@things-factory/auth-base 10.1.278 → 10.1.280

package/spec/unit/checkin-domain.spec.ts

@@ -1,307 +0,0 @@
-/**
- * 체크인 자격 판정 — 실제 엔티티·실제 쿼리 검증.
- *
- * 보안 판정이므로 로직을 재현하지 않고, 빌드된 `@things-factory/auth-base` 의 실제 함수
- * (`getUserDomains` / `canUserCheckinDomain`)를 실제 엔티티 메타데이터(실제 조인 테이블·네이밍
- * 전략)로 만든 sqlite in-memory 스키마에 대해 그대로 실행한다.
- *
- * 주의: 이 스펙은 빌드 산출물(`dist-server`)을 대상으로 한다 — 소스를 고친 뒤에는
- * `npm run build:server` 를 먼저 실행해야 변경이 반영된다.
- */
-
-import { DataSource } from 'typeorm'
-
-import { NamingStrategy, addDataSource, entities as shellEntities, Domain } from '@things-factory/shell'
-import {
-  DomainOwner,
-  GrantedRole,
-  Role,
-  User,
-  canUserCheckinDomain,
-  entities as authEntities,
-  getUserDomains
-} from '@things-factory/auth-base'
-
-let dataSource: DataSource
-
-async function domain(name: string, parent?: Domain, owner?: string): Promise<Domain> {
-  return await dataSource.getRepository(Domain).save({
-    name,
-    subdomain: name,
-    parent,
-    owner
-  } as any)
-}
-
-async function user(name: string, domains: Domain[], roles: Role[] = []): Promise<User> {
-  return await dataSource.getRepository(User).save({
-    name,
-    email: `${name}@test.com`,
-    username: name,
-    domains,
-    roles
-  } as any)
-}
-
-async function role(name: string, roleDomain: Domain): Promise<Role> {
-  return await dataSource.getRepository(Role).save({ name, domain: roleDomain } as any)
-}
-
-/** 판정에 쓰이는 도메인은 `context.state.domain` 처럼 온전히 적재된 것이어야 한다. */
-async function reload(target: Domain): Promise<Domain> {
-  return await dataSource.getRepository(Domain).findOneBy({ id: target.id })
-}
-
-async function reloadUser(target: User): Promise<User> {
-  return await dataSource.getRepository(User).findOne({ where: { id: target.id }, relations: ['domains'] })
-}
-
-async function checkinSubdomains(target: User): Promise<string[]> {
-  return (await getUserDomains(await reloadUser(target))).map(d => d.subdomain)
-}
-
-beforeAll(async () => {
-  dataSource = new DataSource({
-    type: 'sqlite',
-    database: ':memory:',
-    synchronize: true,
-    dropSchema: true,
-    namingStrategy: new NamingStrategy(),
-    entities: [...shellEntities, ...authEntities],
-    logging: false
-  })
-
-  await dataSource.initialize()
-  addDataSource('default', dataSource)
-})
-
-afterAll(async () => {
-  await dataSource?.destroy()
-})
-
-beforeEach(async () => {
-  /* 스펙 간 격리 — 테이블 이름은 엔티티 메타데이터에서 얻는다 (네이밍 전략에 의존하지 않기 위해). */
-  for (const junction of dataSource.entityMetadatas.filter(metadata => metadata.isJunction)) {
-    await dataSource.query(`DELETE FROM "${junction.tableName}"`)
-  }
-
-  for (const target of [GrantedRole, DomainOwner, Role, User, Domain]) {
-    await dataSource.query(`DELETE FROM "${dataSource.getMetadata(target).tableName}"`)
-  }
-})
-
-describe('부모 도메인으로부터 상속받은 역할', () => {
-  it('부여가 일어난 자식 도메인에 체크인할 수 있다', async () => {
-    const parent = await domain('parent')
-    const child = await domain('child', parent)
-    const inheritedRole = await role('operator', parent)
-    const member = await user('kim', [child], [inheritedRole])
-
-    expect(await canUserCheckinDomain(await reloadUser(member), await reload(child))).toBe(true)
-    expect(await checkinSubdomains(member)).toEqual(['child'])
-  })
-
-  it('역할을 정의한 부모 도메인에는 체크인할 수 없다', async () => {
-    const parent = await domain('parent')
-    const child = await domain('child', parent)
-    const inheritedRole = await role('operator', parent)
-    const member = await user('kim', [child], [inheritedRole])
-
-    expect(await canUserCheckinDomain(await reloadUser(member), await reload(parent))).toBe(false)
-    expect(await checkinSubdomains(member)).not.toContain('parent')
