@things-factory/auth-base 10.1.215 → 10.1.223

package/dist-server/utils/verification-token-rule.js

@@ -27,7 +27,7 @@ const crypto_1 = require("crypto");
  * and a rule that reads it would extend a link by touching the row. `expiresAt` is written once,
  * with the token.
  *
- * A row without `expiresAt` reads as **expired** — the rule `invitation-state.ts` uses. Such rows
+ * A row without `expiresAt` reads as **expired**. Such rows
  * were written before this existed, with the token in plain text; refusing them is also how links
  * already sent stop working when this ships.
  *
@@ -39,6 +39,8 @@ const crypto_1 = require("crypto");
 const HOUR = 60 * 60 * 1000;
 exports.VERIFICATION_TOKEN_LIFETIME_MS = Object.freeze({
     'password-reset': 1 * HOUR,
+    /* Handed over by mail or by hand, so it lives as long as an invitation did (ADR-0161 decision 3). */
+    'password-setup': 48 * HOUR,
     unlock: 1 * HOUR,
     activation: 48 * HOUR
 });

package/dist-server/utils/verification-token-rule.js.map

@@ -1 +1 @@
-{"version":3,"file":"verification-token-rule.js","sourceRoot":"","sources":["../../server/utils/verification-token-rule.ts"],"names":[],"mappings":";;;AA2CA,sDAEC;AAQD,gEAQC;AAMD,0DAYC;AA/ED,mCAAmC;AAEnC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAEH,MAAM,IAAI,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAA;AAEd,QAAA,8BAA8B,GAAqC,MAAM,CAAC,MAAM,CAAC;IAC5F,gBAAgB,EAAE,CAAC,GAAG,IAAI;IAC1B,MAAM,EAAE,CAAC,GAAG,IAAI;IAChB,UAAU,EAAE,EAAE,GAAG,IAAI;CACtB,CAAC,CAAA;AAEF,6CAA6C;AAC7C,SAAgB,qBAAqB,CAAC,KAAa;IACjD,OAAO,IAAA,mBAAU,EAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;AACjE,CAAC;AAED;;;;;GAKG;AACH,SAAgB,0BAA0B,CAAC,IAAY,EAAE,MAAY,IAAI,IAAI,EAAE;IAC7E,MAAM,QAAQ,GAAG,sCAA8B,CAAC,IAAI,CAAC,CAAA;IAErD,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,IAAI,KAAK,CAAC,4BAA4B,IAAI,mBAAmB,CAAC,CAAA;IACtE,CAAC;IAED,OAAO,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,QAAQ,CAAC,CAAA;AAC3C,CAAC;AAKD,0GAA0G;AAC1G,SAAgB,uBAAuB,CAAC,MAA+B,EAAE,MAAY,IAAI,IAAI,EAAE;IAC7F,IAAI,CAAC,MAAM,EAAE,SAAS,EAAE,CAAC;QACvB,OAAO,KAAK,CAAA;IACd,CAAC;IAED,MAAM,EAAE,GAAG,MAAM,CAAC,SAAS,YAAY,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAA;IAE3F,IAAI,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC;QAC/B,OAAO,KAAK,CAAA;IACd,CAAC;IAED,OAAO,GAAG,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,OAAO,EAAE,CAAA;AACrC,CAAC","sourcesContent":["import { createHash } from 'crypto'\n\n/**\n * How long a mailed link lives, and what the table keeps of it. (Pure rule.)\n *\n * Password reset, unlock and sign-up confirmation each mail a link that carries a token, and the\n * token is the whole credential: whoever holds the link resets the password or unlocks the account.\n * Before 2026-09-24 those tokens never expired, were stored as written and were found by that same\n * value — so a reset mail from last year still changed a password today, and a copy of the table\n * (a backup, a replica, a dump handed to support) was a set of live reset links.\n *\n * ── The lifetimes ──────────────────────────────────────────────────────────\n *\n *   password-reset   1 hour    hands the account over at once, so short\n *   unlock           1 hour    the same\n *   activation       48 hours  the person may read the mail late; it only confirms an address\n *\n * Decided with the architect, 2026-09-24 (`docs/design/auth-rebuild-questions-2026-09-24.md` Q4).\n *\n * ── Expiry is its own column ───────────────────────────────────────────────\n * Not derived from `createdAt` or `updatedAt`: `updatedAt` moves every time the row is saved again,\n * and a rule that reads it would extend a link by touching the row. `expiresAt` is written once,\n * with the token.\n *\n * A row without `expiresAt` reads as **expired** — the rule `invitation-state.ts` uses. Such rows\n * were written before this existed, with the token in plain text; refusing them is also how links\n * already sent stop working when this ships.\n *\n * ── What is stored is a hash ───────────────────────────────────────────────\n * sha256 of the token. The token is 16 random bytes, so there is nothing for a slow hash to protect\n * — it guards against guessing, and there is no guessing a random 128-bit value. The point is only\n * that the table no longer holds anything a link can be made from.\n */\n\nconst HOUR = 60 * 60 * 1000\n\nexport const VERIFICATION_TOKEN_LIFETIME_MS: Readonly<Record<string, number>> = Object.freeze({\n  'password-reset': 1 * HOUR,\n  unlock: 1 * HOUR,\n  activation: 48 * HOUR\n})\n\n/** The value the table keeps for a token. */\nexport function hashVerificationToken(token: string): string {\n  return createHash('sha256').update(token, 'utf8').digest('hex')\n}\n\n/**\n * When a token of this type, issued at `now`, stops working.\n *\n * Throws for a type with no lifetime here — a new kind of mailed link has to say how long it lives\n * rather than inherit forever.\n */\nexport function verificationTokenExpiresAt(type: string, now: Date = new Date()): Date {\n  const lifetime = VERIFICATION_TOKEN_LIFETIME_MS[type]\n\n  if (!lifetime) {\n    throw new Error(`verification token type '${type}' has no lifetime`)\n  }\n\n  return new Date(now.getTime() + lifetime)\n}\n\n/** The parts of a stored token this rule reads. */\nexport type VerificationTokenRecord = { expiresAt?: Date | string | null } | null | undefined\n\n/** May this token still be used, as of `now`? Absence of an expiry refuses; the expiry itself refuses. */\nexport function isVerificationTokenLive(record: VerificationTokenRecord, now: Date = new Date()): boolean {\n  if (!record?.expiresAt) {\n    return false\n  }\n\n  const at = record.expiresAt instanceof Date ? record.expiresAt : new Date(record.expiresAt)\n\n  if (Number.isNaN(at.getTime())) {\n    return false\n  }\n\n  return now.getTime() < at.getTime()\n}\n"]}
