@things-factory/auth-base 10.1.213 → 10.1.218

package/dist-server/utils/invitation-state.js

@@ -1,76 +0,0 @@
-"use strict";
-/**
- * What state an invitation is in, and whether it can still be accepted. (Pure rule.)
- *
- * ## Why the table keeps rows now
- *
- * Accepting used to delete the row and cancelling still does, so the table was a queue of
- * pending invitations and nothing else. The moment somebody joined, the fact that they had been
- * invited stopped existing — which is why no screen was ever built on it, and why nothing calls
- * any of it. An invitation list has to be able to say *who was invited, by whom, when, and
- * whether they came in*.
- *
- * So the row survives and carries its state. `pending` → one of the other three, and never back.
- *
- * ## Why expiry is derived and not only stored
- *
- * A token that outlives its invitation is a credential nobody is watching. If `expired` were
- * only ever a written value, it would depend on something running to write it, and the gap
- * between the expiry passing and that thing running is a window where the token still works.
- * So the rule reads the clock: a pending row past its `expiresAt` **is** expired, whatever the
- * column says. Writing the status is then bookkeeping for the list, not the guard.
- *
- * ## What an absent value means, and why it refuses
- *
- * Rows written before this existed have neither status nor expiry. They come from a flow that
- * never completed — the link in the email led nowhere — so treating them as live would keep
- * tokens alive that were never usable in the first place.
- *
- *   status absent       reads as `pending`, which is what the old table meant by a row existing
- *   expiresAt absent    reads as **expired**. An invitation that cannot say when it dies is not
- *                       a live invitation, and this is a credential: absence refuses.
- */
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.InvitationStatus = void 0;
-exports.invitationState = invitationState;
-exports.mayAccept = mayAccept;
-/** The states an invitation row can be in. Stored, and also derived for expiry. */
-var InvitationStatus;
-(function (InvitationStatus) {
-    InvitationStatus["PENDING"] = "pending";
-    InvitationStatus["ACCEPTED"] = "accepted";
-    InvitationStatus["CANCELLED"] = "cancelled";
-    InvitationStatus["EXPIRED"] = "expired";
-})(InvitationStatus || (exports.InvitationStatus = InvitationStatus = {}));
-function expiryPassed(expiresAt, now) {
-    if (!expiresAt) {
-        /* No expiry recorded — see the note above. Absence refuses. */
-        return true;
-    }
-    const at = expiresAt instanceof Date ? expiresAt : new Date(expiresAt);
-    if (Number.isNaN(at.getTime())) {
-        return true;
-    }
-    return at.getTime() <= now.getTime();
-}
-/**
- * The state this invitation is in, as of `now`.
- *
- * Only a pending row is measured against the clock. Once a row has been accepted or cancelled
- * that is what happened to it, and time passing does not rewrite history.
- */
-function invitationState(invitation, now = new Date()) {
-    const status = invitation?.status || InvitationStatus.PENDING;
-    if (status === InvitationStatus.ACCEPTED || status === InvitationStatus.CANCELLED) {
-        return status;
-    }
-    if (status === InvitationStatus.EXPIRED) {
-        return InvitationStatus.EXPIRED;
-    }
-    return expiryPassed(invitation?.expiresAt, now) ? InvitationStatus.EXPIRED : InvitationStatus.PENDING;
-}
-/** May this invitation still be accepted? Only a pending one that has not run out. */
-function mayAccept(invitation, now = new Date()) {
-    return !!invitation && invitationState(invitation, now) === InvitationStatus.PENDING;
-}
-//# sourceMappingURL=invitation-state.js.map

