@things-factory/auth-base 10.1.278 → 10.1.280

package/tests/checkin-privilege-seam-db.test.ts

@@ -1,158 +0,0 @@
-import { closeAuthDatabase, Domain, getRepository, openAuthDatabase, resetAuthDatabase } from './db'
-import { loadCompiled } from './compiled'
-
-const { Privilege } = loadCompiled('service/privilege/privilege')
-const { Role } = loadCompiled('service/role/role')
-const { User, UserStatus } = loadCompiled('service/user/user')
-const { canUserCheckinDomain } = loadCompiled('utils/can-user-checkin-domain')
-
-/**
- * The seam between "may this person come in" and "may this person do that".
- *
- * ── The two rules are not the same rule ─────────────────────────────────────
- * Coming in (`checkin-domain-rule.ts`) asks for **membership AND a role**, or a partner grant,
- * or ownership. The membership half is load-bearing and the file says why: a role defined in a
- * parent domain is inherited by every child, so "holds a parent role" on its own would make a
- * role granted for one child an entry pass to all its siblings.
- *
- * Acting (`User.hasPrivilege`) asks only for a role in this domain or its parent. There is no
- * membership condition. That is on purpose and written down — the comment above it delegates
- * the sibling problem to the checkin gate.
- *
- * ── So what does this file do ───────────────────────────────────────────────
- * It writes down the one line where the two answers differ, which the specs never had:
- *
- *   not a member + holds a parent role      checkin ✗      privilege ○
- *
- * `spec/unit/checkin-privilege.spec.ts` opens by talking about "a user who checked in to a
- * child domain", and then every one of its ten fixtures makes that user a member — the variable
- * is even called `member`. The premise it names is never the thing it varies, so the gap sits
- * outside all of it.
- *
- * ── Why this is pinned green rather than written red ────────────────────────
- * Both halves are what the code does today, and today it does not leak: every server caller of
- * `hasPrivilege` sits behind `domainAuthenticateMiddleware`, which runs the checkin gate first
- * (measured 2026-09-20 across all nineteen call sites — board-service and figure-service routers
- * are on `domainPrivateRouter`, the rest arrive through GraphQL or the subscription middleware).
- *
- * So this is one layer of depth, not an open door. A red test would mean a broken build for a
- * decision nobody has taken yet. What this does instead is make the gap impossible to close or
- * widen without saying so: **when the privilege layer gains the membership condition, the second
- * assertion here flips**, and that is the axis the fix splits.
- *
- * ⚠ sqlite (`tests/db.ts`).
- */
-
-let parent: any
-let child: any
-let sibling: any
-let outsider: any
-
-/** `context.state.domain` carries `parentId`; the repository does not fill it in. */
-async function withParentId(domain: any, parentId: string | null) {
-  return { ...(await getRepository(Domain).findOneBy({ id: domain.id })), parentId }
-}
-
-beforeAll(async () => {
-  await openAuthDatabase()
-})
-
-afterAll(async () => {
-  await closeAuthDatabase()
-})
-
-beforeEach(async () => {
-  await resetAuthDatabase()
-
-  const p = await getRepository(Domain).save({ name: 'system', subdomain: 'system' })
-  const c = await getRepository(Domain).save({ name: 'acme', subdomain: 'acme', parent: p })
-  const s = await getRepository(Domain).save({ name: 'beta', subdomain: 'beta', parent: p })
-  const o = await getRepository(Domain).save({ name: 'gamma', subdomain: 'gamma' })
-
-  parent = await withParentId(p, null)
-  child = await withParentId(c, p.id)
-  sibling = await withParentId(s, p.id)
-  outsider = await withParentId(o, null)
-})
-
-async function inheritedRoleHolder(memberOf: any[]) {
-  const seeing = await getRepository(Privilege).save({ name: 'query', category: 'board' })
-  const role = await getRepository(Role).save({
-    name: 'viewer',
-    domain: { id: parent.id },
-    privileges: [seeing]
-  })
-
-  const person = await getRepository(User).save({
-    username: 'kim@acme.z',
-    email: 'kim@acme.z',
-    name: 'kim',
-    status: UserStatus.ACTIVATED,
-    domains: memberOf.map(domain => ({ id: domain.id })),
-    roles: [role]
-  })
-
-  return await getRepository(User).findOne({ where: { id: person.id }, relations: ['domains', 'roles'] })
-}
-
-describe('a member of this domain holding an inherited role', () => {
-  it('comes in, and may act', async () => {
-    /* The case the inheritance exists for, and the one the specs cover ten times over. */
-    const person = await inheritedRoleHolder([child])
-
-    expect(await canUserCheckinDomain(person, child)).toBe(true)
-    expect(await User.hasPrivilege('query', 'board', child, person)).toBe(true)
-  })
-})
-
-describe('⚠ someone who is not a member but holds the parent role', () => {
-  it('does not come in', async () => {
-    /*
-     * The membership half doing its job. Without it, a role granted inside one child would be
-     * an entry pass to every sibling of that child.
-     */
-    const person = await inheritedRoleHolder([sibling])
-
-    expect(await canUserCheckinDomain(person, child)).toBe(false)
-  })
-
-  it('⚠ but would be allowed to act, if anything asked', async () => {
-    /*
-     * ⚠ **This is the gap, written down.** The privilege layer does not ask about membership, so
-     * it answers yes for a person the door would have turned away.
-     *
-     * It costs nothing today because nothing reaches `hasPrivilege` without the door having run
-     * first. It is one layer rather than two, and this line is what a second layer would change.
-     */
-    const person = await inheritedRoleHolder([sibling])
-
-    expect(await User.hasPrivilege('query', 'board', child, person)).toBe(true)
-  })
-
-  it('holds for someone with no membership at all', async () => {
-    /* Not an artefact of being a member of a sibling — belonging nowhere reads the same. */
-    const person = await inheritedRoleHolder([])
-
-    expect(await canUserCheckinDomain(person, child)).toBe(false)
-    expect(await User.hasPrivilege('query', 'board', child, person)).toBe(true)
-  })
-})
-
-describe('what the gap does not extend to', () => {
-  it('a domain that is not below the role domain', async () => {
-    /*
-     * The privilege layer is loose about membership, not about inheritance. A role defined in
-     * `system` reaches `system` and its children, and `gamma` is neither.
-     */
-    const person = await inheritedRoleHolder([outsider])
-
-    expect(await canUserCheckinDomain(person, outsider)).toBe(false)
-    expect(await User.hasPrivilege('query', 'board', outsider, person)).toBe(false)
-  })
-
-  it('a privilege the role does not carry', async () => {
-    const person = await inheritedRoleHolder([sibling])
-
-    expect(await User.hasPrivilege('mutation', 'board', child, person)).toBe(false)
-  })
-})

