@things-factory/auth-base 10.1.278 → 10.1.280

package/tests/access-entry-targets-db.test.ts

@@ -1,176 +0,0 @@
-/**
- * The access request's AI 입력 declarations (ADR-0103 decision 4).
- *
- * The model drafts and a person presses; the card's check is the review the list screen asks. That last point is
- * what this file holds above all: the card's findings for a decision equal `reviewDecision` for the same decision.
- *
- * The declarations are read from the compiled package so their check reaches the same entities as the database.
- * The assistant's own validation is asked through its source file, which needs only `graphql`.
- */
-import { parse } from 'graphql'
-
-import { clearEntryTargets, declareEntryTarget } from '../../ai-assistant/server/service/data-entry/entry-target'
-import { applyEntryProposal } from '../../ai-assistant/server/service/data-entry/entry-apply'
-
-import { closeAuthDatabase, Domain, getRepository, openAuthDatabase, resetAuthDatabase } from './db'
-import { loadCompiled } from './compiled'
-
-import uiEn from '../../auth-ui/translations/en.json'
-import uiKo from '../../auth-ui/translations/ko.json'
-
-const { Role } = loadCompiled('service/role/role')
-const { Privilege } = loadCompiled('service/privilege/privilege')
-const { User } = loadCompiled('service/user/user')
-const access = loadCompiled('controllers/access-request')
-const targets = loadCompiled('ai-entry/access-entry-targets')
-const { judgePermission } = loadCompiled('utils/check-permission')
-const { AccessRequest } = loadCompiled('service/access-request/access-request')
-
-const rootFields = (document: string) =>
-  ((parse(document).definitions[0] as any).selectionSet.selections as any[]).map(one => one.name.value)
-
-const row = (values: Record<string, unknown>, index = 0) => ({ index, values, sources: [], issues: [] })
-
-describe('the declarations', () => {
-  afterEach(() => clearEntryTargets())
-
-  it('the built public AUTH entry exports the same refusal formatter used by AI entry', () => {
-    expect(loadCompiled('index').privilegeRejection).toBe(loadCompiled('service/privilege/privilege-rejection').privilegeRejection)
-  })
-
-  it('are accepted by the assistant as declared', () => {
-    for (const target of targets.accessEntryTargets()) expect(() => declareEntryTarget(target)).not.toThrow()
-  })
-
-  it('★ the decision card writes through decideAccessRequest - the person presses it; nothing else is a door', () => {
-    const decision = targets.accessDecisionEntryTarget()
-    expect(rootFields(decision.mutation)).toEqual(['decideAccessRequest'])
-    expect(rootFields(decision.fields.find((f: any) => f.name === 'request').reference.query)).toEqual(['accessRequests'])
-    expect(rootFields(targets.accessRequestEntryTarget().mutation)).toEqual(['requestAccess'])
-  })
-
-  it('a denial carries no role, a grant carries its role id', () => {
-    expect(targets.decisionOf(row({ request: { id: 'q' }, decision: 'DENY', role: { id: 'r' }, reason: 'no' }))).toEqual({
-      requestId: 'q',
-      decision: 'DENY',
-      roleId: undefined,
-      reason: 'no'
-    })
-    expect(targets.decisionOf(row({ request: { id: 'q' }, decision: 'GRANT', role: { id: 'r' } })).roleId).toBe('r')
-  })
-
-  it('a request is named by person or privilege; only pending ones; several stay several', () => {
-    const items = [
-      { id: '1', state: 'PENDING', category: 'warehouse', privilege: 'mutation', requester: { name: '김민수' } },
-      { id: '2', state: 'PENDING', category: 'board', privilege: 'query', requester: { name: '김민지' } },
-      { id: '3', state: 'GRANTED', category: 'warehouse', privilege: 'mutation', requester: { name: '김민수' } }
-    ]
-    expect(targets.requestsNamed(items, '김민수').map((r: any) => r.id)).toEqual(['1'])
-    expect(targets.requestsNamed(items, '김민').map((r: any) => r.id)).toEqual(['1', '2'])
-    expect(targets.requestsNamed(items, 'board:query').map((r: any) => r.label)).toEqual(['김민지 · board:query'])
-  })
-
-  it('every word the card shows is in the screen words', () => {
-    const decision = targets.accessDecisionEntryTarget()
-    const keys = [
-      decision.labelKey,
-      targets.accessRequestEntryTarget().labelKey,
-      ...[...decision.fields, ...targets.accessRequestEntryTarget().fields].map((f: any) => f.labelKey),
-      'access-request.decision.grant',
-      'access-request.decision.deny',
