'unknown'\n\n/**\n * A privilege refused by the request, whatever the person's roles. `by` says who refused it:\n * the domain's address list (shell domain-middleware) or the installation's license (board-service).\n */\nexport type ProhibitedPrivilege = { category: string; privilege: string; by?: 'address' | 'license' }\n\nexport type PermissionJudgement = { permitted: true } | { permitted: false; because: RefusalCause }\n\nconst PERMITTED: PermissionJudgement = { permitted: true }\n\nfunction refused(because: RefusalCause): PermissionJudgement {\n  return { permitted: false, because }\n}\n\nfunction prohibitionOf(prohibitedPrivileges: ProhibitedPrivilege[] | undefined, category: string, privilege: string) {\n  return (prohibitedPrivileges || []).find(pp => pp.category == category && pp.privilege == privilege)\n}\n\n/**\n * The gate, with its reason. `checkPermission` answers only the boolean and is what most callers\n * want; the privilege directive reads this so a refusal can say which of the four it was.\n */\nexport async function judgePermission(\n  privilegeObject: PrivilegeObject,\n  user: User,\n  domain: Domain,\n  unsafeIP?: boolean,\n  prohibitedPrivileges?: ProhibitedPrivilege[]\n): Promise<PermissionJudgement> {\n  if (!privilegeObject) {\n    return PERMITTED\n  }\n\n  const { owner: domainOwnerGranted, super: superUserGranted, category, privilege } = privilegeObject\n\n  /* Ownership as the gate has always asked it - `process` carries the answer (domain-authenticate-middleware installs it). */\n  const ownershipOpens = async () =>\n    !!(\n      (domainOwnerGranted && (await (process as any).domainOwnerGranted(domain, user))) ||\n      (superUserGranted && (await (process as any).superUserGranted(domain, user)))\n    )\n\n  /*\n   * From an unsafe address ownership never opened anything and was never asked. It is asked now only on the\n   * way to a refusal, to tell \"address\" from \"role\" - and a missing answer is \"no\", so the gate refuses as it did.\n   */\n  const ownershipWouldHaveOpened = async () => {\n    try {\n      return await ownershipOpens()\n    } catch {\n      return false\n    }\n  }\n\n  if (unsafeIP) {\n    if (privilege && category) {\n      // unsafeIP 상황에서는 ownership granted는 적용되지 않는다.\n      const prohibition = prohibitionOf(prohibitedPrivileges, category, privilege)\n      if (prohibition) {\n        return refused(prohibition.by ?? 'unknown')\n      }\n\n      if (await User.hasPrivilege(privilege, category, domain, user)) {\n        return PERMITTED\n      }\n\n      /* An owner without the role would pass from a safe address - what stopped them is where they are. */\n      return refused((await ownershipWouldHaveOpened()) ? 'address' : 'role')\n    }\n\n    /*\n     * Ownership does not count from an unsafe address, so a declaration that rests on\n     * ownership alone has nothing left to stand on here and the answer is no.\n     *\n     * This read `!domainOwnerGranted && !superUserGranted` until 2026-09-15, which answered\n     * **yes** for an object that named nothing at all — the same `{}` a safe address\n     * refused. An unsafe address was the more permissive of the two, which is backwards.\n     * `privilege-directive.ts` now refuses to build a declaration that names nothing, but\n     * this function is exported and called directly, so the rule is fixed here too.\n     */\n    return refused('address')\n  } else {\n    if (!privilege || !category) {\n      // privilege, category가 설정되지 않은 경우에는 ownership granted만을 적용한다.\n      return (await ownershipOpens()) ? PERMITTED : refused('ownership')\n    }\n\n    if (await ownershipOpens()) {\n      return PERMITTED\n    }\n\n    const prohibition = prohibitionOf(prohibitedPrivileges, category, privilege)\n    if (prohibition) {\n      return refused(prohibition.by ?? 'unknown')\n    }\n\n    return (await User.hasPrivilege(privilege, category, domain, user)) ? PERMITTED : refused('role')\n  }\n}\n\nexport async function checkPermission(\n  privilegeObject: PrivilegeObject,\n  user: User,\n  domain: Domain,\n  unsafeIP?: boolean,\n  prohibitedPrivileges?: ProhibitedPrivilege[]\n): Promise<boolean> {\n  return (await judgePermission(privilegeObject, user, domain, unsafeIP, prohibitedPrivileges)).permitted\n}\n"]}