-  })
-
-  it('멤버가 아닌 형제 자식 도메인에는 체크인할 수 없다', async () => {
-    const parent = await domain('parent')
-    const child = await domain('child', parent)
-    const sibling = await domain('sibling', parent)
-    const inheritedRole = await role('operator', parent)
-    const member = await user('kim', [child], [inheritedRole])
-
-    expect(await canUserCheckinDomain(await reloadUser(member), await reload(sibling))).toBe(false)
-    expect(await checkinSubdomains(member)).toEqual(['child'])
-  })
-
-  it('부모의 역할을 부모에서 부여받았다면 부모에 체크인한다', async () => {
-    const parent = await domain('parent')
-    const child = await domain('child', parent)
-    const parentRole = await role('operator', parent)
-    const member = await user('kim', [parent], [parentRole])
-
-    expect(await canUserCheckinDomain(await reloadUser(member), await reload(parent))).toBe(true)
-    expect(await canUserCheckinDomain(await reloadUser(member), await reload(child))).toBe(false)
-  })
-})
-
-describe('자기 도메인에 정의된 역할', () => {
-  it('멤버이고 역할이 있으면 체크인한다', async () => {
-    const target = await domain('acme')
-    const ownRole = await role('operator', target)
-    const member = await user('kim', [target], [ownRole])
-
-    expect(await canUserCheckinDomain(await reloadUser(member), await reload(target))).toBe(true)
-  })
-
-  it('멤버이지만 역할이 없으면 체크인하지 못한다', async () => {
-    const target = await domain('acme')
-    const member = await user('kim', [target], [])
-
-    expect(await canUserCheckinDomain(await reloadUser(member), await reload(target))).toBe(false)
-    expect(await checkinSubdomains(member)).toEqual([])
-  })
-
-  it('역할이 있지만 멤버가 아니면 체크인하지 못한다', async () => {
-    const target = await domain('acme')
-    const outsideRole = await role('operator', target)
-    const outsider = await user('lee', [], [outsideRole])
-
-    expect(await canUserCheckinDomain(await reloadUser(outsider), await reload(target))).toBe(false)
-    expect(await checkinSubdomains(outsider)).toEqual([])
-  })
-})
-
-describe('파트너십으로 grant 된 역할', () => {
-  it('공급자 도메인의 멤버가 아니어도 체크인한다', async () => {
-    const supplier = await domain('supplier')
-    const customer = await domain('customer')
-    const supplierRole = await role('carrier', supplier)
-    await dataSource.getRepository(GrantedRole).save({ role: supplierRole, domain: customer } as any)
-
-    const customerUser = await user('park', [customer], [supplierRole])
-
-    expect(await canUserCheckinDomain(await reloadUser(customerUser), await reload(supplier))).toBe(true)
-    expect((await checkinSubdomains(customerUser)).sort()).toEqual(['supplier'])
-  })
-
-  it('grant 되지 않은 역할은 파트너 경로를 열지 않는다', async () => {
-    const supplier = await domain('supplier')
-    const customer = await domain('customer')
-    const supplierRole = await role('carrier', supplier)
-
-    const customerUser = await user('park', [customer], [supplierRole])
-
-    expect(await canUserCheckinDomain(await reloadUser(customerUser), await reload(supplier))).toBe(false)
-  })
-
-  it('다른 도메인에 grant 된 역할은 근거가 되지 않는다', async () => {
-    const supplier = await domain('supplier')
-    const customer = await domain('customer')
-    const stranger = await domain('stranger')
-    const supplierRole = await role('carrier', supplier)
-    await dataSource.getRepository(GrantedRole).save({ role: supplierRole, domain: stranger } as any)
-
-    const customerUser = await user('park', [customer], [supplierRole])
-
-    expect(await canUserCheckinDomain(await reloadUser(customerUser), await reload(supplier))).toBe(false)
-  })
-})
-
-describe('소유권', () => {
-  it('하위 호환 owner 컬럼으로 체크인한다', async () => {
-    const target = await domain('acme')
-    const owner = await user('boss', [])