package/tests/compiled.ts

@@ -1,41 +0,0 @@
-/**
- * 게이트 시험이 **컴파일된 산출물**(`dist-server`)을 드는 이유.
- *
- * 이 패키지의 엔티티는 `@Field({ nullable: true })` 처럼 **명시 타입이 없는** type-graphql
- * 데코레이터를 쓴다. 그것을 읽으려면 `emitDecoratorMetadata` 가 필요한데 jest 의 변환기는
- * babel 이고, babel 은 tsc 의 그 기능을 대체하지 못한다. 그래서 소스에서 `user.ts` 를 들면
- * import 시점에 죽는다:
- *
- *   Unable to infer GraphQL type from TypeScript reflection system.
- *     at privilege.ts:15  ← role.ts → user.ts 를 타고 올라온다
- *
- * legacy 데코레이터로 바꾸는 길은 이미 시도했고 되돌렸다(루트 `jest.config.js` 주석).
- * 그래서 **엔티티 그래프에 닿는 시험은 tsc 산출물을 든다.** 루트 `pretest` 가 `yarn build` 이므로
- * `yarn test` 경로에서는 산출물이 항상 갱신되어 있다.
- *
- * **대가**: 산출물은 낡을 수 있고, 타입 검사가 이 경계를 넘지 않는다 — `yarn _test` 로 빌드를
- * 건너뛰고 돌리면 옛 시그니처를 시험하게 된다. 그래서 아래 로더가 산출물이 없으면
- * **무엇을 해야 하는지 말하고** 죽는다(조용한 초록보다 낫다).
- *
- * 순수 함수(`checkin-domain-rule` · `privilege-rejection` · `privilege-deprecation`)는
- * 엔티티에 닿지 않으므로 소스에서 그대로 든다. 이 로더는 그 밖의 것에만 쓴다.
- */
-
-import { existsSync } from 'fs'
-import { join } from 'path'
-
-const DIST = join(__dirname, '..', 'dist-server')
-
-export function loadCompiled<T = any>(modulePath: string): T {
-  const resolved = join(DIST, `${modulePath}.js`)
-
-  if (!existsSync(resolved)) {
-    throw new Error(
-      `auth-base 산출물이 없다: ${resolved}\n` +
-        `이 시험은 tsc 산출물을 든다(이유는 tests/compiled.ts). 먼저 빌드할 것:\n` +
-        `  yarn workspace @things-factory/auth-base build:server`
-    )
-  }
-
-  return require(resolved)
-}