package/dist-server/utils/invitation-state.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"invitation-state.js","sourceRoot":"","sources":["../../server/utils/invitation-state.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;;;AAqCH,0CAYC;AAGD,8BAEC;AApDD,mFAAmF;AACnF,IAAY,gBAKX;AALD,WAAY,gBAAgB;IAC1B,uCAAmB,CAAA;IACnB,yCAAqB,CAAA;IACrB,2CAAuB,CAAA;IACvB,uCAAmB,CAAA;AACrB,CAAC,EALW,gBAAgB,gCAAhB,gBAAgB,QAK3B;AAQD,SAAS,YAAY,CAAC,SAA2C,EAAE,GAAS;IAC1E,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,+DAA+D;QAC/D,OAAO,IAAI,CAAA;IACb,CAAC;IAED,MAAM,EAAE,GAAG,SAAS,YAAY,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,SAAS,CAAC,CAAA;IAEtE,IAAI,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC;QAC/B,OAAO,IAAI,CAAA;IACb,CAAC;IAED,OAAO,EAAE,CAAC,OAAO,EAAE,IAAI,GAAG,CAAC,OAAO,EAAE,CAAA;AACtC,CAAC;AAED;;;;;GAKG;AACH,SAAgB,eAAe,CAAC,UAA4B,EAAE,MAAY,IAAI,IAAI,EAAE;IAClF,MAAM,MAAM,GAAG,UAAU,EAAE,MAAM,IAAI,gBAAgB,CAAC,OAAO,CAAA;IAE7D,IAAI,MAAM,KAAK,gBAAgB,CAAC,QAAQ,IAAI,MAAM,KAAK,gBAAgB,CAAC,SAAS,EAAE,CAAC;QAClF,OAAO,MAA0B,CAAA;IACnC,CAAC;IAED,IAAI,MAAM,KAAK,gBAAgB,CAAC,OAAO,EAAE,CAAC;QACxC,OAAO,gBAAgB,CAAC,OAAO,CAAA;IACjC,CAAC;IAED,OAAO,YAAY,CAAC,UAAU,EAAE,SAAS,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC,CAAC,gBAAgB,CAAC,OAAO,CAAA;AACvG,CAAC;AAED,sFAAsF;AACtF,SAAgB,SAAS,CAAC,UAA4B,EAAE,MAAY,IAAI,IAAI,EAAE;IAC5E,OAAO,CAAC,CAAC,UAAU,IAAI,eAAe,CAAC,UAAU,EAAE,GAAG,CAAC,KAAK,gBAAgB,CAAC,OAAO,CAAA;AACtF,CAAC","sourcesContent":["/**\n * What state an invitation is in, and whether it can still be accepted. (Pure rule.)\n *\n * ## Why the table keeps rows now\n *\n * Accepting used to delete the row and cancelling still does, so the table was a queue of\n * pending invitations and nothing else. The moment somebody joined, the fact that they had been\n * invited stopped existing — which is why no screen was ever built on it, and why nothing calls\n * any of it. An invitation list has to be able to say *who was invited, by whom, when, and\n * whether they came in*.\n *\n * So the row survives and carries its state. `pending` → one of the other three, and never back.\n *\n * ## Why expiry is derived and not only stored\n *\n * A token that outlives its invitation is a credential nobody is watching. If `expired` were\n * only ever a written value, it would depend on something running to write it, and the gap\n * between the expiry passing and that thing running is a window where the token still works.\n * So the rule reads the clock: a pending row past its `expiresAt` **is** expired, whatever the\n * column says. Writing the status is then bookkeeping for the list, not the guard.\n *\n * ## What an absent value means, and why it refuses\n *\n * Rows written before this existed have neither status nor expiry. They come from a flow that\n * never completed — the link in the email led nowhere — so treating them as live would keep\n * tokens alive that were never usable in the first place.\n *\n *   status absent       reads as `pending`, which is what the old table meant by a row existing\n *   expiresAt absent    reads as **expired**. An invitation that cannot say when it dies is not\n *                       a live invitation, and this is a credential: absence refuses.\n */\n\n/** The states an invitation row can be in. Stored, and also derived for expiry. */\nexport enum InvitationStatus {\n  PENDING = 'pending',\n  ACCEPTED = 'accepted',\n  CANCELLED = 'cancelled',\n  EXPIRED = 'expired'\n}\n\n/** The parts of an invitation this rule reads. */\nexport type InvitationRecord = {\n  status?: string | null\n  expiresAt?: Date | string | null\n} | null | undefined\n\nfunction expiryPassed(expiresAt: Date | string | null | undefined, now: Date): boolean {\n  if (!expiresAt) {\n    /* No expiry recorded — see the note above. Absence refuses. */\n    return true\n  }\n\n  const at = expiresAt instanceof Date ? expiresAt : new Date(expiresAt)\n\n  if (Number.isNaN(at.getTime())) {\n    return true\n  }\n\n  return at.getTime() <= now.getTime()\n}\n\n/**\n * The state this invitation is in, as of `now`.\n *\n * Only a pending row is measured against the clock. Once a row has been accepted or cancelled\n * that is what happened to it, and time passing does not rewrite history.\n */\nexport function invitationState(invitation: InvitationRecord, now: Date = new Date()): InvitationStatus {\n  const status = invitation?.status || InvitationStatus.PENDING\n\n  if (status === InvitationStatus.ACCEPTED || status === InvitationStatus.CANCELLED) {\n    return status as InvitationStatus\n  }\n\n  if (status === InvitationStatus.EXPIRED) {\n    return InvitationStatus.EXPIRED\n  }\n\n  return expiryPassed(invitation?.expiresAt, now) ? InvitationStatus.EXPIRED : InvitationStatus.PENDING\n}\n\n/** May this invitation still be accepted? Only a pending one that has not run out. */\nexport function mayAccept(invitation: InvitationRecord, now: Date = new Date()): boolean {\n  return !!invitation && invitationState(invitation, now) === InvitationStatus.PENDING\n}\n"]}

