@things-factory/auth-base 10.1.278 → 10.1.280

package/tests/access-request-review.test.ts

@@ -1,193 +0,0 @@
-/**
- * The access decision review - pure (ADR-0103, docs/design/access-request.md §6-1).
- *
- * The list screen, the AI 입력 draft card and the decision door all read this one function, so what it says
- * is what every one of them says. Each code is held here on its own.
- */
-
-import {
-  effectiveState,
-  expiryFrom,
-  isBlocked,
-  reviewAccessDecision,
-  smallestRole,
-  type DecisionFacts
-} from '../server/utils/access-request-review.js'
-
-const NOW = new Date('2026-10-02T09:00:00Z')
-const ASKED = { category: 'warehouse', privilege: 'mutation' }
-const SEE = { category: 'warehouse', privilege: 'query' }
-const GRANT_ROLES = { category: 'user', privilege: 'mutation' }
-
-function facts(over: Partial<DecisionFacts> = {}): DecisionFacts {
-  return {
-    request: { state: 'PENDING', requesterId: 'kim', ...ASKED, expiresAt: expiryFrom(NOW) },
-    deciderId: 'park',
-    decision: 'GRANT',
-    reason: null,
-    role: { id: 'r-inbound', name: 'inbound', privileges: [ASKED] },
-    requester: { active: true, inDomain: true },
-    requesterHoldsIt: false,
-    candidates: [{ id: 'r-inbound', name: 'inbound', privilegeCount: 1 }],
-    deciderPrivileges: [ASKED, SEE, GRANT_ROLES],
-    deciderIsOwner: false,
-    deniedBefore: null,
-    now: NOW,
-    ...over
-  }
-}
-
-const codes = (f: DecisionFacts) => reviewAccessDecision(f).map(issue => `${issue.blocking ? '⛔' : '⚠'}${issue.code}`)
-
-describe('a clean grant', () => {
-  it('★ the smallest role that holds exactly what was asked passes with nothing to say', () => {
-    expect(reviewAccessDecision(facts())).toEqual([])
-  })
-})
-
-describe('what keeps a decision from being made', () => {
-  it('★ no such request', () => {
-    expect(codes(facts({ request: null }))).toEqual(['⛔access-request-not-found'])
-  })
-
-  it('★ decided, withdrawn or expired already - another person may have decided a moment ago', () => {
-    for (const state of ['GRANTED', 'DENIED', 'WITHDRAWN', 'EXPIRED'] as const) {
-      expect(codes(facts({ request: { ...facts().request!, state } }))).toContain('⛔request-not-pending')
-    }
-  })
-
-  it('★ a pending request past its time is expired whatever the column says', () => {
-    const late = facts({ request: { ...facts().request!, expiresAt: new Date(NOW.getTime() - 1) } })
-    expect(codes(late)).toContain('⛔request-not-pending')
-  })
-
-  it('★ the decider is the requester', () => {
-    expect(codes(facts({ deciderId: 'kim' }))).toContain('⛔own-request')
-  })
-
-  it('★ the requester is locked, inactive or gone from the domain', () => {
-    expect(codes(facts({ requester: { active: false, inDomain: true } }))).toContain('⛔requester-unavailable')
-    expect(codes(facts({ requester: { active: true, inDomain: false } }))).toContain('⛔requester-unavailable')
-    expect(codes(facts({ requester: null }))).toContain('⛔requester-unavailable')
-  })
-
-  it('★ a denial without a reason', () => {
-    expect(codes(facts({ decision: 'DENY', reason: '  ', role: null }))).toEqual(['⛔deny-needs-reason'])