-      'access-request.issue.not-by-role'
-    ]
-    for (const dict of [uiEn, uiKo] as Record<string, string>[]) for (const key of keys) expect([key, typeof dict[key]]).toEqual([key, 'string'])
-  })
-})
-
-describe('the card says what the screen says', () => {
-  let domain: any
-  let kim: any
-  let park: any
-  let inbound: any
-  let manager: any
-
-  beforeAll(async () => {
-    await openAuthDatabase()
-  })
-
-  afterAll(async () => {
-    await closeAuthDatabase()
-  })
-
-  beforeEach(async () => {
-    await resetAuthDatabase()
-    const saved = await getRepository(Domain).save({ name: 'Plant A', subdomain: 'plant-a' })
-    domain = await getRepository(Domain).findOneBy({ id: saved.id })
-    const mutation = await getRepository(Privilege).save({ name: 'mutation', category: 'warehouse' })
-    const query = await getRepository(Privilege).save({ name: 'query', category: 'warehouse' })
-    const grant = await getRepository(Privilege).save({ name: 'mutation', category: 'user' })
-    inbound = await getRepository(Role).save({ name: 'inbound', domain, privileges: [mutation] })
-    manager = await getRepository(Role).save({ name: 'manager', domain, privileges: [mutation, query, grant] })
-    const admins = await getRepository(Role).save({ name: 'admins', domain, privileges: [grant] })
-    const make = (name: string, roles: any[]) =>
-      getRepository(User).save({ username: name, email: `${name}@example.com`, name, salt: User.generateSalt(), status: 'activated', domains: [domain], roles })
-    kim = await make('kim', [])
-    park = await make('park', [admins])
-  })
-
-  const state = (user: any) => ({ domain, user })
-
-  it.each(['GRANT', 'DENY'])('a stored AI decision applies %s through the same controller and schedules the result after commit', async decision => {
-    const request = await access.requestAccess({ category: 'warehouse', privilege: 'mutation', reason: 'inbound' }, { state: { ...state(kim), afterCommit: [] } } as any)
-    const target = targets.accessDecisionEntryTarget()
-    /* notification's `sendNotice` (ADR-0164 amendment 1), seen as who, where and what the notice says */
-    const notify = jest.fn()
-    const sendNotice = (notice: any) => notify({ receivers: notice.receivers.map((one: any) => one.id), url: notice.address, title: notice.words('ko').subject })
-    const afterCommit: any[] = []
-    const context = { state: { ...state(park), sendNotice, afterCommit }, t: (key: string) => key }
-    const execute = jest.fn(async (document, variables) => {
-      expect(document).toBe(target.mutation)
-      const decided = await access.decideAccessRequest(variables.decision, context)
-      return { data: { decideAccessRequest: decided } }
-    })
-    const proposal = { key: 'ai-decision', kind: 'entry', target: target.key, rows: [row({ request: { id: request.id }, decision, ...(decision === 'GRANT' ? { role: { id: inbound.id } } : { reason: 'IT only' }) })] }
-    const outcome = await applyEntryProposal(proposal.key, {
-      messages: [{ id: 'm', proposals: [proposal] }], answered: false, state: context.state,
-      passesDoor: async door => {
-        expect(door).toBe('Mutation.decideAccessRequest')
-        return (await judgePermission({ category: 'user', privilege: 'mutation', owner: true }, park, domain)).permitted
-      },
-      execute
-    }, key => key === target.key ? target : undefined)
-    expect(outcome).toMatchObject({ verdict: 'accepted', applied: 1, missed: 0 })
-    expect(execute).toHaveBeenCalledTimes(1)
-    expect(notify).not.toHaveBeenCalled()
-    for (const step of afterCommit) await step.run()
-    expect(notify).toHaveBeenCalledWith(expect.objectContaining({ receivers: [kim.id], url: 'my-access-requests', title: `access-request.notify.${decision === 'GRANT' ? 'granted' : 'denied'}.title` }))
-    expect((await getRepository(AccessRequest).findOneBy({ id: request.id })).state).toBe(decision === 'GRANT' ? 'GRANTED' : 'DENIED')
-    expect(await User.hasPrivilege('mutation', 'warehouse', domain, kim)).toBe(decision === 'GRANT')
-  })
-
-  it('★ the card\'s findings are reviewDecision\'s, for grant and for deny', async () => {
-    const request = await access.requestAccess({ category: 'warehouse', privilege: 'mutation', reason: 'inbound' }, { state: { ...state(kim), afterCommit: [] } } as any)
-    const rows = [
-      row({ request: { id: request.id }, decision: 'GRANT', role: { id: manager.id } }, 0),
