@things-factory/auth-base 10.1.278 → 10.1.280

package/spec/unit/domain-owner-mutation.spec.ts

@@ -1,337 +0,0 @@
-/**
- * DomainOwner Mutation 로직 테스트
- *
- * addDomainOwner / removeDomainOwner mutation 의 핵심 비즈니스 로직
- * (멤버 확인, 중복 방지, 마지막 오너 보호, legacy cache 동기화)을
- * 테스트 엔티티 스키마로 재현해 검증한다.
- */
-
-import { EntityManager } from 'typeorm'
-import { TestDatabase } from '../../../../test/test-database'
-import {
-  domainFactory,
-  userFactory,
-  domainOwnerFactory
-} from '../../../../test/factories'
-import { Domain, DomainOwner, User } from '../../../../test/entities/schemas'
-
-// ============================================================
-// 테스트용 헬퍼: source 로직을 테스트 스키마로 재현
-// ============================================================
-
-/**
- * addDomainOwner 의 핵심 로직
- * - 대상 유저가 domain 멤버인지 확인
- * - 이미 owner인지 확인
- * - 엔트리 생성
- * - Domain.owner 캐시가 비어있으면 세팅
- */
-async function addDomainOwnerLogic(
-  manager: EntityManager,
-  domain: Domain,
-  targetUser: User,
-  actor: User,
-  options: { isMember: boolean; reason?: string }
-): Promise<DomainOwner> {
-  if (!options.isMember) {
-    throw new Error(`User '${targetUser.name}' is not a member of this domain.`)
-  }
-
-  const ownerRepo = manager.getRepository<DomainOwner>('DomainOwner')
-
-  const existing = await ownerRepo.findOne({
-    where: { domain: { id: domain.id }, user: { id: targetUser.id } }
-  })
-  if (existing) {
-    throw new Error(`User '${targetUser.name}' is already an owner of this domain.`)
-  }
-
-  const entry = ownerRepo.create({
-    domain: { id: domain.id } as Domain,
-    user: { id: targetUser.id } as User,
-    grantedBy: actor,
-    reason: options.reason
-  } as Partial<DomainOwner>)
-  const saved = await ownerRepo.save(entry)
-
-  if (!domain.owner) {
-    await manager.update('Domain', domain.id, { owner: targetUser.id })
-  }
-
-  return saved
-}
-
-/**
- * removeDomainOwner 의 핵심 로직
- * - 대상 유저의 엔트리 혹은 legacy owner 여부 확인
- * - 남을 owner가 1명 이상 보장
- * - legacy cache가 제거 대상이면 남은 오너 중 하나로 재설정
- */
-async function removeDomainOwnerLogic(
-  manager: EntityManager,
-  domain: Domain,
-  targetUser: User
-): Promise<boolean> {
-  const ownerRepo = manager.getRepository<DomainOwner>('DomainOwner')
-
-  const entry = await ownerRepo.findOne({
-    where: { domain: { id: domain.id }, user: { id: targetUser.id } }
-  })
-  const hasLegacyOwner = domain.owner === targetUser.id
-
-  if (!entry && !hasLegacyOwner) {
-    throw new Error(`User '${targetUser.name}' is not an owner of this domain.`)
-  }
-
-  const ownerCount = await ownerRepo.count({
-    where: { domain: { id: domain.id } }
-  })
-
-  let remaining = ownerCount
-  if (entry) remaining -= 1
-  if (domain.owner && domain.owner !== targetUser.id) {
-    const legacyInTable = await ownerRepo.findOne({
-      where: { domain: { id: domain.id }, user: { id: domain.owner } }
-    })
-    if (!legacyInTable) remaining += 1
-  }
-
-  if (remaining < 1) {
-    throw new Error('Cannot remove the last owner of a domain. Add another owner first.')