-    await dataSource.getRepository(Domain).update(target.id, { owner: owner.id })
-
-    expect(await canUserCheckinDomain(await reloadUser(owner), await reload(target))).toBe(true)
-    expect(await checkinSubdomains(owner)).toEqual(['acme'])
-  })
-
-  it('DomainOwner 테이블 기준으로도 체크인한다', async () => {
-    const target = await domain('acme')
-    const owner = await user('boss', [])
-    await dataSource.getRepository(DomainOwner).save({ domain: target, user: owner } as any)
-
-    expect(await canUserCheckinDomain(await reloadUser(owner), await reload(target))).toBe(true)
-    expect(await checkinSubdomains(owner)).toEqual(['acme'])
-  })
-
-  it('다른 사용자가 owner 인 도메인은 체크인하지 못한다', async () => {
-    const target = await domain('acme')
-    const owner = await user('boss', [])
-    const other = await user('lee', [])
-    await dataSource.getRepository(Domain).update(target.id, { owner: owner.id })
-
-    expect(await canUserCheckinDomain(await reloadUser(other), await reload(target))).toBe(false)
-  })
-})
-
-describe('핫패스 조회 비용', () => {
-  /**
-   * `canUserCheckinDomain` 은 매 요청 도메인 인증에서 호출된다. 도메인 목록 전체를 계산하지
-   * 않고 대상 도메인만 판정하도록 되어 있는데, 이 성질이 깨지면 요청당 비용이 늘어난다.
-   */
-  async function countQueries(work: () => Promise<unknown>): Promise<number> {
-    let count = 0
-    const original = (dataSource as any).logger
-
-    ;(dataSource as any).logger = {
-      logQuery: () => {
-        count++
-      },
-      logQueryError: () => {},
-      logQuerySlow: () => {},
-      logSchemaBuild: () => {},
-      logMigration: () => {},
-      log: () => {}
-    }
-
-    try {
-      await work()
-    } finally {
-      ;(dataSource as any).logger = original
-    }
-
-    return count
-  }
-
-  it('통과 판정은 1회 조회로 끝난다', async () => {
-    const parent = await domain('parent')
-    const child = await domain('child', parent)
-    const inheritedRole = await role('operator', parent)
-    const member = await user('kim', [child], [inheritedRole])
-
-    const loadedUser = await reloadUser(member)
-    const loadedDomain = await reload(child)
-
-    expect(await countQueries(() => canUserCheckinDomain(loadedUser, loadedDomain))).toBe(1)
-  })
-
-  it('목록 계산은 4회 조회로 끝난다 (경로별 조회가 도메인 행을 직접 반환한다)', async () => {
-    const parent = await domain('parent')
-    const child = await domain('child', parent)
-    const inheritedRole = await role('operator', parent)
-    const member = await user('kim', [child], [inheritedRole])
-
-    const loadedUser = await reloadUser(member)
-
-    expect(await countQueries(() => getUserDomains(loadedUser))).toBe(4)
-  })
-
-  it('거절 판정도 3회를 넘지 않는다', async () => {
-    const target = await domain('acme')
-    const outsider = await user('lee', [], [])
-
-    const loadedUser = await reloadUser(outsider)
-    const loadedDomain = await reload(target)
-
-    expect(await countQueries(() => canUserCheckinDomain(loadedUser, loadedDomain))).toBeLessThanOrEqual(3)
-  })
-})
-
-describe('여러 도메인이 얽힌 목록 계산', () => {
-  it('부여받은 도메인만 목록에 담는다', async () => {
-    const parent = await domain('parent')
-    const childA = await domain('child-a', parent)
-    const childB = await domain('child-b', parent)
-    const other = await domain('other')
-
-    const inheritedRole = await role('operator', parent)
-    const childBRole = await role('viewer', childB)
-    await role('unassigned', other)
-
-    /* childA: 상속 역할 부여 / childB: 자기 역할 부여 / other: 멤버이지만 역할 없음 */
-    const member = await user('kim', [childA, childB, other], [inheritedRole, childBRole])
-
-    expect((await checkinSubdomains(member)).sort()).toEqual(['child-a', 'child-b'])
-  })
-})

package/spec/unit/checkin-privilege.spec.ts

@@ -1,205 +0,0 @@
-/**
- * 권한 판정의 도메인 상속 — 실제 엔티티·실제 쿼리 검증.
