@things-factory/auth-base 10.1.218 → 10.1.223

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@things-factory/auth-base",
-  "version": "10.1.218",
+  "version": "10.1.223",
   "main": "dist-server/index.js",
   "browser": "dist-client/index.js",
   "things-factory": true,
@@ -50,5 +50,5 @@
     "passport-jwt": "^4.0.0",
     "passport-local": "^1.0.0"
   },
-  "gitHead": "b4e60fdfe307cecebb2264267f616749a502d5fe"
+  "gitHead": "868f2026b8373371ad04f42b0a097964d0d0ed0f"
 }

package/tests/role-template-gap-db.test.ts

@@ -1,5 +1,6 @@
 /**
- * What a role lacks against the template of its name - against a real database (ADR-0075 decision 1).
+ * What a role lacks against its base template - against a real database (ADR-0075 decision 1, amended 2026-10-26:
+ * a role keeps one base template, `Role.templateId`, and is never paired by name).
  *
  * A template is a seed and nothing pushes its later grants into roles already standing. When
  * operato-plant's templates gained ai-assistant, the roles in miratek stayed without it and only
@@ -14,12 +15,16 @@ const { Role } = loadCompiled('service/role/role')
 const { Privilege } = loadCompiled('service/privilege/privilege')
 const { User } = loadCompiled('service/user/user')
 const { RoleTemplateMutation } = loadCompiled('service/role-template/role-template-mutation')
+const { RoleMutation } = loadCompiled('service/role/role-mutation')
 const { RoleTemplateGapResolver } = loadCompiled('service/role-template/role-template-gap-resolver')
 const { registerRoleTemplate } = loadCompiled('service/role-template/role-template')
 const { registerRoleTask } = loadCompiled('service/role-template/role-task')
 
 const mutation = new RoleTemplateMutation()
-const gapOf = (role: any, templateId?: string) => new RoleTemplateGapResolver().templateGap(role, templateId)
+const gapOf = (role: any) => new RoleTemplateGapResolver().templateGap(role)
+const reread = (role: any) => getRepository(Role).findOneBy({ id: role.id })
+/* The role screen's base template field saves through `updateRole`. */
+const baseOn = (role: any, templateId: string | null) => new RoleMutation().updateRole(role.id, { templateId } as any, { ...context(), t: (key: string) => key } as any)
 const coverageOf = (role: any) => new RoleTemplateGapResolver().taskCoverage(role)
 
 let domain: any
@@ -107,13 +112,52 @@ describe('the gap between a role and its template', () => {
     expect((await gapOf(role)).missingCount).toBe(0)
   })
 
-  it('★ is null for a role no template names - a renamed role belongs to its administrator', async () => {
+  it('★ a role made under a name of its own is still based on the template', async () => {
     declareTemplate(['query'])
     const role = await mutation.createRoleFromTemplate('plant.qi', 'NIGHT-INSPECTOR', context())
+    declareTemplate(['query', 'mutation'])
+
+    expect((await reread(role)).templateId).toBe('plant.qi')
+    expect(await gapOf(await reread(role))).toMatchObject({ templateId: 'plant.qi', missingCount: 1 })
+  })
+
+  it('★ is null for a role that is based on no template, even when a template carries its name', async () => {
+    declareTemplate(['query'])
+    const role = await getRepository(Role).save({ domain, name: 'QUALITY-INSPECTOR', privileges: [] })
 
     expect(await gapOf(role)).toBeNull()
   })
 