-  }
-
-  if (entry) {
-    await ownerRepo.delete(entry.id)
-  }
-
-  if (hasLegacyOwner) {
-    const next = await ownerRepo.findOne({
-      where: { domain: { id: domain.id } },
-      order: { grantedAt: 'ASC' }
-    })
-    const nextOwnerId = next
-      ? (await manager.findOne<DomainOwner>('DomainOwner', {
-          where: { id: next.id },
-          relations: ['user']
-        }))?.user.id ?? null
-      : null
-    await manager.update('Domain', domain.id, { owner: nextOwnerId })
-  }
-
-  return true
-}
-
-// ============================================================
-// 테스트
-// ============================================================
-
-describe('addDomainOwner 로직', () => {
-  let testDb: TestDatabase
-
-  beforeAll(() => {
-    testDb = TestDatabase.getInstance()
-  })
-
-  it('도메인 멤버를 owner로 추가할 수 있다', async () => {
-    const ds = testDb.getDataSource()
-    const domain = await domainFactory.create({})
-    const actor = await userFactory.create({ name: 'actor' })
-    const target = await userFactory.create({ name: 'target' })
-
-    const entry = await addDomainOwnerLogic(ds.manager, domain, target, actor, {
-      isMember: true
-    })
-
-    expect(entry.id).toBeDefined()
-
-    const reloaded = await ds.manager.findOne<DomainOwner>('DomainOwner', {
-      where: { id: entry.id },
-      relations: ['user', 'grantedBy']
-    })
-    expect(reloaded?.user.id).toBe(target.id)
-    expect(reloaded?.grantedBy?.id).toBe(actor.id)
-  })
-
-  it('Domain.owner 캐시가 비어있으면 추가된 user로 세팅한다', async () => {
-    const ds = testDb.getDataSource()
-    const domain = await domainFactory.create({ owner: null as any })
-    const actor = await userFactory.create({ name: 'actor' })
-    const target = await userFactory.create({ name: 'target' })
-
-    await addDomainOwnerLogic(ds.manager, domain, target, actor, {
-      isMember: true
-    })
-
-    const reloadedDomain = await ds.manager.findOne<Domain>('Domain', {
-      where: { id: domain.id }
-    })
-    expect(reloadedDomain?.owner).toBe(target.id)
-  })
-
-  it('Domain.owner 캐시가 이미 있으면 덮어쓰지 않는다', async () => {
-    const ds = testDb.getDataSource()
-    const existingOwner = await userFactory.create({ name: 'existing' })
-    const domain = await domainFactory.create({ owner: existingOwner.id })
-    const actor = await userFactory.create({ name: 'actor' })
-    const target = await userFactory.create({ name: 'target' })
-
-    await addDomainOwnerLogic(ds.manager, domain, target, actor, {
-      isMember: true
-    })
-
-    const reloadedDomain = await ds.manager.findOne<Domain>('Domain', {
-      where: { id: domain.id }
-    })
-    expect(reloadedDomain?.owner).toBe(existingOwner.id)
-  })
-
-  it('도메인 비멤버는 owner로 추가할 수 없다', async () => {
-    const ds = testDb.getDataSource()
-    const domain = await domainFactory.create({})
-    const actor = await userFactory.create({ name: 'actor' })
-    const outsider = await userFactory.create({ name: 'outsider' })
-
-    await expect(
-      addDomainOwnerLogic(ds.manager, domain, outsider, actor, { isMember: false })
-    ).rejects.toThrow(/not a member/)
-  })
-
-  it('이미 owner인 user를 중복 추가할 수 없다', async () => {
-    const ds = testDb.getDataSource()
-    const domain = await domainFactory.create({})
-    const actor = await userFactory.create({ name: 'actor' })
