@things-factory/auth-base 10.1.278 → 10.1.280

package/tests/audit-db.test.ts

@@ -1,410 +0,0 @@
-/**
- * The audit record (ADR-0141) - what it keeps, and what it never keeps.
- *
- * The doors run through the real `@privilege` wrapper on an SDL schema (the shape
- * `privilege-directive.test.ts` uses - type-graphql resolvers cannot be loaded under jest), inside a
- * real audit scope, against the sqlite harness. Grants run through the real subscribers.
- */
-
-import { graphql } from 'graphql'
-import { makeExecutableSchema } from '@graphql-tools/schema'
-
-import { authDataSource, closeAuthDatabase, Domain, getRepository, openAuthDatabase, resetAuthDatabase } from './db'
-import { loadCompiled } from './compiled'
-
-const { privilegeDirectiveTypeDefs, privilegeDirectiveResolver } = loadCompiled('service/privilege/privilege-directive')
-const { auditTargetDirectiveTypeDefs } = loadCompiled('service/audit/audit-target')
-const { runInAuditScope, recordAuditAction, flushAudit, auditHealth } = loadCompiled('service/audit/audit-recorder')
-const { AuditAction } = loadCompiled('service/audit/audit-action')
-const { AuditRequest } = loadCompiled('service/audit/audit-request')
-const { AuditQuery } = loadCompiled('service/audit/audit-query')
-const { purgeExpiredAudit } = loadCompiled('service/audit/audit-retention')
-const { User } = loadCompiled('service/user/user')
-const { Role } = loadCompiled('service/role/role')
-const { Privilege } = loadCompiled('service/privilege/privilege')
-const { signin } = loadCompiled('controllers/signin')
-
-const PASSWORD = 'Passw0rd!'
-
-let domain: any
-let other: any
-let kim: any
-let lee: any
-
-const typeDefs = `
-  type Item { id: String }
-  type Query {
-    payslip(employeeId: String): String
-      @privilege(category: "payroll", privilege: "query")
-      @auditTarget(kind: "Employee", arg: "employeeId")
-    payslips: [Item] @privilege(category: "payroll", privilege: "query")
-    broken: String @privilege(category: "payroll", privilege: "query")
-    ownersOnly: String @privilege(superUserGranted: true)
-  }
-`
-
-function buildSchema() {
-  const schema = makeExecutableSchema({
-    typeDefs: [privilegeDirectiveTypeDefs, auditTargetDirectiveTypeDefs, typeDefs],
-    resolvers: {
-      Query: {
-        payslip: (_: any, { employeeId }: any) => `pay of ${employeeId}`,
-        payslips: () => [{ id: 'a' }, { id: 'b' }, { id: 'c' }],
-        broken: () => {
-          const error: any = new Error('salary 4,200,000 for kim')
-          error.extensions = { code: 'INTERNAL_SERVER_ERROR' }
-          throw error
-        },
-        ownersOnly: () => 'ok'
-      }
-    }
-  })
-  return privilegeDirectiveResolver(schema, { modules: [], mode: 'boot' })
-}
-
-/** A koa-like request: what the recorder reads from it and nothing more. */
-function koaContext(user: any, query: string, at = domain) {
-  return {
-    method: 'POST',
-    path: '/graphql',
-    state: { domain: at, user },
-    req: { headers: { 'x-forwarded-for': '203.0.113.7, 10.0.0.1' }, socket: { remoteAddress: '10.0.0.1' } },
-    request: { header: { 'user-agent': 'Mozilla/5.0 test' }, body: { query, operationName: 'Pay' } }
-  }
-}
-
-/** One request through the schema, as the auth middleware runs it. */
-async function request(user: any, query: string, at = domain) {
-  const context = koaContext(user, query, at)
-  const result = await runInAuditScope(context, 'graphql', () => graphql({ schema: buildSchema(), source: query, contextValue: context }))
-  await flushAudit()
-  return result
-}
-
-const actions = (where: any = {}) => getRepository(AuditAction).find({ where, relations: ['actor', 'domain'] })
-
-async function seedUser(name: string, overrides: any = {}) {
