@things-factory/auth-base 10.1.218 → 10.1.226

package/dist-server/utils/access-token-cookie.js

@@ -6,6 +6,7 @@ exports.setSessionAccessToken = setSessionAccessToken;
 exports.clearAccessTokenCookie = clearAccessTokenCookie;
 const env_1 = require("@things-factory/env");
 const max_age_js_1 = require("../constants/max-age.js");
+const identity_confirmation_js_1 = require("../service/identity-confirmation/identity-confirmation.js");
 const accessTokenCookieKey = env_1.config.get('accessTokenCookieKey', 'access_token');
 function getAccessTokenCookie(context) {
     return context?.cookies?.get(accessTokenCookieKey);
@@ -37,6 +38,8 @@ function clearAccessTokenCookie(context) {
         sameSite: 'Lax'
     };
     context.cookies.set(accessTokenCookieKey, '', cookie);
+    /* A confirmation that it was the person ends with the sign-in it confirmed (ADR-0168). */
+    (0, identity_confirmation_js_1.forgetConfirmation)(context);
     /*
      * TODO clear i18next cookie as well - need to support domain
      * https://github.com/hatiolab/things-factory/issues/70

package/dist-server/utils/access-token-cookie.js.map

@@ -1 +1 @@
-{"version":3,"file":"access-token-cookie.js","sourceRoot":"","sources":["../../server/utils/access-token-cookie.ts"],"names":[],"mappings":";;AAKA,oDAEC;AAED,oDAWC;AAED,sDASC;AAED,wDAgBC;AAjDD,6CAA4C;AAC5C,wDAAiD;AAEjD,MAAM,oBAAoB,GAAG,YAAM,CAAC,GAAG,CAAC,sBAAsB,EAAE,cAAc,CAAC,CAAA;AAE/E,SAAgB,oBAAoB,CAAC,OAAO;IAC1C,OAAO,OAAO,EAAE,OAAO,EAAE,GAAG,CAAC,oBAAoB,CAAC,CAAA;AACpD,CAAC;AAED,SAAgB,oBAAoB,CAAC,OAAO,EAAE,KAAK;IACjD,MAAM,EAAE,MAAM,EAAE,GAAG,OAAO,CAAA;IAE1B,IAAI,MAAM,GAAG;QACX,MAAM;QACN,QAAQ,EAAE,IAAI;QACd,MAAM,EAAE,oBAAO;QACf,QAAQ,EAAE,KAAK;KAChB,CAAA;IAED,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,oBAAoB,EAAE,KAAK,EAAE,MAAM,CAAC,CAAA;AAC1D,CAAC;AAED,SAAgB,qBAAqB,CAAC,OAAO;IAC3C,0FAA0F;IAC1F,MAAM,EAAE,IAAI,EAAE,GAAG,OAAO,CAAC,KAAK,CAAA;IAE9B,OAAO,CAAC,OAAO,GAAG;QAChB,EAAE,EAAE,IAAI,CAAC,EAAE;QACX,QAAQ,EAAE,IAAI,CAAC,IAAI;QACnB,MAAM,EAAE,IAAI,CAAC,KAAK;KACnB,CAAA;AACH,CAAC;AAED,SAAgB,sBAAsB,CAAC,OAAO;IAC5C,MAAM,EAAE,MAAM,EAAE,GAAG,OAAO,CAAA;IAE1B,IAAI,MAAM,GAAG;QACX,MAAM;QACN,QAAQ,EAAE,IAAI;QACd,QAAQ,EAAE,KAAK;KAChB,CAAA;IAED,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,oBAAoB,EAAE,EAAE,EAAE,MAAM,CAAC,CAAA;IACrD;;;OAGG;IACH,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,EAAE,EAAE,EAAE,MAAM,CAAC,CAAA;IAC1C,OAAO,CAAC,OAAO,GAAG,IAAI,CAAA;AACxB,CAAC","sourcesContent":["import { config } from '@things-factory/env'\nimport { MAX_AGE } from '../constants/max-age.js'\n\nconst accessTokenCookieKey = config.get('accessTokenCookieKey', 'access_token')\n\nexport function getAccessTokenCookie(context) {\n  return context?.cookies?.get(accessTokenCookieKey)\n}\n\nexport function setAccessTokenCookie(context, token) {\n  const { secure } = context\n\n  var cookie = {\n    secure,\n    httpOnly: true,\n    maxAge: MAX_AGE,\n    sameSite: 'Lax'\n  }\n\n  context.cookies.set(accessTokenCookieKey, token, cookie)\n}\n\nexport function setSessionAccessToken(context) {\n  /* koa-session 을 사용하는 경우에는, cookie 직접 설정이 작동되지 않는다. 그런 경우에는 session에 설정해서 cookie를 변경한다. */\n  const { user } = context.state\n\n  context.session = {\n    id: user.id,\n    userType: user.type,\n    status: user.state\n  }\n}\n\nexport function clearAccessTokenCookie(context) {\n  const { secure } = context\n\n  var cookie = {\n    secure,\n    httpOnly: true,\n    sameSite: 'Lax'\n  }\n\n  context.cookies.set(accessTokenCookieKey, '', cookie)\n  /*\n   * TODO clear i18next cookie as well - need to support domain\n   * https://github.com/hatiolab/things-factory/issues/70\n   */\n  context.cookies.set('i18next', '', cookie)\n  context.session = null\n}\n"]}