package/tests/invitation-db.test.ts

@@ -1,416 +0,0 @@
-import { closeAuthDatabase, Domain, getRepository, openAuthDatabase, resetAuthDatabase } from './db'
-import { loadCompiled } from './compiled'
-
-const { Invitation } = loadCompiled('service/invitation/invitation')
-const { InvitationMutation } = loadCompiled('service/invitation/invitation-mutation')
-const { InvitationQuery } = loadCompiled('service/invitation/invitation-query')
-const { Privilege } = loadCompiled('service/privilege/privilege')
-const { Role } = loadCompiled('service/role/role')
-const { User, UserStatus } = loadCompiled('service/user/user')
-const { acceptInvitation } = loadCompiled('controllers/invitation')
-const { InvitationStatus } = loadCompiled('utils/invitation-state')
-
-const mutation = new InvitationMutation()
-const query = new InvitationQuery()
-
-/**
- * Inviting somebody into a domain, and their accepting it.
- *
- * ── What this replaced ──────────────────────────────────────────────────────
- * `invitation-surface-db.test.ts` stood here and pinned the old shape: a row with no domain, no
- * status and no expiry, read by `{ email, reference, type }` from any tenant, deleted the moment
- * anybody accepted. It existed so that nobody could build on `reference` or remove it quietly.
- * It failed the moment this was built, which is what it was for.
- *
- * ── The token ───────────────────────────────────────────────────────────────
- * It travels in the link's fragment, so the server never sees it in a request line. Accepting
- * asks for the invited address too, because a forwarded mail is the one way the token can still
- * reach somebody else and no amount of hiding closes that.
- *
- * ⚠ sqlite (`tests/db.ts`). Mail is not sent here — `@things-factory/email-base` is stubbed by
- * the harness the same way the other mailing paths are, and what is asserted is the row.
- */
-
-let ours: any
-let theirs: any
-let admin: any
-
-function context(d: any) {
-  return {
-    state: { domain: d, user: admin, tx: undefined },
-    lng: 'en',
-    headers: {},
-    request: { protocol: 'http', host: 'acme.test' },
-    throw: (code: number, message: string) => {
-      const error: any = new Error(message)
-      error.status = code
-      throw error
-    }
-  } as any
-}
-
-async function refusalCodeOf(promise: Promise<unknown>): Promise<string> {
-  try {
-    await promise
-  } catch (error: any) {
-    return error?.code || error?.extensions?.refusal?.code || `not a refusal: ${error?.message}`
-  }
-
-  return 'nothing was thrown'
-}
-
-async function roleIn(domain: any, name: string) {
-  const privilege = await getRepository(Privilege).save({ name: 'query', category: `board-${name}` })
-
-  return await getRepository(Role).save({ name, domain: { id: domain.id }, privileges: [privilege] })
-}
-
-async function personWithAccount(email: string, domains: any[] = []) {
-  return await getRepository(User).save({
-    username: email,
-    email,
-    name: email,
-    userType: 'user',
-    status: UserStatus.ACTIVATED,
-    domains: domains.map(d => ({ id: d.id }))
-  })
-}
-
-/** The row as it stands, with its token — which no client is ever given. */
-async function stored(id: string) {
-  return await getRepository(Invitation).findOne({ where: { id }, relations: ['domain', 'roles'] })
-}
-
-beforeAll(async () => {
-  await openAuthDatabase()
-})
-
-afterAll(async () => {
-  await closeAuthDatabase()
-})
-
-beforeEach(async () => {
-  await resetAuthDatabase()
-
-  ours = await getRepository(Domain).save({ name: 'acme', subdomain: 'acme' })
-  theirs = await getRepository(Domain).save({ name: 'beta', subdomain: 'beta' })
-  admin = await personWithAccount('admin@acme.z', [ours])
-})
-
-describe('sending one', () => {
-  it('stands a pending invitation to this domain, with an expiry and a token', async () => {
-    const sent = await mutation.sendInvitation('kim@acme.z', context(ours))
-    const row = await stored(sent.id)
-
-    expect(row.status).toEqual(InvitationStatus.PENDING)
-    expect(row.domain.id).toEqual(ours.id)
-    expect(row.expiresAt).toBeTruthy()
-    expect(row.token).toHaveLength(32)
-  })
-
-  it('takes the domain from the request, not from the caller', async () => {
-    /*
-     * ⚠ It used to be `reference`, a string the caller passed. That is how a door ends up
-     * writing and reading other tenants' rows.