-  const salt = User.generateSalt()
-  return await getRepository(User).save({
-    username: name,
-    email: `${name}@example.com`,
-    name,
-    salt,
-    password: User.encode(PASSWORD, salt),
-    status: 'activated',
-    domains: [domain],
-    ...overrides
-  })
-}
-
-function allow(granted: boolean, { superUser = false } = {}) {
-  User.hasPrivilege = jest.fn().mockResolvedValue(granted)
-  ;(process as any).domainOwnerGranted = jest.fn().mockResolvedValue(false)
-  ;(process as any).superUserGranted = jest.fn().mockResolvedValue(superUser)
-}
-
-const originalHasPrivilege = User.hasPrivilege
-
-beforeAll(async () => {
-  await openAuthDatabase()
-})
-
-beforeEach(async () => {
-  await resetAuthDatabase()
-  User.hasPrivilege = originalHasPrivilege
-  domain = await getRepository(Domain).save({ name: 'office', subdomain: 'office' })
-  other = await getRepository(Domain).save({ name: 'plant', subdomain: 'plant' })
-  kim = await seedUser('kim')
-  lee = await seedUser('lee')
-})
-
-afterEach(() => {
-  delete (process as any).domainOwnerGranted
-  delete (process as any).superUserGranted
-})
-
-afterAll(async () => {
-  await closeAuthDatabase()
-})
-
-describe('a request is one line, its doors are rows (§3.1 · §3.2)', () => {
-  it('equal checks in one request become one row with a count, keeping each target', async () => {
-    allow(true)
-    await request(kim, '{ a: payslip(employeeId: "emp-one") b: payslip(employeeId: "emp-two") c: payslip(employeeId: "emp-one") }')
-
-    const [line] = await getRepository(AuditRequest).find({ relations: ['actor', 'domain'] })
-    expect(line).toMatchObject({ channel: 'graphql', operationType: 'query', operationName: 'Pay', fields: 'payslip', ip: '203.0.113.7', userAgent: 'Mozilla/5.0 test' })
-    /* The root fields by schema name - the arguments asked never reach the line. */
-    expect(JSON.stringify(line)).not.toMatch(/emp-one|emp-two/)
-    expect(line.actor.id).toBe(kim.id)
-    expect(line.domain.id).toBe(domain.id)
-
-    const [check] = await actions({ kind: 'door.check' })
-    expect(check).toMatchObject({ door: 'payroll:query', decision: 'granted', basis: 'role', count: 3, targetKind: 'Employee', targetRole: 'requested', requestId: line.id })
-    expect([...check.targetIds].sort()).toEqual(['emp-one', 'emp-two'])
-
-    const [result] = await actions({ kind: 'door.result' })
-    expect(result).toMatchObject({ outcome: 'ok', count: 3 })
-  })
-
-  it('a check-in outside GraphQL is a line under the site and person its event named', async () => {
-    const context = { method: 'GET', path: '/auth/checkin/office', state: {}, req: { headers: {}, socket: { remoteAddress: '10.0.0.9' } }, request: { header: {} }, _matchedRoute: '/auth/checkin/:subdomain?' }
-    await runInAuditScope(context, 'http', () => recordAuditAction({ kind: 'auth.checkin', outcome: 'ok' }, { actorId: kim.id, domainId: domain.id }))
-    await flushAudit()
-
-    const [line] = await getRepository(AuditRequest).find({ relations: ['actor', 'domain'] })
-    expect(line).toMatchObject({ channel: 'http', route: '/auth/checkin/:subdomain?', ip: '10.0.0.9' })
-    expect(line.actor.id).toBe(kim.id)
-    expect(line.domain.id).toBe(domain.id)
-  })
-
-  it('an http request that recorded nothing leaves no line', async () => {
-    await runInAuditScope({ method: 'GET', path: '/theme.css', state: {} }, 'http', async () => undefined)
-    await flushAudit()
-    expect(await getRepository(AuditRequest).count()).toBe(0)
-  })
-
-  it('a list counts what it returned', async () => {
-    allow(true)
-    await request(kim, '{ payslips { id } }')
-
-    const [result] = await actions({ kind: 'door.result' })