+{"version":3,"file":"check-permission.js","sourceRoot":"","sources":["../../server/utils/check-permission.ts"],"names":[],"mappings":";;AAgDA,0CAkFC;AAED,0CAQC;AA1ID,qDAA8C;AA2B9C,uDAAuD;AACvD,MAAM,SAAS,GAAwB,EAAE,SAAS,EAAE,IAAI,EAAE,CAAA;AAE1D,SAAS,OAAO,CAAC,EAAc;IAC7B,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,EAAE,EAAE,CAAA;AAChC,CAAC;AAED,SAAS,OAAO,CAAC,OAAqB;IACpC,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,OAAO,EAAE,CAAA;AACtC,CAAC;AAED,SAAS,aAAa,CAAC,oBAAuD,EAAE,QAAgB,EAAE,SAAiB;IACjH,OAAO,CAAC,oBAAoB,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,QAAQ,IAAI,QAAQ,IAAI,EAAE,CAAC,SAAS,IAAI,SAAS,CAAC,CAAA;AACtG,CAAC;AAED;;;GAGG;AACI,KAAK,UAAU,eAAe,CACnC,eAAgC,EAChC,IAAU,EACV,MAAc,EACd,QAAkB,EAClB,oBAA4C;IAE5C,IAAI,CAAC,eAAe,EAAE,CAAC;QACrB,OAAO,SAAS,CAAA;IAClB,CAAC;IAED,MAAM,EAAE,KAAK,EAAE,kBAAkB,EAAE,KAAK,EAAE,gBAAgB,EAAE,QAAQ,EAAE,SAAS,EAAE,GAAG,eAAe,CAAA;IAEnG;;;OAGG;IACH,MAAM,cAAc,GAAG,KAAK,IAAgC,EAAE;QAC5D,IAAI,kBAAkB,IAAI,CAAC,MAAO,OAAe,CAAC,kBAAkB,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;YAAE,OAAO,cAAc,CAAA;QAC1G,IAAI,gBAAgB,IAAI,CAAC,MAAO,OAAe,CAAC,gBAAgB,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;YAAE,OAAO,WAAW,CAAA;QACnG,OAAO,IAAI,CAAA;IACb,CAAC,CAAA;IACD,MAAM,cAAc,GAAG,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,cAAc,EAAE,CAAC,CAAA;IAE7D;;;OAGG;IACH,MAAM,wBAAwB,GAAG,KAAK,IAAI,EAAE;QAC1C,IAAI,CAAC;YACH,OAAO,MAAM,cAAc,EAAE,CAAA;QAC/B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAA;QACd,CAAC;IACH,CAAC,CAAA;IAED,IAAI,QAAQ,EAAE,CAAC;QACb,IAAI,SAAS,IAAI,QAAQ,EAAE,CAAC;YAC1B,8CAA8C;YAC9C,MAAM,WAAW,GAAG,aAAa,CAAC,oBAAoB,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAA;YAC5E,IAAI,WAAW,EAAE,CAAC;gBAChB,OAAO,OAAO,CAAC,WAAW,CAAC,EAAE,IAAI,SAAS,CAAC,CAAA;YAC7C,CAAC;YAED,IAAI,MAAM,cAAI,CAAC,YAAY,CAAC,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,CAAC;gBAC/D,OAAO,OAAO,CAAC,MAAM,CAAC,CAAA;YACxB,CAAC;YAED,qGAAqG;YACrG,OAAO,OAAO,CAAC,CAAC,MAAM,wBAAwB,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,CAAA;QACzE,CAAC;QAED;;;;;;;;;WASG;QACH,OAAO,OAAO,CAAC,SAAS,CAAC,CAAA;IAC3B,CAAC;SAAM,CAAC;QACN,IAAI,CAAC,SAAS,IAAI,CAAC,QAAQ,EAAE,CAAC;YAC5B,8DAA8D;YAC9D,MAAM,KAAK,GAAG,MAAM,cAAc,EAAE,CAAA;YACpC,OAAO,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,CAAA;QACtD,CAAC;QAED,MAAM,KAAK,GAAG,MAAM,cAAc,EAAE,CAAA;QACpC,IAAI,KAAK,EAAE,CAAC;YACV,OAAO,OAAO,CAAC,KAAK,CAAC,CAAA;QACvB,CAAC;QAED,MAAM,WAAW,GAAG,aAAa,CAAC,oBAAoB,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAA;QAC5E,IAAI,WAAW,EAAE,CAAC;YAChB,OAAO,OAAO,CAAC,WAAW,CAAC,EAAE,IAAI,SAAS,CAAC,CAAA;QAC7C,CAAC;QAED,OAAO,CAAC,MAAM,cAAI,CAAC,YAAY,CAAC,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAA;IACzG,CAAC;AACH,CAAC;AAEM,KAAK,UAAU,eAAe,CACnC,eAAgC,EAChC,IAAU,EACV,MAAc,EACd,QAAkB,EAClB,oBAA4C;IAE5C,OAAO,CAAC,MAAM,eAAe,CAAC,eAAe,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,oBAAoB,CAAC,CAAC,CAAC,SAAS,CAAA;AACzG,CAAC","sourcesContent":["import { Domain } from '@things-factory/shell'\nimport { PrivilegeObject } from '../service/privilege/privilege.js'\nimport { User } from '../service/user/user.js'\n\n/**\n * Why a gate said no - what the person can do about it differs (ADR-0103 decision 1).\n *\n *  role       none of their roles holds category:privilege - a role can be given (an access request)\n *  address    refused from where they are: the domain's protected address list\n *  license    refused by what this installation is licensed for\n *  ownership  the declaration opens only to domain or system owners - no role gives it\n *  unknown    a prohibition that does not say where it came from - the reason is not made up\n */\nexport type RefusalCause = 'role' | 'address' | 'license' | 'ownership' | 'unknown'\n\n/**\n * A privilege refused by the request, whatever the person's roles. `by` says who refused it:\n * the domain's address list (shell domain-middleware) or the installation's license (board-service).\n */\nexport type ProhibitedPrivilege = { category: string; privilege: string; by?: 'address' | 'license' }\n\n/**\n * What opened a gate - the audit keeps it with every check (ADR-0141 §3.2), so a pass that rested on\n * superuser is told from one a role gave.\n */\nexport type GrantBasis = 'role' | 'domain-owner' | 'superuser'\n\nexport type PermissionJudgement = { permitted: true; by?: GrantBasis } | { permitted: false; because: RefusalCause }\n\n/* A gate that declares nothing - nothing opened it. */\nconst PERMITTED: PermissionJudgement = { permitted: true }\n\nfunction granted(by: GrantBasis): PermissionJudgement {\n  return { permitted: true, by }\n}\n\nfunction refused(because: RefusalCause): PermissionJudgement {\n  return { permitted: false, because }\n}\n\nfunction prohibitionOf(prohibitedPrivileges: ProhibitedPrivilege[] | undefined, category: string, privilege: string) {\n  return (prohibitedPrivileges || []).find(pp => pp.category == category && pp.privilege == privilege)\n}\n\n/**\n * The gate, with its reason. `checkPermission` answers only the boolean and is what most callers\n * want; the privilege directive reads this so a refusal can say which of the four it was.