-     */
-    const sent = await mutation.sendInvitation('kim@acme.z', context(ours))
-
-    expect((await stored(sent.id)).domain.id).toEqual(ours.id)
-    expect((await stored(sent.id)).domain.id).not.toEqual(theirs.id)
-  })
-
-  it('carries the roles the person arrives with', async () => {
-    /* Without them they sign in and have no screens at all. */
-    const viewer = await roleIn(ours, 'viewer')
-
-    const sent = await mutation.sendInvitation('kim@acme.z', context(ours), [viewer.id])
-
-    expect((await stored(sent.id)).roles.map((role: any) => role.id)).toEqual([viewer.id])
-  })
-
-  it('does not take a role from another domain', async () => {
-    const foreign = await roleIn(theirs, 'viewer')
-
-    const sent = await mutation.sendInvitation('kim@acme.z', context(ours), [foreign.id])
-
-    expect((await stored(sent.id)).roles).toEqual([])
-  })
-
-  it('re-issues the standing invitation rather than making a second one', async () => {
-    /*
-     * ⚠ One pending invitation per person and domain. The history keeps every row, so this
-     * cannot be a unique index without forbidding "invited, left, invited again" — it is held
-     * here instead.
-     */
-    const first = await mutation.sendInvitation('kim@acme.z', context(ours))
-    const again = await mutation.sendInvitation('kim@acme.z', context(ours))
-
-    expect(again.id).toEqual(first.id)
-    expect(await getRepository(Invitation).count()).toEqual(1)
-  })
-
-  it('gives the re-issued one a new token', async () => {
-    /* Two live links for one invitation is one more than anybody meant to send. */
-    const first = await mutation.sendInvitation('kim@acme.z', context(ours))
-    const before = (await stored(first.id)).token
-
-    await mutation.sendInvitation('kim@acme.z', context(ours))
-
-    expect((await stored(first.id)).token).not.toEqual(before)
-  })
-
-  it('refuses somebody who is already here', async () => {
-    await personWithAccount('kim@acme.z', [ours])
-
-    expect(await refusalCodeOf(mutation.sendInvitation('kim@acme.z', context(ours)))).toEqual(
-      'invitation-already-a-member'
-    )
-  })
-})
-
-describe('accepting', () => {
-  async function pending(email = 'kim@acme.z', roleNames: string[] = []) {
-    const roles = []
-
-    for (const name of roleNames) {
-      roles.push(await roleIn(ours, name))
-    }
-
-    const sent = await mutation.sendInvitation(
-      email,
-      context(ours),
-      roles.map(role => role.id)
-    )
-
-    return await stored(sent.id)
-  }
-
-  it('lets somebody who already has an account in, with their roles', async () => {
-    const invitation = await pending('kim@acme.z', ['viewer'])
-    const kim = await personWithAccount('kim@acme.z')
-
-    const { created } = await acceptInvitation({
-      token: invitation.token,
-      email: 'kim@acme.z',
-      context: context(ours)
-    })
-
-    const joined = await getRepository(User).findOne({ where: { id: kim.id }, relations: ['domains', 'roles'] })
-
-    expect(created).toBe(false)
-    expect(joined.domains.map((d: any) => d.id)).toContain(ours.id)
-    expect(joined.roles.map((role: any) => role.name)).toEqual(['viewer'])
-  })
-
-  it('creates the account for somebody who has none', async () => {
-    /*
-     * ⚠ The case this whole feature is for. The `user-invite` screen records that an installation
-     * with no default password has no path at all for a person who does not exist yet — nobody
-     * can set their password for them.