-    const target = await userFactory.create({ name: 'target' })
-
-    await addDomainOwnerLogic(ds.manager, domain, target, actor, { isMember: true })
-
-    await expect(
-      addDomainOwnerLogic(ds.manager, domain, target, actor, { isMember: true })
-    ).rejects.toThrow(/already an owner/)
-  })
-})
-
-describe('removeDomainOwner 로직', () => {
-  let testDb: TestDatabase
-
-  beforeAll(() => {
-    testDb = TestDatabase.getInstance()
-  })
-
-  it('여러 owner 중 한 명을 제거할 수 있다', async () => {
-    const ds = testDb.getDataSource()
-    const domain = await domainFactory.create({})
-    const u1 = await userFactory.create({ name: 'U1' })
-    const u2 = await userFactory.create({ name: 'U2' })
-    await domainOwnerFactory.grant(domain, u1)
-    await domainOwnerFactory.grant(domain, u2)
-
-    const result = await removeDomainOwnerLogic(ds.manager, domain, u2)
-    expect(result).toBe(true)
-
-    const remaining = await ds.manager.count('DomainOwner', {
-      where: { domain: { id: domain.id } }
-    })
-    expect(remaining).toBe(1)
-  })
-
-  it('마지막 남은 owner는 제거할 수 없다 (최소 1명 유지)', async () => {
-    const ds = testDb.getDataSource()
-    const domain = await domainFactory.create({})
-    const soleOwner = await userFactory.create({ name: 'sole' })
-    await domainOwnerFactory.grant(domain, soleOwner)
-
-    await expect(
-      removeDomainOwnerLogic(ds.manager, domain, soleOwner)
-    ).rejects.toThrow(/last owner/)
-  })
-
-  it('legacy cache 만 있고 join 테이블에 없어도 "owner"로 인정되어 제거 거부 (마지막 1인)', async () => {
-    const ds = testDb.getDataSource()
-    const legacyOwner = await userFactory.create({ name: 'legacy' })
-    const domain = await domainFactory.create({ owner: legacyOwner.id })
-    // join table 에 엔트리 없음
-
-    await expect(
-      removeDomainOwnerLogic(ds.manager, domain, legacyOwner)
-    ).rejects.toThrow(/last owner/)
-  })
-
-  it('legacy cache + 다른 오너가 join 테이블에 있으면 legacy 제거 가능', async () => {
-    const ds = testDb.getDataSource()
-    const legacyOwner = await userFactory.create({ name: 'legacy' })
-    const newOwner = await userFactory.create({ name: 'new' })
-    const domain = await domainFactory.create({ owner: legacyOwner.id })
-    await domainOwnerFactory.grant(domain, newOwner)
-
-    await removeDomainOwnerLogic(ds.manager, domain, legacyOwner)
-
-    const reloadedDomain = await ds.manager.findOne<Domain>('Domain', {
-      where: { id: domain.id }
-    })
-    // legacy cache 는 남은 오너(newOwner)로 재설정되어야 함
-    expect(reloadedDomain?.owner).toBe(newOwner.id)
-  })
-
-  it('legacy cache 대상 제거 시 남은 DomainOwner 중 한 명으로 cache 재설정', async () => {
-    const ds = testDb.getDataSource()
-    const u1 = await userFactory.create({ name: 'U1' })
-    const u2 = await userFactory.create({ name: 'U2' })
-    const u3 = await userFactory.create({ name: 'U3' })
-    const domain = await domainFactory.create({ owner: u1.id })
-    await domainOwnerFactory.grant(domain, u1)
-    await domainOwnerFactory.grant(domain, u2)
-    await domainOwnerFactory.grant(domain, u3)
-
-    await removeDomainOwnerLogic(ds.manager, domain, u1)
-
-    const reloadedDomain = await ds.manager.findOne<Domain>('Domain', {
-      where: { id: domain.id }
-    })
-    // SQLite datetime 은 초 단위 해상도라 grantedAt 이 동일할 수 있음 → 순서 비결정적.
-    // 핵심 불변조건: cache 는 u1 이 아니고, 남은 오너 (u2 또는 u3) 중 하나로 갱신됨.