- *
- * 역할은 부모 도메인으로부터 상속되므로, 상속 역할을 부여받아 자식 도메인에 체크인한 사용자는
- * 그 역할의 권한을 자식 도메인에서 행사할 수 있어야 한다. 체크인만 열리고 권한이 0 이면
- * 상속 부여는 무의미하다.
- *
- * 주의: 이 스펙은 빌드 산출물(`dist-server`)을 대상으로 한다.
- */
-
-import { DataSource } from 'typeorm'
-
-import { NamingStrategy, addDataSource, entities as shellEntities, Domain } from '@things-factory/shell'
-import {
-  DomainOwner,
-  Privilege,
-  Role,
-  User,
-  entities as authEntities,
-  getDomainsWithPrivilege
-} from '@things-factory/auth-base'
-
-let dataSource: DataSource
-
-async function domain(name: string, parent?: Domain): Promise<Domain> {
-  return await dataSource.getRepository(Domain).save({ name, subdomain: name, parent } as any)
-}
-
-async function privilege(name: string, category: string): Promise<Privilege> {
-  return await dataSource.getRepository(Privilege).save({ name, category } as any)
-}
-
-async function role(name: string, roleDomain: Domain, privileges: Privilege[]): Promise<Role> {
-  return await dataSource.getRepository(Role).save({ name, domain: roleDomain, privileges } as any)
-}
-
-async function user(name: string, domains: Domain[], roles: Role[]): Promise<User> {
-  return await dataSource.getRepository(User).save({
-    name,
-    email: `${name}@test.com`,
-    username: name,
-    domains,
-    roles
-  } as any)
-}
-
-async function reload(target: Domain): Promise<Domain> {
-  return await dataSource.getRepository(Domain).findOneBy({ id: target.id })
-}
-
-async function reloadUser(target: User): Promise<User> {
-  return await dataSource.getRepository(User).findOne({ where: { id: target.id }, relations: ['domains'] })
-}
-
-beforeAll(async () => {
-  dataSource = new DataSource({
-    type: 'sqlite',
-    database: ':memory:',
-    synchronize: true,
-    dropSchema: true,
-    namingStrategy: new NamingStrategy(),
-    entities: [...shellEntities, ...authEntities],
-    logging: false
-  })
-
-  await dataSource.initialize()
-  addDataSource('default', dataSource)
-})
-
-afterAll(async () => {
-  await dataSource?.destroy()
-})
-
-beforeEach(async () => {
-  for (const junction of dataSource.entityMetadatas.filter(metadata => metadata.isJunction)) {
-    await dataSource.query(`DELETE FROM "${junction.tableName}"`)
-  }
-
-  for (const target of [DomainOwner, Role, Privilege, User, Domain]) {
-    await dataSource.query(`DELETE FROM "${dataSource.getMetadata(target).tableName}"`)
-  }
-})
-
-describe('User.hasPrivilege — 도메인 상속', () => {
-  it('자기 도메인에 정의된 역할의 권한을 행사한다', async () => {
-    const target = await domain('acme')
-    const query = await privilege('query', 'board')
-    const operator = await role('operator', target, [query])
-    const member = await user('kim', [target], [operator])
-
-    expect(await User.hasPrivilege('query', 'board', await reload(target), member)).toBe(true)
-  })
-
-  it('부모 도메인에 정의된 상속 역할의 권한을 자식 도메인에서 행사한다', async () => {
-    const parent = await domain('parent')
-    const child = await domain('child', parent)
-    const query = await privilege('query', 'board')
-    const inherited = await role('operator', parent, [query])
-    const member = await user('kim', [child], [inherited])
-
-    expect(await User.hasPrivilege('query', 'board', await reload(child), member)).toBe(true)
-  })
-
-  it('무관한 도메인에 정의된 역할의 권한은 행사하지 못한다', async () => {
-    const target = await domain('acme')