-      row({ request: { id: request.id }, decision: 'GRANT', role: { id: inbound.id } }, 1),
-      row({ request: { id: request.id }, decision: 'DENY', reason: '' }, 2)
-    ]
-
-    const card = await targets.accessDecisionEntryTarget().check(rows, { state: state(park) })
-
-    for (const [index, one] of rows.entries()) {
-      const screen = await access.reviewDecision(targets.decisionOf(one), { state: state(park) } as any)
-      expect(card[index].map((issue: any) => [issue.code, issue.blocking])).toEqual(screen.map((issue: any) => [issue.code, issue.blocking]))
-    }
-    expect(card[0].map((issue: any) => issue.code)).toContain('role-grants-admin')
-    expect(card[2].map((issue: any) => issue.code)).toEqual(['deny-needs-reason'])
-  })
-
-  it('★ the request card refuses what the door would - already held', async () => {
-    const lee = await getRepository(User).save({
-      username: 'lee', email: 'lee@example.com', name: 'lee', salt: User.generateSalt(), status: 'activated', domains: [domain], roles: [inbound]
-    })
-    const [issues] = await targets.accessRequestEntryTarget().check([row({ category: 'warehouse', privilege: 'mutation' })], { state: state(lee) })
-    expect(issues).toEqual([expect.objectContaining({ code: 'already-holds', blocking: true })])
-  })
-})

package/tests/access-request-db.test.ts

@@ -1,394 +0,0 @@
-/**
- * Asking, deciding, telling - the access request end to end on the database (ADR-0103).
- *
- * The controller is called with a request state as the doors receive it. `sendNotice` is a spy: the notification
- * module is optional and the row is the record.
- */
-
-import { closeAuthDatabase, Domain, getRepository, openAuthDatabase, resetAuthDatabase } from './db'
-import { loadCompiled } from './compiled'
-
-const { Role } = loadCompiled('service/role/role')
-const { Privilege } = loadCompiled('service/privilege/privilege')
-const { User } = loadCompiled('service/user/user')
-const { DomainOwner } = loadCompiled('service/domain-owner/domain-owner')
-const { AccessRequest } = loadCompiled('service/access-request/access-request')
-const access = loadCompiled('controllers/access-request')
-
-let domain: any
-let other: any
-let warehouseMutation: any
-let warehouseQuery: any
-let userMutation: any
-let inbound: any
-let manager: any
-let admins: any
-let kim: any
-let park: any
-let owner: any
-
-async function makeUser(name: string, domains: any[], roles: any[] = [], over: any = {}) {
-  const tag = Math.random().toString(36).slice(2, 8)
-  return await getRepository(User).save({
-    username: `${name}-${tag}`,
-    email: `${name}-${tag}@example.com`,
-    name,
-    salt: User.generateSalt(),
-    status: 'activated',
-    domains,
-    roles,
-    ...over
-  })
-}
-
-/* notification's `sendNotice` (ADR-0164 amendment 1), seen as who, where and what the notice says */
-const noticeSpy = () => {
-  const told = jest.fn()
-  return { told, sendNotice: (notice: any) => told({ receivers: notice.receivers.map((one: any) => one.id), url: notice.address, title: notice.words('ko').subject }) }
-}
-
-function contextOf(user: any, over: any = {}) {
-  const { told: notify, sendNotice } = noticeSpy()
-  const afterCommit: any[] = []
-  return {
-    state: { domain, user, afterCommit, sendNotice, ...over },
-    t: (key: string) => key,
-    afterCommit,
-    notify
-  } as any
-}
-
-async function commit(context: any) {
-  for (const step of context.afterCommit) await step.run()
-}
-
-async function holds(user: any, category: string, privilege: string) {
-  return await User.hasPrivilege(privilege, category, domain, user)
-}
-
-beforeAll(async () => {
-  await openAuthDatabase()
-})
-
-afterAll(async () => {
-  await closeAuthDatabase()
-})
-
-beforeEach(async () => {
-  await resetAuthDatabase()
-
-  const saved = await getRepository(Domain).save({ name: 'Plant A', subdomain: 'plant-a' })
-  domain = await getRepository(Domain).findOneBy({ id: saved.id })
-  other = await getRepository(Domain).save({ name: 'Other', subdomain: 'other' })
-
-  warehouseMutation = await getRepository(Privilege).save({ name: 'mutation', category: 'warehouse' })
-  warehouseQuery = await getRepository(Privilege).save({ name: 'query', category: 'warehouse' })
-  userMutation = await getRepository(Privilege).save({ name: 'mutation', category: 'user' })
-
-  inbound = await getRepository(Role).save({ name: 'inbound', domain, privileges: [warehouseMutation] })
