@things-factory/auth-base 10.1.215 → 10.1.218

package/tests/invitation-db.test.ts

@@ -1,416 +0,0 @@
-import { closeAuthDatabase, Domain, getRepository, openAuthDatabase, resetAuthDatabase } from './db'
-import { loadCompiled } from './compiled'
-
-const { Invitation } = loadCompiled('service/invitation/invitation')
-const { InvitationMutation } = loadCompiled('service/invitation/invitation-mutation')
-const { InvitationQuery } = loadCompiled('service/invitation/invitation-query')
-const { Privilege } = loadCompiled('service/privilege/privilege')
-const { Role } = loadCompiled('service/role/role')
-const { User, UserStatus } = loadCompiled('service/user/user')
-const { acceptInvitation } = loadCompiled('controllers/invitation')
-const { InvitationStatus } = loadCompiled('utils/invitation-state')
-
-const mutation = new InvitationMutation()
-const query = new InvitationQuery()
-
-/**
- * Inviting somebody into a domain, and their accepting it.
- *
- * ── What this replaced ──────────────────────────────────────────────────────
- * `invitation-surface-db.test.ts` stood here and pinned the old shape: a row with no domain, no
- * status and no expiry, read by `{ email, reference, type }` from any tenant, deleted the moment
- * anybody accepted. It existed so that nobody could build on `reference` or remove it quietly.
- * It failed the moment this was built, which is what it was for.
- *
- * ── The token ───────────────────────────────────────────────────────────────
- * It travels in the link's fragment, so the server never sees it in a request line. Accepting
- * asks for the invited address too, because a forwarded mail is the one way the token can still
- * reach somebody else and no amount of hiding closes that.
- *
- * ⚠ sqlite (`tests/db.ts`). Mail is not sent here — `@things-factory/email-base` is stubbed by
- * the harness the same way the other mailing paths are, and what is asserted is the row.
- */
-
-let ours: any
-let theirs: any
-let admin: any
-
-function context(d: any) {
-  return {
-    state: { domain: d, user: admin, tx: undefined },
-    lng: 'en',
-    headers: {},
-    request: { protocol: 'http', host: 'acme.test' },
-    throw: (code: number, message: string) => {
-      const error: any = new Error(message)
-      error.status = code
-      throw error
-    }
-  } as any
-}
-
-async function refusalCodeOf(promise: Promise<unknown>): Promise<string> {
-  try {
-    await promise
-  } catch (error: any) {
-    return error?.code || error?.extensions?.refusal?.code || `not a refusal: ${error?.message}`
-  }
-
-  return 'nothing was thrown'
-}
-
-async function roleIn(domain: any, name: string) {
-  const privilege = await getRepository(Privilege).save({ name: 'query', category: `board-${name}` })
-
-  return await getRepository(Role).save({ name, domain: { id: domain.id }, privileges: [privilege] })
-}
-
-async function personWithAccount(email: string, domains: any[] = []) {
-  return await getRepository(User).save({
-    username: email,
-    email,
-    name: email,
-    userType: 'user',
-    status: UserStatus.ACTIVATED,
-    domains: domains.map(d => ({ id: d.id }))
-  })
-}
-
-/** The row as it stands, with its token — which no client is ever given. */
-async function stored(id: string) {
-  return await getRepository(Invitation).findOne({ where: { id }, relations: ['domain', 'roles'] })
-}
-
-beforeAll(async () => {
-  await openAuthDatabase()
-})
-
-afterAll(async () => {
-  await closeAuthDatabase()
-})
-
-beforeEach(async () => {
-  await resetAuthDatabase()
-
-  ours = await getRepository(Domain).save({ name: 'acme', subdomain: 'acme' })
-  theirs = await getRepository(Domain).save({ name: 'beta', subdomain: 'beta' })
-  admin = await personWithAccount('admin@acme.z', [ours])
-})
-
-describe('sending one', () => {
-  it('stands a pending invitation to this domain, with an expiry and a token', async () => {
-    const sent = await mutation.sendInvitation('kim@acme.z', context(ours))
-    const row = await stored(sent.id)
-
-    expect(row.status).toEqual(InvitationStatus.PENDING)
-    expect(row.domain.id).toEqual(ours.id)
-    expect(row.expiresAt).toBeTruthy()
-    expect(row.token).toHaveLength(32)
-  })
-
-  it('takes the domain from the request, not from the caller', async () => {
-    /*
-     * ⚠ It used to be `reference`, a string the caller passed. That is how a door ends up
-     * writing and reading other tenants' rows.