+{"version":3,"file":"access-token-cookie.js","sourceRoot":"","sources":["../../server/utils/access-token-cookie.ts"],"names":[],"mappings":";;AAMA,oDAEC;AAED,oDAWC;AAED,sDASC;AAED,wDAkBC;AApDD,6CAA4C;AAC5C,wDAAiD;AACjD,wGAA8F;AAE9F,MAAM,oBAAoB,GAAG,YAAM,CAAC,GAAG,CAAC,sBAAsB,EAAE,cAAc,CAAC,CAAA;AAE/E,SAAgB,oBAAoB,CAAC,OAAO;IAC1C,OAAO,OAAO,EAAE,OAAO,EAAE,GAAG,CAAC,oBAAoB,CAAC,CAAA;AACpD,CAAC;AAED,SAAgB,oBAAoB,CAAC,OAAO,EAAE,KAAK;IACjD,MAAM,EAAE,MAAM,EAAE,GAAG,OAAO,CAAA;IAE1B,IAAI,MAAM,GAAG;QACX,MAAM;QACN,QAAQ,EAAE,IAAI;QACd,MAAM,EAAE,oBAAO;QACf,QAAQ,EAAE,KAAK;KAChB,CAAA;IAED,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,oBAAoB,EAAE,KAAK,EAAE,MAAM,CAAC,CAAA;AAC1D,CAAC;AAED,SAAgB,qBAAqB,CAAC,OAAO;IAC3C,0FAA0F;IAC1F,MAAM,EAAE,IAAI,EAAE,GAAG,OAAO,CAAC,KAAK,CAAA;IAE9B,OAAO,CAAC,OAAO,GAAG;QAChB,EAAE,EAAE,IAAI,CAAC,EAAE;QACX,QAAQ,EAAE,IAAI,CAAC,IAAI;QACnB,MAAM,EAAE,IAAI,CAAC,KAAK;KACnB,CAAA;AACH,CAAC;AAED,SAAgB,sBAAsB,CAAC,OAAO;IAC5C,MAAM,EAAE,MAAM,EAAE,GAAG,OAAO,CAAA;IAE1B,IAAI,MAAM,GAAG;QACX,MAAM;QACN,QAAQ,EAAE,IAAI;QACd,QAAQ,EAAE,KAAK;KAChB,CAAA;IAED,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,oBAAoB,EAAE,EAAE,EAAE,MAAM,CAAC,CAAA;IACrD,0FAA0F;IAC1F,IAAA,6CAAkB,EAAC,OAAO,CAAC,CAAA;IAC3B;;;OAGG;IACH,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,EAAE,EAAE,EAAE,MAAM,CAAC,CAAA;IAC1C,OAAO,CAAC,OAAO,GAAG,IAAI,CAAA;AACxB,CAAC","sourcesContent":["import { config } from '@things-factory/env'\nimport { MAX_AGE } from '../constants/max-age.js'\nimport { forgetConfirmation } from '../service/identity-confirmation/identity-confirmation.js'\n\nconst accessTokenCookieKey = config.get('accessTokenCookieKey', 'access_token')\n\nexport function getAccessTokenCookie(context) {\n  return context?.cookies?.get(accessTokenCookieKey)\n}\n\nexport function setAccessTokenCookie(context, token) {\n  const { secure } = context\n\n  var cookie = {\n    secure,\n    httpOnly: true,\n    maxAge: MAX_AGE,\n    sameSite: 'Lax'\n  }\n\n  context.cookies.set(accessTokenCookieKey, token, cookie)\n}\n\nexport function setSessionAccessToken(context) {\n  /* koa-session 을 사용하는 경우에는, cookie 직접 설정이 작동되지 않는다. 그런 경우에는 session에 설정해서 cookie를 변경한다. */\n  const { user } = context.state\n\n  context.session = {\n    id: user.id,\n    userType: user.type,\n    status: user.state\n  }\n}\n\nexport function clearAccessTokenCookie(context) {\n  const { secure } = context\n\n  var cookie = {\n    secure,\n    httpOnly: true,\n    sameSite: 'Lax'\n  }\n\n  context.cookies.set(accessTokenCookieKey, '', cookie)\n  /* A confirmation that it was the person ends with the sign-in it confirmed (ADR-0168). */\n  forgetConfirmation(context)\n  /*\n   * TODO clear i18next cookie as well - need to support domain\n   * https://github.com/hatiolab/things-factory/issues/70\n   */\n  context.cookies.set('i18next', '', cookie)\n  context.session = null\n}\n"]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@things-factory/auth-base",
-  "version": "10.1.218",
+  "version": "10.1.226",
   "main": "dist-server/index.js",
   "browser": "dist-client/index.js",
   "things-factory": true,
@@ -50,5 +50,5 @@
     "passport-jwt": "^4.0.0",
     "passport-local": "^1.0.0"
   },
-  "gitHead": "b4e60fdfe307cecebb2264267f616749a502d5fe"
+  "gitHead": "abc5cf99effa2de579a1cbfda74ddc5eb41dba50"
 }