-    expect(reloadedDomain?.owner).not.toBe(u1.id)
-    expect([u2.id, u3.id]).toContain(reloadedDomain?.owner)
-  })
-
-  it('owner가 아닌 user는 제거할 수 없다', async () => {
-    const ds = testDb.getDataSource()
-    const domain = await domainFactory.create({})
-    const owner = await userFactory.create({ name: 'owner' })
-    const other = await userFactory.create({ name: 'other' })
-    await domainOwnerFactory.grant(domain, owner)
-
-    await expect(
-      removeDomainOwnerLogic(ds.manager, domain, other)
-    ).rejects.toThrow(/not an owner/)
-  })
-
-  it('legacy cache 만 있는 마지막 오너 + 새 오너 추가 후에는 legacy 제거 가능', async () => {
-    const ds = testDb.getDataSource()
-    const legacy = await userFactory.create({ name: 'legacy' })
-    const domain = await domainFactory.create({ owner: legacy.id })
-    // 이 시점에서 legacy는 cache로만 유일한 owner → 제거 불가
-    await expect(
-      removeDomainOwnerLogic(ds.manager, domain, legacy)
-    ).rejects.toThrow(/last owner/)
-
-    // 새 오너를 추가하면
-    const newOwner = await userFactory.create({ name: 'new' })
-    const actor = await userFactory.create({ name: 'actor' })
-    await addDomainOwnerLogic(ds.manager, domain, newOwner, actor, { isMember: true })
-
-    // legacy를 제거할 수 있음 (remaining = legacy 1 + new 1 - 1 = 1)
-    // NOTE: addDomainOwnerLogic은 domain.owner가 이미 legacy.id 이므로 덮어쓰지 않음
-    // 따라서 domain 은 여전히 legacy.id 가 cache
-    const reloadedDomain = await ds.manager.findOne<Domain>('Domain', {
-      where: { id: domain.id }
-    })
-    expect(reloadedDomain!.owner).toBe(legacy.id)
-
-    await removeDomainOwnerLogic(ds.manager, reloadedDomain!, legacy)
-
-    const finalDomain = await ds.manager.findOne<Domain>('Domain', {
-      where: { id: domain.id }
-    })
-    expect(finalDomain?.owner).toBe(newOwner.id)
-  })
-})

package/spec/unit/domain-ownership.spec.ts

@@ -1,188 +0,0 @@
-/**
- * 도메인 소유권 판정 — 실제 엔티티·실제 쿼리 검증.
- *
- * 도메인 관리자는 여러 명일 수 있다(`DomainOwner` 테이블). `Domain.owner` 컬럼은 대표 오너
- * 표시용 캐시이므로, 도메인 범위의 판정은 두 경로를 함께 봐야 한다.
- *
- * 주의: 이 스펙은 빌드 산출물(`dist-server`)을 대상으로 한다.
- */
-
-import { DataSource } from 'typeorm'
-
-import { NamingStrategy, addDataSource, entities as shellEntities, Domain } from '@things-factory/shell'
-import {
-  DomainOwner,
-  User,
-  entities as authEntities,
-  findDomainOwnerUserIds,
-  isDomainOwner,
-  setPrimaryDomainOwner
-} from '@things-factory/auth-base'
-
-let dataSource: DataSource
-
-async function domain(name: string): Promise<Domain> {
-  return await dataSource.getRepository(Domain).save({ name, subdomain: name } as any)
-}
-
-async function usr(name: string): Promise<User> {
-  return await dataSource.getRepository(User).save({
-    name,
-    email: `${name}@test.com`,
-    username: name
-  } as any)
-}
-
-async function reload(target: Domain): Promise<Domain> {
-  return await dataSource.getRepository(Domain).findOneBy({ id: target.id })
-}
-
-async function ownerEntryCount(target: Domain): Promise<number> {
-  return await dataSource.getRepository(DomainOwner).count({ where: { domain: { id: target.id } } })
-}
-
-beforeAll(async () => {
-  dataSource = new DataSource({
-    type: 'sqlite',
-    database: ':memory:',
-    synchronize: true,
-    dropSchema: true,
-    namingStrategy: new NamingStrategy(),
-    entities: [...shellEntities, ...authEntities],
-    logging: false
-  })
-
-  await dataSource.initialize()
-  addDataSource('default', dataSource)
-})
-
-afterAll(async () => {
-  await dataSource?.destroy()
-})
-
-beforeEach(async () => {
-  for (const junction of dataSource.entityMetadatas.filter(metadata => metadata.isJunction)) {
-    await dataSource.query(`DELETE FROM "${junction.tableName}"`)
-  }
-
-  for (const target of [DomainOwner, User, Domain]) {
-    await dataSource.query(`DELETE FROM "${dataSource.getMetadata(target).tableName}"`)
-  }
-})
-
-describe('isDomainOwner', () => {
-  it('대표 오너 컬럼으로 인정한다', async () => {
-    const target = await domain('acme')
-    const owner = await usr('boss')
-    await dataSource.getRepository(Domain).update(target.id, { owner: owner.id })
-
-    expect(await isDomainOwner(await reload(target), owner)).toBe(true)