+{"version":3,"file":"verification-token-rule.js","sourceRoot":"","sources":["../../server/utils/verification-token-rule.ts"],"names":[],"mappings":";;;AA6CA,sDAEC;AAQD,gEAQC;AAMD,0DAYC;AAjFD,mCAAmC;AAEnC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAEH,MAAM,IAAI,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAA;AAEd,QAAA,8BAA8B,GAAqC,MAAM,CAAC,MAAM,CAAC;IAC5F,gBAAgB,EAAE,CAAC,GAAG,IAAI;IAC1B,qGAAqG;IACrG,gBAAgB,EAAE,EAAE,GAAG,IAAI;IAC3B,MAAM,EAAE,CAAC,GAAG,IAAI;IAChB,UAAU,EAAE,EAAE,GAAG,IAAI;CACtB,CAAC,CAAA;AAEF,6CAA6C;AAC7C,SAAgB,qBAAqB,CAAC,KAAa;IACjD,OAAO,IAAA,mBAAU,EAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;AACjE,CAAC;AAED;;;;;GAKG;AACH,SAAgB,0BAA0B,CAAC,IAAY,EAAE,MAAY,IAAI,IAAI,EAAE;IAC7E,MAAM,QAAQ,GAAG,sCAA8B,CAAC,IAAI,CAAC,CAAA;IAErD,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,IAAI,KAAK,CAAC,4BAA4B,IAAI,mBAAmB,CAAC,CAAA;IACtE,CAAC;IAED,OAAO,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,QAAQ,CAAC,CAAA;AAC3C,CAAC;AAKD,0GAA0G;AAC1G,SAAgB,uBAAuB,CAAC,MAA+B,EAAE,MAAY,IAAI,IAAI,EAAE;IAC7F,IAAI,CAAC,MAAM,EAAE,SAAS,EAAE,CAAC;QACvB,OAAO,KAAK,CAAA;IACd,CAAC;IAED,MAAM,EAAE,GAAG,MAAM,CAAC,SAAS,YAAY,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAA;IAE3F,IAAI,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC;QAC/B,OAAO,KAAK,CAAA;IACd,CAAC;IAED,OAAO,GAAG,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,OAAO,EAAE,CAAA;AACrC,CAAC","sourcesContent":["import { createHash } from 'crypto'\n\n/**\n * How long a mailed link lives, and what the table keeps of it. (Pure rule.)\n *\n * Password reset, unlock and sign-up confirmation each mail a link that carries a token, and the\n * token is the whole credential: whoever holds the link resets the password or unlocks the account.\n * Before 2026-09-24 those tokens never expired, were stored as written and were found by that same\n * value — so a reset mail from last year still changed a password today, and a copy of the table\n * (a backup, a replica, a dump handed to support) was a set of live reset links.\n *\n * ── The lifetimes ──────────────────────────────────────────────────────────\n *\n *   password-reset   1 hour    hands the account over at once, so short\n *   unlock           1 hour    the same\n *   activation       48 hours  the person may read the mail late; it only confirms an address\n *\n * Decided with the architect, 2026-09-24 (`docs/design/auth-rebuild-questions-2026-09-24.md` Q4).\n *\n * ── Expiry is its own column ───────────────────────────────────────────────\n * Not derived from `createdAt` or `updatedAt`: `updatedAt` moves every time the row is saved again,\n * and a rule that reads it would extend a link by touching the row. `expiresAt` is written once,\n * with the token.\n *\n * A row without `expiresAt` reads as **expired**. Such rows\n * were written before this existed, with the token in plain text; refusing them is also how links\n * already sent stop working when this ships.\n *\n * ── What is stored is a hash ───────────────────────────────────────────────\n * sha256 of the token. The token is 16 random bytes, so there is nothing for a slow hash to protect\n * — it guards against guessing, and there is no guessing a random 128-bit value. The point is only\n * that the table no longer holds anything a link can be made from.\n */\n\nconst HOUR = 60 * 60 * 1000\n\nexport const VERIFICATION_TOKEN_LIFETIME_MS: Readonly<Record<string, number>> = Object.freeze({\n  'password-reset': 1 * HOUR,\n  /* Handed over by mail or by hand, so it lives as long as an invitation did (ADR-0161 decision 3). */\n  'password-setup': 48 * HOUR,\n  unlock: 1 * HOUR,\n  activation: 48 * HOUR\n})\n\n/** The value the table keeps for a token. */\nexport function hashVerificationToken(token: string): string {\n  return createHash('sha256').update(token, 'utf8').digest('hex')\n}\n\n/**\n * When a token of this type, issued at `now`, stops working.\n *\n * Throws for a type with no lifetime here — a new kind of mailed link has to say how long it lives\n * rather than inherit forever.\n */\nexport function verificationTokenExpiresAt(type: string, now: Date = new Date()): Date {\n  const lifetime = VERIFICATION_TOKEN_LIFETIME_MS[type]\n\n  if (!lifetime) {\n    throw new Error(`verification token type '${type}' has no lifetime`)\n  }\n\n  return new Date(now.getTime() + lifetime)\n}\n\n/** The parts of a stored token this rule reads. */\nexport type VerificationTokenRecord = { expiresAt?: Date | string | null } | null | undefined\n\n/** May this token still be used, as of `now`? Absence of an expiry refuses; the expiry itself refuses. */\nexport function isVerificationTokenLive(record: VerificationTokenRecord, now: Date = new Date()): boolean {\n  if (!record?.expiresAt) {\n    return false\n  }\n\n  const at = record.expiresAt instanceof Date ? record.expiresAt : new Date(record.expiresAt)\n\n  if (Number.isNaN(at.getTime())) {\n    return false\n  }\n\n  return now.getTime() < at.getTime()\n}\n"]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@things-factory/auth-base",
-  "version": "10.1.215",
+  "version": "10.1.223",
   "main": "dist-server/index.js",
   "browser": "dist-client/index.js",
   "things-factory": true,
@@ -50,5 +50,5 @@
     "passport-jwt": "^4.0.0",
     "passport-local": "^1.0.0"
   },
-  "gitHead": "7de5e80eb1f4e2e268746aee39f820e7563f454d"
+  "gitHead": "868f2026b8373371ad04f42b0a097964d0d0ed0f"
 }