package/tests/confirm-identity-db.test.ts

@@ -0,0 +1,85 @@
+/**
+ * Confirming it is still the signed-in person (ADR-0168) by password, through the real controller on the sqlite
+ * harness: a miss counts toward the same lock as signing in and leaves no confirmation; a match leaves one; both
+ * are audited as `auth.confirm-identity`.
+ */
+
+import { closeAuthDatabase, Domain, getRepository, openAuthDatabase, resetAuthDatabase, authDataSource } from './db'
+import { loadCompiled } from './compiled'
+
+const { User } = loadCompiled('service/user/user')
+const { AuditAction } = loadCompiled('service/audit/audit-action')
+const { flushAudit } = loadCompiled('service/audit/audit-recorder')
+const { confirmIdentity } = loadCompiled('controllers/confirm-identity')
+const { verifyPassword } = loadCompiled('controllers/signin')
+const { isRecentlyConfirmed } = loadCompiled('service/identity-confirmation/identity-confirmation')
+
+const PASSWORD = 'Passw0rd!'
+
+let domain: any
+let kim: any
+
+function request(user: any) {
+  const jar = new Map<string, string>()
+  return {
+    state: { user, domain, tx: authDataSource().manager },
+    cookies: { get: (name: string) => jar.get(name) || undefined, set: (name: string, value: string) => jar.set(name, value) }
+  } as any
+}
+
+const byPassword = (context: any, password: string) => confirmIdentity('password', context, (user: any) => verifyPassword(user, password, context))
+
+async function audits() {
+  await flushAudit()
+  const rows = await getRepository(AuditAction).find({ where: { kind: 'auth.confirm-identity' }, order: { createdAt: 'ASC' } })
+  return rows.map(row => [row.outcome, row.code, row.detail?.method])
+}
+
+beforeAll(async () => {
+  await openAuthDatabase()
+})
+
+afterAll(async () => {
+  await closeAuthDatabase()
+})
+
+beforeEach(async () => {
+  await resetAuthDatabase()
+  domain = await getRepository(Domain).save({ name: 'office', subdomain: 'office' })
+  const salt = User.generateSalt()
+  kim = await getRepository(User).save({
+    username: 'kim',
+    email: 'kim@example.com',
+    name: 'kim',
+    salt,
+    password: User.encode(PASSWORD, salt),
+    status: 'activated',
+    domains: [domain]
+  })
+})
+
+it('leaves a confirmation for the person when the password matches', async () => {
+  const context = request(kim)
+  await byPassword(context, PASSWORD)
+
+  expect(isRecentlyConfirmed(context, kim.id)).toBe(true)
+  expect(await audits()).toEqual([['ok', null, 'password']])
+})
+
+it('a miss leaves none, counts toward the lock, and is audited with its code', async () => {
+  const context = request(kim)
+  await expect(byPassword(context, 'wrong')).rejects.toMatchObject({ errorCode: 'password-not-matched' })
+
+  expect(isRecentlyConfirmed(context, kim.id)).toBe(false)
+  expect((await getRepository(User).findOneBy({ id: kim.id })).failCount).toBe(1)
+  expect(await audits()).toEqual([['error', 'password-not-matched', 'password']])
+})
+
+it('the fifth miss locks the account, and a locked account confirms nothing', async () => {
+  for (let i = 0; i < 4; i++) await expect(byPassword(request(kim), 'wrong')).rejects.toMatchObject({ errorCode: 'password-not-matched' })
+  await expect(byPassword(request(kim), 'wrong')).rejects.toMatchObject({ errorCode: 'user-locked' })
+
+  const context = request(kim)
+  await expect(byPassword(context, PASSWORD)).rejects.toMatchObject({ errorCode: 'user-locked' })
+  expect(isRecentlyConfirmed(context, kim.id)).toBe(false)
+})