-    expect(codes(facts({ decision: 'DENY', reason: 'IT only', role: null }))).toEqual([])
-  })
-
-  it('★ the requester holds it already', () => {
-    expect(codes(facts({ requesterHoldsIt: true }))).toContain('⛔already-holds')
-  })
-
-  it('★ no role chosen, or one this domain cannot assign', () => {
-    expect(codes(facts({ role: null }))).toEqual(['⛔role-required'])
-    expect(codes(facts({ role: null, roleNamedButNotAssignable: true }))).toEqual(['⛔role-not-assignable'])
-  })
-
-  it('★ the role does not hold the asked privilege', () => {
-    expect(codes(facts({ role: { id: 'r-viewer', name: 'viewer', privileges: [SEE] } }))).toEqual(['⛔role-does-not-grant'])
-  })
-})
-
-describe('what the person deciding is told', () => {
-  const manager = { id: 'r-manager', name: 'manager', privileges: [ASKED, SEE, GRANT_ROLES] }
-  const candidates = [
-    { id: 'r-inbound', name: 'inbound', privilegeCount: 1 },
-    { id: 'r-manager', name: 'manager', privilegeCount: 3 }
-  ]
-
-  it('★ the role gives more than was asked - named', () => {
-    const issues = reviewAccessDecision(facts({ role: manager, candidates }))
-    expect(issues.find(i => i.code === 'role-grants-more')).toMatchObject({
-      blocking: false,
-      params: { count: 2, privileges: 'warehouse:query, user:mutation' }
-    })
-  })
-
-  it('★ the role hands on the power to give roles', () => {
-    expect(codes(facts({ role: manager, candidates }))).toContain('⚠role-grants-admin')
-  })
-
-  it('asking for the role-giving power itself is not warned as a side effect', () => {
-    const asked = facts({
-      request: { ...facts().request!, ...GRANT_ROLES },
-      role: { id: 'r-admin', name: 'admin', privileges: [GRANT_ROLES] },
-      candidates: [{ id: 'r-admin', name: 'admin', privilegeCount: 1 }]
-    })
-    expect(codes(asked)).not.toContain('⚠role-grants-admin')
-  })
-
-  it('★ a smaller role grants it too - its name', () => {
-    const issues = reviewAccessDecision(facts({ role: manager, candidates }))
-    expect(issues.find(i => i.code === 'smaller-role-exists')).toMatchObject({ params: { role: 'inbound', count: 1 } })
-  })
-
-  it('★ the role gives what the decider does not have - told, not refused (Q6)', () => {
-    const issues = reviewAccessDecision(facts({ role: manager, candidates, deciderPrivileges: [ASKED] }))
-    expect(issues.find(i => i.code === 'decider-lacks-it')).toMatchObject({ blocking: false, params: { privileges: 'warehouse:query, user:mutation' } })
-    expect(isBlocked(issues)).toBe(false)
-  })
-
-  it('an owner is not told they lack anything', () => {
-    expect(codes(facts({ role: manager, candidates, deciderPrivileges: [], deciderIsOwner: true }))).not.toContain('⚠decider-lacks-it')
-  })
-
-  it('★ denied before - by whom, when, why', () => {
-    const issues = reviewAccessDecision(facts({ deniedBefore: { by: 'Lee', at: '2026-09-01T00:00:00Z', reason: 'IT only' } }))
-    expect(issues).toEqual([
-      { code: 'denied-before', blocking: false, field: 'request', params: { by: 'Lee', at: '2026-09-01T00:00:00.000Z', reason: 'IT only' } }
-    ])
-  })
-})
-
-describe('helpers', () => {