package/tests/add-user-gates.test.ts

@@ -0,0 +1,34 @@
+import { buildSchema } from 'type-graphql'
+
+import { loadCompiled } from './compiled'
+
+/**
+ * The questions the user popups ask are gated as the actions they lead to.
+ *
+ * `checkUserExistence` is asked only by the add-user popup, before `inviteUser` / `createUser`
+ * (each `user:mutation`, owner granted). It asked `user:query` alone, so a domain owner without that role was refused
+ * the lookup and the popup took the refusal for "no account" - and set out to create an account for someone who
+ * had one. `mayIssuePasswordSetupLink` answers for the setup link button, so it stands where `issuePasswordSetupLink` does.
+ */
+const { schema: declared } = loadCompiled('service/index')
+const { privilegeDirectiveResolver, privilegeOfField } = loadCompiled('service/privilege/privilege-directive')
+
+function gateOf(field: string) {
+  const gate = privilegeOfField('Query', field)
+  return [gate.known, gate['gate']?.category, gate['gate']?.privilege, gate['gate']?.owner]
+}
+
+describe('what the user popups ask', () => {
+  beforeAll(async () => {
+    const schema = await buildSchema({ resolvers: declared.resolverClasses, validate: false })
+    privilegeDirectiveResolver(schema, { modules: [] })
+  })
+
+  it('★ checkUserExistence asks what adding a user asks - user:mutation, or the owner', () => {
+    expect(gateOf('checkUserExistence')).toEqual([true, 'user', 'mutation', true])
+  })
+
+  it('mayIssuePasswordSetupLink asks what issuing asks', () => {
+    expect(gateOf('mayIssuePasswordSetupLink')).toEqual([true, 'user', 'mutation', true])
+  })
+})

package/tests/list-inheritance-db.test.ts

@@ -19,9 +19,6 @@ const { Appliance } = loadCompiled('service/appliance/appliance')
 const { ApplianceQuery } = loadCompiled('service/appliance/appliance-query')
 const { Application } = loadCompiled('service/application/application')
 const { ApplicationQuery } = loadCompiled('service/application/application-query')
-const { Invitation } = loadCompiled('service/invitation/invitation')
-const { InvitationStatus } = loadCompiled('utils/invitation-state')
-const { InvitationQuery } = loadCompiled('service/invitation/invitation-query')
 const { Partner } = loadCompiled('service/partner/partner')
 const { PartnerQuery } = loadCompiled('service/partner/partner-query')
 