package/tests/identity-confirmation.test.ts

@@ -0,0 +1,146 @@
+/**
+ * `@recentConfirmation` (ADR-0168) - the seam. A door that asks for a recent confirmation opens only when the
+ * person confirmed in this browser within the last ten minutes, as themself; passing does not lengthen it. Built as SDL the way
+ * `privilege-directive.test.ts` builds its schema - the wrapper sees only the field, `context.state` and the cookies.
+ */
+
+import { graphql } from 'graphql'
+import { makeExecutableSchema } from '@graphql-tools/schema'
+import jwt from 'jsonwebtoken'
+
+import { loadCompiled } from './compiled'
+
+const { privilegeDirectiveTypeDefs, privilegeDirectiveResolver } = loadCompiled('service/privilege/privilege-directive')
+const confirmation = loadCompiled('service/identity-confirmation/identity-confirmation')
+const { SECRET } = loadCompiled('utils/get-secret')
+const { User } = loadCompiled('service/user/user')
+
+const DOMAIN = { id: 'domain-1', subdomain: 'office' }
+const KIM = { id: 'kim', domains: [DOMAIN] }
+const LEE = { id: 'lee', domains: [DOMAIN] }
+
+const typeDefs = `
+  type Query {
+    myPayslips: String @privilege(category: "office-self", privilege: "query") @recentConfirmation
+    myLeave: String @privilege(category: "office-self", privilege: "query")
+  }
+`
+
+function buildSchema(defs = typeDefs) {
+  return privilegeDirectiveResolver(
+    makeExecutableSchema({
+      typeDefs: [privilegeDirectiveTypeDefs, confirmation.recentConfirmationDirectiveTypeDefs, defs],
+      resolvers: { Query: { myPayslips: () => 'slips', myLeave: () => 'leave' } }
+    })
+  )
+}
+
+/** A browser: the cookies it holds between requests. */
+function browser() {
+  const jar = new Map<string, string>()
+  const options = new Map<string, any>()
+  return {
+    jar,
+    options,
+    cookies: {
+      get: (name: string) => jar.get(name) || undefined,
+      set: (name: string, value: string, option: any) => (jar.set(name, value), options.set(name, option))
+    }
+  }
+}
+
+function run(schema: any, field: string, user: any, at: ReturnType<typeof browser>) {
+  return graphql({ schema, source: `{ ${field} }`, contextValue: { state: { domain: DOMAIN, user }, cookies: at.cookies } })
+}
+
+const refusalOf = (result: any) => result.errors?.[0]?.extensions?.refusal?.code
+
+beforeEach(() => {
+  User.hasPrivilege = jest.fn().mockResolvedValue(true)
+  ;(process as any).domainOwnerGranted = jest.fn().mockResolvedValue(false)
+  ;(process as any).superUserGranted = jest.fn().mockResolvedValue(false)
+})
+
+afterEach(() => {
+  delete (process as any).domainOwnerGranted
+  delete (process as any).superUserGranted
+})
+
+it('refuses a door that asks for it when the person has not confirmed, with a code the screen can name', async () => {
+  const result = await run(buildSchema(), 'myPayslips', KIM, browser())
+
+  expect(result.data?.myPayslips ?? null).toBeNull()
+  expect(refusalOf(result)).toBe('identity-confirmation-required')
+  expect(result.errors?.[0]?.extensions?.code).toBe('IDENTITY_CONFIRMATION_REQUIRED')
+})
+
+it('opens it after the person confirmed, and does not lengthen the confirmation as it passes', async () => {
+  const at = browser()
+  confirmation.rememberConfirmation({ cookies: at.cookies }, KIM.id)
+  const given = at.jar.get('identity_confirmed')