+  it('★ refuses to top up a role based on another template, and changes nothing', async () => {
+    declareTemplate(['query'])
+    registerRoleTemplate({ id: 'plant.qm', name: 'QUALITY-MANAGER', grants: [{ category: 'board', axes: ['query', 'mutation'] }] })
+    const role = await mutation.createRoleFromTemplate('plant.qi', undefined, context())
+
+    await expect(mutation.createRoleFromTemplate('plant.qm', 'QUALITY-INSPECTOR', context())).rejects.toThrow(/based on role template "plant.qi", not "plant.qm"/)
+
+    const stored = await getRepository(Role).findOne({ where: { id: role.id }, relations: ['privileges'] })
+    expect(stored.templateId).toBe('plant.qi')
+    expect(stored.privileges.map((p: any) => p.name)).toEqual(['query'])
+  })
+
+  it('★ tops up a standing role that has no base and makes the template its base', async () => {
+    declareTemplate(['query', 'mutation'])
+    const role = await getRepository(Role).save({ domain, name: 'QUALITY-INSPECTOR', privileges: [] })
+
+    await mutation.createRoleFromTemplate('plant.qi', undefined, context())
+
+    expect((await reread(role)).templateId).toBe('plant.qi')
+    expect((await gapOf(await reread(role))).missingCount).toBe(0)
+  })
+
+  it('★ is null when the base is a template this installation no longer declares', async () => {
+    declareTemplate(['query'])
+    const role = await mutation.createRoleFromTemplate('plant.qi', undefined, context())
+    ;(process as any)['ROLE_TEMPLATES'] = {}
+
+    expect(await gapOf(await reread(role))).toBeNull()
+  })
+
   it('does not take away what the administrator added beyond the template', async () => {
     declareTemplate(['query'])
     const role = await mutation.createRoleFromTemplate('plant.qi', undefined, context())
@@ -131,19 +175,26 @@ describe('the gap between a role and its template', () => {
     expect(gap.extraCount).toBe(1)
   })
 
-  it('★ lays a role against a template the administrator picks, whatever the role is called', async () => {
+  it('★ lays a role named in the site\'s own words against the base the administrator gives it', async () => {
     declareTemplate(['query', 'mutation'])
     const role = await getRepository(Role).save({ domain, name: '품질검사', privileges: [await getRepository(Privilege).findOneBy({ category: 'board', name: 'query' })] })
 
     expect(await gapOf(role)).toBeNull()
-    expect(await gapOf(role, 'plant.qi')).toMatchObject({ templateId: 'plant.qi', missing: [{ category: 'board', axes: ['mutation'] }], extraCount: 0 })
+
+    await baseOn(role, 'plant.qi')
+    expect(await gapOf(await reread(role))).toMatchObject({ templateId: 'plant.qi', missing: [{ category: 'board', axes: ['mutation'] }], extraCount: 0 })
+
+    await baseOn(role, null)
+    expect((await reread(role)).templateId).toBeNull()
+    expect(await gapOf(await reread(role))).toBeNull()
   })
 
-  it('refuses a template id that does not exist rather than answering null', async () => {
+  it('refuses a base template id that does not exist rather than storing it', async () => {
     declareTemplate(['query'])
     const role = await mutation.createRoleFromTemplate('plant.qi', undefined, context())
 
-    await expect(gapOf(role, 'plant.nobody')).rejects.toThrow(/no role template "plant.nobody"/)
+    await expect(baseOn(role, 'plant.nobody')).rejects.toThrow(/no role template "plant.nobody"/)
+    expect((await reread(role)).templateId).toBe('plant.qi')
   })
 })
 

package/tests/role-template-seed-db.test.ts

@@ -119,7 +119,8 @@ describe('seeding', () => {
     expect(await getRepository(Role).count()).toBe(1)
   })
 
-  it('adds the union when two applications declare the same seat', async () => {
+  /* A role has one base template (ADR-0075 decision 1, amended 2026-10-26) - two apps declaring one name no longer union. */
+  it('refuses a second template onto a role of the same name based on the first', async () => {
     registerRoleTemplate({ id: 'plant.qi', name: 'QUALITY-INSPECTOR', grants: [{ category: 'board', axes: ['query'] }] })
     registerRoleTemplate({
       id: 'twin.qi',
@@ -127,10 +128,10 @@ describe('seeding', () => {
       grants: [{ category: 'board', axes: ['mutation'] }]
     })
 
-    await mutation.createRoleFromTemplate('plant.qi', undefined, context())
-    const role = await mutation.createRoleFromTemplate('twin.qi', undefined, context())
+    const role = await mutation.createRoleFromTemplate('plant.qi', undefined, context())
+    await expect(mutation.createRoleFromTemplate('twin.qi', undefined, context())).rejects.toThrow(/based on role template "plant.qi", not "twin.qi"/)
 
-    expect(await privilegesOf(role.id)).toEqual(['board:mutation', 'board:query'])
+    expect(await privilegesOf(role.id)).toEqual(['board:query'])
     expect(await getRepository(Role).count()).toBe(1)
   })