-     */
-    const invitation = await pending('new@acme.z', ['viewer'])
-
-    const { created } = await acceptInvitation({
-      token: invitation.token,
-      email: 'new@acme.z',
-      name: 'New Person',
-      password: 'Passw0rd!x',
-      context: context(ours)
-    })
-
-    const person = await getRepository(User).findOne({
-      where: { email: 'new@acme.z' },
-      relations: ['domains', 'roles']
-    })
-
-    expect(created).toBe(true)
-    expect(person.status).toEqual(UserStatus.ACTIVATED)
-    expect(person.domains.map((d: any) => d.id)).toEqual([ours.id])
-    expect(person.roles.map((role: any) => role.name)).toEqual(['viewer'])
-  })
-
-  it('will not create an account without a password', async () => {
-    const invitation = await pending('new@acme.z')
-
-    expect(
-      await refusalCodeOf(
-        acceptInvitation({ token: invitation.token, email: 'new@acme.z', context: context(ours) })
-      )
-    ).toEqual('invitation-needs-a-password')
-  })
-
-  it('marks the row accepted instead of deleting it', async () => {
-    /* ⚠ The reason the table exists. Deleting takes the fact that they were invited with it. */
-    const invitation = await pending()
-    await personWithAccount('kim@acme.z')
-
-    await acceptInvitation({ token: invitation.token, email: 'kim@acme.z', context: context(ours) })
-
-    const row = await stored(invitation.id)
-
-    expect(row).not.toBeNull()
-    expect(row.status).toEqual(InvitationStatus.ACCEPTED)
-    expect(row.acceptedAt).toBeTruthy()
-  })
-
-  it('cannot be used twice', async () => {
-    const invitation = await pending()
-    await personWithAccount('kim@acme.z')
-
-    await acceptInvitation({ token: invitation.token, email: 'kim@acme.z', context: context(ours) })
-
-    expect(
-      await refusalCodeOf(
-        acceptInvitation({ token: invitation.token, email: 'kim@acme.z', context: context(ours) })
-      )
-    ).toEqual('invitation-not-open')
-  })
-})
-
-describe('⚠ what the token alone is not enough for', () => {
-  async function pending(email = 'kim@acme.z') {
-    return await stored((await mutation.sendInvitation(email, context(ours))).id)
-  }
-
-  it('refuses when the address given is not the one invited', async () => {
-    /*
-     * ⚠ The mitigation for the one leak that hiding the token cannot close: the mail being
-     * forwarded. Holding the link is not enough on its own.
-     */
-    const invitation = await pending('kim@acme.z')
-    await personWithAccount('someone.else@acme.z')
-
-    expect(
-      await refusalCodeOf(
-        acceptInvitation({ token: invitation.token, email: 'someone.else@acme.z', context: context(ours) })
-      )
-    ).toEqual('invitation-not-open')
-  })
-
-  it('accepts the invited address whatever case it is typed in', async () => {
-    const invitation = await pending('Kim@Acme.Z')
-    await personWithAccount('kim@acme.z')
-
-    await expect(
-      acceptInvitation({ token: invitation.token, email: '  KIM@acme.z  ', context: context(ours) })
-    ).resolves.toBeTruthy()
-  })
-
-  it('refuses an expired invitation', async () => {
-    const invitation = await pending()
-    await personWithAccount('kim@acme.z')
-
-    await getRepository(Invitation).save({ ...invitation, expiresAt: new Date(Date.now() - 1000) })
-
-    expect(
-      await refusalCodeOf(
-        acceptInvitation({ token: invitation.token, email: 'kim@acme.z', context: context(ours) })
-      )
-    ).toEqual('invitation-not-open')
-  })
-
-  it('refuses a cancelled one whose expiry is still ahead', async () => {
-    const invitation = await pending()
-    await personWithAccount('kim@acme.z')
-
-    await mutation.cancelInvitation(invitation.id, context(ours))
-
-    expect(
-      await refusalCodeOf(
-        acceptInvitation({ token: invitation.token, email: 'kim@acme.z', context: context(ours) })
-      )
-    ).toEqual('invitation-not-open')
-  })
-
-  it('refuses a token that is not one of ours, the same way', async () => {
-    /*
-     * One answer for a wrong token, a wrong address, an expired one and a cancelled one. Telling
-     * them apart would let somebody learn which tokens are real.