-  it('the smallest role, ties by name - the same answer every time', () => {
-    expect(smallestRole([{ name: 'b', privilegeCount: 2 }, { name: 'a', privilegeCount: 2 }, { name: 'c', privilegeCount: 5 }])?.name).toBe('a')
-    expect(smallestRole([])).toBeUndefined()
-  })
-
-  it('a request waits fourteen days', () => {
-    expect(expiryFrom(NOW).toISOString()).toBe('2026-10-16T09:00:00.000Z')
-    expect(effectiveState('PENDING', null, NOW)).toBe('PENDING')
-    expect(effectiveState('GRANTED', new Date(0), NOW)).toBe('GRANTED')
-  })
-})
-
-describe('the parent domain\'s role (ADR-0103 decision 8)', () => {
-  it('★ blocks when the decider does not decide in the parent, passes when they do', () => {
-    expect(codes(facts({ roleIsParents: true, deciderMayChangeParentRoles: false }))).toContain('⛔role-belongs-to-parent')
-    expect(codes(facts({ roleIsParents: true, deciderMayChangeParentRoles: true }))).not.toContain('⛔role-belongs-to-parent')
-    expect(codes(facts({ roleIsParents: false }))).not.toContain('⛔role-belongs-to-parent')
-  })
-})
-
-describe('the task asked for (ADR-0103 decision 9)', () => {
-  const task = { id: 'warehouse.keeping', privileges: [ASKED, SEE] }
-
-  it('★ a role short of the task asked is told which privileges it lacks - not refused', () => {
-    const issues = reviewAccessDecision(facts({ task }))
-    expect(issues.find(issue => issue.code === 'role-lacks-task')).toEqual({
-      code: 'role-lacks-task',
-      blocking: false,
-      field: 'role',
-      params: { role: 'inbound', task: 'warehouse.keeping', privileges: 'warehouse:query' }
-    })
-    expect(isBlocked(issues)).toBe(false)
-  })
-
-  it('★ says nothing when no task was asked or the task is gone', () => {
-    expect(codes(facts({ task: null }))).not.toContain('⚠role-lacks-task')
-    expect(codes(facts())).not.toContain('⚠role-lacks-task')
-  })
-
-  it('★ a smaller role that drops the task is not proposed over a role holding it', () => {
-    const keeper = { id: 'r-keeper', name: 'keeper', privileges: [ASKED, SEE, GRANT_ROLES] }
-    const candidates = [
-      { id: 'r-keeper', name: 'keeper', privilegeCount: 3, holdsTask: true },
-      { id: 'r-inbound', name: 'inbound', privilegeCount: 1, holdsTask: false }
-    ]
-    expect(codes(facts({ task, role: keeper, candidates }))).not.toContain('⚠smaller-role-exists')
-    expect(smallestRole(candidates)?.name).toBe('keeper')
-  })
-})

package/tests/account-lock-db.test.ts

@@ -1,216 +0,0 @@
-/**
- * 잠금이 스스로 풀리는 것 — 실 경로(`signin` · `checkAuth`)를 태워 본다.
- *
- * `account-lock-rule.test.ts` 는 규칙만 본다. 규칙이 옳아도 **부르는 자리**가 틀리면 계정은
- * 영구히 잠긴 채로 남는다. 그래서 여기서는 실제 컨트롤러를 태우고 **행을 다시 읽는다.**
- *
- * 시계는 넘길 수 없으므로(컨트롤러가 안에서 `new Date()` 를 읽는다) **`lockedAt` 을 과거로
- * 옮겨** 시간이 지난 상태를 만든다.
- */
-
-import { config } from '@things-factory/env'
-
-import { closeAuthDatabase, Domain, getRepository, openAuthDatabase, resetAuthDatabase } from './db'
-import { loadCompiled } from './compiled'
-
-const { User } = loadCompiled('service/user/user')
-const { signin } = loadCompiled('controllers/signin')
-
-const PASSWORD = 'Passw0rd!'
-const WRONG = 'Wr0ngPass!'