-    expect(result.returned).toBe(3)
-  })
-
-  it('a refusal is a check with its cause and no result', async () => {
-    allow(false)
-    await request(kim, '{ payslip(employeeId: "e9") }')
-
-    const rows = await actions()
-    expect(rows).toHaveLength(1)
-    expect(rows[0]).toMatchObject({ kind: 'door.check', decision: 'denied', basis: 'role', targetIds: ['e9'] })
-  })
-
-  it('passing the door is not doing the work - an error is a result with a code, never the message', async () => {
-    allow(true)
-    await request(kim, '{ broken }')
-
-    const [result] = await actions({ kind: 'door.result' })
-    expect(result).toMatchObject({ outcome: 'error', code: 'INTERNAL_SERVER_ERROR' })
-    expect(JSON.stringify(await actions())).not.toMatch(/4,200,000|salary/)
-  })
-
-  it('a pass that rested on superuser says so', async () => {
-    allow(false, { superUser: true })
-    await request(kim, '{ ownersOnly }')
-
-    const [check] = await actions({ kind: 'door.check' })
-    expect(check).toMatchObject({ door: 'super', decision: 'granted', basis: 'superuser' })
-  })
-})
-
-describe('who may do what is recorded where it is saved (§3.3 · §4-1)', () => {
-  async function grant(user: any, roles: any[]) {
-    const holder = await getRepository(User).findOne({ where: { id: user.id }, relations: ['roles'] })
-    holder.roles = roles
-    return await getRepository(User).save(holder)
-  }
-
-  it('a role given and taken back', async () => {
-    const role = await getRepository(Role).save({ name: 'payroll', domain })
-
-    await runInAuditScope(koaContext(lee, ''), 'http', () => grant(kim, [role]))
-    await runInAuditScope(koaContext(lee, ''), 'http', () => grant(kim, []))
-    await flushAudit()
-
-    const granted = await actions({ kind: 'role.grant' })
-    expect(granted).toHaveLength(1)
-    expect(granted[0]).toMatchObject({ targetKind: 'User', targetIds: [kim.id], objectKind: 'Role', objectId: role.id })
-    expect(granted[0].actor.id).toBe(lee.id)
-    expect(granted[0].domain.id).toBe(domain.id)
-
-    expect(await actions({ kind: 'role.revoke' })).toHaveLength(1)
-  })
-
-  it('a privilege added to a role, and removed', async () => {
-    const privilege = await getRepository(Privilege).save({ name: 'query', category: 'payroll' })
-    const role = await getRepository(Role).save({ name: 'payroll', domain, privileges: [privilege] })
-    role.privileges = []
-    await getRepository(Role).save(role)
-
-    expect(await actions({ kind: 'role.privilege.add' })).toMatchObject([{ targetIds: [role.id], objectKind: 'Privilege', objectId: privilege.id }])
-    expect(await actions({ kind: 'role.privilege.remove' })).toHaveLength(1)
-  })
-
-  it('a status change keeps the states, nothing else', async () => {
-    kim.status = 'inactive'
-    await getRepository(User).save(kim)
-
-    const [row] = await actions({ kind: 'user.status' })
-    expect(row.detail).toEqual({ from: 'activated', to: 'inactive' })
-  })
-
-  it('a grant rolled back leaves no record', async () => {
-    const role = await getRepository(Role).save({ name: 'payroll', domain })
-
-    await expect(
-      authDataSource().transaction(async manager => {
-        const holder = await manager.getRepository(User).findOne({ where: { id: kim.id }, relations: ['roles'] })
-        holder.roles = [role]
-        await manager.getRepository(User).save(holder)
-        throw new Error('the change failed')
-      })
-    ).rejects.toThrow('the change failed')
-
-    expect(await actions({ kind: 'role.grant' })).toHaveLength(0)
-  })
-
-  it('a grant whose record cannot be written does not happen', async () => {
-    const role = await getRepository(Role).save({ name: 'payroll', domain })