@@ -101,18 +98,6 @@ const LISTS: [string, () => Promise<any>, (params: any, context: any) => Promise
       }),
     (params, context) => new ApplicationQuery().applications(params, context)
   ],
-  [
-    'invitations',
-    () =>
-      getRepository(Invitation).save({
-        email: 'lee@acme.z',
-        domain: parent,
-        status: InvitationStatus.PENDING,
-        token: 'parent-token',
-        expiresAt: new Date(Date.now() + 3600_000)
-      }),
-    (params, context) => new InvitationQuery().invitations(params, context)
-  ],
   [
     'partners',
     () => getRepository(Partner).save({ domain: parent, partnerDomain, requestedAt: new Date() }),

package/tests/lock-recovery.test.ts

@@ -70,7 +70,7 @@ describe('재설정 메일 경로 (PASSWORD_RESET)', () => {
     const user = await lockedUser()
     await giveToken(user.id, 'tok', VerificationTokenType.PASSWORD_RESET)
 
-    await resetPassword('tok', NEW, context)
+    await resetPassword('tok', NEW, 'kim@example.com', context)
 
     const after = await getRepository(User).findOneBy({ id: user.id })
     expect(User.verify(after.password, NEW, after.salt)).toBe(true)
@@ -84,7 +84,7 @@ describe('재설정 메일 경로 (PASSWORD_RESET)', () => {
     const user = await lockedUser()
     await giveToken(user.id, 'tok', VerificationTokenType.PASSWORD_RESET)
 
-    await resetPassword('tok', NEW, context)
+    await resetPassword('tok', NEW, 'kim@example.com', context)
 
     await expect(signin({ username: 'kim', password: NEW })).rejects.toThrow()
   })

package/tests/open-doors.test.ts

@@ -81,8 +81,7 @@ describe('the doors that were closed', () => {
    *   domainUserRoleRegister         makes a domain, its roles and its users. `domainRegister`
    *                                  beside it makes only a domain and is super-user only
    *   loginHistories                 everybody's sign-ins - now the audit's, behind `audit:query` (ADR-0141)
-   *   invitation / invitations       and neither of them scopes by tenant at all
-   *   sendInvitation / cancelInvitation / inviteUser
+   *   inviteUser
    */
   const CLOSED = {
     Mutation: [
@@ -92,11 +91,9 @@ describe('the doors that were closed', () => {
       'deleteAuthProvider',
       'deleteAuthProviders',
       'domainUserRoleRegister',
-      'sendInvitation',
-      'cancelInvitation',
       'inviteUser'
     ],
-    Query: ['auditRecords', 'auditPeople', 'auditDoors', 'auditHealth', 'invitation', 'invitations']
+    Query: ['auditRecords', 'auditPeople', 'auditDoors', 'auditHealth']
   }
 
   it.each(Object.entries(CLOSED).flatMap(([t, fields]) => fields.map(f => [t, f])))('%s.%s', (typeName, field) => {

package/tests/password-reset-rule-db.test.ts

@@ -1,14 +1,12 @@
 /**
- * Whom a domain may put back on the default password.
+ * Whose password a domain may take back - by issuing a password setup link (ADR-0161).
  *
- * `resetPasswordToDefault` asked only that the person belong to the asking domain. A person has one password for
- * every domain, and the default is known: whoever signs in with it first is sent to set a new one. So a user manager
- * of any domain could take the account of someone who also works elsewhere, of another domain's owner, and of the
- * super user (the system domain's owner) the moment that person was a member here.
+ * The reset asked only that the person belong to the asking domain. A person has one password for every domain, so a
+ * user manager of any domain could take the password of someone who also works elsewhere, of another domain's owner,
+ * and of the super user (the system domain's owner) the moment that person was a member here. It was the default
+ * password then; it is a setup link now, and the same people are refused.
  */
 
-import { config } from '@things-factory/env'
-
 import { closeAuthDatabase, Domain, getRepository, openAuthDatabase, resetAuthDatabase } from './db'
 import { loadCompiled } from './compiled'
 
@@ -17,7 +15,6 @@ const { UserMutation } = loadCompiled('service/user/user-mutation')
 const { UserQuery } = loadCompiled('service/user/user-query')
 const { DomainOwner } = loadCompiled('service/domain-owner/domain-owner')
 