\n */\nexport async function judgePermission(\n  privilegeObject: PrivilegeObject,\n  user: User,\n  domain: Domain,\n  unsafeIP?: boolean,\n  prohibitedPrivileges?: ProhibitedPrivilege[]\n): Promise<PermissionJudgement> {\n  if (!privilegeObject) {\n    return PERMITTED\n  }\n\n  const { owner: domainOwnerGranted, super: superUserGranted, category, privilege } = privilegeObject\n\n  /*\n   * Ownership as the gate has always asked it - `process` carries the answer (domain-authenticate-middleware\n   * installs it). Domain owner first, then superuser, as the `||` it replaces; it now says which one opened.\n   */\n  const ownershipBasis = async (): Promise<GrantBasis | null> => {\n    if (domainOwnerGranted && (await (process as any).domainOwnerGranted(domain, user))) return 'domain-owner'\n    if (superUserGranted && (await (process as any).superUserGranted(domain, user))) return 'superuser'\n    return null\n  }\n  const ownershipOpens = async () => !!(await ownershipBasis())\n\n  /*\n   * From an unsafe address ownership never opened anything and was never asked. It is asked now only on the\n   * way to a refusal, to tell \"address\" from \"role\" - and a missing answer is \"no\", so the gate refuses as it did.\n   */\n  const ownershipWouldHaveOpened = async () => {\n    try {\n      return await ownershipOpens()\n    } catch {\n      return false\n    }\n  }\n\n  if (unsafeIP) {\n    if (privilege && category) {\n      // unsafeIP 상황에서는 ownership granted는 적용되지 않는다.\n      const prohibition = prohibitionOf(prohibitedPrivileges, category, privilege)\n      if (prohibition) {\n        return refused(prohibition.by ?? 'unknown')\n      }\n\n      if (await User.hasPrivilege(privilege, category, domain, user)) {\n        return granted('role')\n      }\n\n      /* An owner without the role would pass from a safe address - what stopped them is where they are. */\n      return refused((await ownershipWouldHaveOpened()) ? 'address' : 'role')\n    }\n\n    /*\n     * Ownership does not count from an unsafe address, so a declaration that rests on\n     * ownership alone has nothing left to stand on here and the answer is no.\n     *\n     * This read `!domainOwnerGranted && !superUserGranted` until 2026-09-15, which answered\n     * **yes** for an object that named nothing at all — the same `{}` a safe address\n     * refused. An unsafe address was the more permissive of the two, which is backwards.\n     * `privilege-directive.ts` now refuses to build a declaration that names nothing, but\n     * this function is exported and called directly, so the rule is fixed here too.\n     */\n    return refused('address')\n  } else {\n    if (!privilege || !category) {\n      // privilege, category가 설정되지 않은 경우에는 ownership granted만을 적용한다.\n      const basis = await ownershipBasis()\n      return basis ? granted(basis) : refused('ownership')\n    }\n\n    const basis = await ownershipBasis()\n    if (basis) {\n      return granted(basis)\n    }\n\n    const prohibition = prohibitionOf(prohibitedPrivileges, category, privilege)\n    if (prohibition) {\n      return refused(prohibition.by ?? 'unknown')\n    }\n\n    return (await User.hasPrivilege(privilege, category, domain, user)) ? granted('role') : refused('role')\n  }\n}\n\nexport async function checkPermission(\n  privilegeObject: PrivilegeObject,\n  user: User,\n  domain: Domain,\n  unsafeIP?: boolean,\n  prohibitedPrivileges?: ProhibitedPrivilege[]\n): Promise<boolean> {\n  return (await judgePermission(privilegeObject, user, domain, unsafeIP, prohibitedPrivileges)).permitted\n}\n"]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@things-factory/auth-base",
-  "version": "10.1.192",
+  "version": "10.1.198",
   "main": "dist-server/index.js",
   "browser": "dist-client/index.js",
   "things-factory": true,
@@ -38,6 +38,7 @@
     "@things-factory/email-base": "^10.1.188",
     "@things-factory/env": "^10.1.149",
     "@things-factory/shell": "^10.1.188",
+    "@things-factory/task-lease": "^10.1.188",
     "@things-factory/utils": "^10.1.179",
     "@types/webappsec-credential-management": "^0.6.9",
     "jsonwebtoken": "^9.0.0",
@@ -49,5 +50,5 @@
     "passport-jwt": "^4.0.0",
     "passport-local": "^1.0.0"
   },
-  "gitHead": "c44fe3ae4646dc4ffad7947785322acdb84c7374"
+  "gitHead": "68f884a78ca3a779c2b057ba5b8f6e03f477d701"
 }

package/tests/audit-db.test.ts

@@ -0,0 +1,394 @@
+/**
+ * The audit record (ADR-0141) - what it keeps, and what it never keeps.