-  })
-
-  it('DomainOwner 테이블의 공동 오너도 인정한다', async () => {
-    const target = await domain('acme')
-    const primary = await usr('boss')
-    const coOwner = await usr('deputy')
-    await dataSource.getRepository(Domain).update(target.id, { owner: primary.id })
-    await dataSource.getRepository(DomainOwner).save({ domain: target, user: coOwner } as any)
-
-    expect(await isDomainOwner(await reload(target), coOwner)).toBe(true)
-  })
-
-  it('오너가 아닌 사용자는 인정하지 않는다', async () => {
-    const target = await domain('acme')
-    const owner = await usr('boss')
-    const other = await usr('lee')
-    await dataSource.getRepository(Domain).update(target.id, { owner: owner.id })
-
-    expect(await isDomainOwner(await reload(target), other)).toBe(false)
-  })
-
-  it('다른 도메인의 오너 엔트리는 인정하지 않는다', async () => {
-    const target = await domain('acme')
-    const another = await domain('other')
-    const coOwner = await usr('deputy')
-    await dataSource.getRepository(DomainOwner).save({ domain: another, user: coOwner } as any)
-
-    expect(await isDomainOwner(await reload(target), coOwner)).toBe(false)
-  })
-
-  it('도메인이나 사용자가 없으면 인정하지 않는다', async () => {
-    const target = await domain('acme')
-    const owner = await usr('boss')
-
-    expect(await isDomainOwner(null, owner)).toBe(false)
-    expect(await isDomainOwner(await reload(target), null)).toBe(false)
-  })
-})
-
-describe('findDomainOwnerUserIds', () => {
-  it('대표 오너와 공동 오너를 합쳐서 반환한다', async () => {
-    const target = await domain('acme')
-    const primary = await usr('boss')
-    const coOwner = await usr('deputy')
-    const plain = await usr('lee')
-    await dataSource.getRepository(Domain).update(target.id, { owner: primary.id })
-    await dataSource.getRepository(DomainOwner).save({ domain: target, user: coOwner } as any)
-
-    const ownerIds = await findDomainOwnerUserIds(await reload(target))
-
-    expect(ownerIds.has(primary.id)).toBe(true)
-    expect(ownerIds.has(coOwner.id)).toBe(true)
-    expect(ownerIds.has(plain.id)).toBe(false)
-    expect(ownerIds.size).toBe(2)
-  })
-
-  it('대표 오너가 테이블에도 있으면 중복 계산하지 않는다', async () => {
-    const target = await domain('acme')
-    const primary = await usr('boss')
-    await dataSource.getRepository(Domain).update(target.id, { owner: primary.id })
-    await dataSource.getRepository(DomainOwner).save({ domain: target, user: primary } as any)
-
-    expect((await findDomainOwnerUserIds(await reload(target))).size).toBe(1)
-  })
-})
-
-describe('setPrimaryDomainOwner', () => {
-  it('컬럼과 테이블을 함께 세팅한다', async () => {
-    const target = await domain('acme')
-    const owner = await usr('boss')
-
-    await setPrimaryDomainOwner(target, owner.id)
-
-    expect((await reload(target)).owner).toBe(owner.id)
-    expect(await ownerEntryCount(target)).toBe(1)
-    expect(await isDomainOwner(await reload(target), owner)).toBe(true)
-  })
-
-  it('기존 공동 오너 엔트리를 제거하지 않는다', async () => {
-    const target = await domain('acme')
-    const previous = await usr('boss')
-    const next = await usr('deputy')
-    await setPrimaryDomainOwner(target, previous.id)
-
-    await setPrimaryDomainOwner(target, next.id)
-
-    expect((await reload(target)).owner).toBe(next.id)
-    expect(await ownerEntryCount(target)).toBe(2)
-    /* 이관 후에도 이전 오너는 공동 오너로 남는다 — 제거는 removeDomainOwner 의 책임. */
-    expect(await isDomainOwner(await reload(target), previous)).toBe(true)
-  })
-
-  it('같은 오너를 다시 지정해도 엔트리를 중복 생성하지 않는다', async () => {
-    const target = await domain('acme')
-    const owner = await usr('boss')
-
-    await setPrimaryDomainOwner(target, owner.id)
-    await setPrimaryDomainOwner(target, owner.id)
-
-    expect(await ownerEntryCount(target)).toBe(1)
-  })
-
-  it('도메인이나 사용자가 없으면 명시적으로 실패한다', async () => {
-    const target = await domain('acme')
-
-    await expect(setPrimaryDomainOwner(target, '')).rejects.toThrow()
-    await expect(setPrimaryDomainOwner(null as any, 'some-user')).rejects.toThrow()
-  })
-})

package/tests/access-assistant-db.test.ts

@@ -1,155 +0,0 @@
-/**
- * What the assistant reads to draft access decisions (ADR-0103 decision 6).