-    const table = authDataSource().getMetadata(AuditAction).tableName
-    await authDataSource().query(`ALTER TABLE ${table} RENAME TO ${table}_away`)
-
-    try {
-      await expect(grant(kim, [role])).rejects.toThrow()
-    } finally {
-      await authDataSource().query(`ALTER TABLE ${table}_away RENAME TO ${table}`)
-    }
-
-    const holder = await getRepository(User).findOne({ where: { id: kim.id }, relations: ['roles'] })
-    expect(holder.roles).toHaveLength(0)
-  })
-})
-
-describe('only the fields it allows (§3.4)', () => {
-  it('a detail key the kind did not register is refused', async () => {
-    await expect(recordAuditAction({ kind: 'user.status', detail: { salary: 4200000 } })).rejects.toThrow(/does not allow detail "salary"/)
-  })
-
-  it('a kind nobody registered is refused', async () => {
-    await expect(recordAuditAction({ kind: 'payroll.view' })).rejects.toThrow(/not registered/)
-  })
-})
-
-describe('signing in (§3.3)', () => {
-  it('a success, a wrong password, an account that does not exist', async () => {
-    await signin({ username: 'kim', password: PASSWORD })
-    await expect(signin({ username: 'kim', password: 'Wr0ngPass!' })).rejects.toThrow()
-    await expect(signin({ username: 'nobody', password: PASSWORD })).rejects.toThrow()
-    await flushAudit()
-
-    const rows = await getRepository(AuditAction).find({ where: { kind: 'auth.signin' }, relations: ['actor'], order: { createdAt: 'ASC' } })
-    expect(rows.map(row => [row.outcome, row.code, row.actor?.id ?? null, row.detail?.method])).toEqual([
-      ['ok', null, kim.id, 'password'],
-      ['error', 'password-not-matched', kim.id, 'password'],
-      ['error', 'user not found', null, 'password']
-    ])
-  })
-})
-
-describe('a write that fails is counted apart and does not stop the answer (§4-4 · §4-5)', () => {
-  it('the request is answered and the failure counted', async () => {
-    allow(true)
-    const before = auditHealth().failures
-    const table = authDataSource().getMetadata(AuditRequest).tableName
-    await authDataSource().query(`ALTER TABLE ${table} RENAME TO ${table}_away`)
-
-    try {
-      const result = await request(kim, '{ payslip(employeeId: "e1") }')
-      expect(result.data).toEqual({ payslip: 'pay of e1' })
-    } finally {
-      await authDataSource().query(`ALTER TABLE ${table}_away RENAME TO ${table}`)
-    }
-
-    expect(auditHealth().failures).toBe(before + 1)
-    expect(auditHealth().lastFailedAt).toBeInstanceOf(Date)
-  })
-})
-
-describe('reading the audit (§5 · §6)', () => {
-  const day = 24 * 60 * 60 * 1000
-  const from = new Date(Date.now() - day)
-  const to = new Date(Date.now() + day)
-  const context = (user = lee, at = domain) => ({ state: { domain: at, user } })
-
-  it("each member's checks, audit reads left out, and only this domain's", async () => {
-    allow(true)
-    await request(kim, '{ payslip(employeeId: "e1") }')
-    await request(kim, '{ payslips { id } }', other)
-    allow(false)
-    await request(kim, '{ payslip(employeeId: "e2") }')
-    await recordAuditAction({ kind: 'door.check', door: 'audit:query', decision: 'granted' }, { actorId: kim.id, domainId: domain.id })
-    await recordAuditAction({ kind: 'auth.checkin', outcome: 'ok' }, { actorId: kim.id, domainId: domain.id })
-
-    const people = await new AuditQuery().auditPeople(from, to, context())
-    const row = people.find((one: any) => one.user.id === kim.id)
-    expect(row).toMatchObject({ granted: 1, denied: 1, checkins: 1 })
-    expect(row.lastCheckinAt).toBeInstanceOf(Date)
-    /* The moment itself - a driver's zone-less text read as local time was hours off. */
-    expect(Math.abs(row.lastCheckinAt.getTime() - Date.now())).toBeLessThan(60_000)