+
+  await new Promise(resolve => setTimeout(resolve, 1100))
+  const result = await run(buildSchema(), 'myPayslips', KIM, at)
+
+  expect(result.errors).toBeUndefined()
+  expect(result.data).toEqual({ myPayslips: 'slips' })
+  expect(at.jar.get('identity_confirmed')).toBe(given)
+  expect(at.options.get('identity_confirmed')).toMatchObject({ httpOnly: true, maxAge: 10 * 60 * 1000 })
+})
+
+it('holds for ten minutes from the moment it was given, and says until when', () => {
+  const at = browser()
+  const before = Date.now()
+  confirmation.rememberConfirmation({ cookies: at.cookies }, KIM.id)
+
+  const until = confirmation.confirmedUntil({ cookies: at.cookies }, KIM.id).getTime()
+  expect(until).toBeGreaterThanOrEqual(Math.floor(before / 1000) * 1000 + 10 * 60 * 1000)
+  expect(until).toBeLessThanOrEqual(Date.now() + 10 * 60 * 1000)
+  expect(confirmation.confirmedUntil({ cookies: at.cookies }, LEE.id)).toBeNull()
+})
+
+it("does not open on another person's confirmation", async () => {
+  const at = browser()
+  confirmation.rememberConfirmation({ cookies: at.cookies }, LEE.id)
+
+  expect(refusalOf(await run(buildSchema(), 'myPayslips', KIM, at))).toBe('identity-confirmation-required')
+})
+
+it('does not open on an expired confirmation, a forged one, or one let go', async () => {
+  const expired = browser()
+  expired.jar.set('identity_confirmed', jwt.sign({ sub: KIM.id, purpose: 'identity-confirmation' }, SECRET, { expiresIn: -10 }))
+  expect(refusalOf(await run(buildSchema(), 'myPayslips', KIM, expired))).toBe('identity-confirmation-required')
+
+  const forged = browser()
+  forged.jar.set('identity_confirmed', jwt.sign({ sub: KIM.id, purpose: 'identity-confirmation' }, 'another secret', { expiresIn: 300 }))
+  expect(refusalOf(await run(buildSchema(), 'myPayslips', KIM, forged))).toBe('identity-confirmation-required')
+
+  const signedIn = browser()
+  signedIn.jar.set('identity_confirmed', jwt.sign({ sub: KIM.id }, SECRET, { expiresIn: 300 }))
+  expect(refusalOf(await run(buildSchema(), 'myPayslips', KIM, signedIn))).toBe('identity-confirmation-required')
+
+  const leftAlone = browser()
+  confirmation.rememberConfirmation({ cookies: leftAlone.cookies }, KIM.id)
+  confirmation.forgetConfirmation({ cookies: leftAlone.cookies })
+  expect(refusalOf(await run(buildSchema(), 'myPayslips', KIM, leftAlone))).toBe('identity-confirmation-required')
+})
+
+it('asks the privilege first - a person without it is refused for the privilege, confirmed or not', async () => {
+  User.hasPrivilege = jest.fn().mockResolvedValue(false)
+  const at = browser()
+  confirmation.rememberConfirmation({ cookies: at.cookies }, KIM.id)
+
+  const result = await run(buildSchema(), 'myPayslips', KIM, at)
+  expect(result.errors?.[0]?.extensions?.code).not.toBe('IDENTITY_CONFIRMATION_REQUIRED')
+})
+
+it('leaves a door that does not ask alone', async () => {
+  const result = await run(buildSchema(), 'myLeave', KIM, browser())
+
+  expect(result.errors).toBeUndefined()
+  expect(result.data).toEqual({ myLeave: 'leave' })
+})
+
+it('refuses to build a door that asks for the confirmation without a privilege beside it', () => {
+  expect(() => buildSchema('type Query { myPayslips: String @recentConfirmation myLeave: String }')).toThrow('has no @privilege beside it')
+})