-    const other = await domain('other')
-    const query = await privilege('query', 'board')
-    const otherRole = await role('operator', other, [query])
-    const member = await user('kim', [target], [otherRole])
-
-    expect(await User.hasPrivilege('query', 'board', await reload(target), member)).toBe(false)
-  })
-
-  it('역할이 갖지 않은 권한은 행사하지 못한다', async () => {
-    const parent = await domain('parent')
-    const child = await domain('child', parent)
-    const query = await privilege('query', 'board')
-    await privilege('mutation', 'board')
-    const inherited = await role('viewer', parent, [query])
-    const member = await user('kim', [child], [inherited])
-
-    expect(await User.hasPrivilege('mutation', 'board', await reload(child), member)).toBe(false)
-  })
-
-  it('조부모 도메인의 역할까지 거슬러 올라가지는 않는다 (상속은 1단)', async () => {
-    const grandParent = await domain('grand')
-    const parent = await domain('parent', grandParent)
-    const child = await domain('child', parent)
-    const query = await privilege('query', 'board')
-    const grandRole = await role('operator', grandParent, [query])
-    const member = await user('kim', [child], [grandRole])
-
-    expect(await User.hasPrivilege('query', 'board', await reload(child), member)).toBe(false)
-  })
-})
-
-describe('User.getPrivilegesByDomain — 도메인 상속', () => {
-  it('상속 역할의 권한이 목록에 포함된다', async () => {
-    const parent = await domain('parent')
-    const child = await domain('child', parent)
-    const inheritedPrivilege = await privilege('query', 'board')
-    const ownPrivilege = await privilege('mutation', 'worklist')
-    const inherited = await role('operator', parent, [inheritedPrivilege])
-    const own = await role('editor', child, [ownPrivilege])
-    const member = await user('kim', [child], [inherited, own])
-
-    const privileges = await User.getPrivilegesByDomain(member, await reload(child))
-
-    expect(privileges).toEqual(
-      expect.arrayContaining([
-        { category: 'board', privilege: 'query' },
-        { category: 'worklist', privilege: 'mutation' }
-      ])
-    )
-  })
-
-  it('무관한 도메인 역할의 권한은 목록에서 제외된다', async () => {
-    const target = await domain('acme')
-    const other = await domain('other')
-    const otherPrivilege = await privilege('query', 'secret')
-    const otherRole = await role('operator', other, [otherPrivilege])
-    const member = await user('kim', [target, other], [otherRole])
-
-    const privileges = await User.getPrivilegesByDomain(member, await reload(target))
-
-    expect(privileges).toEqual([])
-  })
-})
-
-describe('getDomainsWithPrivilege — 부여 도메인 + 상속', () => {
-  it('상속 역할로 권한을 가진 자식 도메인을 반환한다', async () => {
-    const parent = await domain('parent')
-    const child = await domain('child', parent)
-    const query = await privilege('query', 'board')
-    const inherited = await role('operator', parent, [query])
-    const member = await user('kim', [child], [inherited])
-
-    const domains = await getDomainsWithPrivilege(await reloadUser(member), 'query', 'board')
-
-    expect(domains.map(d => d.subdomain)).toEqual(['child'])
-  })
-
-  it('권한 없는 역할만 부여된 도메인은 제외한다', async () => {
-    const withPrivilege = await domain('with')
-    const without = await domain('without')
-    const query = await privilege('query', 'board')