-
-/** 기본값은 10분이다 — 설정이 없을 때의 값(`utils/lock-duration.ts`). */
-const DEFAULT_MINUTES = 10
-
-let domain: any
-
-async function seedUser(overrides: any = {}) {
-  const salt = User.generateSalt()
-
-  return await getRepository(User).save({
-    username: 'kim',
-    email: 'kim@example.com',
-    name: 'Kim',
-    salt,
-    password: User.encode(PASSWORD, salt),
-    status: 'activated',
-    domains: [domain],
-    ...overrides
-  })
-}
-
-const attempt = (password: string) => signin({ username: 'kim', password })
-
-const reload = (id: string) => getRepository(User).findOneBy({ id })
-
-/** 잠긴 시각을 `minutes` 분 전으로 옮긴다 — 시간이 지난 상태를 만드는 방법. */
-async function ageLock(id: string, minutes: number) {
-  await getRepository(User).update({ id }, { lockedAt: new Date(Date.now() - minutes * 60 * 1000) })
-}
-
-async function lockOut() {
-  const user = await seedUser()
-  for (let i = 0; i < 5; i++) {
-    await expect(attempt(WRONG)).rejects.toThrow()
-  }
-  return user
-}
-
-beforeAll(async () => {
-  await openAuthDatabase()
-})
-
-beforeEach(async () => {
-  await resetAuthDatabase()
-  domain = await getRepository(Domain).save({ name: 'plant-a', subdomain: 'plant-a' })
-})
-
-afterAll(async () => {
-  await closeAuthDatabase()
-})
-
-describe('잠글 때 시각을 남긴다', () => {
-  it('다섯 번째 실패에 `lockedAt` 이 써진다', async () => {
-    const before = Date.now()
-    const user = await lockOut()
-    const after = Date.now()
-
-    const locked = await reload(user.id)
-
-    expect(locked.status).toBe('locked')
-    expect(locked.lockedAt).toBeTruthy()
-
-    const at = new Date(locked.lockedAt).getTime()
-    expect(at).toBeGreaterThanOrEqual(before - 1000)
-    expect(at).toBeLessThanOrEqual(after + 1000)
-  })
-
-  it('네 번째까지는 시각이 없다', async () => {
-    const user = await seedUser()
-
-    for (let i = 0; i < 4; i++) {
-      await expect(attempt(WRONG)).rejects.toThrow()
-    }
-
-    const still = await reload(user.id)
-    expect(still.status).toBe('activated')
-    expect(still.lockedAt).toBeFalsy()
-  })
-})
-
-describe('기본 10분 안에는 잠겨 있다', () => {
-  it('맞는 비밀번호도 거절한다', async () => {
-    const user = await lockOut()
-    await ageLock(user.id, DEFAULT_MINUTES - 1)
-
-    await expect(attempt(PASSWORD)).rejects.toThrow()
-    expect((await reload(user.id)).status).toBe('locked')
-  })
-})
-
-describe('시간이 지나면 스스로 풀린다', () => {
-  it('맞는 비밀번호로 들어가진다', async () => {
-    const user = await lockOut()
-    await ageLock(user.id, DEFAULT_MINUTES + 1)
-
-    const result = await attempt(PASSWORD)
-
-    expect(result.token).toBeTruthy()
-  })
-
-  it('행이 되돌아간다 — 상태·셈·시각 셋 다', async () => {
-    const user = await lockOut()
-    await ageLock(user.id, DEFAULT_MINUTES + 1)
-
-    await attempt(PASSWORD)
-
-    const released = await reload(user.id)
-    expect(released.status).toBe('activated')
-    expect(released.failCount).toBe(0)
-    expect(released.lockedAt).toBeFalsy()