-const DEFAULT_PASSWORD = 'Default!234'
 const OWN_PASSWORD = 'Mine!5678'
 
 let here: any
@@ -40,15 +37,20 @@ async function makeUser(domains: any[], extra: any = {}) {
 }
 
 function context(domain: any) {
-  return { state: { domain, tx: undefined }, t: (key: string) => key } as any
+  return {
+    state: { domain, tx: undefined },
+    t: (key: string) => key,
+    headers: {},
+    request: { protocol: 'https', host: 'acme.example.com' }
+  } as any
 }
 
 function reset(user: any, domain: any) {
-  return new UserMutation().resetPasswordToDefault(user.username, context(domain))
+  return new UserMutation().issuePasswordSetupLink(user.username, false, context(domain))
 }
 
 function mayReset(user: any, domain: any) {
-  return new UserQuery().mayResetPasswordToDefault(user.id, context(domain))
+  return new UserQuery().mayIssuePasswordSetupLink(user.id, context(domain))
 }
 
 async function stillHasOwnPassword(user: any) {
@@ -61,13 +63,11 @@ beforeAll(async () => {
 })
 
 afterAll(async () => {
-  config.set('password', undefined)
   await closeAuthDatabase()
 })
 
 beforeEach(async () => {
   await resetAuthDatabase()
-  config.set('password', { defaultPassword: DEFAULT_PASSWORD })
 
   const domainRepository = getRepository(Domain)
   here = await domainRepository.save({ name: 'Plant A', subdomain: 'plant-a' })
@@ -76,14 +76,15 @@ beforeEach(async () => {
 })
 
 describe('a person wholly of this domain', () => {
-  it('is reset to the default, and the screen offers it', async () => {
+  it('is issued a link and waits for a password, and the screen offers it', async () => {
     const user = await makeUser([here])
 
     expect(await mayReset(user, here)).toBe(true)
-    await expect(reset(user, here)).resolves.toBe(true)
+    await expect(reset(user, here)).resolves.toMatchObject({ link: expect.stringContaining('/auth/reset-password#') })
 
     const read = await getRepository(User).findOneBy({ id: user.id })
-    expect(User.verify(read.password, DEFAULT_PASSWORD, read.salt)).toBe(true)
+    expect(read.status).toBe('password_reset_required')
+    expect(await stillHasOwnPassword(user)).toBe(false)
   })
 })
 