+ *
+ * The doors run through the real `@privilege` wrapper on an SDL schema (the shape
+ * `privilege-directive.test.ts` uses - type-graphql resolvers cannot be loaded under jest), inside a
+ * real audit scope, against the sqlite harness. Grants run through the real subscribers.
+ */
+
+import { graphql } from 'graphql'
+import { makeExecutableSchema } from '@graphql-tools/schema'
+
+import { authDataSource, closeAuthDatabase, Domain, getRepository, openAuthDatabase, resetAuthDatabase } from './db'
+import { loadCompiled } from './compiled'
+
+const { privilegeDirectiveTypeDefs, privilegeDirectiveResolver } = loadCompiled('service/privilege/privilege-directive')
+const { auditTargetDirectiveTypeDefs } = loadCompiled('service/audit/audit-target')
+const { runInAuditScope, recordAuditAction, flushAudit, auditHealth } = loadCompiled('service/audit/audit-recorder')
+const { AuditAction } = loadCompiled('service/audit/audit-action')
+const { AuditRequest } = loadCompiled('service/audit/audit-request')
+const { AuditQuery } = loadCompiled('service/audit/audit-query')
+const { purgeExpiredAudit } = loadCompiled('service/audit/audit-retention')
+const { User } = loadCompiled('service/user/user')
+const { Role } = loadCompiled('service/role/role')
+const { Privilege } = loadCompiled('service/privilege/privilege')
+const { signin } = loadCompiled('controllers/signin')
+
+const PASSWORD = 'Passw0rd!'
+
+let domain: any
+let other: any
+let kim: any
+let lee: any
+
+const typeDefs = `
+  type Item { id: String }
+  type Query {
+    payslip(employeeId: String): String
+      @privilege(category: "payroll", privilege: "query")
+      @auditTarget(kind: "Employee", arg: "employeeId")
+    payslips: [Item] @privilege(category: "payroll", privilege: "query")
+    broken: String @privilege(category: "payroll", privilege: "query")
+    ownersOnly: String @privilege(superUserGranted: true)
+  }
+`
+
+function buildSchema() {
+  const schema = makeExecutableSchema({
+    typeDefs: [privilegeDirectiveTypeDefs, auditTargetDirectiveTypeDefs, typeDefs],
+    resolvers: {
+      Query: {
+        payslip: (_: any, { employeeId }: any) => `pay of ${employeeId}`,
+        payslips: () => [{ id: 'a' }, { id: 'b' }, { id: 'c' }],
+        broken: () => {
+          const error: any = new Error('salary 4,200,000 for kim')
+          error.extensions = { code: 'INTERNAL_SERVER_ERROR' }
+          throw error
+        },
+        ownersOnly: () => 'ok'
+      }
+    }
+  })
+  return privilegeDirectiveResolver(schema, { modules: [], mode: 'boot' })
+}
+
+/** A koa-like request: what the recorder reads from it and nothing more. */
+function koaContext(user: any, query: string, at = domain) {
+  return {
+    method: 'POST',
+    path: '/graphql',
+    state: { domain: at, user },
+    req: { headers: { 'x-forwarded-for': '203.0.113.7, 10.0.0.1' }, socket: { remoteAddress: '10.0.0.1' } },
+    request: { header: { 'user-agent': 'Mozilla/5.0 test' }, body: { query, operationName: 'Pay' } }
+  }
+}
+
+/** One request through the schema, as the auth middleware runs it. */
+async function request(user: any, query: string, at = domain) {
+  const context = koaContext(user, query, at)
+  const result = await runInAuditScope(context, 'graphql', () => graphql({ schema: buildSchema(), source: query, contextValue: context }))
+  await flushAudit()
+  return result
+}
+
+const actions = (where: any = {}) => getRepository(AuditAction).find({ where, relations: ['actor', 'domain'] })
+
+async function seedUser(name: string, overrides: any = {}) {
+  const salt = User.generateSalt()
+  return await getRepository(User).save({
+    username: name,
+    email: `${name}@example.com`,
+    name,
+    salt,
+    password: User.encode(PASSWORD, salt),
+    status: 'activated',
+    domains: [domain],
+    ...overrides
+  })
+}
+
+function allow(granted: boolean, { superUser = false } = {}) {
+  User.hasPrivilege = jest.fn().mockResolvedValue(granted)
+  ;(process as any).domainOwnerGranted = jest.fn().mockResolvedValue(false)
+  ;(process as any).superUserGranted = jest.fn().mockResolvedValue(superUser)
+}
+
+const originalHasPrivilege = User.hasPrivilege
+
+beforeAll(async () => {
+  await openAuthDatabase()
+})
+
+beforeEach(async () => {
+  await resetAuthDatabase()
+  User.hasPrivilege = originalHasPrivilege
+  domain = await getRepository(Domain).save({ name: 'office', subdomain: 'office' })