-  })
-
-  it('풀린 뒤 틀려도 셈이 1 부터 다시 센다 — 잠금이 곧 창이다', async () => {
-    const user = await lockOut()
-    await ageLock(user.id, DEFAULT_MINUTES + 1)
-
-    /* 틀린 비밀번호로도 잠금이 풀린다 — 판정이 대조보다 먼저다. */
-    await expect(attempt(WRONG)).rejects.toThrow()
-
-    const after = await reload(user.id)
-    expect(after.status).toBe('activated')
-    expect(after.failCount).toBe(1)
-    expect(after.lockedAt).toBeFalsy()
-  })
-
-  it('다시 잠기려면 다섯 번을 새로 틀려야 한다', async () => {
-    const user = await lockOut()
-    await ageLock(user.id, DEFAULT_MINUTES + 1)
-
-    for (let i = 0; i < 4; i++) {
-      await expect(attempt(WRONG)).rejects.toThrow()
-    }
-    expect((await reload(user.id)).status).toBe('activated')
-
-    await expect(attempt(WRONG)).rejects.toThrow()
-    expect((await reload(user.id)).status).toBe('locked')
-  })
-})
-
-describe('`lockedAt` 이 없는 잠긴 행 — 이 변경 전에 잠긴 것', () => {
-  it('풀리지 않는다', async () => {
-    /* 조용히 열리는 쪽으로 기울면 잠긴 계정 전체가 한 번에 열린다. 관리자(`activateUser`)와
-       잠금 해제 메일이 푸는 길로 남긴다. */
-    const user = await seedUser({ status: 'locked', failCount: 5, lockedAt: null })
-
-    await expect(attempt(PASSWORD)).rejects.toThrow()
-    expect((await reload(user.id)).status).toBe('locked')
-  })
-})
-
-describe('요청 경로(`checkAuth`)도 같은 판정을 쓴다', () => {
-  it('잠긴 동안에는 토큰을 거절한다', async () => {
-    const user = await lockOut()
-    await ageLock(user.id, DEFAULT_MINUTES - 1)
-
-    await expect(User.checkAuth({ username: 'kim' })).rejects.toThrow()
-  })
-
-  it('시간이 지나면 통과시킨다 — 그리고 **행을 고치지 않는다**', async () => {
-    /* 매 요청 지나는 경로라 쓰기를 얹지 않는다. 행 정리는 다음 `signin` 이 한다. */
-    const user = await lockOut()
-    await ageLock(user.id, DEFAULT_MINUTES + 1)
-
-    const authed = await User.checkAuth({ username: 'kim' })
-    expect(authed.id).toBe(user.id)
-
-    const untouched = await reload(user.id)
-    expect(untouched.status).toBe('locked')
-    expect(untouched.lockedAt).toBeTruthy()
-  })
-})
-
-describe('설정으로 자동해제를 끌 수 있다', () => {
-  afterEach(() => {
-    config.set('password', undefined)
-  })
-
-  it('0 이면 시간이 지나도 풀리지 않는다', async () => {
-    config.set('password', { lockDurationMinutes: 0 })
-
-    const user = await lockOut()
-    await ageLock(user.id, 60 * 24 * 365)
-
-    await expect(attempt(PASSWORD)).rejects.toThrow()
-    expect((await reload(user.id)).status).toBe('locked')
-  })
-
-  it('설정한 분이 지나면 풀린다', async () => {
-    config.set('password', { lockDurationMinutes: 1 })
-
-    const user = await lockOut()
-    await ageLock(user.id, 2)
-
-    expect((await attempt(PASSWORD)).token).toBeTruthy()
-  })
-})

package/tests/account-lock-rule.test.ts

@@ -1,141 +0,0 @@
-/**
- * 계정 잠금 판정 규칙 시험 — 순수 함수라 엔티티에 닿지 않는다.
- *
- * 이 규칙이 하는 일은 하나다: 「이 잠금이 아직 유효한가」. 그 답을 두 곳이 쓴다 —
- * `signin`(들어오려는 사람)과 `User.checkAuth`(요청마다). 두 곳이 각자 판단하면 로그인은
- * 되는데 요청은 거절되는 상태가 생기므로 규칙을 한 곳에 두었고, 여기서 그 규칙만 본다.
- *
- * 시계를 인자로 받으므로 「10분 뒤」를 기다리지 않고 시험한다.