package/tests/confirm-identity-db.test.ts

@@ -1,85 +0,0 @@
-/**
- * Confirming it is still the signed-in person (ADR-0168) by password, through the real controller on the sqlite
- * harness: a miss counts toward the same lock as signing in and leaves no confirmation; a match leaves one; both
- * are audited as `auth.confirm-identity`.
- */
-
-import { closeAuthDatabase, Domain, getRepository, openAuthDatabase, resetAuthDatabase, authDataSource } from './db'
-import { loadCompiled } from './compiled'
-
-const { User } = loadCompiled('service/user/user')
-const { AuditAction } = loadCompiled('service/audit/audit-action')
-const { flushAudit } = loadCompiled('service/audit/audit-recorder')
-const { confirmIdentity } = loadCompiled('controllers/confirm-identity')
-const { verifyPassword } = loadCompiled('controllers/signin')
-const { isRecentlyConfirmed } = loadCompiled('service/identity-confirmation/identity-confirmation')
-
-const PASSWORD = 'Passw0rd!'
-
-let domain: any
-let kim: any
-
-function request(user: any) {
-  const jar = new Map<string, string>()
-  return {
-    state: { user, domain, tx: authDataSource().manager },
-    cookies: { get: (name: string) => jar.get(name) || undefined, set: (name: string, value: string) => jar.set(name, value) }
-  } as any
-}
-
-const byPassword = (context: any, password: string) => confirmIdentity('password', context, (user: any) => verifyPassword(user, password, context))
-
-async function audits() {
-  await flushAudit()
-  const rows = await getRepository(AuditAction).find({ where: { kind: 'auth.confirm-identity' }, order: { createdAt: 'ASC' } })
-  return rows.map(row => [row.outcome, row.code, row.detail?.method])
-}
-
-beforeAll(async () => {
-  await openAuthDatabase()
-})
-
-afterAll(async () => {
-  await closeAuthDatabase()
-})
-
-beforeEach(async () => {
-  await resetAuthDatabase()
-  domain = await getRepository(Domain).save({ name: 'office', subdomain: 'office' })
-  const salt = User.generateSalt()
-  kim = await getRepository(User).save({
-    username: 'kim',
-    email: 'kim@example.com',
-    name: 'kim',
-    salt,
-    password: User.encode(PASSWORD, salt),
-    status: 'activated',
-    domains: [domain]
-  })
-})
-
-it('leaves a confirmation for the person when the password matches', async () => {
-  const context = request(kim)
-  await byPassword(context, PASSWORD)
-
-  expect(isRecentlyConfirmed(context, kim.id)).toBe(true)
-  expect(await audits()).toEqual([['ok', null, 'password']])
-})
-
-it('a miss leaves none, counts toward the lock, and is audited with its code', async () => {
-  const context = request(kim)
-  await expect(byPassword(context, 'wrong')).rejects.toMatchObject({ errorCode: 'password-not-matched' })
-
-  expect(isRecentlyConfirmed(context, kim.id)).toBe(false)
-  expect((await getRepository(User).findOneBy({ id: kim.id })).failCount).toBe(1)
-  expect(await audits()).toEqual([['error', 'password-not-matched', 'password']])
-})
-
-it('the fifth miss locks the account, and a locked account confirms nothing', async () => {
-  for (let i = 0; i < 4; i++) await expect(byPassword(request(kim), 'wrong')).rejects.toMatchObject({ errorCode: 'password-not-matched' })
-  await expect(byPassword(request(kim), 'wrong')).rejects.toMatchObject({ errorCode: 'user-locked' })
-
-  const context = request(kim)
-  await expect(byPassword(context, PASSWORD)).rejects.toMatchObject({ errorCode: 'user-locked' })
-  expect(isRecentlyConfirmed(context, kim.id)).toBe(false)
-})