-     */
-    const sent = await mutation.sendInvitation('kim@acme.z', context(ours))
-
-    expect((await stored(sent.id)).domain.id).toEqual(ours.id)
-    expect((await stored(sent.id)).domain.id).not.toEqual(theirs.id)
-  })
-
-  it('carries the roles the person arrives with', async () => {
-    /* Without them they sign in and have no screens at all. */
-    const viewer = await roleIn(ours, 'viewer')
-
-    const sent = await mutation.sendInvitation('kim@acme.z', context(ours), [viewer.id])
-
-    expect((await stored(sent.id)).roles.map((role: any) => role.id)).toEqual([viewer.id])
-  })
-
-  it('does not take a role from another domain', async () => {
-    const foreign = await roleIn(theirs, 'viewer')
-
-    const sent = await mutation.sendInvitation('kim@acme.z', context(ours), [foreign.id])
-
-    expect((await stored(sent.id)).roles).toEqual([])
-  })
-
-  it('re-issues the standing invitation rather than making a second one', async () => {
-    /*
-     * ⚠ One pending invitation per person and domain. The history keeps every row, so this
-     * cannot be a unique index without forbidding "invited, left, invited again" — it is held
-     * here instead.
-     */
-    const first = await mutation.sendInvitation('kim@acme.z', context(ours))
-    const again = await mutation.sendInvitation('kim@acme.z', context(ours))
-
-    expect(again.id).toEqual(first.id)
-    expect(await getRepository(Invitation).count()).toEqual(1)
-  })
-
-  it('gives the re-issued one a new token', async () => {
-    /* Two live links for one invitation is one more than anybody meant to send. */
-    const first = await mutation.sendInvitation('kim@acme.z', context(ours))
-    const before = (await stored(first.id)).token
-
-    await mutation.sendInvitation('kim@acme.z', context(ours))
-
-    expect((await stored(first.id)).token).not.toEqual(before)
-  })
-
-  it('refuses somebody who is already here', async () => {
-    await personWithAccount('kim@acme.z', [ours])
-
-    expect(await refusalCodeOf(mutation.sendInvitation('kim@acme.z', context(ours)))).toEqual(
-      'invitation-already-a-member'
-    )
-  })
-})
-
-describe('accepting', () => {
-  async function pending(email = 'kim@acme.z', roleNames: string[] = []) {
-    const roles = []
-
-    for (const name of roleNames) {
-      roles.push(await roleIn(ours, name))
-    }
-
-    const sent = await mutation.sendInvitation(
-      email,
-      context(ours),
-      roles.map(role => role.id)
-    )
-
-    return await stored(sent.id)
-  }
-
-  it('lets somebody who already has an account in, with their roles', async () => {
-    const invitation = await pending('kim@acme.z', ['viewer'])
-    const kim = await personWithAccount('kim@acme.z')
-
-    const { created } = await acceptInvitation({
-      token: invitation.token,
-      email: 'kim@acme.z',
-      context: context(ours)
-    })
-
-    const joined = await getRepository(User).findOne({ where: { id: kim.id }, relations: ['domains', 'roles'] })
-
-    expect(created).toBe(false)
-    expect(joined.domains.map((d: any) => d.id)).toContain(ours.id)
-    expect(joined.roles.map((role: any) => role.name)).toEqual(['viewer'])
-  })
-
-  it('creates the account for somebody who has none', async () => {
-    /*
-     * ⚠ The case this whole feature is for. The `user-invite` screen records that an installation
-     * with no default password has no path at all for a person who does not exist yet — nobody
-     * can set their password for them.