- */
-
-import {
-  AccountLockFacts,
-  LOCKED_STATUS,
-  LOCK_FOREVER,
-  accountLockExpiresAt,
-  isAccountLocked,
-  isAccountLockExpired
-} from '../server/utils/account-lock-rule.js'
-import { loadCompiled } from './compiled'
-
-const MINUTES = 10
-const AT = new Date('2026-09-10T09:00:00.000Z')
-const minutesAfter = (n: number) => new Date(AT.getTime() + n * 60 * 1000)
-
-const locked = (overrides: Partial<AccountLockFacts> = {}): AccountLockFacts => ({
-  status: LOCKED_STATUS,
-  lockedAt: AT,
-  ...overrides
-})
-
-describe('엔티티와 값이 어긋나지 않는다', () => {
-  it('`LOCKED_STATUS` 가 `UserStatus.LOCKED` 와 같다', () => {
-    /* 이 규칙은 엔티티를 import 하지 않는다(그러면 순수 시험이 닿지 못한다). 그래서 두 값이
-       어긋나는 것을 막는 것은 이 시험뿐이다. */
-    const { UserStatus } = loadCompiled('service/user/user')
-
-    expect(LOCKED_STATUS).toBe(UserStatus.LOCKED)
-  })
-})
-
-describe('잠금이 아닌 상태', () => {
-  it('활성 계정은 잠금이 아니다', () => {
-    for (const status of ['activated', 'inactive', 'deleted', 'banned', 'password_reset_required']) {
-      expect(isAccountLocked({ status, lockedAt: AT }, AT, MINUTES)).toBe(false)
-      expect(isAccountLockExpired({ status, lockedAt: AT }, AT, MINUTES)).toBe(false)
-      expect(accountLockExpiresAt({ status, lockedAt: AT }, MINUTES)).toBeNull()
-    }
-  })
-
-  it('사실이 비어 있어도 던지지 않는다', () => {
-    for (const facts of [undefined, null, {}, { status: null }] as any[]) {
-      expect(isAccountLocked(facts, AT, MINUTES)).toBe(false)
-    }
-  })
-})
-
-describe('시간이 지나면 풀린다', () => {
-  it('설정한 시간 안에는 잠겨 있다', () => {
-    expect(isAccountLocked(locked(), AT, MINUTES)).toBe(true)
-    expect(isAccountLocked(locked(), minutesAfter(9), MINUTES)).toBe(true)
-  })
-
-  it('설정한 시간이 지나면 풀린다', () => {
-    expect(isAccountLocked(locked(), minutesAfter(10), MINUTES)).toBe(false)
-    expect(isAccountLocked(locked(), minutesAfter(60), MINUTES)).toBe(false)
-  })
-
-  it('경계는 만료 시각을 포함하지 않는다 — 정확히 10분이면 풀린 것이다', () => {
-    const facts = locked()
-
-    expect(isAccountLocked(facts, minutesAfter(10 - 1 / 60000), MINUTES)).toBe(true)
-    expect(isAccountLocked(facts, minutesAfter(10), MINUTES)).toBe(false)
-  })
-
-  it('풀린 것을 따로 물을 수 있다 — 행을 되돌려야 하는지 판단하는 자리', () => {
-    expect(isAccountLockExpired(locked(), minutesAfter(5), MINUTES)).toBe(false)
-    expect(isAccountLockExpired(locked(), minutesAfter(15), MINUTES)).toBe(true)
-  })
-
-  it('만료 시각을 계산해 준다', () => {
-    expect(accountLockExpiresAt(locked(), MINUTES)).toEqual(minutesAfter(10))
-  })
-
-  it('드라이버가 문자열로 준 시각도 읽는다', () => {
-    /* sqlite·mssql 은 `Date` 대신 문자열을 주기도 한다. */
-    const facts = locked({ lockedAt: AT.toISOString() })
-
-    expect(isAccountLocked(facts, minutesAfter(5), MINUTES)).toBe(true)
-    expect(isAccountLocked(facts, minutesAfter(15), MINUTES)).toBe(false)
-  })
-})
-
-describe('문은 `status` 가 지킨다 — `lockedAt` 이 아니다', () => {
-  it('한 번도 잠긴 적 없는 계정은 `lockedAt` 이 없어도 열려 있다', () => {
-    /*
-     * 이 한 줄이 배포 사고 하나를 막는다. 판정이 `lockedAt` 을 먼저 보면 칸이 비어 있는
-     * **모든** 계정(= 한 번도 잠긴 적 없는 계정 전부)이 잠김이 되어 아무도 못 들어온다.
-     * 그래서 `status` 를 먼저 보고, 잠금이 아니면 `lockedAt` 을 아예 보지 않는다.