package/tests/password-setup-db.test.ts

@@ -0,0 +1,213 @@
+/**
+ * An administrator never sets anybody's password (ADR-0161).
+ *
+ * It used to be the installation's default password - one value everyone handed one knew, with no end, for every
+ * account an administrator made or reset. Now such an account waits for its password, and the person sets it through
+ * a one-time link that is mailed or handed over: 48 hours, hashed at rest, asking for the address it was for, and the
+ * only live one. Issuing it ends the sessions opened before.
+ */
+
+import { authDataSource, closeAuthDatabase, Domain, getRepository, openAuthDatabase, resetAuthDatabase } from './db'
+import { loadCompiled } from './compiled'
+
+const jwt = require('jsonwebtoken')
+
+const { User } = loadCompiled('service/user/user')
+const { UserMutation } = loadCompiled('service/user/user-mutation')
+const { VerificationToken } = loadCompiled('service/verification-token/verification-token')
+const { signin } = loadCompiled('controllers/signin')
+const { resetPassword } = loadCompiled('controllers/reset-password')
+const { hashVerificationToken } = loadCompiled('utils/verification-token-rule')
+
+const OWN_PASSWORD = 'Mine!5678'
+const NEW_PASSWORD = 'N3w!Passw0rd'
+const HOUR = 60 * 60 * 1000
+
+let here: any
+
+function context(tx?: any) {
+  return {
+    state: { domain: here, tx },
+    t: (key: string) => key,
+    headers: {},
+    request: { protocol: 'https', host: 'acme.example.com' }
+  } as any
+}
+
+async function makeActive(email = 'kim@example.com') {
+  const salt = User.generateSalt()
+  return await getRepository(User).save({
+    username: email,
+    email,
+    name: 'Kim',
+    salt,
+    password: User.encode(OWN_PASSWORD, salt),
+    status: 'activated',
+    domains: [here]
+  })
+}
+
+function create(email = 'lee@example.com') {
+  return new UserMutation().createUser({ username: email, email, name: 'Lee', userType: 'user' }, context())
+}
+
+function issue(user: any, mail = false, tx?: any) {
+  return new UserMutation().issuePasswordSetupLink(user.username, mail, context(tx))
+}
+
+const tokenOf = (link: string) => link.split('#')[1]
+const reload = (id: string) => getRepository(User).findOneBy({ id })
+const setPassword = (token: string, email: string, password = NEW_PASSWORD) =>
+  resetPassword(token, password, email, { t: (key: string) => key })
+
+beforeAll(async () => {
+  await openAuthDatabase()
+})
+
+afterAll(async () => {
+  await closeAuthDatabase()
+})
+
+beforeEach(async () => {
+  await resetAuthDatabase()
+  here = await getRepository(Domain).save({ name: 'Plant A', subdomain: 'plant-a' })
+})
+
+describe('an account an administrator makes', () => {
+  it('★ waits for its password, which nobody was given', async () => {
+    const made = await create()
+    const read = await reload(made.id)
+
+    expect(read.status).toBe('password_reset_required')
+    expect(read.password).toBeTruthy()
+  })
+
+  it('★ does not sign in, and a guess against it is not counted', async () => {
+    const made = await create()
+
+    await expect(signin({ username: made.username, password: 'anything' })).rejects.toMatchObject({
+      errorCode: 'password-setup-pending'
+    })
+    expect((await reload(made.id)).failCount ?? 0).toBe(0)
+  })
+
+  it('★ is refused on every request too', async () => {
+    const made = await create()
+
+    await expect(User.checkAuth({ username: made.username, email: made.email })).rejects.toMatchObject({
+      errorCode: 'password-setup-pending'
+    })
+  })
+
+  it('is not opened by activating it', async () => {
+    const made = await create()
+
+    await expect(new UserMutation().activateUser(made.username, context())).rejects.toMatchObject({
+      code: 'password-setup-pending'
+    })
+  })
+})
+
+describe('the setup link', () => {
+  it('★ is handed back once, kept only as a hash, and lives 48 hours', async () => {
+    const made = await create()
+    const before = Date.now()
+
+    const issued = await issue(made)
+
+    expect(issued.link).toMatch(/^https?:\/\/acme\.example\.com\/auth\/reset-password#[0-9a-f]{32}$/)
+    const stored = await getRepository(VerificationToken).findOneBy({ userId: made.id })
+    expect(stored.type).toBe('password-setup')
+    expect(stored.token).toBe(hashVerificationToken(tokenOf(issued.link)))
+    expect(stored.token).not.toBe(tokenOf(issued.link))
+    expect(new Date(stored.expiresAt).getTime() - before).toBeGreaterThanOrEqual(48 * HOUR - 1000)
+    expect(new Date(stored.expiresAt).getTime() - before).toBeLessThanOrEqual(48 * HOUR + 5000)
+  })
+
+  it('★ opens the account with the address it was for, and then signs in', async () => {
+    const made = await create()
+    const { link } = await issue(made)
+
+    await setPassword(tokenOf(link), 'LEE@example.com ')
+
+    expect((await reload(made.id)).status).toBe('activated')
+    await expect(signin({ username: made.username, password: NEW_PASSWORD })).resolves.toMatchObject({
+      token: expect.any(String)
+    })
+  })
+
+  it('★ is not enough without the address it was for', async () => {
+    const made = await create()
+    const { link } = await issue(made)
+
+    await expect(setPassword(tokenOf(link), 'someone@else.example')).rejects.toThrow()
+    await expect(setPassword(tokenOf(link), '')).rejects.toThrow()
+    expect((await reload(made.id)).status).toBe('password_reset_required')
+  })
+
+  it('works once', async () => {
+    const made = await create()
+    const { link } = await issue(made)
+
+    await setPassword(tokenOf(link), made.email)
+    await expect(setPassword(tokenOf(link), made.email, 'An0ther!Pass')).rejects.toThrow()
+  })
+
+  it('★ issued again, retires the last one', async () => {
+    const made = await create()
+    const first = await issue(made)
+    const second = await issue(made)
+
+    await expect(setPassword(tokenOf(first.link), made.email)).rejects.toThrow()
+    await setPassword(tokenOf(second.link), made.email)
+    expect((await reload(made.id)).status).toBe('activated')
+  })
+})
+
+describe('taking back the password of an account in use', () => {
+  it('★ stops the old password and ends the sessions opened before', async () => {
+    const kim = await makeActive()
+    const { token: before } = await signin({ username: kim.username, password: OWN_PASSWORD })
+    await expect(User.checkAuth(jwt.decode(before))).resolves.toBeTruthy()
+
+    const { link } = await issue(kim)
+
+    await expect(signin({ username: kim.username, password: OWN_PASSWORD })).rejects.toMatchObject({
+      errorCode: 'password-setup-pending'
+    })
+
+    await setPassword(tokenOf(link), kim.email)
+
+    /* Open again - but the session from before stays ended: its generation has passed. */
+    await expect(User.checkAuth(jwt.decode(before))).rejects.toThrow()
+    const { token: after } = await signin({ username: kim.username, password: NEW_PASSWORD })
+    await expect(User.checkAuth(jwt.decode(after))).resolves.toBeTruthy()
+  })
+
+  it('★ by mail - a mail that does not go out changes nothing', async () => {
+    const kim = await makeActive()
+
+    await expect(
+      authDataSource().transaction(async (tx: any) => await issue(kim, true, tx))
+    ).rejects.toMatchObject({ code: 'password-setup-mail-not-sent' })
+
+    const read = await reload(kim.id)
+    expect(read.status).toBe('activated')
+    expect(User.verify(read.password, OWN_PASSWORD, read.salt)).toBe(true)
+    expect(await getRepository(VerificationToken).findOneBy({ userId: kim.id })).toBeNull()
+  })
+})
+
+describe('a forgotten password', () => {
+  it('asks for the address as well, through the same page', async () => {
+    const kim = await makeActive()
+    const { makeVerificationToken } = loadCompiled('controllers/utils/make-verification-token')
+    const { saveVerificationToken } = loadCompiled('controllers/utils/save-verification-token')
+    const token = makeVerificationToken()
+    await saveVerificationToken(kim.id, token, 'password-reset')
+
+    await expect(setPassword(token, 'someone@else.example')).rejects.toThrow()
+    await setPassword(token, kim.email)
+    await expect(signin({ username: kim.username, password: NEW_PASSWORD })).resolves.toBeTruthy()
+  })
+})