-     */
-    const invitation = await pending('new@acme.z', ['viewer'])
-
-    const { created } = await acceptInvitation({
-      token: invitation.token,
-      email: 'new@acme.z',
-      name: 'New Person',
-      password: 'Passw0rd!x',
-      context: context(ours)
-    })
-
-    const person = await getRepository(User).findOne({
-      where: { email: 'new@acme.z' },
-      relations: ['domains', 'roles']
-    })
-
-    expect(created).toBe(true)
-    expect(person.status).toEqual(UserStatus.ACTIVATED)
-    expect(person.domains.map((d: any) => d.id)).toEqual([ours.id])
-    expect(person.roles.map((role: any) => role.name)).toEqual(['viewer'])
-  })
-
-  it('will not create an account without a password', async () => {
-    const invitation = await pending('new@acme.z')
-
-    expect(
-      await refusalCodeOf(
-        acceptInvitation({ token: invitation.token, email: 'new@acme.z', context: context(ours) })
-      )
-    ).toEqual('invitation-needs-a-password')
-  })
-
-  it('marks the row accepted instead of deleting it', async () => {
-    /* ⚠ The reason the table exists. Deleting takes the fact that they were invited with it. */
-    const invitation = await pending()
-    await personWithAccount('kim@acme.z')
-
-    await acceptInvitation({ token: invitation.token, email: 'kim@acme.z', context: context(ours) })
-
-    const row = await stored(invitation.id)
-
-    expect(row).not.toBeNull()
-    expect(row.status).toEqual(InvitationStatus.ACCEPTED)
-    expect(row.acceptedAt).toBeTruthy()
-  })
-
-  it('cannot be used twice', async () => {
-    const invitation = await pending()
-    await personWithAccount('kim@acme.z')
-
-    await acceptInvitation({ token: invitation.token, email: 'kim@acme.z', context: context(ours) })
-
-    expect(
-      await refusalCodeOf(
-        acceptInvitation({ token: invitation.token, email: 'kim@acme.z', context: context(ours) })
-      )
-    ).toEqual('invitation-not-open')
-  })
-})
-
-describe('⚠ what the token alone is not enough for', () => {
-  async function pending(email = 'kim@acme.z') {
-    return await stored((await mutation.sendInvitation(email, context(ours))).id)
-  }
-
-  it('refuses when the address given is not the one invited', async () => {
-    /*
-     * ⚠ The mitigation for the one leak that hiding the token cannot close: the mail being
-     * forwarded. Holding the link is not enough on its own.
-     */
-    const invitation = await pending('kim@acme.z')
-    await personWithAccount('someone.else@acme.z')
-
-    expect(
-      await refusalCodeOf(
-        acceptInvitation({ token: invitation.token, email: 'someone.else@acme.z', context: context(ours) })
-      )
-    ).toEqual('invitation-not-open')
-  })
-
-  it('accepts the invited address whatever case it is typed in', async () => {
-    const invitation = await pending('Kim@Acme.Z')
-    await personWithAccount('kim@acme.z')
-
-    await expect(
-      acceptInvitation({ token: invitation.token, email: '  KIM@acme.z  ', context: context(ours) })
-    ).resolves.toBeTruthy()
-  })
-
-  it('refuses an expired invitation', async () => {
-    const invitation = await pending()
-    await personWithAccount('kim@acme.z')
-
-    await getRepository(Invitation).save({ ...invitation, expiresAt: new Date(Date.now() - 1000) })
-
-    expect(
-      await refusalCodeOf(
-        acceptInvitation({ token: invitation.token, email: 'kim@acme.z', context: context(ours) })
-      )
-    ).toEqual('invitation-not-open')
-  })
-
-  it('refuses a cancelled one whose expiry is still ahead', async () => {
-    const invitation = await pending()
-    await personWithAccount('kim@acme.z')
-
-    await mutation.cancelInvitation(invitation.id, context(ours))
-
-    expect(
-      await refusalCodeOf(
-        acceptInvitation({ token: invitation.token, email: 'kim@acme.z', context: context(ours) })
-      )
-    ).toEqual('invitation-not-open')
-  })
-
-  it('refuses a token that is not one of ours, the same way', async () => {
-    /*
-     * One answer for a wrong token, a wrong address, an expired one and a cancelled one. Telling
-     * them apart would let somebody learn which tokens are real.