+  other = await getRepository(Domain).save({ name: 'plant', subdomain: 'plant' })
+  kim = await seedUser('kim')
+  lee = await seedUser('lee')
+})
+
+afterEach(() => {
+  delete (process as any).domainOwnerGranted
+  delete (process as any).superUserGranted
+})
+
+afterAll(async () => {
+  await closeAuthDatabase()
+})
+
+describe('a request is one line, its doors are rows (§3.1 · §3.2)', () => {
+  it('equal checks in one request become one row with a count, keeping each target', async () => {
+    allow(true)
+    await request(kim, '{ a: payslip(employeeId: "emp-one") b: payslip(employeeId: "emp-two") c: payslip(employeeId: "emp-one") }')
+
+    const [line] = await getRepository(AuditRequest).find({ relations: ['actor', 'domain'] })
+    expect(line).toMatchObject({ channel: 'graphql', operationType: 'query', operationName: 'Pay', fields: 'payslip', ip: '203.0.113.7', userAgent: 'Mozilla/5.0 test' })
+    /* The root fields by schema name - the arguments asked never reach the line. */
+    expect(JSON.stringify(line)).not.toMatch(/emp-one|emp-two/)
+    expect(line.actor.id).toBe(kim.id)
+    expect(line.domain.id).toBe(domain.id)
+
+    const [check] = await actions({ kind: 'door.check' })
+    expect(check).toMatchObject({ door: 'payroll:query', decision: 'granted', basis: 'role', count: 3, targetKind: 'Employee', targetRole: 'requested', requestId: line.id })
+    expect([...check.targetIds].sort()).toEqual(['emp-one', 'emp-two'])
+
+    const [result] = await actions({ kind: 'door.result' })
+    expect(result).toMatchObject({ outcome: 'ok', count: 3 })
+  })
+
+  it('a check-in outside GraphQL is a line under the site and person its event named', async () => {
+    const context = { method: 'GET', path: '/auth/checkin/office', state: {}, req: { headers: {}, socket: { remoteAddress: '10.0.0.9' } }, request: { header: {} }, _matchedRoute: '/auth/checkin/:subdomain?' }
+    await runInAuditScope(context, 'http', () => recordAuditAction({ kind: 'auth.checkin', outcome: 'ok' }, { actorId: kim.id, domainId: domain.id }))
+    await flushAudit()
+
+    const [line] = await getRepository(AuditRequest).find({ relations: ['actor', 'domain'] })
+    expect(line).toMatchObject({ channel: 'http', route: '/auth/checkin/:subdomain?', ip: '10.0.0.9' })
+    expect(line.actor.id).toBe(kim.id)
+    expect(line.domain.id).toBe(domain.id)
+  })
+
+  it('an http request that recorded nothing leaves no line', async () => {
+    await runInAuditScope({ method: 'GET', path: '/theme.css', state: {} }, 'http', async () => undefined)
+    await flushAudit()
+    expect(await getRepository(AuditRequest).count()).toBe(0)
+  })
+
+  it('a list counts what it returned', async () => {
+    allow(true)
+    await request(kim, '{ payslips { id } }')
+
+    const [result] = await actions({ kind: 'door.result' })
+    expect(result.returned).toBe(3)
+  })
+
+  it('a refusal is a check with its cause and no result', async () => {
+    allow(false)
+    await request(kim, '{ payslip(employeeId: "e9") }')
+
+    const rows = await actions()
+    expect(rows).toHaveLength(1)
+    expect(rows[0]).toMatchObject({ kind: 'door.check', decision: 'denied', basis: 'role', targetIds: ['e9'] })
+  })
+
+  it('passing the door is not doing the work - an error is a result with a code, never the message', async () => {
+    allow(true)
+    await request(kim, '{ broken }')
+
+    const [result] = await actions({ kind: 'door.result' })
+    expect(result).toMatchObject({ outcome: 'error', code: 'INTERNAL_SERVER_ERROR' })
+    expect(JSON.stringify(await actions())).not.toMatch(/4,200,000|salary/)
+  })
+
+  it('a pass that rested on superuser says so', async () => {
+    allow(false, { superUser: true })
+    await request(kim, '{ ownersOnly }')
+
+    const [check] = await actions({ kind: 'door.check' })
+    expect(check).toMatchObject({ door: 'super', decision: 'granted', basis: 'superuser' })
+  })
+})
+
+describe('who may do what is recorded where it is saved (§3.3 · §4-1)', () => {
+  async function grant(user: any, roles: any[]) {
+    const holder = await getRepository(User).findOne({ where: { id: user.id }, relations: ['roles'] })
+    holder.roles = roles
+    return await getRepository(User).save(holder)
+  }
+
+  it('a role given and taken back', async () => {
+    const role = await getRepository(Role).save({ name: 'payroll', domain })