-    const granted = await role('operator', withPrivilege, [query])
-    const plain = await role('guest', without, [])
-    const member = await user('kim', [withPrivilege, without], [granted, plain])
-
-    const domains = await getDomainsWithPrivilege(await reloadUser(member), 'query', 'board')
-
-    expect(domains.map(d => d.subdomain)).toEqual(['with'])
-  })
-
-  it('소유 도메인은 권한 판정 없이 포함한다', async () => {
-    const owned = await domain('owned')
-    const owner = await user('boss', [], [])
-    await dataSource.getRepository(Domain).update(owned.id, { owner: owner.id })
-
-    const domains = await getDomainsWithPrivilege(await reloadUser(owner), 'query', 'board')
-
-    expect(domains.map(d => d.subdomain)).toEqual(['owned'])
-  })
-})

package/spec/unit/domain-owner-entity.spec.ts

@@ -1,179 +0,0 @@
-/**
- * DomainOwner Entity Tests
- *
- * DomainOwner 엔티티의 저장/조회/유니크 제약/캐스케이드 테스트.
- * EntitySchema 기반 테스트 DB를 사용하므로 실제 @things-factory/shell 의
- * Domain/User 엔티티 대신 테스트 전용 스키마를 사용한다.
- */
-
-import { TestDatabase } from '../../../../test/test-database'
-import { withTestTransaction } from '../../../../test/test-context'
-import {
-  domainFactory,
-  userFactory,
-  domainOwnerFactory
-} from '../../../../test/factories'
-import { DomainOwner } from '../../../../test/entities/schemas'
-
-describe('DomainOwner Entity', () => {
-  let testDb: TestDatabase
-
-  beforeAll(() => {
-    testDb = TestDatabase.getInstance()
-  })
-
-  describe('생성', () => {
-    it('기본 DomainOwner 엔트리를 저장할 수 있다', async () => {
-      await withTestTransaction(async context => {
-        const { tx } = context.state
-
-        const domain = await domainFactory.create({}, tx)
-        const user = await userFactory.create({}, tx)
-
-        const entry = await domainOwnerFactory.grant(domain, user, {}, tx)
-
-        expect(entry.id).toBeDefined()
-        expect(entry.grantedAt).toBeInstanceOf(Date)
-      })
-    })
-
-    it('grantedBy (부여자) 감사 정보를 저장한다', async () => {
-      await withTestTransaction(async context => {
-        const { tx } = context.state
-
-        const domain = await domainFactory.create({}, tx)
-        const newOwner = await userFactory.create({ name: 'Alice' }, tx)
-        const granter = await userFactory.create({ name: 'Bob the Admin' }, tx)
-
-        const entry = await domainOwnerFactory.grantBy(
-          domain,
-          newOwner,
-          granter,
-          { reason: 'initial setup' },
-          tx
-        )
-
-        const reloaded = await tx.findOne<DomainOwner>('DomainOwner', {
-          where: { id: entry.id },
-          relations: ['user', 'grantedBy', 'domain']
-        })
-
-        expect(reloaded?.user.id).toBe(newOwner.id)
-        expect(reloaded?.grantedBy?.id).toBe(granter.id)
-        expect(reloaded?.domain.id).toBe(domain.id)
-        expect(reloaded?.reason).toBe('initial setup')
-      })
-    })
-
-    it('reason 은 선택(null)적이다', async () => {
-      await withTestTransaction(async context => {
-        const { tx } = context.state
-
-        const domain = await domainFactory.create({}, tx)
-        const user = await userFactory.create({}, tx)
-
-        const entry = await domainOwnerFactory.grant(domain, user, { reason: null as any }, tx)
-
-        expect(entry.id).toBeDefined()
-      })
-    })
-  })
-
-  describe('유니크 제약', () => {