-  manager = await getRepository(Role).save({ name: 'manager', domain, privileges: [warehouseMutation, warehouseQuery, userMutation] })
-  admins = await getRepository(Role).save({ name: 'admins', domain, privileges: [userMutation, warehouseQuery] })
-
-  kim = await makeUser('kim', [domain])
-  park = await makeUser('park', [domain], [admins])
-  owner = await makeUser('owner', [domain])
-  await getRepository(DomainOwner).save({ domain, user: owner })
-})
-
-const ASK = { category: 'warehouse', privilege: 'mutation', operationName: 'updateInboundPlan', reason: 'inbound from today' }
-
-describe('asking', () => {
-  it('★ a request is a row - pending, fourteen days, and the people who decide are told once', async () => {
-    const context = contextOf(kim)
-    const request = await access.requestAccess(ASK, context)
-    await commit(context)
-
-    expect(request).toMatchObject({ state: 'PENDING', category: 'warehouse', privilege: 'mutation', count: 1, reason: 'inbound from today' })
-    expect(context.notify).toHaveBeenCalledTimes(1)
-    expect([...context.notify.mock.calls[0][0].receivers].sort()).toEqual([owner.id, park.id].sort())
-    expect(context.notify.mock.calls[0][0].url).toBe(`access-requests?id=${request.id}`)
-  })
-
-  it('★ asking again adds to the pending one - no second row, nobody told again', async () => {
-    await access.requestAccess(ASK, contextOf(kim))
-    const again = contextOf(kim)
-    const merged = await access.requestAccess({ ...ASK, reason: 'still needed' }, again)
-    await commit(again)
-
-    expect(merged.count).toBe(2)
-    expect(merged.reason).toBe('still needed')
-    expect(await getRepository(AccessRequest).count()).toBe(1)
-    expect(again.notify).not.toHaveBeenCalled()
-  })
-
-  it('★ a privilege the caller holds is not asked for', async () => {
-    const kimWithRole = await makeUser('lee', [domain], [inbound])
-    await expect(access.requestAccess(ASK, contextOf(kimWithRole))).rejects.toMatchObject({ code: 'access-request-already-holds' })
-  })
-
-  it('★ refused by the license, not by a role - not taken, whatever the screen sent', async () => {
-    const context = contextOf(kim, { prohibitedPrivileges: [{ category: 'warehouse', privilege: 'mutation', by: 'license' }] })
-    await expect(access.requestAccess(ASK, context)).rejects.toMatchObject({ code: 'access-request-not-by-role', params: { because: 'license' } })
-  })
-
-  it('a privilege nobody declared is not asked for', async () => {
-    await expect(access.requestAccess({ category: 'nothing', privilege: 'here', reason: 'x' }, contextOf(kim))).rejects.toMatchObject({
-      code: 'access-request-unknown-privilege'
-    })
-  })
-
-  it('the requester withdraws their own, and nobody else can', async () => {
-    const request = await access.requestAccess(ASK, contextOf(kim))
-    await expect(access.withdrawAccessRequest(request.id, contextOf(park))).rejects.toMatchObject({ code: 'access-request-not-withdrawable' })
-    expect((await access.withdrawAccessRequest(request.id, contextOf(kim))).state).toBe('WITHDRAWN')
-  })
-})
-
-describe('who decides', () => {
-  it('★ owners and holders of user:mutation in this domain, never the requester', async () => {
-    const outsider = await makeUser('outsider', [other], [admins])
-    const ids = await access.findDeciderIds(domain, park.id)
-    expect(ids).toEqual([owner.id].sort())
-    expect(ids).not.toContain(outsider.id)
-  })
-})
-
-describe('deciding', () => {
-  it('★ grant puts the requester into the role - they pass the gate on the next request', async () => {
-    const request = await access.requestAccess(ASK, contextOf(kim))
-    const context = contextOf(park)
-    const decided = await access.decideAccessRequest({ requestId: request.id, decision: 'GRANT', roleId: inbound.id }, context)
-    await commit(context)
-
-    expect(decided).toMatchObject({ state: 'GRANTED', grantedRole: { id: inbound.id } })
-    expect(await holds(kim, 'warehouse', 'mutation')).toBe(true)
-    expect(context.notify).toHaveBeenCalledWith(
-      expect.objectContaining({ receivers: [kim.id], title: 'access-request.notify.granted.title', url: 'my-access-requests' })
-    )
-  })
-
-  it('★ deny keeps the reason and tells the requester', async () => {
-    const request = await access.requestAccess(ASK, contextOf(kim))
-    const context = contextOf(park)