package/tests/role-template-gap-db.test.ts

@@ -1,5 +1,6 @@
 /**
- * What a role lacks against the template of its name - against a real database (ADR-0075 decision 1).
+ * What a role lacks against its base template - against a real database (ADR-0075 decision 1, amended 2026-10-26:
+ * a role keeps one base template, `Role.templateId`, and is never paired by name).
  *
  * A template is a seed and nothing pushes its later grants into roles already standing. When
  * operato-plant's templates gained ai-assistant, the roles in miratek stayed without it and only
@@ -14,12 +15,16 @@ const { Role } = loadCompiled('service/role/role')
 const { Privilege } = loadCompiled('service/privilege/privilege')
 const { User } = loadCompiled('service/user/user')
 const { RoleTemplateMutation } = loadCompiled('service/role-template/role-template-mutation')
+const { RoleMutation } = loadCompiled('service/role/role-mutation')
 const { RoleTemplateGapResolver } = loadCompiled('service/role-template/role-template-gap-resolver')
 const { registerRoleTemplate } = loadCompiled('service/role-template/role-template')
 const { registerRoleTask } = loadCompiled('service/role-template/role-task')
 
 const mutation = new RoleTemplateMutation()
-const gapOf = (role: any, templateId?: string) => new RoleTemplateGapResolver().templateGap(role, templateId)
+const gapOf = (role: any) => new RoleTemplateGapResolver().templateGap(role)
+const reread = (role: any) => getRepository(Role).findOneBy({ id: role.id })
+/* The role screen's base template field saves through `updateRole`. */
+const baseOn = (role: any, templateId: string | null) => new RoleMutation().updateRole(role.id, { templateId } as any, { ...context(), t: (key: string) => key } as any)
 const coverageOf = (role: any) => new RoleTemplateGapResolver().taskCoverage(role)
 
 let domain: any
@@ -107,13 +112,52 @@ describe('the gap between a role and its template', () => {
     expect((await gapOf(role)).missingCount).toBe(0)
   })
 
-  it('★ is null for a role no template names - a renamed role belongs to its administrator', async () => {
+  it('★ a role made under a name of its own is still based on the template', async () => {
     declareTemplate(['query'])
     const role = await mutation.createRoleFromTemplate('plant.qi', 'NIGHT-INSPECTOR', context())
+    declareTemplate(['query', 'mutation'])
+
+    expect((await reread(role)).templateId).toBe('plant.qi')
+    expect(await gapOf(await reread(role))).toMatchObject({ templateId: 'plant.qi', missingCount: 1 })
+  })
+
+  it('★ is null for a role that is based on no template, even when a template carries its name', async () => {
+    declareTemplate(['query'])
+    const role = await getRepository(Role).save({ domain, name: 'QUALITY-INSPECTOR', privileges: [] })
 
     expect(await gapOf(role)).toBeNull()
   })
 