-    expect(people.find((one: any) => one.user.id === lee.id)).toMatchObject({ granted: 0, denied: 0, checkins: 0 })
-  })
-
-  it("each member's last use is their latest request to this domain, and none before any", async () => {
-    allow(true)
-    await getRepository(AuditRequest).save([
-      { id: '00000000-0000-4000-8000-000000000001', domain, actor: kim, channel: 'graphql', createdAt: new Date(Date.now() - 3 * 60 * 60 * 1000) },
-      { id: '00000000-0000-4000-8000-000000000002', domain: other, actor: kim, channel: 'graphql', createdAt: new Date(Date.now() + 60 * 60 * 1000) }
-    ])
-    await request(kim, '{ payslip(employeeId: "e1") }')
-
-    const people = await new AuditQuery().auditPeople(from, to, context())
-    const row = people.find((one: any) => one.user.id === kim.id)
-    expect(row.lastUsedAt).toBeInstanceOf(Date)
-    /* The latest of this domain's - not the older one here, nor the later one in another domain. */
-    expect(Math.abs(row.lastUsedAt.getTime() - Date.now())).toBeLessThan(60_000)
-    expect(people.find((one: any) => one.user.id === lee.id).lastUsedAt).toBeUndefined()
-  })
-
-  it('every declared door, one with no record in the period too', async () => {
-    await getRepository(Privilege).save([
-      { name: 'query', category: 'payroll' },
-      { name: 'mutation', category: 'payroll' },
-      { name: 'query', category: 'audit' }
-    ])
-    allow(true)
-    await request(kim, '{ payslip(employeeId: "e1") }')
-
-    const doors = await new AuditQuery().auditDoors(from, to, context())
-    expect(doors.map((one: any) => [one.door, one.people, one.granted])).toEqual([
-      ['payroll:mutation', 0, 0],
-      ['payroll:query', 1, 1]
-    ])
-  })
-
-  it('records narrow by outcome, and never reach another domain', async () => {
-    allow(true)
-    await request(kim, '{ payslip(employeeId: "e1") }')
-    await request(kim, '{ payslip(employeeId: "e1") }', other)
-    allow(false)
-    await request(lee, '{ payslip(employeeId: "e2") }')
-
-    const all = await new AuditQuery().auditRecords({ from, to }, context())
-    expect(all.total).toBe(2)
-
-    const denied = await new AuditQuery().auditRecords({ from, to, outcome: 'denied' }, context())
-    expect(denied.items.map((one: any) => one.request.actor.id)).toEqual([lee.id])
-    expect(denied.items[0].actions.map((one: any) => one.kind)).toEqual(['door.check'])
-  })
-
-  it('my record is what I did, whatever is asked', async () => {
-    await recordAuditAction({ kind: 'auth.checkin', outcome: 'ok' }, { actorId: kim.id, domainId: domain.id })
-    await recordAuditAction(
-      { kind: 'role.grant', targetKind: 'User', targetIds: [kim.id], objectKind: 'Role', objectId: 'r' },
-      { actorId: lee.id, domainId: domain.id }
-    )
-
-    const mine = await new AuditQuery().myAuditActions(undefined, 10, context(kim))
-    expect(mine.map((one: any) => one.kind)).toEqual(['auth.checkin'])
-  })
-})
-
-describe('retention (§7)', () => {
-  it('removes what is past a year and keeps the rest', async () => {
-    await recordAuditAction({ kind: 'auth.checkin', outcome: 'ok' }, { actorId: kim.id, domainId: domain.id })
-    const later = new Date(Date.now() + 366 * 24 * 60 * 60 * 1000)
-
-    expect(await purgeExpiredAudit(new Date())).toEqual({ requests: 0, actions: 0 })
-    expect(await purgeExpiredAudit(later)).toEqual({ requests: 0, actions: 1 })
-  })
-})

package/tests/audit-work.test.ts

@@ -1,58 +0,0 @@
-/**
- * Work done through the doors (ADR-0185 decision 6) - read from the audit: a declared mutation that went through is a
- * piece of the person's work on that day; an undeclared one, a failed one, another person's or another day's is not.