-     */
-    expect(
-      await refusalCodeOf(acceptInvitation({ token: 'no-such-token', email: 'kim@acme.z', context: context(ours) }))
-    ).toEqual('invitation-not-open')
-  })
-})
-
-describe('withdrawing one', () => {
-  it('marks it cancelled and keeps the row', async () => {
-    const sent = await mutation.sendInvitation('kim@acme.z', context(ours))
-
-    expect(await mutation.cancelInvitation(sent.id, context(ours))).toBe(true)
-    expect((await stored(sent.id)).status).toEqual(InvitationStatus.CANCELLED)
-  })
-
-  it('does not reach another tenant', async () => {
-    /* ⚠ It used to delete by `{ email, reference, type }`, which took an id from anywhere. */
-    const foreign = await getRepository(Invitation).save({
-      email: 'lee@beta.z',
-      domain: { id: theirs.id },
-      status: InvitationStatus.PENDING,
-      token: 'theirs',
-      expiresAt: new Date(Date.now() + 3600_000)
-    })
-
-    expect(await mutation.cancelInvitation(foreign.id, context(ours))).toBe(false)
-    expect((await stored(foreign.id)).status).toEqual(InvitationStatus.PENDING)
-  })
-
-  it('says no for one that is already finished', async () => {
-    const sent = await mutation.sendInvitation('kim@acme.z', context(ours))
-    await mutation.cancelInvitation(sent.id, context(ours))
-
-    expect(await mutation.cancelInvitation(sent.id, context(ours))).toBe(false)
-  })
-})
-
-describe('the list', () => {
-  it('shows this domain and not another', async () => {
-    await mutation.sendInvitation('kim@acme.z', context(ours))
-    await getRepository(Invitation).save({
-      email: 'lee@beta.z',
-      domain: { id: theirs.id },
-      status: InvitationStatus.PENDING,
-      token: 'theirs',
-      expiresAt: new Date(Date.now() + 3600_000)
-    })
-
-    const { items, total } = await query.invitations({ filters: [] } as any, context(ours))
-
-    expect(total).toEqual(1)
-    expect(items[0].email).toEqual('kim@acme.z')
-  })
-
-  it('keeps accepted invitations in it', async () => {
-    /* ⚠ The history. This is what there was nothing to put on a screen before. */
-    const sent = await mutation.sendInvitation('kim@acme.z', context(ours))
-    await personWithAccount('kim@acme.z')
-
-    await acceptInvitation({ token: (await stored(sent.id)).token, email: 'kim@acme.z', context: context(ours) })
-
-    const { items, total } = await query.invitations({ filters: [] } as any, context(ours))
-
-    expect(total).toEqual(1)
-    expect(await query.state(items[0])).toEqual(InvitationStatus.ACCEPTED)
-  })
-
-  it('calls a pending row past its expiry expired, before anything writes that', async () => {
-    const sent = await mutation.sendInvitation('kim@acme.z', context(ours))
-    const row = await stored(sent.id)
-
-    await getRepository(Invitation).save({ ...row, expiresAt: new Date(Date.now() - 1000) })
-
-    expect(await query.state(await stored(sent.id))).toEqual(InvitationStatus.EXPIRED)
-  })
-
-  it('does not answer for an id from another tenant', async () => {
-    const foreign = await getRepository(Invitation).save({
-      email: 'lee@beta.z',
-      domain: { id: theirs.id },
-      status: InvitationStatus.PENDING,
-      token: 'theirs',
-      expiresAt: new Date(Date.now() + 3600_000)
-    })
-
-    expect(await query.invitation(foreign.id, context(ours))).toBeNull()
-  })
-})

package/tests/invitation-route.test.ts

@@ -1,116 +0,0 @@
-import { readFileSync, readdirSync } from 'fs'
-import { join } from 'path'
-
-import { loadCompiled } from './compiled'
-
-const { authPublicProcessRouter } = loadCompiled('router/auth-public-process-router')
-const { ACCEPT_INVITATION_PATH } = loadCompiled('controllers/invitation')
-
-/**
- * The link in each mail lands on a route that exists.
- *
- * ── Why this file exists ────────────────────────────────────────────────────
- * The invitation mail pointed at `/auth/accept/<token>` — a path with no route anywhere — so the
- * invitee fell through to the private history fallback and the domain gate turned them away for
- * not being a member yet. That was found and fixed on 2026-09-20, and the fix made the same
- * mistake again: the new route was declared as `/accept-invitation` on a router whose prefix is
- * `/auth`, and the mail and the page both used `/accept-invitation`. It shipped that way.
- *
- * Every test of the invitation called the controller directly, so none of them ever went through
- * a route. This one reads the router's own table — the paths koa-router resolved, prefix included
- * — and holds each mail's link against it.