- *
- * Two facts are held here. The read tool answers only this domain, only to someone who may decide, never the
- * caller's own requests. And a pending request handed over as the screen's context does not reach the model's
- * prompt - which is why the tool exists; if that ever changes, this file says so.
- */
-import { registryAssistantChat } from '../../ai-client-base/server/service/assistant/registry-assistant'
-import { clearToolRegistry, registerToolCategory } from '../../ai-client-base/server/service/tool-registry/index.js'
-
-import { closeAuthDatabase, Domain, getRepository, openAuthDatabase, resetAuthDatabase } from './db'
-import { loadCompiled } from './compiled'
-
-import uiEn from '../../auth-ui/translations/en.json'
-import uiKo from '../../auth-ui/translations/ko.json'
-
-const { Role } = loadCompiled('service/role/role')
-const { Privilege } = loadCompiled('service/privilege/privilege')
-const { User } = loadCompiled('service/user/user')
-const { DomainOwner } = loadCompiled('service/domain-owner/domain-owner')
-const { AccessRequest } = loadCompiled('service/access-request/access-request')
-const access = loadCompiled('controllers/access-request')
-const assistant = loadCompiled('ai-entry/access-assistant')
-const targets = loadCompiled('ai-entry/access-entry-targets')
-
-let domain: any
-let other: any
-let kim: any
-let lee: any
-let park: any
-let owner: any
-let worker: any
-let otherAdmin: any
-
-async function makeUser(name: string, domains: any[], roles: any[] = []) {
-  return await getRepository(User).save({
-    username: name, email: `${name}@example.com`, name, salt: User.generateSalt(), status: 'activated', domains, roles
-  })
-}
-
-const ask = (user: any, privilege = 'mutation', inDomain = domain) =>
-  access.requestAccess({ category: 'warehouse', privilege, reason: 'needed for work' }, { state: { domain: inDomain, user, afterCommit: [] } } as any)
-
-beforeAll(async () => {
-  await openAuthDatabase()
-})
-
-afterAll(async () => {
-  await closeAuthDatabase()
-})
-
-beforeEach(async () => {
-  await resetAuthDatabase()
-  ;(process as any).domainOwnerGranted = async (d: any, u: any) =>
-    !!(await getRepository(DomainOwner).findOne({ where: { domain: { id: d.id }, user: { id: u.id } } }))
-  ;(process as any).superUserGranted = async () => false
-
-  domain = await getRepository(Domain).findOneBy({ id: (await getRepository(Domain).save({ name: 'Plant A', subdomain: 'plant-a' })).id })
-  other = await getRepository(Domain).findOneBy({ id: (await getRepository(Domain).save({ name: 'Other', subdomain: 'other' })).id })
-
-  const mutation = await getRepository(Privilege).save({ name: 'mutation', category: 'warehouse' })
-  await getRepository(Privilege).save({ name: 'query', category: 'warehouse' })
-  const grant = await getRepository(Privilege).save({ name: 'mutation', category: 'user' })
-  await getRepository(Role).save({ name: 'inbound', domain, privileges: [mutation] })
-  const admins = await getRepository(Role).save({ name: 'admins', domain, privileges: [grant] })
-  const otherAdmins = await getRepository(Role).save({ name: 'admins', domain: other, privileges: [grant] })
-
-  kim = await makeUser('kim', [domain])
-  lee = await makeUser('lee', [domain])
-  park = await makeUser('park', [domain], [admins])
-  owner = await makeUser('owner', [domain])
-  worker = await makeUser('worker', [domain])
-  otherAdmin = await makeUser('otheradmin', [other], [otherAdmins])
-  await getRepository(DomainOwner).save({ domain, user: owner })
-})
-
-afterEach(() => {
-  delete (process as any).domainOwnerGranted
-  delete (process as any).superUserGranted