-     */
-    const never = { status: 'activated' } as AccountLockFacts
-
-    expect(isAccountLocked(never, AT, MINUTES)).toBe(false)
-    expect(isAccountLockExpired(never, AT, MINUTES)).toBe(false)
-    expect(accountLockExpiresAt(never, MINUTES)).toBeNull()
-  })
-
-  it('자동해제를 끈 설정에서도 잠기지 않은 계정은 열려 있다', () => {
-    /* 「자동해제 없음」이 「전원 잠금」이 되지 않는다. */
-    expect(isAccountLocked({ status: 'activated' }, AT, LOCK_FOREVER)).toBe(false)
-    expect(isAccountLocked({ status: 'activated', lockedAt: null }, AT, LOCK_FOREVER)).toBe(false)
-  })
-})
-
-describe('잠긴 계정에서 `lockedAt` 이 없을 때', () => {
-  it('「잠겼다」가 아니라 **「자동 해제가 없다」**가 된다', () => {
-    /*
-     * 이 변경 전에 잠긴 행에는 칸이 비어 있다. 언제 풀릴지 계산할 수 없으니 자동으로는 안
-     * 풀린다 — 풀어 주는 쪽으로 기울면 **잠긴 계정 전체가 조용히 열린다.** 관리자
-     * (`activateUser`)와 잠금 해제 메일이 푸는 길로 남는다.
-     *
-     * 이것은 위 절과 짝이다: 잠금 여부는 `status` 가 정하고, 여기서 `lockedAt` 이 정하는 것은
-     * **해제 시각이 있나**뿐이다.
-     */
-    for (const lockedAt of [undefined, null, '', 'not-a-date'] as any[]) {
-      const facts = locked({ lockedAt })
-
-      expect(isAccountLocked(facts, minutesAfter(600), MINUTES)).toBe(true)
-      expect(isAccountLockExpired(facts, minutesAfter(600), MINUTES)).toBe(false)
-      expect(accountLockExpiresAt(facts, MINUTES)).toBeNull()
-    }
-  })
-})
-
-describe('자동해제를 끄는 설정', () => {
-  it('0 이하면 풀리지 않는다', () => {
-    for (const duration of [LOCK_FOREVER, 0, -1, undefined, null, NaN] as any[]) {
-      expect(isAccountLocked(locked(), minutesAfter(60 * 24 * 365), duration)).toBe(true)
-      expect(accountLockExpiresAt(locked(), duration)).toBeNull()
-    }
-  })
-})

package/tests/account-mail.test.ts

@@ -1,69 +0,0 @@
-/**
- * The four account mails: each in the person's language, with its own subject, in the one mail every module sends -
- * the application's brand at the head, never the old frame with a logo fetched from hatiolab.com.
- */
-import fs from 'fs'
-import path from 'path'
-
-import { DEFAULT_BRAND } from '@things-factory/email-base'
-import { i18next, NAMESPACE, translatorFor } from '@things-factory/i18n-base/translator'
-
-import { ACCOUNT_MAIL_KINDS, accountMail, accountMailWords } from '../server/controllers/account-mail'
-
-const LANGUAGES = ['ko', 'en', 'ja', 'zh', 'ms', 'es']
-const LINK = 'https://office.example.com/auth/reset-password#token'
-
-/* A test runs outside an application, so the translator has not gathered this module's words; they are added here. */
-beforeAll(() => {
-  for (const lng of LANGUAGES) {
-    const words = JSON.parse(fs.readFileSync(path.resolve(__dirname, '../translations', `${lng}.json`), 'utf8'))
-    i18next.addResourceBundle(lng, NAMESPACE, words, true, true)
-  }
-})
-
-describe('the words of an account mail', () => {
-  test('every mail has its subject, body and button in every language - never a key', () => {
-    for (const lng of LANGUAGES) {
-      for (const kind of ACCOUNT_MAIL_KINDS) {
-        const words = accountMailWords(translatorFor(lng), kind, 'Brand X')
-
-        for (const [part, text] of Object.entries(words)) {
-          expect([lng, kind, part, text]).not.toEqual([lng, kind, part, expect.stringMatching(/^(title|text|button)\.account-mail-/)])
-          expect([lng, kind, part, text.trim()]).not.toEqual([lng, kind, part, ''])
-        }
-        expect(words.body).toContain('Brand X')
-      }
-    }
-  })
-
-  test('the four subjects differ in every language - a reset is not mistaken for an unlock', () => {