package/tests/picture-reducer.test.ts

@@ -0,0 +1,25 @@
+import { SET_PICTURE, SET_PROFILE } from '../client/actions/auth'
+import auth from '../client/reducers/auth'
+
+/** The signed-in person's picture, which the header's avatar draws (`auth.picture`). */
+describe('the signed-in person\'s picture', () => {
+  const picture = { picture: '/attachment/face.png', left: 0, top: 0, zoom: 1 }
+
+  it('starts with none - the avatar draws a monogram', () => {
+    expect(auth(undefined, { type: '@@INIT' }).picture).toBeNull()
+  })
+
+  it('★ is set by SET_PICTURE and survives a later profile', () => {
+    let state = auth(undefined, { type: SET_PICTURE, picture })
+    state = auth(state, { type: SET_PROFILE, user: { name: '남상혁' } })
+
+    expect(state.picture).toEqual(picture)
+    expect(state.user).toEqual({ name: '남상혁' })
+  })
+
+  it('a missing picture clears it', () => {
+    const state = auth(auth(undefined, { type: SET_PICTURE, picture }), { type: SET_PICTURE, picture: undefined })
+
+    expect(state.picture).toBeNull()
+  })
+})

package/tests/role-template-gap-db.test.ts

@@ -1,5 +1,6 @@
 /**
- * What a role lacks against the template of its name - against a real database (ADR-0075 decision 1).
+ * What a role lacks against its base template - against a real database (ADR-0075 decision 1, amended 2026-10-26:
+ * a role keeps one base template, `Role.templateId`, and is never paired by name).
  *
  * A template is a seed and nothing pushes its later grants into roles already standing. When
  * operato-plant's templates gained ai-assistant, the roles in miratek stayed without it and only
@@ -14,12 +15,16 @@ const { Role } = loadCompiled('service/role/role')
 const { Privilege } = loadCompiled('service/privilege/privilege')
 const { User } = loadCompiled('service/user/user')
 const { RoleTemplateMutation } = loadCompiled('service/role-template/role-template-mutation')
+const { RoleMutation } = loadCompiled('service/role/role-mutation')
 const { RoleTemplateGapResolver } = loadCompiled('service/role-template/role-template-gap-resolver')
 const { registerRoleTemplate } = loadCompiled('service/role-template/role-template')
 const { registerRoleTask } = loadCompiled('service/role-template/role-task')
 
 const mutation = new RoleTemplateMutation()
-const gapOf = (role: any, templateId?: string) => new RoleTemplateGapResolver().templateGap(role, templateId)
+const gapOf = (role: any) => new RoleTemplateGapResolver().templateGap(role)
+const reread = (role: any) => getRepository(Role).findOneBy({ id: role.id })
+/* The role screen's base template field saves through `updateRole`. */
+const baseOn = (role: any, templateId: string | null) => new RoleMutation().updateRole(role.id, { templateId } as any, { ...context(), t: (key: string) => key } as any)
 const coverageOf = (role: any) => new RoleTemplateGapResolver().taskCoverage(role)
 
 let domain: any
@@ -107,13 +112,52 @@ describe('the gap between a role and its template', () => {
     expect((await gapOf(role)).missingCount).toBe(0)
   })
 
-  it('★ is null for a role no template names - a renamed role belongs to its administrator', async () => {
+  it('★ a role made under a name of its own is still based on the template', async () => {
     declareTemplate(['query'])
     const role = await mutation.createRoleFromTemplate('plant.qi', 'NIGHT-INSPECTOR', context())
+    declareTemplate(['query', 'mutation'])
+
+    expect((await reread(role)).templateId).toBe('plant.qi')
+    expect(await gapOf(await reread(role))).toMatchObject({ templateId: 'plant.qi', missingCount: 1 })
+  })
+
+  it('★ is null for a role that is based on no template, even when a template carries its name', async () => {
+    declareTemplate(['query'])
+    const role = await getRepository(Role).save({ domain, name: 'QUALITY-INSPECTOR', privileges: [] })
 
     expect(await gapOf(role)).toBeNull()
   })
 