- */
-
-import { authDataSource, closeAuthDatabase, Domain, getRepository, openAuthDatabase, resetAuthDatabase } from './db'
-import { loadCompiled } from './compiled'
-
-const { registerWorkDoors, workDoneBy } = loadCompiled('service/audit/audit-work')
-const { AuditAction } = loadCompiled('service/audit/audit-action')
-const { AuditRequest } = loadCompiled('service/audit/audit-request')
-const { User } = loadCompiled('service/user/user')
-
-let domain: any, kim: any, lee: any
-
-beforeAll(async () => {
-  await openAuthDatabase()
-})
-afterAll(async () => {
-  await closeAuthDatabase()
-})
-
-beforeEach(async () => {
-  await resetAuthDatabase()
-  domain = await getRepository(Domain).save({ name: 'work', subdomain: 'work' })
-  kim = await getRepository(User).save({ name: 'kim', email: 'kim@work.test', status: 'activated' })
-  lee = await getRepository(User).save({ name: 'lee', email: 'lee@work.test', status: 'activated' })
-})
-
-const request = async (actor: any, at: string, fields: string, outcome: 'ok' | 'error' | 'both' | null, operationType = 'mutation') => {
-  const one = await getRepository(AuditRequest).save({ id: require('crypto').randomUUID(), domain, actor, createdAt: new Date(at), channel: 'graphql', operationType, fields })
-  for (const each of outcome === 'both' ? ['ok', 'error'] : outcome ? [outcome] : [])
-    await getRepository(AuditAction).save({ domain, actor, requestId: one.id, createdAt: new Date(at), kind: 'door.result', door: 'office:mutation', outcome: each })
-  return one
-}
-
-it('a declared mutation that went through is a piece of work, once per request and work', async () => {
-  registerWorkDoors([
-    { work: 'work.office.bank-lines', fields: ['updateMultipleCashTransaction', 'createCashTransaction'] },
-    { work: 'work.office.tax-invoices', fields: ['importOfficeTaxInvoices'] }
-  ])
-  expect(() => registerWorkDoors([{ work: 'work.other', fields: ['importOfficeTaxInvoices'] }])).toThrow(/declared as the work/)
-
-  await request(kim, '2026-11-10T01:00:00Z', 'updateMultipleCashTransaction,createCashTransaction', 'ok')
-  await request(kim, '2026-11-10T02:00:00Z', 'importOfficeTaxInvoices', 'ok')
-  await request(kim, '2026-11-10T03:00:00Z', 'importOfficeTaxInvoices', 'error')
-  await request(kim, '2026-11-10T03:30:00Z', 'createCashTransaction,importOfficeTaxInvoices', 'both')
-  await request(kim, '2026-11-10T04:00:00Z', 'saveMyDraft', 'ok')
-  await request(kim, '2026-11-10T05:00:00Z', 'importOfficeTaxInvoices', 'ok', 'query')
-  await request(lee, '2026-11-10T06:00:00Z', 'importOfficeTaxInvoices', 'ok')
-  await request(kim, '2026-11-17T01:00:00Z', 'importOfficeTaxInvoices', 'ok')
-
-  const done = await workDoneBy(authDataSource().manager, domain, kim.id, new Date('2026-11-09T00:00:00Z'), new Date('2026-11-16T00:00:00Z'))
-  expect(done.map((one: any) => [one.at.toISOString(), one.work])).toEqual([
-    ['2026-11-10T01:00:00.000Z', 'work.office.bank-lines'],
-    ['2026-11-10T02:00:00.000Z', 'work.office.tax-invoices']
-  ])
-})

package/tests/auth-base-role-tasks.test.ts

@@ -1,58 +0,0 @@
-/**
- * auth-base's own tasks (ADR-0139 decision 11) - each names doors declared where auth-base runs
- * (its own server or shell's, which it depends on), and says what it is in all six languages.
- *
- * A task naming a category nobody declares is a definition error only when an application builds a
- * seat from it; a task with no words shows its id on the role screen. Both are caught here, where
- * the task is written.