+  it('★ refuses to top up a role based on another template, and changes nothing', async () => {
+    declareTemplate(['query'])
+    registerRoleTemplate({ id: 'plant.qm', name: 'QUALITY-MANAGER', grants: [{ category: 'board', axes: ['query', 'mutation'] }] })
+    const role = await mutation.createRoleFromTemplate('plant.qi', undefined, context())
+
+    await expect(mutation.createRoleFromTemplate('plant.qm', 'QUALITY-INSPECTOR', context())).rejects.toThrow(/based on role template "plant.qi", not "plant.qm"/)
+
+    const stored = await getRepository(Role).findOne({ where: { id: role.id }, relations: ['privileges'] })
+    expect(stored.templateId).toBe('plant.qi')
+    expect(stored.privileges.map((p: any) => p.name)).toEqual(['query'])
+  })
+
+  it('★ tops up a standing role that has no base and makes the template its base', async () => {
+    declareTemplate(['query', 'mutation'])
+    const role = await getRepository(Role).save({ domain, name: 'QUALITY-INSPECTOR', privileges: [] })
+
+    await mutation.createRoleFromTemplate('plant.qi', undefined, context())
+
+    expect((await reread(role)).templateId).toBe('plant.qi')
+    expect((await gapOf(await reread(role))).missingCount).toBe(0)
+  })
+
+  it('★ is null when the base is a template this installation no longer declares', async () => {
+    declareTemplate(['query'])
+    const role = await mutation.createRoleFromTemplate('plant.qi', undefined, context())
+    ;(process as any)['ROLE_TEMPLATES'] = {}
+
+    expect(await gapOf(await reread(role))).toBeNull()
+  })
+
   it('does not take away what the administrator added beyond the template', async () => {
     declareTemplate(['query'])
     const role = await mutation.createRoleFromTemplate('plant.qi', undefined, context())
@@ -131,19 +175,26 @@ describe('the gap between a role and its template', () => {
     expect(gap.extraCount).toBe(1)
   })
 
-  it('★ lays a role against a template the administrator picks, whatever the role is called', async () => {
+  it('★ lays a role named in the site\'s own words against the base the administrator gives it', async () => {
     declareTemplate(['query', 'mutation'])
     const role = await getRepository(Role).save({ domain, name: '품질검사', privileges: [await getRepository(Privilege).findOneBy({ category: 'board', name: 'query' })] })
 
     expect(await gapOf(role)).toBeNull()
-    expect(await gapOf(role, 'plant.qi')).toMatchObject({ templateId: 'plant.qi', missing: [{ category: 'board', axes: ['mutation'] }], extraCount: 0 })
+
+    await baseOn(role, 'plant.qi')
+    expect(await gapOf(await reread(role))).toMatchObject({ templateId: 'plant.qi', missing: [{ category: 'board', axes: ['mutation'] }], extraCount: 0 })
+
+    await baseOn(role, null)
+    expect((await reread(role)).templateId).toBeNull()
+    expect(await gapOf(await reread(role))).toBeNull()
   })
 
-  it('refuses a template id that does not exist rather than answering null', async () => {
+  it('refuses a base template id that does not exist rather than storing it', async () => {
     declareTemplate(['query'])
     const role = await mutation.createRoleFromTemplate('plant.qi', undefined, context())
 
-    await expect(gapOf(role, 'plant.nobody')).rejects.toThrow(/no role template "plant.nobody"/)
+    await expect(baseOn(role, 'plant.nobody')).rejects.toThrow(/no role template "plant.nobody"/)
+    expect((await reread(role)).templateId).toBe('plant.qi')
   })
 })
 

package/tests/role-template-seed-db.test.ts

@@ -119,7 +119,8 @@ describe('seeding', () => {
     expect(await getRepository(Role).count()).toBe(1)
   })
 
-  it('adds the union when two applications declare the same seat', async () => {
+  /* A role has one base template (ADR-0075 decision 1, amended 2026-10-26) - two apps declaring one name no longer union. */
+  it('refuses a second template onto a role of the same name based on the first', async () => {
     registerRoleTemplate({ id: 'plant.qi', name: 'QUALITY-INSPECTOR', grants: [{ category: 'board', axes: ['query'] }] })
     registerRoleTemplate({
       id: 'twin.qi',
@@ -127,10 +128,10 @@ describe('seeding', () => {
       grants: [{ category: 'board', axes: ['mutation'] }]
     })
 
-    await mutation.createRoleFromTemplate('plant.qi', undefined, context())
-    const role = await mutation.createRoleFromTemplate('twin.qi', undefined, context())
+    const role = await mutation.createRoleFromTemplate('plant.qi', undefined, context())
+    await expect(mutation.createRoleFromTemplate('twin.qi', undefined, context())).rejects.toThrow(/based on role template "plant.qi", not "twin.qi"/)
 