+  it('★ refuses to top up a role based on another template, and changes nothing', async () => {
+    declareTemplate(['query'])
+    registerRoleTemplate({ id: 'plant.qm', name: 'QUALITY-MANAGER', grants: [{ category: 'board', axes: ['query', 'mutation'] }] })
+    const role = await mutation.createRoleFromTemplate('plant.qi', undefined, context())
+
+    await expect(mutation.createRoleFromTemplate('plant.qm', 'QUALITY-INSPECTOR', context())).rejects.toThrow(/based on role template "plant.qi", not "plant.qm"/)
+
+    const stored = await getRepository(Role).findOne({ where: { id: role.id }, relations: ['privileges'] })
+    expect(stored.templateId).toBe('plant.qi')
+    expect(stored.privileges.map((p: any) => p.name)).toEqual(['query'])
+  })
+
+  it('★ tops up a standing role that has no base and makes the template its base', async () => {
+    declareTemplate(['query', 'mutation'])
+    const role = await getRepository(Role).save({ domain, name: 'QUALITY-INSPECTOR', privileges: [] })
+
+    await mutation.createRoleFromTemplate('plant.qi', undefined, context())
+
+    expect((await reread(role)).templateId).toBe('plant.qi')
+    expect((await gapOf(await reread(role))).missingCount).toBe(0)
+  })
+
+  it('★ is null when the base is a template this installation no longer declares', async () => {
+    declareTemplate(['query'])
+    const role = await mutation.createRoleFromTemplate('plant.qi', undefined, context())
+    ;(process as any)['ROLE_TEMPLATES'] = {}
+
+    expect(await gapOf(await reread(role))).toBeNull()
+  })
+
   it('does not take away what the administrator added beyond the template', async () => {
     declareTemplate(['query'])
     const role = await mutation.createRoleFromTemplate('plant.qi', undefined, context())
@@ -131,19 +175,26 @@ describe('the gap between a role and its template', () => {
     expect(gap.extraCount).toBe(1)
   })
 
-  it('★ lays a role against a template the administrator picks, whatever the role is called', async () => {
+  it('★ lays a role named in the site\'s own words against the base the administrator gives it', async () => {
     declareTemplate(['query', 'mutation'])
     const role = await getRepository(Role).save({ domain, name: '품질검사', privileges: [await getRepository(Privilege).findOneBy({ category: 'board', name: 'query' })] })
 
     expect(await gapOf(role)).toBeNull()
-    expect(await gapOf(role, 'plant.qi')).toMatchObject({ templateId: 'plant.qi', missing: [{ category: 'board', axes: ['mutation'] }], extraCount: 0 })
+
+    await baseOn(role, 'plant.qi')
+    expect(await gapOf(await reread(role))).toMatchObject({ templateId: 'plant.qi', missing: [{ category: 'board', axes: ['mutation'] }], extraCount: 0 })
+
+    await baseOn(role, null)
+    expect((await reread(role)).templateId).toBeNull()
+    expect(await gapOf(await reread(role))).toBeNull()
   })
 
-  it('refuses a template id that does not exist rather than answering null', async () => {
+  it('refuses a base template id that does not exist rather than storing it', async () => {
     declareTemplate(['query'])
     const role = await mutation.createRoleFromTemplate('plant.qi', undefined, context())
 
-    await expect(gapOf(role, 'plant.nobody')).rejects.toThrow(/no role template "plant.nobody"/)
+    await expect(baseOn(role, 'plant.nobody')).rejects.toThrow(/no role template "plant.nobody"/)
+    expect((await reread(role)).templateId).toBe('plant.qi')
   })
 })
 

package/tests/role-template-seed-db.test.ts

@@ -119,7 +119,8 @@ describe('seeding', () => {
     expect(await getRepository(Role).count()).toBe(1)
   })
 
-  it('adds the union when two applications declare the same seat', async () => {
+  /* A role has one base template (ADR-0075 decision 1, amended 2026-10-26) - two apps declaring one name no longer union. */
+  it('refuses a second template onto a role of the same name based on the first', async () => {
     registerRoleTemplate({ id: 'plant.qi', name: 'QUALITY-INSPECTOR', grants: [{ category: 'board', axes: ['query'] }] })
     registerRoleTemplate({
       id: 'twin.qi',
@@ -127,10 +128,10 @@ describe('seeding', () => {
       grants: [{ category: 'board', axes: ['mutation'] }]
     })
 
-    await mutation.createRoleFromTemplate('plant.qi', undefined, context())
-    const role = await mutation.createRoleFromTemplate('twin.qi', undefined, context())
+    const role = await mutation.createRoleFromTemplate('plant.qi', undefined, context())
+    await expect(mutation.createRoleFromTemplate('twin.qi', undefined, context())).rejects.toThrow(/based on role template "plant.qi", not "twin.qi"/)
 
-    expect(await privilegesOf(role.id)).toEqual(['board:mutation', 'board:query'])
+    expect(await privilegesOf(role.id)).toEqual(['board:query'])
     expect(await getRepository(Role).count()).toBe(1)
   })