- */
-
-import { readdirSync, readFileSync } from 'fs'
-import { join } from 'path'
-
-import { loadCompiled } from './compiled'
-
-const { ROLE_TASKS } = loadCompiled('role-tasks')
-
-const LANGUAGES = ['ko', 'en', 'ja', 'zh', 'es', 'ms']
-const SERVERS = [join(__dirname, '..', 'server'), join(__dirname, '..', '..', 'shell', 'server')]
-
-/** Every `@privilege(category: "x", privilege: "y")` written in auth-base's and shell's server source. */
-function declaredDoors(): Set<string> {
-  const doors = new Set<string>()
-  const walk = (dir: string) => {
-    for (const entry of readdirSync(dir, { withFileTypes: true })) {
-      const path = join(dir, entry.name)
-      if (entry.isDirectory()) walk(path)
-      else if (entry.name.endsWith('.ts')) {
-        const text = readFileSync(path, 'utf8')
-        for (const match of text.matchAll(/@privilege\(category: \\?"([^"\\]+)\\?", privilege: \\?"([^"\\]+)\\?"/g)) {
-          doors.add(`${match[1]}:${match[2]}`)
-        }
-      }
-    }
-  }
-  SERVERS.forEach(walk)
-  return doors
-}
-
-describe("auth-base's tasks", () => {
-  const doors = declaredDoors()
-
-  it.each(ROLE_TASKS.map((task: any) => [task.id, task]))('%s names doors declared where auth-base runs', (_id, task: any) => {
-    for (const grant of task.grants) {
-      for (const axis of grant.axes) expect(doors).toContain(`${grant.category}:${axis}`)
-    }
-  })
-
-  it.each(LANGUAGES)('%s says what each task is', language => {
-    const words = JSON.parse(readFileSync(join(__dirname, '..', 'translations', `${language}.json`), 'utf8'))
-    for (const task of ROLE_TASKS) {
-      expect({ task: task.id, name: !!words[`task.${task.id}.name`], description: !!words[`task.${task.id}.description`] }).toEqual({
-        task: task.id,
-        name: true,
-        description: true
-      })
-    }
-  })
-})

package/tests/checkin-domain-rule.test.ts

@@ -1,128 +0,0 @@
-/**
- * 체크인 대상 도메인 판정 규칙 테스트.
- *
- * 핵심 회귀: 부모 도메인에 정의된 역할을 자식 도메인에서 부여받은 사용자는
- * "역할을 부여한 도메인(자식)" 에 체크인해야 하고, "역할을 정의한 도메인(부모)" 에는 체크인하지 못한다.
- */
-
-import { CheckinFacts, checkinGrantsOf, isCheckinAllowed } from '../server/utils/checkin-domain-rule.js'
-
-const USER = 'user-1'
-const PARENT = { id: 'domain-parent', parentId: null }
-const CHILD = { id: 'domain-child', parentId: 'domain-parent' }
-const SIBLING = { id: 'domain-sibling', parentId: 'domain-parent' }
-const SUPPLIER = { id: 'domain-supplier', parentId: null }
-
-function facts(partial: Partial<CheckinFacts> = {}): CheckinFacts {
-  return {
-    userId: USER,
-    memberDomainIds: [],
-    roleDomainIds: [],
-    ...partial
-  }
-}
-
-describe('checkin domain rule', () => {
-  describe('상속받은 역할을 부여한 도메인', () => {
-    /* 자식 도메인 관리자가 부모 정의 역할(상속)을 자기 도메인 사용자에게 부여한 상황. */
-    const inheritedGrant = facts({
-      memberDomainIds: [CHILD.id],
-      roleDomainIds: [PARENT.id]
-    })
-
-    it('부여가 일어난 자식 도메인에 체크인할 수 있다', () => {
-      expect(isCheckinAllowed(CHILD, inheritedGrant)).toBe(true)