-    it('같은 (domain, user) 조합은 중복 삽입할 수 없다', async () => {
-      await withTestTransaction(async context => {
-        const { tx } = context.state
-
-        const domain = await domainFactory.create({}, tx)
-        const user = await userFactory.create({}, tx)
-
-        await domainOwnerFactory.grant(domain, user, {}, tx)
-
-        await expect(
-          domainOwnerFactory.grant(domain, user, { reason: 'duplicate' }, tx)
-        ).rejects.toThrow()
-      })
-    })
-
-    it('같은 user는 서로 다른 domain에는 owner로 등록 가능하다', async () => {
-      await withTestTransaction(async context => {
-        const { tx } = context.state
-
-        const domainA = await domainFactory.create({ name: 'A' }, tx)
-        const domainB = await domainFactory.create({ name: 'B' }, tx)
-        const user = await userFactory.create({}, tx)
-
-        const a = await domainOwnerFactory.grant(domainA, user, {}, tx)
-        const b = await domainOwnerFactory.grant(domainB, user, {}, tx)
-
-        expect(a.id).not.toBe(b.id)
-      })
-    })
-
-    it('같은 domain에 여러 user가 owner로 등록 가능하다 (멀티 오너)', async () => {
-      await withTestTransaction(async context => {
-        const { tx } = context.state
-
-        const domain = await domainFactory.create({}, tx)
-        const u1 = await userFactory.create({ name: 'U1' }, tx)
-        const u2 = await userFactory.create({ name: 'U2' }, tx)
-        const u3 = await userFactory.create({ name: 'U3' }, tx)
-
-        await domainOwnerFactory.grant(domain, u1, {}, tx)
-        await domainOwnerFactory.grant(domain, u2, {}, tx)
-        await domainOwnerFactory.grant(domain, u3, {}, tx)
-
-        const count = await tx.count('DomainOwner', {
-          where: { domain: { id: domain.id } }
-        })
-        expect(count).toBe(3)
-      })
-    })
-  })
-
-  describe('CASCADE on delete', () => {
-    it('User 삭제 시 관련 DomainOwner 엔트리가 자동 제거된다', async () => {
-      // 트랜잭션 밖에서 실행 — CASCADE 동작이 FK 제약에 달려있고
-      // sqlite 트랜잭션 롤백에서 깔끔하게 관측하기 어려움.
-      const ds = testDb.getDataSource()
-
-      const domain = await domainFactory.create({ name: 'cascade-user' })
-      const user = await userFactory.create({ name: 'to-delete' })
-      const entry = await domainOwnerFactory.grant(domain, user)
-
-      expect(
-        await ds.manager.count('DomainOwner', { where: { id: entry.id } })
-      ).toBe(1)
-
-      await ds.manager.delete('User', { id: user.id })
-
-      expect(
-        await ds.manager.count('DomainOwner', { where: { id: entry.id } })
-      ).toBe(0)
-    })
-
-    it('Domain 삭제 시 관련 DomainOwner 엔트리가 자동 제거된다', async () => {
-      const ds = testDb.getDataSource()
-
-      const domain = await domainFactory.create({ name: 'cascade-domain' })
-      const u1 = await userFactory.create({ name: 'co-owner-1' })
-      const u2 = await userFactory.create({ name: 'co-owner-2' })
-      await domainOwnerFactory.grant(domain, u1)
-      await domainOwnerFactory.grant(domain, u2)
-
-      expect(
-        await ds.manager.count('DomainOwner', {
-          where: { domain: { id: domain.id } }
-        })
-      ).toBe(2)
-
-      await ds.manager.delete('Domain', { id: domain.id })
-
-      expect(
-        await ds.manager.count('DomainOwner', {
-          where: { domain: { id: domain.id } }
-        })
-      ).toBe(0)
-    })
-  })
-})