-    expect(await privilegesOf(role.id)).toEqual(['board:mutation', 'board:query'])
+    expect(await privilegesOf(role.id)).toEqual(['board:query'])
     expect(await getRepository(Role).count()).toBe(1)
   })
 

package/translations/en.json

@@ -266,5 +266,6 @@
   "privilege.allows.audit.query": "see everyone’s sign-ins, privilege use and refusals, and role changes",
   "task.auth-base.audit-reading.name": "Reading the audit log",
   "task.auth-base.audit-reading.description": "Reads everyone's sign-ins, privilege use and refusals, and role changes in the domain.",
-  "error.access-request-task-mismatch": "the work you picked does not include the refused privilege."
+  "error.access-request-task-mismatch": "the work you picked does not include the refused privilege.",
+  "error.identity confirmation required": "confirm it is you to see this"
 }

package/translations/es.json

@@ -266,5 +266,6 @@
   "privilege.allows.audit.query": "ver los inicios de sesión, el uso y rechazo de privilegios y los cambios de rol de todos",
   "task.auth-base.audit-reading.name": "Consultar el registro de auditoría",
   "task.auth-base.audit-reading.description": "Lee los inicios de sesión, el uso y rechazo de privilegios y los cambios de rol de todos en el dominio.",
-  "error.access-request-task-mismatch": "la tarea elegida no incluye el privilegio rechazado."
+  "error.access-request-task-mismatch": "la tarea elegida no incluye el privilegio rechazado.",
+  "error.identity confirmation required": "confirme que es usted para ver esto"
 }

package/translations/ja.json

@@ -266,5 +266,6 @@
   "privilege.allows.audit.query": "全ユーザーのログイン、権限の使用と拒否、ロール変更の記録を見ることができます。",
   "task.auth-base.audit-reading.name": "監査ログの閲覧",
   "task.auth-base.audit-reading.description": "全ユーザーのログイン、権限の使用と拒否、ロール変更の記録を読む。",
-  "error.access-request-task-mismatch": "選んだ業務に拒否された権限が含まれていません。"
+  "error.access-request-task-mismatch": "選んだ業務に拒否された権限が含まれていません。",
+  "error.identity confirmation required": "本人確認が必要です。"
 }

package/translations/ko.json

@@ -266,5 +266,6 @@
   "privilege.allows.audit.query": "모든 사용자의 로그인, 권한 사용과 거절, 역할 변경 기록을 볼 수 있습니다.",
   "task.auth-base.audit-reading.name": "감사 기록 열람",
   "task.auth-base.audit-reading.description": "모든 사용자의 로그인, 권한 사용과 거절, 역할 변경 기록을 읽는다.",
-  "error.access-request-task-mismatch": "선택한 업무에 접근이 거부된 권한이 포함되어 있지 않습니다."
+  "error.access-request-task-mismatch": "선택한 업무에 접근이 거부된 권한이 포함되어 있지 않습니다.",
+  "error.identity confirmation required": "본인 확인이 필요합니다."
 }

package/translations/ms.json

@@ -266,5 +266,6 @@
   "privilege.allows.audit.query": "boleh melihat log masuk, penggunaan dan penolakan keistimewaan, serta perubahan peranan semua orang.",
   "task.auth-base.audit-reading.name": "Membaca log audit",
   "task.auth-base.audit-reading.description": "Membaca log masuk, penggunaan dan penolakan keistimewaan, serta perubahan peranan semua orang dalam domain.",
-  "error.access-request-task-mismatch": "tugas yang dipilih tidak termasuk keistimewaan yang ditolak."
+  "error.access-request-task-mismatch": "tugas yang dipilih tidak termasuk keistimewaan yang ditolak.",
+  "error.identity confirmation required": "sahkan ini anda untuk melihat ini"
 }

package/translations/zh.json

@@ -266,5 +266,6 @@
   "privilege.allows.audit.query": "可以查看所有用户的登录、权限使用与拒绝以及角色变更记录。",
   "task.auth-base.audit-reading.name": "查看审计日志",
   "task.auth-base.audit-reading.description": "读取所有用户的登录、权限使用与拒绝以及角色变更记录。",
-  "error.access-request-task-mismatch": "所选业务不包含被拒绝的权限。"
+  "error.access-request-task-mismatch": "所选业务不包含被拒绝的权限。",
+  "error.identity confirmation required": "需要确认身份。"
 }