-    const decided = await access.decideAccessRequest({ requestId: request.id, decision: 'DENY', reason: 'IT only' }, context)
-    await commit(context)
-
-    expect(decided).toMatchObject({ state: 'DENIED', decisionReason: 'IT only' })
-    expect(await holds(kim, 'warehouse', 'mutation')).toBe(false)
-    expect(context.notify).toHaveBeenCalledWith(expect.objectContaining({ title: 'access-request.notify.denied.title' }))
-  })
-
-  it('★ the second decision is refused - the first one stands', async () => {
-    const request = await access.requestAccess(ASK, contextOf(kim))
-    await access.decideAccessRequest({ requestId: request.id, decision: 'DENY', reason: 'no' }, contextOf(owner))
-    await expect(access.decideAccessRequest({ requestId: request.id, decision: 'GRANT', roleId: inbound.id }, contextOf(park))).rejects.toMatchObject({
-      code: 'access-decision-request-not-pending'
-    })
-    expect(await holds(kim, 'warehouse', 'mutation')).toBe(false)
-  })
-
-  it('★ two people deciding at once - exactly one wins (both reviews read PENDING before either writes)', async () => {
-    const request = await access.requestAccess(ASK, contextOf(kim))
-    const results = await Promise.allSettled([
-      access.decideAccessRequest({ requestId: request.id, decision: 'DENY', reason: 'no' }, contextOf(owner)),
-      access.decideAccessRequest({ requestId: request.id, decision: 'GRANT', roleId: inbound.id }, contextOf(park))
-    ])
-
-    expect(results.map(r => r.status).sort()).toEqual(['fulfilled', 'rejected'])
-    const lost = results.find(r => r.status === 'rejected') as PromiseRejectedResult
-    expect(lost.reason).toMatchObject({ code: 'access-decision-request-not-pending' })
-  })
-
-  it('★ the review blocks inside the door too - a role without the privilege is refused', async () => {
-    const request = await access.requestAccess(ASK, contextOf(kim))
-    await expect(access.decideAccessRequest({ requestId: request.id, decision: 'GRANT', roleId: admins.id }, contextOf(park))).rejects.toMatchObject({
-      code: 'access-decision-role-does-not-grant'
-    })
-    expect((await getRepository(AccessRequest).findOneBy({ id: request.id })).state).toBe('PENDING')
-  })
-
-  it('★ another tenant\'s role is refused - it is not this domain\'s to give', async () => {
-    const foreign = await getRepository(Role).save({ name: 'foreign', domain: other, privileges: [warehouseMutation] })
-    const request = await access.requestAccess(ASK, contextOf(kim))
-    await expect(access.decideAccessRequest({ requestId: request.id, decision: 'GRANT', roleId: foreign.id }, contextOf(park))).rejects.toMatchObject({
-      code: 'access-decision-role-not-assignable'
-    })
-  })
-
-  it('a request of another domain is not found from this one', async () => {
-    const request = await access.requestAccess(ASK, contextOf(kim))
-    const stranger = await makeUser('stranger', [other], [admins])
-    const fromThere = contextOf(stranger, { domain: await getRepository(Domain).findOneBy({ id: other.id }) })
-    await expect(access.decideAccessRequest({ requestId: request.id, decision: 'DENY', reason: 'x' }, fromThere)).rejects.toMatchObject({
-      code: 'access-decision-access-request-not-found'
-    })
-  })
-
-  it('★ a grant closes the same person\'s other requests it now answers', async () => {
-    const first = await access.requestAccess(ASK, contextOf(kim))
-    const second = await access.requestAccess({ category: 'warehouse', privilege: 'query', reason: 'checking stock' }, contextOf(kim))
-    await access.decideAccessRequest({ requestId: first.id, decision: 'GRANT', roleId: manager.id }, contextOf(owner))
-
-    expect((await getRepository(AccessRequest).findOneBy({ id: second.id })).state).toBe('GRANTED')
-  })
-})
-
-describe('the review as the screen asks it', () => {
-  it('★ candidates smallest first, and the review of a big role names what else it gives', async () => {
-    const request = await access.requestAccess(ASK, contextOf(kim))
-    const candidates = await access.rolesGranting('warehouse', 'mutation', domain)
-    expect(candidates.map((c: any) => c.name)).toEqual(['inbound', 'manager'])
-
-    const issues = await access.reviewDecision({ requestId: request.id, decision: 'GRANT', roleId: manager.id }, contextOf(park))
-    expect(issues.map((i: any) => i.code).sort()).toEqual(['decider-lacks-it', 'role-grants-admin', 'role-grants-more', 'smaller-role-exists'])