-})
-
-describe('listPendingAccessRequests', () => {
-  it('★ a decider reads this domain\'s waiting requests with the roles that grant each', async () => {
-    await ask(kim)
-    const answer = await assistant.pendingRequestsToDecide({ domain, user: park })
-    expect(answer.requests).toEqual([
-      expect.objectContaining({ requester: 'kim', privilege: 'warehouse:mutation', task: null, roles: [{ name: 'inbound', privilegeCount: 1, holdsTask: false }] })
-    ])
-  })
-
-  it('★ another domain\'s requests are not read - even by a decider there', async () => {
-    await ask(kim)
-    const there = await assistant.pendingRequestsToDecide({ domain: other, user: otherAdmin })
-    expect(there.requests).toEqual([])
-  })
-
-  it('★ someone who may not decide is refused - nothing is read', async () => {
-    await ask(kim)
-    expect(await assistant.pendingRequestsToDecide({ domain, user: worker })).toEqual({ refused: 'not-a-decider' })
-  })
-
-  it('★ the caller\'s own requests are left out - they cannot decide them', async () => {
-    await ask(kim)
-    await ask(owner, 'query')
-    const answer = await assistant.pendingRequestsToDecide({ domain, user: owner })
-    expect(answer.requests.map((r: any) => r.requester)).toEqual(['kim'])
-  })
-
-  it('decided and expired requests are left out', async () => {
-    const decided = await ask(kim)
-    await access.decideAccessRequest({ requestId: decided.id, decision: 'DENY', reason: 'no' }, { state: { domain, user: park, afterCommit: [] } } as any)
-    const late = await ask(lee)
-    await getRepository(AccessRequest).update({ id: late.id }, { expiresAt: new Date(Date.now() - 1000) })
-    expect((await assistant.pendingRequestsToDecide({ domain, user: park })).requests).toEqual([])
-  })
-})
-
-describe('the declarations fit together', () => {
-  afterEach(() => clearToolRegistry())
-
-  it('the category registers, the mode names it and the decision target, the words exist', () => {
-    const category = assistant.accessToolCategory()
-    expect(() => registerToolCategory(category)).not.toThrow()
-    const mode = assistant.accessAssistantMode()
-    expect(mode.toolCategories).toEqual([category.name])
-    expect(mode.entryTargets).toEqual([targets.AUTH_ACCESS_DECISION])
-    expect(mode.subjects).toEqual([assistant.ACCESS_REQUESTS_SUBJECT])
-    for (const dict of [uiEn, uiKo] as Record<string, string>[])
-      for (const key of [mode.labelKey, mode.placeholderKey]) expect([key, typeof dict[key]]).toEqual([key, 'string'])
-  })
-
-  it('★ requests handed over as the screen\'s context do not reach the model\'s prompt - the tool is how it reads them', async () => {
-    registerToolCategory(assistant.accessToolCategory())
-    const seen: any[] = []
-    const client = {
-      chatWithTools: async (messages: any, tools: any[], options: any) => {
-        seen.push({ messages, tools, options })
-        return { text: 'ok', toolCalls: [], stopReason: 'end_turn' }
-      }
-    }
-    await registryAssistantChat({
-      client,
-      messages: [{ role: 'user', content: 'sort out the access requests' }],
-      systemPrompt: assistant.accessAssistantMode().systemPrompt,
-      toolCategories: [assistant.AUTH_ACCESS_TOOLS],
-      hostContext: { pendingRequests: ['MARKER-kim-warehouse-mutation'] },
-      state: { domain, user: park },
-      toolAccess: async () => true
-    } as any)
-
-    expect(JSON.stringify(seen[0].options)).not.toContain('MARKER-kim')
-    expect(JSON.stringify(seen[0].messages)).not.toContain('MARKER-kim')
-    expect(seen[0].tools.map((t: any) => t.name)).toEqual(['listPendingAccessRequests'])
-  })
-})