- */
-
-type Layer = { path: string; methods: string[] }
-
-const layers: Layer[] = authPublicProcessRouter.stack.map((layer: any) => ({
-  path: layer.path,
-  methods: layer.methods
-}))
-
-function answers(method: string, path: string): boolean {
-  return layers.some(layer => layer.methods.includes(method) && matches(layer.path, path))
-}
-
-/** A declared path against a concrete one: `:param` matches one segment. */
-function matches(declared: string, actual: string): boolean {
-  const a = declared.split('/')
-  const b = actual.split('/')
-
-  return a.length === b.length && a.every((part, i) => part.startsWith(':') || part === b[i])
-}
-
-describe('the invitation link', () => {
-  it('the page answers where the mail points', () => {
-    /* ⚠ The case that shipped broken. */
-    expect(answers('GET', ACCEPT_INVITATION_PATH)).toBe(true)
-  })
-
-  it('the page posts where the router listens', () => {
-    expect(answers('POST', ACCEPT_INVITATION_PATH)).toBe(true)
-  })
-
-  it('carries the prefix the router adds', () => {
-    /*
-     * Declaring `/accept-invitation` on this router makes it `/auth/accept-invitation`. The spelling
-     * without the prefix is exactly the one that went out, so it is named here as the wrong one.
-     */
-    expect(ACCEPT_INVITATION_PATH.startsWith('/auth/')).toBe(true)
-    expect(answers('GET', '/accept-invitation')).toBe(false)
-  })
-
-  it('is the path the client page uses too', () => {
-    const page = readFileSync(
-      join(__dirname, '..', '..', 'auth-ui', 'client', 'components', 'accept-invitation.ts'),
-      'utf-8'
-    )
-
-    expect(page).toContain(`return '${ACCEPT_INVITATION_PATH}'`)
-  })
-})
-
-describe('the other links sent by mail', () => {
-  /*
-   * Reset, unlock and sign-up confirmation moved to the invitation's shape on 2026-09-24 (Q4): one
-   * exported path, the token after `#`. Each page answers GET where the mail points and POST where
-   * the page sends the token.
-   */
-  const { RESET_PASSWORD_PATH } = loadCompiled('controllers/reset-password')
-  const { UNLOCK_USER_PATH } = loadCompiled('controllers/unlock-user')
-  const { VERIFY_EMAIL_PATH } = loadCompiled('controllers/verification')
-
-  const paths = [RESET_PASSWORD_PATH, UNLOCK_USER_PATH, VERIFY_EMAIL_PATH]
-
-  it('names the three it means to check', () => {
-    expect(paths).toEqual(['/auth/reset-password', '/auth/unlock-user', '/auth/verify'])
-  })
-
-  it.each(paths)('%s — the page answers where the mail points', path => {
-    expect(answers('GET', path)).toBe(true)
-  })
-
-  it.each(paths)('%s — and listens where the page posts', path => {
-    expect(answers('POST', path)).toBe(true)
-  })
-
-  it('no longer answers the old link that confirmed on opening', () => {
-    /* `GET /auth/verify/<token>` confirmed the address for whoever fetched it — a mail scanner too. */
-    expect(answers('GET', '/auth/verify/0123456789abcdef0123456789abcdef')).toBe(false)
-  })
-
-  it('no controller puts a token in a query string or a path', () => {
-    const CONTROLLERS = join(__dirname, '..', 'server', 'controllers')
-    const offending = readdirSync(CONTROLLERS)
-      .filter(file => file.endsWith('.ts'))
-      .filter(file => /\?token=\$\{|\/verify\/\$\{/.test(readFileSync(join(CONTROLLERS, file), 'utf-8')))
-
-    expect(offending).toEqual([])
-  })
-
-  it('nor does the redirect for a password that must be reset', () => {
-    const middleware = readFileSync(join(__dirname, '..', 'server', 'middlewares', 'jwt-authenticate-middleware.ts'), 'utf-8')
-
-    expect(middleware).toContain('context.redirect(`${RESET_PASSWORD_PATH}#${token}`)')
-    expect(middleware).not.toMatch(/\?token=/)
-  })
-})

package/tests/invitation-state.test.ts

@@ -1,92 +0,0 @@
-import { InvitationStatus, invitationState, mayAccept } from '../server/utils/invitation-state'
-
-/**
- * What state an invitation is in, and whether its token still opens anything.
- *
- * The token in an invitation email is a credential: whoever holds it joins a domain. So the
- * cases below lean the way credentials lean — an invitation that cannot say it is live is not
- * live. The opposite mistake is a link that works forever, which is what the table had before
- * (no expiry column at all).