-  })
-})
-
-describe('asking is not a reflex (questions Q9)', () => {
-  it('★ no reason, no request - blank is no reason', async () => {
-    for (const reason of [undefined, '', '   ']) {
-      await expect(access.requestAccess({ ...ASK, reason }, contextOf(kim))).rejects.toMatchObject({ code: 'access-request-needs-reason' })
-    }
-    expect(await getRepository(AccessRequest).count()).toBe(0)
-  })
-
-  it('★ denied lately: the same words are refused, new words are taken', async () => {
-    const first = await access.requestAccess(ASK, contextOf(kim))
-    await access.decideAccessRequest({ requestId: first.id, decision: 'DENY', reason: 'IT only' }, contextOf(park))
-
-    await expect(access.requestAccess(ASK, contextOf(kim))).rejects.toMatchObject({
-      code: 'access-request-same-reason-as-denied',
-      params: { reason: 'IT only' }
-    })
-    const again = await access.requestAccess({ ...ASK, reason: 'moved to the inbound team this week' }, contextOf(kim))
-    expect(again.state).toBe('PENDING')
-  })
-
-  it('a denial older than seven days holds nothing against the same words', async () => {
-    const first = await access.requestAccess(ASK, contextOf(kim))
-    await access.decideAccessRequest({ requestId: first.id, decision: 'DENY', reason: 'not now' }, contextOf(park))
-    await getRepository(AccessRequest).update({ id: first.id }, { decidedAt: new Date(Date.now() - 8 * 24 * 60 * 60 * 1000) })
-    expect((await access.requestAccess(ASK, contextOf(kim))).state).toBe('PENDING')
-  })
-
-  it('★ the popup can say how many people a request reaches - not who', async () => {
-    const { AccessRequestQuery } = loadCompiled('service/access-request/access-request-query')
-    expect(await new AccessRequestQuery().accessRequestDeciderCount(contextOf(kim))).toBe(2)
-    expect(await new AccessRequestQuery().accessRequestDeciderCount(contextOf(park))).toBe(1)
-  })
-})
-
-describe('found in review (2026-10-02)', () => {
-  const { AccessRequestQuery } = loadCompiled('service/access-request/access-request-query')
-
-  it('★ the list is this domain\'s only - asking for the parent\'s with inherited: Only reads nothing', async () => {
-    await access.requestAccess(ASK, contextOf(kim))
-    const savedChild = await getRepository(Domain).save({ name: 'Plant A-1', subdomain: 'plant-a-1', parent: domain })
-    const child = await getRepository(Domain).findOneBy({ id: savedChild.id })
-    const childAdmin = await makeUser('childadmin', [child])
-    const answer = await new AccessRequestQuery().accessRequests({ inherited: 'Only' } as any, { state: { domain: child, user: childAdmin } } as any)
-    expect(answer.items).toEqual([])
-  })
-
-  it('★ ask, withdraw, ask again: one row, and the deciders are told once', async () => {
-    const first = contextOf(kim)
-    const request = await access.requestAccess(ASK, first)
-    await commit(first)
-    await access.withdrawAccessRequest(request.id, contextOf(kim))
-    const again = contextOf(kim)
-    const back = await access.requestAccess({ ...ASK, reason: 'needed after all' }, again)
-    await commit(again)
-
-    expect(back.id).toBe(request.id)
-    expect(back.state).toBe('PENDING')
-    expect(await getRepository(AccessRequest).count()).toBe(1)
-    expect(first.notify).toHaveBeenCalledTimes(1)
-    expect(again.notify).not.toHaveBeenCalled()
-  })
-
-  it('★ a decision may name a parent domain\'s role - the scope the list screen offers', async () => {
-    const savedChild = await getRepository(Domain).save({ name: 'Plant A-2', subdomain: 'plant-a-2', parent: domain })
-    const child = await getRepository(Domain).findOneBy({ id: savedChild.id })
-    const found = await new AccessRequestQuery().assignableRolesNamed('inbound', { state: { domain: child, user: owner } } as any)
-    expect(found.map((r: any) => r.id)).toEqual([inbound.id])
-    expect(await new AccessRequestQuery().assignableRolesNamed('inbou', { state: { domain: child, user: owner } } as any)).toEqual([])
-  })
-
-  it('my requests carry their domain and requester - non-null fields are loaded', async () => {
-    await access.requestAccess(ASK, contextOf(kim))
-    const [mine] = await new AccessRequestQuery().myAccessRequests(contextOf(kim))
-    expect(mine.domain?.id).toBe(domain.id)
-    expect(mine.requester?.id).toBe(kim.id)
-  })
-})
-
-describe('asking for a task (ADR-0103 decision 9)', () => {