+
+    await runInAuditScope(koaContext(lee, ''), 'http', () => grant(kim, [role]))
+    await runInAuditScope(koaContext(lee, ''), 'http', () => grant(kim, []))
+    await flushAudit()
+
+    const granted = await actions({ kind: 'role.grant' })
+    expect(granted).toHaveLength(1)
+    expect(granted[0]).toMatchObject({ targetKind: 'User', targetIds: [kim.id], objectKind: 'Role', objectId: role.id })
+    expect(granted[0].actor.id).toBe(lee.id)
+    expect(granted[0].domain.id).toBe(domain.id)
+
+    expect(await actions({ kind: 'role.revoke' })).toHaveLength(1)
+  })
+
+  it('a privilege added to a role, and removed', async () => {
+    const privilege = await getRepository(Privilege).save({ name: 'query', category: 'payroll' })
+    const role = await getRepository(Role).save({ name: 'payroll', domain, privileges: [privilege] })
+    role.privileges = []
+    await getRepository(Role).save(role)
+
+    expect(await actions({ kind: 'role.privilege.add' })).toMatchObject([{ targetIds: [role.id], objectKind: 'Privilege', objectId: privilege.id }])
+    expect(await actions({ kind: 'role.privilege.remove' })).toHaveLength(1)
+  })
+
+  it('a status change keeps the states, nothing else', async () => {
+    kim.status = 'inactive'
+    await getRepository(User).save(kim)
+
+    const [row] = await actions({ kind: 'user.status' })
+    expect(row.detail).toEqual({ from: 'activated', to: 'inactive' })
+  })
+
+  it('a grant rolled back leaves no record', async () => {
+    const role = await getRepository(Role).save({ name: 'payroll', domain })
+
+    await expect(
+      authDataSource().transaction(async manager => {
+        const holder = await manager.getRepository(User).findOne({ where: { id: kim.id }, relations: ['roles'] })
+        holder.roles = [role]
+        await manager.getRepository(User).save(holder)
+        throw new Error('the change failed')
+      })
+    ).rejects.toThrow('the change failed')
+
+    expect(await actions({ kind: 'role.grant' })).toHaveLength(0)
+  })
+
+  it('a grant whose record cannot be written does not happen', async () => {
+    const role = await getRepository(Role).save({ name: 'payroll', domain })
+    const table = authDataSource().getMetadata(AuditAction).tableName
+    await authDataSource().query(`ALTER TABLE ${table} RENAME TO ${table}_away`)
+
+    try {
+      await expect(grant(kim, [role])).rejects.toThrow()
+    } finally {
+      await authDataSource().query(`ALTER TABLE ${table}_away RENAME TO ${table}`)
+    }
+
+    const holder = await getRepository(User).findOne({ where: { id: kim.id }, relations: ['roles'] })
+    expect(holder.roles).toHaveLength(0)
+  })
+})
+
+describe('only the fields it allows (§3.4)', () => {
+  it('a detail key the kind did not register is refused', async () => {
+    await expect(recordAuditAction({ kind: 'user.status', detail: { salary: 4200000 } })).rejects.toThrow(/does not allow detail "salary"/)
+  })
+
+  it('a kind nobody registered is refused', async () => {
+    await expect(recordAuditAction({ kind: 'payroll.view' })).rejects.toThrow(/not registered/)
+  })
+})
+
+describe('signing in (§3.3)', () => {
+  it('a success, a wrong password, an account that does not exist', async () => {
+    await signin({ username: 'kim', password: PASSWORD })
+    await expect(signin({ username: 'kim', password: 'Wr0ngPass!' })).rejects.toThrow()
+    await expect(signin({ username: 'nobody', password: PASSWORD })).rejects.toThrow()
+    await flushAudit()
+
+    const rows = await getRepository(AuditAction).find({ where: { kind: 'auth.signin' }, relations: ['actor'], order: { createdAt: 'ASC' } })
+    expect(rows.map(row => [row.outcome, row.code, row.actor?.id ?? null])).toEqual([
+      ['ok', null, kim.id],
+      ['error', 'password-not-matched', kim.id],
+      ['error', 'user not found', null]
+    ])
+  })
+})
+
+describe('a write that fails is counted apart and does not stop the answer (§4-4 · §4-5)', () => {
+  it('the request is answered and the failure counted', async () => {
+    allow(true)
+    const before = auditHealth().failures
+    const table = authDataSource().getMetadata(AuditRequest).tableName
+    await authDataSource().query(`ALTER TABLE ${table} RENAME TO ${table}_away`)
+
+    try {
+      const result = await request(kim, '{ payslip(employeeId: "e1") }')
+      expect(result.data).toEqual({ payslip: 'pay of e1' })