- */
-
-const NOW = new Date('2026-09-20T12:00:00Z')
-const LATER = new Date('2026-09-21T12:00:00Z')
-const EARLIER = new Date('2026-09-19T12:00:00Z')
-
-describe('a pending invitation', () => {
-  it('is pending while its expiry is ahead', () => {
-    expect(invitationState({ status: 'pending', expiresAt: LATER }, NOW)).toEqual(InvitationStatus.PENDING)
-    expect(mayAccept({ status: 'pending', expiresAt: LATER }, NOW)).toBe(true)
-  })
-
-  it('is expired once the expiry has passed, before anything writes that down', () => {
-    /*
-     * ⚠ The guard is the clock, not the column. If `expired` were only a written value, the gap
-     * between the expiry passing and something running to record it would be a window where the
-     * token still works.
-     */
-    expect(invitationState({ status: 'pending', expiresAt: EARLIER }, NOW)).toEqual(InvitationStatus.EXPIRED)
-    expect(mayAccept({ status: 'pending', expiresAt: EARLIER }, NOW)).toBe(false)
-  })
-
-  it('is expired exactly at the moment it runs out', () => {
-    /* The boundary belongs to the dead side — a credential does not get its last instant. */
-    expect(mayAccept({ status: 'pending', expiresAt: NOW }, NOW)).toBe(false)
-  })
-
-  it('reads a stored timestamp string the same as a Date', () => {
-    expect(mayAccept({ status: 'pending', expiresAt: LATER.toISOString() }, NOW)).toBe(true)
-    expect(mayAccept({ status: 'pending', expiresAt: EARLIER.toISOString() }, NOW)).toBe(false)
-  })
-})
-
-describe('what an absent value means', () => {
-  it('no status reads as pending', () => {
-    /* That is what a row existing meant in the old table, which had no status column. */
-    expect(invitationState({ expiresAt: LATER }, NOW)).toEqual(InvitationStatus.PENDING)
-  })
-
-  it('⚠ no expiry reads as expired', () => {
-    /*
-     * ⚠ Rows written before this existed have no expiry, and they come from a flow that never
-     * completed — the link in the email led to no route at all. Reading them as live would keep
-     * alive tokens that never worked. A credential that cannot say when it dies does not open
-     * anything.
-     */
-    expect(invitationState({ status: 'pending' }, NOW)).toEqual(InvitationStatus.EXPIRED)
-    expect(invitationState({}, NOW)).toEqual(InvitationStatus.EXPIRED)
-    expect(mayAccept({ status: 'pending', expiresAt: null }, NOW)).toBe(false)
-  })
-
-  it('an unreadable timestamp reads as expired too', () => {
-    expect(mayAccept({ status: 'pending', expiresAt: 'not a date' }, NOW)).toBe(false)
-  })
-
-  it('no invitation at all is not acceptable', () => {
-    expect(mayAccept(null, NOW)).toBe(false)
-    expect(mayAccept(undefined, NOW)).toBe(false)
-  })
-})
-
-describe('a row that is already finished', () => {
-  it('stays accepted however long ago it was', () => {
-    /*
-     * ⚠ Time does not rewrite history. If an accepted row expired later, the list would stop
-     * being able to say that this person was invited and came in — which is the whole reason the
-     * row is kept.
-     */
-    expect(invitationState({ status: 'accepted', expiresAt: EARLIER }, NOW)).toEqual(InvitationStatus.ACCEPTED)
-    expect(invitationState({ status: 'accepted' }, NOW)).toEqual(InvitationStatus.ACCEPTED)
-  })
-
-  it('stays cancelled', () => {
-    expect(invitationState({ status: 'cancelled', expiresAt: LATER }, NOW)).toEqual(InvitationStatus.CANCELLED)
-  })
-
-  it('cannot be accepted, whatever its expiry says', () => {
-    /* ⚠ A cancelled invitation whose expiry is still ahead must not open anything. */
-    expect(mayAccept({ status: 'cancelled', expiresAt: LATER }, NOW)).toBe(false)
-    expect(mayAccept({ status: 'accepted', expiresAt: LATER }, NOW)).toBe(false)
-    expect(mayAccept({ status: 'expired', expiresAt: LATER }, NOW)).toBe(false)
-  })
-})