-     */
-    expect(
-      await refusalCodeOf(acceptInvitation({ token: 'no-such-token', email: 'kim@acme.z', context: context(ours) }))
-    ).toEqual('invitation-not-open')
-  })
-})
-
-describe('withdrawing one', () => {
-  it('marks it cancelled and keeps the row', async () => {
-    const sent = await mutation.sendInvitation('kim@acme.z', context(ours))
-
-    expect(await mutation.cancelInvitation(sent.id, context(ours))).toBe(true)
-    expect((await stored(sent.id)).status).toEqual(InvitationStatus.CANCELLED)
-  })
-
-  it('does not reach another tenant', async () => {
-    /* ⚠ It used to delete by `{ email, reference, type }`, which took an id from anywhere. */
-    const foreign = await getRepository(Invitation).save({
-      email: 'lee@beta.z',
-      domain: { id: theirs.id },
-      status: InvitationStatus.PENDING,
-      token: 'theirs',
-      expiresAt: new Date(Date.now() + 3600_000)
-    })
-
-    expect(await mutation.cancelInvitation(foreign.id, context(ours))).toBe(false)
-    expect((await stored(foreign.id)).status).toEqual(InvitationStatus.PENDING)
-  })
-
-  it('says no for one that is already finished', async () => {
-    const sent = await mutation.sendInvitation('kim@acme.z', context(ours))
-    await mutation.cancelInvitation(sent.id, context(ours))
-
-    expect(await mutation.cancelInvitation(sent.id, context(ours))).toBe(false)
-  })
-})
-
-describe('the list', () => {
-  it('shows this domain and not another', async () => {
-    await mutation.sendInvitation('kim@acme.z', context(ours))
-    await getRepository(Invitation).save({
-      email: 'lee@beta.z',
-      domain: { id: theirs.id },
-      status: InvitationStatus.PENDING,
-      token: 'theirs',
-      expiresAt: new Date(Date.now() + 3600_000)
-    })
-
-    const { items, total } = await query.invitations({ filters: [] } as any, context(ours))
-
-    expect(total).toEqual(1)
-    expect(items[0].email).toEqual('kim@acme.z')
-  })
-
-  it('keeps accepted invitations in it', async () => {
-    /* ⚠ The history. This is what there was nothing to put on a screen before. */
-    const sent = await mutation.sendInvitation('kim@acme.z', context(ours))
-    await personWithAccount('kim@acme.z')
-
-    await acceptInvitation({ token: (await stored(sent.id)).token, email: 'kim@acme.z', context: context(ours) })
-
-    const { items, total } = await query.invitations({ filters: [] } as any, context(ours))
-
-    expect(total).toEqual(1)
-    expect(await query.state(items[0])).toEqual(InvitationStatus.ACCEPTED)
-  })
-
-  it('calls a pending row past its expiry expired, before anything writes that', async () => {
-    const sent = await mutation.sendInvitation('kim@acme.z', context(ours))
-    const row = await stored(sent.id)
-
-    await getRepository(Invitation).save({ ...row, expiresAt: new Date(Date.now() - 1000) })
-
-    expect(await query.state(await stored(sent.id))).toEqual(InvitationStatus.EXPIRED)
-  })
-
-  it('does not answer for an id from another tenant', async () => {
-    const foreign = await getRepository(Invitation).save({
-      email: 'lee@beta.z',
-      domain: { id: theirs.id },
-      status: InvitationStatus.PENDING,
-      token: 'theirs',
-      expiresAt: new Date(Date.now() + 3600_000)
-    })
-
-    expect(await query.invitation(foreign.id, context(ours))).toBeNull()
-  })
-})

package/tests/invitation-route.test.ts

@@ -1,116 +0,0 @@
-import { readFileSync, readdirSync } from 'fs'
-import { join } from 'path'
-
-import { loadCompiled } from './compiled'
-
-const { authPublicProcessRouter } = loadCompiled('router/auth-public-process-router')
-const { ACCEPT_INVITATION_PATH } = loadCompiled('controllers/invitation')
-
-/**
- * The link in each mail lands on a route that exists.
- *
- * ── Why this file exists ────────────────────────────────────────────────────
- * The invitation mail pointed at `/auth/accept/<token>` — a path with no route anywhere — so the
- * invitee fell through to the private history fallback and the domain gate turned them away for
- * not being a member yet. That was found and fixed on 2026-09-20, and the fix made the same
- * mistake again: the new route was declared as `/accept-invitation` on a router whose prefix is
- * `/auth`, and the mail and the page both used `/accept-invitation`. It shipped that way.
