@things-factory/auth-base 10.1.228 → 10.1.232

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@things-factory/auth-base",
-  "version": "10.1.228",
+  "version": "10.1.232",
   "main": "dist-server/index.js",
   "browser": "dist-client/index.js",
   "things-factory": true,
@@ -50,5 +50,5 @@
     "passport-jwt": "^4.0.0",
     "passport-local": "^1.0.0"
   },
-  "gitHead": "fc4ede44617418df8701e83b83d177db4142a8f3"
+  "gitHead": "9307e1db833f13018e3f0ca9b1050f947cbefd68"
 }

package/tests/declare-privileges.test.ts

@@ -0,0 +1,29 @@
+/**
+ * A privilege asked in code only - an issued document kind's rule (ADR-0176) - is declared with `declarePrivileges`, so
+ * the sync makes its rows and a role task naming it can be applied. 10.1.81 asked `employee-certificate` with
+ * `checkPermission` alone; no row was ever made and the template naming it was refused (2026-10-30).
+ */
+import { loadCompiled } from './compiled'
+
+const { declarePrivileges } = loadCompiled('service/privilege/privilege-directive')
+const { undeclaredTaskGrants } = loadCompiled('service/role-template/role-task')
+
+describe('declarePrivileges', () => {
+  it('declares the pairs, so a task naming them is whole', () => {
+    declarePrivileges('test kind', [
+      ['test-certificate', 'query'],
+      ['test-certificate', 'mutation']
+    ])
+    expect(process['PRIVILEGES']['test-certificate query']).toEqual(['test-certificate', 'query'])
+    expect(undeclaredTaskGrants({ id: 'test.issuing', grants: [{ category: 'test-certificate', axes: ['query', 'mutation'] }] })).toEqual([])
+  })
+
+  it('refuses an axis the installation does not declare, as @privilege does', () => {
+    expect(() => declarePrivileges('test kind', [['test-certificate', 'mutaiton']])).toThrow(/axis "mutaiton"/)
+    expect(process['PRIVILEGES']['test-certificate mutaiton']).toBeUndefined()
+  })
+
+  it('refuses an empty category', () => {
+    expect(() => declarePrivileges('test kind', [['', 'query']])).toThrow(/empty/)
+  })
+})

package/tests/open-fields-framework.test.ts

@@ -43,7 +43,7 @@ const PACKAGES = join(__dirname, '..', '..')
  * 2026-09-24: auth-base only. The generator below writes the rest; running it for the framework is
  * the next step of §8 step 1 and was held back from the 10.1.38 cut so it could be verified first.
  */
-const OPTED_IN = ['auth-base']
+const OPTED_IN = ['auth-base', 'pdf']
 
 /** Modules that cannot be measured here, and why. Adding one needs its reason. */
 const CANNOT_MEASURE: Record<string, string> = {