+    } finally {
+      await authDataSource().query(`ALTER TABLE ${table}_away RENAME TO ${table}`)
+    }
+
+    expect(auditHealth().failures).toBe(before + 1)
+    expect(auditHealth().lastFailedAt).toBeInstanceOf(Date)
+  })
+})
+
+describe('reading the audit (§5 · §6)', () => {
+  const day = 24 * 60 * 60 * 1000
+  const from = new Date(Date.now() - day)
+  const to = new Date(Date.now() + day)
+  const context = (user = lee, at = domain) => ({ state: { domain: at, user } })
+
+  it("each member's checks, audit reads left out, and only this domain's", async () => {
+    allow(true)
+    await request(kim, '{ payslip(employeeId: "e1") }')
+    await request(kim, '{ payslips { id } }', other)
+    allow(false)
+    await request(kim, '{ payslip(employeeId: "e2") }')
+    await recordAuditAction({ kind: 'door.check', door: 'audit:query', decision: 'granted' }, { actorId: kim.id, domainId: domain.id })
+    await recordAuditAction({ kind: 'auth.checkin', outcome: 'ok' }, { actorId: kim.id, domainId: domain.id })
+
+    const people = await new AuditQuery().auditPeople(from, to, context())
+    const row = people.find((one: any) => one.user.id === kim.id)
+    expect(row).toMatchObject({ granted: 1, denied: 1, checkins: 1 })
+    expect(row.lastCheckinAt).toBeInstanceOf(Date)
+    /* The moment itself - a driver's zone-less text read as local time was hours off. */
+    expect(Math.abs(row.lastCheckinAt.getTime() - Date.now())).toBeLessThan(60_000)
+    expect(people.find((one: any) => one.user.id === lee.id)).toMatchObject({ granted: 0, denied: 0, checkins: 0 })
+  })
+
+  it('every declared door, one with no record in the period too', async () => {
+    await getRepository(Privilege).save([
+      { name: 'query', category: 'payroll' },
+      { name: 'mutation', category: 'payroll' },
+      { name: 'query', category: 'audit' }
+    ])
+    allow(true)
+    await request(kim, '{ payslip(employeeId: "e1") }')
+
+    const doors = await new AuditQuery().auditDoors(from, to, context())
+    expect(doors.map((one: any) => [one.door, one.people, one.granted])).toEqual([
+      ['payroll:mutation', 0, 0],
+      ['payroll:query', 1, 1]
+    ])
+  })
+
+  it('records narrow by outcome, and never reach another domain', async () => {
+    allow(true)
+    await request(kim, '{ payslip(employeeId: "e1") }')
+    await request(kim, '{ payslip(employeeId: "e1") }', other)
+    allow(false)
+    await request(lee, '{ payslip(employeeId: "e2") }')
+
+    const all = await new AuditQuery().auditRecords({ from, to }, context())
+    expect(all.total).toBe(2)
+
+    const denied = await new AuditQuery().auditRecords({ from, to, outcome: 'denied' }, context())
+    expect(denied.items.map((one: any) => one.request.actor.id)).toEqual([lee.id])
+    expect(denied.items[0].actions.map((one: any) => one.kind)).toEqual(['door.check'])
+  })
+
+  it('my record is what I did, whatever is asked', async () => {
+    await recordAuditAction({ kind: 'auth.checkin', outcome: 'ok' }, { actorId: kim.id, domainId: domain.id })
+    await recordAuditAction(
+      { kind: 'role.grant', targetKind: 'User', targetIds: [kim.id], objectKind: 'Role', objectId: 'r' },
+      { actorId: lee.id, domainId: domain.id }
+    )
+
+    const mine = await new AuditQuery().myAuditActions(undefined, 10, context(kim))
+    expect(mine.map((one: any) => one.kind)).toEqual(['auth.checkin'])
+  })
+})
+
+describe('retention (§7)', () => {
+  it('removes what is past a year and keeps the rest', async () => {
+    await recordAuditAction({ kind: 'auth.checkin', outcome: 'ok' }, { actorId: kim.id, domainId: domain.id })
+    const later = new Date(Date.now() + 366 * 24 * 60 * 60 * 1000)
+
+    expect(await purgeExpiredAudit(new Date())).toEqual({ requests: 0, actions: 0 })
+    expect(await purgeExpiredAudit(later)).toEqual({ requests: 0, actions: 1 })
+  })
+})

package/tests/auth-base-role-tasks.test.ts

@@ -0,0 +1,58 @@
+/**
+ * auth-base's own tasks (ADR-0139 decision 11) - each names doors declared where auth-base runs
+ * (its own server or shell's, which it depends on), and says what it is in all six languages.
+ *
+ * A task naming a category nobody declares is a definition error only when an application builds a
+ * seat from it; a task with no words shows its id on the role screen. Both are caught here, where
+ * the task is written.