-      expect(checkinGrantsOf(CHILD, inheritedGrant)).toEqual([{ via: 'inherited-role', roleDomainId: PARENT.id }])
-    })
-
-    it('역할을 정의한 부모 도메인에는 체크인할 수 없다', () => {
-      expect(isCheckinAllowed(PARENT, inheritedGrant)).toBe(false)
-    })
-
-    it('멤버가 아닌 형제 자식 도메인에는 체크인할 수 없다', () => {
-      /* 부모 역할은 모든 자식이 상속하므로, 멤버십 없이 열리면 테넌트 격리가 깨진다. */
-      expect(isCheckinAllowed(SIBLING, inheritedGrant)).toBe(false)
-    })
-  })
-
-  describe('자기 도메인에 정의된 역할', () => {
-    const ownGrant = facts({
-      memberDomainIds: [CHILD.id],
-      roleDomainIds: [CHILD.id]
-    })
-
-    it('그 도메인에 체크인할 수 있다', () => {
-      expect(checkinGrantsOf(CHILD, ownGrant)).toEqual([{ via: 'role', roleDomainId: CHILD.id }])
-    })
-
-    it('부모 도메인에는 체크인할 수 없다', () => {
-      expect(isCheckinAllowed(PARENT, ownGrant)).toBe(false)
-    })
-  })
-
-  describe('멤버십과 역할', () => {
-    it('멤버이지만 어떤 역할도 없으면 체크인할 수 없다', () => {
-      expect(isCheckinAllowed(CHILD, facts({ memberDomainIds: [CHILD.id] }))).toBe(false)
-    })
-
-    it('역할만 있고 멤버가 아니면 체크인할 수 없다', () => {
-      expect(isCheckinAllowed(CHILD, facts({ roleDomainIds: [CHILD.id] }))).toBe(false)
-    })
-
-    it('최상위 도메인은 상속 경로가 없다', () => {
-      const rootFacts = facts({ memberDomainIds: [PARENT.id], roleDomainIds: ['domain-other'] })
-      expect(isCheckinAllowed(PARENT, rootFacts)).toBe(false)
-    })
-  })
-
-  describe('파트너십으로 grant 된 역할', () => {
-    /* 공급자 도메인이 자기 역할을 고객 도메인에 grant 하고, 고객 사용자가 그 역할을 부여받았다. */
-    const partnerGrant = facts({
-      memberDomainIds: [CHILD.id],
-      roleDomainIds: [SUPPLIER.id],
-      partnerRoleDomainIds: [SUPPLIER.id]
-    })
-
-    it('멤버가 아니어도 공급자 도메인에 체크인할 수 있다', () => {
-      expect(checkinGrantsOf(SUPPLIER, partnerGrant)).toEqual([{ via: 'partner', roleDomainId: SUPPLIER.id }])
-    })
-
-    it('grant 되지 않은 역할은 파트너 경로를 열지 않는다', () => {
-      const notGranted = facts({
-        memberDomainIds: [CHILD.id],
-        roleDomainIds: [SUPPLIER.id]
-      })
-      expect(isCheckinAllowed(SUPPLIER, notGranted)).toBe(false)
-    })
-  })
-
-  describe('소유권', () => {
-    it('하위 호환 owner 캐시 컬럼으로 체크인할 수 있다', () => {
-      expect(checkinGrantsOf({ ...PARENT, owner: USER }, facts())).toEqual([{ via: 'owner' }])
-    })
-
-    it('DomainOwner 테이블 기준으로도 체크인할 수 있다', () => {
-      expect(checkinGrantsOf(PARENT, facts({ ownedDomainIds: [PARENT.id] }))).toEqual([{ via: 'owner' }])
-    })
-
-    it('다른 사용자가 owner 인 도메인은 체크인할 수 없다', () => {
-      expect(isCheckinAllowed({ ...PARENT, owner: 'user-2' }, facts())).toBe(false)
-    })
-  })
-
-  describe('여러 근거가 동시에 성립하는 경우', () => {
-    it('근거를 모두 반환한다 (권한 판정이 그중 권한 있는 역할을 골라야 한다)', () => {
-      const both = facts({
-        memberDomainIds: [CHILD.id],
-        roleDomainIds: [CHILD.id, PARENT.id],
-        ownedDomainIds: [CHILD.id]
-      })
-
-      expect(checkinGrantsOf(CHILD, both)).toEqual([
-        { via: 'owner' },
-        { via: 'role', roleDomainId: CHILD.id },
-        { via: 'inherited-role', roleDomainId: PARENT.id }
-      ])
-    })
-  })
-})