- *
- * Every test of the invitation called the controller directly, so none of them ever went through
- * a route. This one reads the router's own table — the paths koa-router resolved, prefix included
- * — and holds each mail's link against it.
- */
-
-type Layer = { path: string; methods: string[] }
-
-const layers: Layer[] = authPublicProcessRouter.stack.map((layer: any) => ({
-  path: layer.path,
-  methods: layer.methods
-}))
-
-function answers(method: string, path: string): boolean {
-  return layers.some(layer => layer.methods.includes(method) && matches(layer.path, path))
-}
-
-/** A declared path against a concrete one: `:param` matches one segment. */
-function matches(declared: string, actual: string): boolean {
-  const a = declared.split('/')
-  const b = actual.split('/')
-
-  return a.length === b.length && a.every((part, i) => part.startsWith(':') || part === b[i])
-}
-
-describe('the invitation link', () => {
-  it('the page answers where the mail points', () => {
-    /* ⚠ The case that shipped broken. */
-    expect(answers('GET', ACCEPT_INVITATION_PATH)).toBe(true)
-  })
-
-  it('the page posts where the router listens', () => {
-    expect(answers('POST', ACCEPT_INVITATION_PATH)).toBe(true)
-  })
-
-  it('carries the prefix the router adds', () => {
-    /*
-     * Declaring `/accept-invitation` on this router makes it `/auth/accept-invitation`. The spelling
-     * without the prefix is exactly the one that went out, so it is named here as the wrong one.
-     */
-    expect(ACCEPT_INVITATION_PATH.startsWith('/auth/')).toBe(true)
-    expect(answers('GET', '/accept-invitation')).toBe(false)
-  })
-
-  it('is the path the client page uses too', () => {
-    const page = readFileSync(
-      join(__dirname, '..', '..', 'auth-ui', 'client', 'components', 'accept-invitation.ts'),
-      'utf-8'
-    )
-
-    expect(page).toContain(`return '${ACCEPT_INVITATION_PATH}'`)
-  })
-})
-
-describe('the other links sent by mail', () => {
-  /*
-   * Reset, unlock and sign-up confirmation moved to the invitation's shape on 2026-09-24 (Q4): one
-   * exported path, the token after `#`. Each page answers GET where the mail points and POST where
-   * the page sends the token.
-   */
-  const { RESET_PASSWORD_PATH } = loadCompiled('controllers/reset-password')
-  const { UNLOCK_USER_PATH } = loadCompiled('controllers/unlock-user')
-  const { VERIFY_EMAIL_PATH } = loadCompiled('controllers/verification')
-
-  const paths = [RESET_PASSWORD_PATH, UNLOCK_USER_PATH, VERIFY_EMAIL_PATH]
-
-  it('names the three it means to check', () => {
-    expect(paths).toEqual(['/auth/reset-password', '/auth/unlock-user', '/auth/verify'])
-  })
-
-  it.each(paths)('%s — the page answers where the mail points', path => {
-    expect(answers('GET', path)).toBe(true)
-  })
-
-  it.each(paths)('%s — and listens where the page posts', path => {
-    expect(answers('POST', path)).toBe(true)
-  })
-
-  it('no longer answers the old link that confirmed on opening', () => {
-    /* `GET /auth/verify/<token>` confirmed the address for whoever fetched it — a mail scanner too. */
-    expect(answers('GET', '/auth/verify/0123456789abcdef0123456789abcdef')).toBe(false)
-  })
-
-  it('no controller puts a token in a query string or a path', () => {
-    const CONTROLLERS = join(__dirname, '..', 'server', 'controllers')
-    const offending = readdirSync(CONTROLLERS)
-      .filter(file => file.endsWith('.ts'))
-      .filter(file => /\?token=\$\{|\/verify\/\$\{/.test(readFileSync(join(CONTROLLERS, file), 'utf-8')))
-
-    expect(offending).toEqual([])
-  })
-
-  it('nor does the redirect for a password that must be reset', () => {
-    const middleware = readFileSync(join(__dirname, '..', 'server', 'middlewares', 'jwt-authenticate-middleware.ts'), 'utf-8')
-
-    expect(middleware).toContain('context.redirect(`${RESET_PASSWORD_PATH}#${token}`)')
-    expect(middleware).not.toMatch(/\?token=/)
-  })
-})