+ */
+
+import { readdirSync, readFileSync } from 'fs'
+import { join } from 'path'
+
+import { loadCompiled } from './compiled'
+
+const { ROLE_TASKS } = loadCompiled('role-tasks')
+
+const LANGUAGES = ['ko', 'en', 'ja', 'zh', 'es', 'ms']
+const SERVERS = [join(__dirname, '..', 'server'), join(__dirname, '..', '..', 'shell', 'server')]
+
+/** Every `@privilege(category: "x", privilege: "y")` written in auth-base's and shell's server source. */
+function declaredDoors(): Set<string> {
+  const doors = new Set<string>()
+  const walk = (dir: string) => {
+    for (const entry of readdirSync(dir, { withFileTypes: true })) {
+      const path = join(dir, entry.name)
+      if (entry.isDirectory()) walk(path)
+      else if (entry.name.endsWith('.ts')) {
+        const text = readFileSync(path, 'utf8')
+        for (const match of text.matchAll(/@privilege\(category: \\?"([^"\\]+)\\?", privilege: \\?"([^"\\]+)\\?"/g)) {
+          doors.add(`${match[1]}:${match[2]}`)
+        }
+      }
+    }
+  }
+  SERVERS.forEach(walk)
+  return doors
+}
+
+describe("auth-base's tasks", () => {
+  const doors = declaredDoors()
+
+  it.each(ROLE_TASKS.map((task: any) => [task.id, task]))('%s names doors declared where auth-base runs', (_id, task: any) => {
+    for (const grant of task.grants) {
+      for (const axis of grant.axes) expect(doors).toContain(`${grant.category}:${axis}`)
+    }
+  })
+
+  it.each(LANGUAGES)('%s says what each task is', language => {
+    const words = JSON.parse(readFileSync(join(__dirname, '..', 'translations', `${language}.json`), 'utf8'))
+    for (const task of ROLE_TASKS) {
+      expect({ task: task.id, name: !!words[`task.${task.id}.name`], description: !!words[`task.${task.id}.description`] }).toEqual({
+        task: task.id,
+        name: true,
+        description: true
+      })
+    }
+  })
+})

package/tests/list-inheritance-db.test.ts

@@ -24,8 +24,6 @@ const { InvitationStatus } = loadCompiled('utils/invitation-state')
 const { InvitationQuery } = loadCompiled('service/invitation/invitation-query')
 const { Partner } = loadCompiled('service/partner/partner')
 const { PartnerQuery } = loadCompiled('service/partner/partner-query')
-const { LoginHistory } = loadCompiled('service/login-history/login-history')
-const { LoginHistoryQuery } = loadCompiled('service/login-history/login-history-query')
 
 let parent: any
 let child: any
@@ -119,11 +117,6 @@ const LISTS: [string, () => Promise<any>, (params: any, context: any) => Promise
     'partners',
     () => getRepository(Partner).save({ domain: parent, partnerDomain, requestedAt: new Date() }),
     (params, context) => new PartnerQuery().partners(params, context)
-  ],
-  [
-    'login histories',
-    () => LoginHistory.stamp(parent, parentUser, '10.0.0.1'),
-    (params, context) => new LoginHistoryQuery().loginHistories(params, context)
   ]
 ]
 

package/tests/open-doors.test.ts

@@ -80,7 +80,7 @@ describe('the doors that were closed', () => {
    *                                  signs in, so adding one is not an edit to a settings row
    *   domainUserRoleRegister         makes a domain, its roles and its users. `domainRegister`
    *                                  beside it makes only a domain and is super-user only
-   *   loginHistories                 everybody's sign-ins
+   *   loginHistories                 everybody's sign-ins - now the audit's, behind `audit:query` (ADR-0141)
    *   invitation / invitations       and neither of them scopes by tenant at all
    *   sendInvitation / cancelInvitation / inviteUser
    */
@@ -96,7 +96,7 @@ describe('the doors that were closed', () => {
       'cancelInvitation',
       'inviteUser'
     ],
-    Query: ['loginHistories', 'invitation', 'invitations']
+    Query: ['auditRecords', 'auditPeople', 'auditDoors', 'auditHealth', 'invitation', 'invitations']
   }
 
   it.each(Object.entries(CLOSED).flatMap(([t, fields]) => fields.map(f => [t, f])))('%s.%s', (typeName, field) => {

package/tests/refusal-cause.test.ts

@@ -64,7 +64,7 @@ describe('a refusal says which of the four it was', () => {
   it('★ an owner without the role, from an unsafe address: address - from a safe one they pass', async () => {
     given({ owner: true })
     expect(await judgePermission(OWNED, USER, DOMAIN, true)).toEqual({ permitted: false, because: 'address' })
-    expect(await judgePermission(OWNED, USER, DOMAIN, false)).toEqual({ permitted: true })
+    expect(await judgePermission(OWNED, USER, DOMAIN, false)).toEqual({ permitted: true, by: 'domain-owner' })
   })
 
   it('an unsafe address whose ownership cannot be asked still refuses as role - it refused before', async () => {