-  const { registerRoleTask } = loadCompiled('service/role-template/role-task')
-  const { AccessRequestQuery } = loadCompiled('service/access-request/access-request-query')
-
-  beforeEach(() => {
-    ;(process as any)['ROLE_TASKS'] = {}
-    ;(process as any).PRIVILEGES = {
-      'warehouse query': ['warehouse', 'query'],
-      'warehouse mutation': ['warehouse', 'mutation'],
-      'user mutation': ['user', 'mutation']
-    }
-    registerRoleTask({ id: 'warehouse.keeping', grants: [{ category: 'warehouse', axes: ['query', 'mutation'] }] })
-    registerRoleTask({ id: 'warehouse.reading', grants: [{ category: 'warehouse', axes: ['query'] }] })
-  })
-
-  it('★ the tasks holding a refused privilege are listed fewest privileges first', async () => {
-    const query = new AccessRequestQuery()
-    expect((await query.tasksGranting('warehouse', 'query')).map((one: any) => [one.taskId, one.privilegeCount])).toEqual([
-      ['warehouse.reading', 1],
-      ['warehouse.keeping', 2]
-    ])
-    expect((await query.tasksGranting('warehouse', 'mutation')).map((one: any) => one.taskId)).toEqual(['warehouse.keeping'])
-  })
-
-  it('★ the request keeps the task asked for, and refuses one that does not hold the refused privilege', async () => {
-    const request = await access.requestAccess({ ...ASK, taskId: 'warehouse.keeping' }, contextOf(kim))
-    expect(request.taskId).toBe('warehouse.keeping')
-
-    await expect(access.requestAccess({ ...ASK, taskId: 'warehouse.reading' }, contextOf(park))).rejects.toMatchObject({ code: 'access-request-task-mismatch' })
-  })
-
-  it('★ asking again with other work adds to the pending one and does not change the work it named', async () => {
-    await access.requestAccess({ ...ASK, taskId: 'warehouse.keeping' }, contextOf(kim))
-    registerRoleTask({ id: 'warehouse.receiving', grants: [{ category: 'warehouse', axes: ['mutation'] }] })
-    const merged = await access.requestAccess({ ...ASK, taskId: 'warehouse.receiving', reason: 'still needed' }, contextOf(kim))
-
-    expect(merged.count).toBe(2)
-    expect(merged.taskId).toBe('warehouse.keeping')
-    expect(await getRepository(AccessRequest).count()).toBe(1)
-  })
-
-  it('★ roles holding the whole task come first, then fewest privileges', async () => {
-    expect((await access.rolesGranting('warehouse', 'mutation', domain)).map((c: any) => c.name)).toEqual(['inbound', 'manager'])
-    const ordered = await access.rolesGranting('warehouse', 'mutation', domain, undefined, 'warehouse.keeping')
-    expect(ordered.map((c: any) => [c.name, c.holdsTask])).toEqual([
-      ['manager', true],
-      ['inbound', false]
-    ])
-  })
-
-  it('★ a role short of the task is told, not refused - and a smaller role short of it is not proposed', async () => {
-    const request = await access.requestAccess({ ...ASK, taskId: 'warehouse.keeping' }, contextOf(kim))
-
-    const short = await access.reviewDecision({ requestId: request.id, decision: 'GRANT', roleId: inbound.id }, contextOf(park))
-    expect(short.find((i: any) => i.code === 'role-lacks-task')).toMatchObject({ blocking: false, params: { task: 'warehouse.keeping', privileges: 'warehouse:query' } })
-
-    const whole = await access.reviewDecision({ requestId: request.id, decision: 'GRANT', roleId: manager.id }, contextOf(park))
-    expect(whole.map((i: any) => i.code)).not.toContain('role-lacks-task')
-    expect(whole.map((i: any) => i.code)).not.toContain('smaller-role-exists')
-  })
-
-  it('a task gone from the catalog is no error - the review says nothing of it and no role is put first', async () => {
-    const request = await access.requestAccess({ ...ASK, taskId: 'warehouse.keeping' }, contextOf(kim))
-    ;(process as any)['ROLE_TASKS'] = {}
-
-    const issues = await access.reviewDecision({ requestId: request.id, decision: 'GRANT', roleId: inbound.id }, contextOf(park))
-    expect(issues.map((i: any) => i.code)).not.toContain('role-lacks-task')
-    expect((await access.rolesGranting('warehouse', 'mutation', domain, undefined, 'warehouse.keeping')).map((c: any) => c.name)).toEqual(['inbound', 'manager'])
-  })
-})

package/tests/access-request-pg.test.ts

@@ -1,83 +0,0 @@
-/**
- * The access request under real concurrency - postgres only (`AUTH_TEST_PG`). sqlite holds one connection and
- * cannot show two transactions racing (feedback: verify concurrency on postgres).