-    for (const lng of LANGUAGES) {
-      const subjects = ACCOUNT_MAIL_KINDS.map(kind => accountMailWords(translatorFor(lng), kind, 'Brand X').subject)
-      expect(new Set(subjects).size).toBe(ACCOUNT_MAIL_KINDS.length)
-    }
-  })
-})
-
-describe('an account mail', () => {
-  const context = (lng?: string) => ({ lng, i18next })
-
-  test('is written in the person’s language, else the language of the request', () => {
-    expect(accountMail({ kind: 'unlock-account', user: { locale: 'ko-KR' }, link: LINK, context: context('en-US') }).subject).toBe('계정 잠김')
-    expect(accountMail({ kind: 'unlock-account', user: { locale: null }, link: LINK, context: context('ja') }).subject).toBe(
-      translatorFor('ja')('title.account-mail-unlock-account')
-    )
-  })
-
-  test('is the one mail: the brand at the head, the subject in the band, the link as the button, no fetched image', () => {
-    const { subject, content } = accountMail({ kind: 'reset-password', user: { locale: 'ko' }, link: LINK, context: context() })
-
-    expect(subject).toBe('비밀번호 재설정')
-    expect(content).toContain('<html lang="ko">')
-    expect(content).toContain(`>${DEFAULT_BRAND.name}<`)
-    expect(content).toContain(`href="${LINK}"`)
-    expect(content).toContain('>비밀번호 재설정</font></a')
-    expect(content).toContain('Copyright © HatioLab Inc. All rights reserved.')
-    expect(content).not.toContain('<img')
-    expect(content).not.toContain('Hatio, Lab.')
-  })
-})

package/tests/activate-page-case.test.ts

@@ -1,53 +0,0 @@
-import { loadCompiled } from './compiled'
-
-const { authenticate401Middleware } = loadCompiled('middlewares/authenticate-401-middleware')
-const { AuthError } = loadCompiled('errors/auth-error')
-const CODES = loadCompiled('constants/error-code')
-
-/**
- * One page, `auth-activate`, answers a locked account and one not yet confirmed. It said "your
- * account is not activated" to both: the reason was in `message`, and the page never read it. A
- * locked person was not told why, nor that the unlock mail had already gone.
- *
- * The page tells the two apart by `errorCode`, so that is what this holds - for both cases.
- */
-
-async function pageFor(errorCode: string) {
-  let rendered: any
-
-  const context: any = {
-    t: (key: string) => key,
-    method: 'GET',
-    header: { accept: 'text/html' },
-    path: '/',
-    originalUrl: '/',
-    query: {},
-    request: { body: {} },
-    render: async (view: string, options: any) => {
-      rendered = { view, ...options }
-    }
-  }
-
-  await authenticate401Middleware(context, async () => {
-    throw new AuthError({ errorCode, detail: { username: 'kim', email: 'kim@example.com' } })
-  })
-
-  return rendered
-}
-
-describe.each([CODES.USER_LOCKED, CODES.USER_NOT_ACTIVATED])('%s', errorCode => {
-  it('goes to the activate page with its code', async () => {
-    const page = await pageFor(errorCode)
-
-    expect(page.pageElement).toBe('auth-activate')
-    expect(page.data.errorCode).toBe(errorCode)
-  })
-})
-
-it('the page reads the locked code by the spelling the server sends', () => {
-  const { readFileSync } = require('fs')
-  const { join } = require('path')
-  const page = readFileSync(join(__dirname, '..', '..', 'auth-ui', 'client', 'entries', 'auth', 'activate.ts'), 'utf-8')
-
-  expect(page).toContain(`this.data?.errorCode === '${CODES.USER_LOCKED}'`)
-})