- *
- * Each call runs in its own transaction, as the `@transaction` door gives it.
- */
-import { authDataSource, closeAuthDatabase, Domain, getRepository, openAuthDatabase, resetAuthDatabase } from './db'
-import { loadCompiled } from './compiled'
-
-const { Role } = loadCompiled('service/role/role')
-const { Privilege } = loadCompiled('service/privilege/privilege')
-const { User } = loadCompiled('service/user/user')
-const { AccessRequest } = loadCompiled('service/access-request/access-request')
-const access = loadCompiled('controllers/access-request')
-
-const onPostgres = process.env.AUTH_TEST_PG ? describe : describe.skip
-
-onPostgres('on postgres', () => {
-  let domain: any
-  let kim: any
-  let park: any
-  let owner: any
-  let inbound: any
-
-  const inTransaction = <T>(user: any, run: (context: any) => Promise<T>) =>
-    authDataSource().transaction(tx => run({ state: { domain, user, tx, afterCommit: [] }, t: (key: string) => key }))
-
-  beforeAll(async () => {
-    await openAuthDatabase()
-  })
-
-  afterAll(async () => {
-    await closeAuthDatabase()
-  })
-
-  beforeEach(async () => {
-    await resetAuthDatabase()
-    domain = await getRepository(Domain).findOneBy({ id: (await getRepository(Domain).save({ name: 'Plant A', subdomain: 'plant-a' })).id })
-    const mutation = await getRepository(Privilege).save({ name: 'mutation', category: 'warehouse' })
-    const grant = await getRepository(Privilege).save({ name: 'mutation', category: 'user' })
-    inbound = await getRepository(Role).save({ name: 'inbound', domain, privileges: [mutation] })
-    const admins = await getRepository(Role).save({ name: 'admins', domain, privileges: [grant] })
-    const make = (name: string, roles: any[] = []) =>
-      getRepository(User).save({ username: name, email: `${name}@example.com`, name, salt: User.generateSalt(), status: 'activated', domains: [domain], roles })
-    kim = await make('kim')
-    park = await make('park', [admins])
-    owner = await make('owner', [admins])
-  })
-
-  it('★ two people deciding at once, each in a transaction - exactly one wins, and the loser leaves nothing', async () => {
-    const request = await inTransaction(kim, context => access.requestAccess({ category: 'warehouse', privilege: 'mutation', reason: 'inbound' }, context))
-
-    const results = await Promise.allSettled([
-      inTransaction(owner, context => access.decideAccessRequest({ requestId: request.id, decision: 'DENY', reason: 'no' }, context)),
-      inTransaction(park, context => access.decideAccessRequest({ requestId: request.id, decision: 'GRANT', roleId: inbound.id }, context))
-    ])
-
-    expect(results.map(r => r.status).sort()).toEqual(['fulfilled', 'rejected'])
-    const stored = await getRepository(AccessRequest).findOne({ where: { id: request.id }, relations: ['grantedRole'] })
-    const holds = await User.hasPrivilege('mutation', 'warehouse', domain, kim)
-    /* The role is given exactly when the stored decision is a grant - a losing grant does not leave the role behind. */
-    expect(holds).toBe(stored.state === 'GRANTED')
-  })
-
-  it('★ a grant closes the requester\'s other requests it answers - read inside the transaction, not the default connection', async () => {
-    const query = await getRepository(Privilege).save({ name: 'query', category: 'warehouse' })
-    const both = await getRepository(Role).save({ name: 'both', domain, privileges: [query, await getRepository(Privilege).findOneBy({ name: 'mutation', category: 'warehouse' })] })
-    const first = await inTransaction(kim, context => access.requestAccess({ category: 'warehouse', privilege: 'mutation', reason: 'inbound' }, context))
-    const second = await inTransaction(kim, context => access.requestAccess({ category: 'warehouse', privilege: 'query', reason: 'stock' }, context))
-
-    await inTransaction(owner, context => access.decideAccessRequest({ requestId: first.id, decision: 'GRANT', roleId: both.id }, context))
-
-    expect((await getRepository(AccessRequest).findOneBy({ id: second.id })).state).toBe('GRANTED')
-  })
-
-  it('★ the same person asking twice at once - one pending request, not two', async () => {
-    await Promise.allSettled([
-      inTransaction(kim, context => access.requestAccess({ category: 'warehouse', privilege: 'mutation', reason: 'inbound' }, context)),
-      inTransaction(kim, context => access.requestAccess({ category: 'warehouse', privilege: 'mutation', reason: 'inbound' }, context))
-    ])
-    expect(await getRepository(AccessRequest).count({ where: { state: 'PENDING' } })).toBe(1)
-  })
-})