package/tests/credential-at-rest-db.test.ts

@@ -1,246 +0,0 @@
-import { config } from '@things-factory/env'
-
-import { closeAuthDatabase, Domain, getRepository, openAuthDatabase, resetAuthDatabase } from './db'
-import { loadCompiled } from './compiled'
-
-const { Appliance } = loadCompiled('service/appliance/appliance')
-const { Application } = loadCompiled('service/application/application')
-const { User, UserStatus } = loadCompiled('service/user/user')
-
-/**
- * Storing a credential as ciphertext, on the installations that asked for it (ADR-0085).
- *
- * ── The three states that have to hold ──────────────────────────────────────
- *
- *   off            writes plaintext, reads plaintext        an untouched deployment
- *   on             writes ciphertext, reads either          the rows convert one at a time
- *   on then off    writes plaintext again, reads either     turning it off loses nothing
- *
- * The third is the one that makes the switch safe to try. If reading followed the switch, a
- * deployment that turned it on and then changed its mind would lose every row written while it
- * was on — the values would still be in the table and would read as nothing.
- *
- * These go through the repository rather than calling the transformer, so what is checked is
- * what a column actually does. The raw column is read with a second query that bypasses the
- * entity, which is the only way to see which shape is on disk.
- *
- * ⚠ sqlite (`tests/db.ts`).
- */
-
-/** What `shell`'s transformer writes: 32 hex characters of IV, a colon, then hex. */
-const CIPHERTEXT = /^[0-9a-f]{32}:(?:[0-9a-f]{2})+$/
-
-const configGet = config.get
-
-function encryptionOff() {
-  config.get = configGet
-}
-
-function encryptionOn() {
-  config.get = ((key: string, fallback?: any) =>
-    key === 'credential/encryptAtRest' ? true : configGet(key, fallback)) as typeof config.get
-}
-
-let domain: any
-
-/** The bytes on disk, read without the entity so the transformer does not run. */
-async function storedAccessToken(id: string): Promise<string> {
-  const [row] = await getRepository(Appliance).query('select access_token from appliances where id = ?', [id])
-
-  return row?.access_token
-}
-
-async function storedAppSecret(id: string): Promise<string> {
-  const [row] = await getRepository(Application).query('select app_secret from applications where id = ?', [id])
-
-  return row?.app_secret
-}
-
-/** Application declares six columns non-null; only appSecret matters here. */
-async function saveApplication(appSecret: string) {
-  return await getRepository(Application).save({
-    domain,
-    name: 'billing',
-    email: 'billing@acme.z',
-    url: 'https://billing.example.com',
-    redirectUrl: 'https://billing.example.com/callback',
-    status: 0,
-    type: 'OTHERS',
-    appSecret
-  })
-}
-
-async function saveAppliance(name: string, accessToken: string) {
-  return await getRepository(Appliance).save({
-    domain,
-    name,
-    serialNo: `${name}-SN`,
-    brand: 'Acme',
-    model: 'X1',
-    accessToken
-  })
-}
-
-beforeAll(async () => {
-  await openAuthDatabase()
-})
-
-afterAll(async () => {
-  encryptionOff()
-  await closeAuthDatabase()
-})
-
-beforeEach(async () => {
-  encryptionOff()
-  await resetAuthDatabase()
-
-  domain = await getRepository(Domain).save({ name: 'acme', subdomain: 'acme' })
-})
-
-describe('with the switch off — an installation that configured nothing', () => {
-  it('stores the token as it always did', async () => {
-    const saved = await saveAppliance('gate-a', 'plain-token-value')
-
-    expect(await storedAccessToken(saved.id)).toEqual('plain-token-value')
-  })
-
-  it('reads back what it wrote', async () => {
-    const saved = await saveAppliance('gate-b', 'plain-token-value')
-
-    expect((await getRepository(Appliance).findOneBy({ id: saved.id })).accessToken).toEqual('plain-token-value')
-  })
-
-  it('stores an application secret as it always did', async () => {
-    const saved = await saveApplication('plain-secret')
-
-    expect(await storedAppSecret(saved.id)).toEqual('plain-secret')
-    expect((await getRepository(Application).findOneBy({ id: saved.id })).appSecret).toEqual('plain-secret')
-  })
-})
-
-describe('with the switch on', () => {
-  beforeEach(() => encryptionOn())
-
-  it('stores the token as ciphertext', async () => {
-    const saved = await saveAppliance('gate-c', 'secret-token-value')
-    const onDisk = await storedAccessToken(saved.id)
-
-    expect(onDisk).toMatch(CIPHERTEXT)
-    expect(onDisk).not.toContain('secret-token-value')
-  })
-
-  it('reads it back as what was written', async () => {
-    const saved = await saveAppliance('gate-d', 'secret-token-value')
-
-    expect((await getRepository(Appliance).findOneBy({ id: saved.id })).accessToken).toEqual('secret-token-value')
-  })
-
-  it('stores an application secret as ciphertext', async () => {
-    const saved = await saveApplication('secret-value')
-
-    expect(await storedAppSecret(saved.id)).toMatch(CIPHERTEXT)
-    expect((await getRepository(Application).findOneBy({ id: saved.id })).appSecret).toEqual('secret-value')
-  })
-
-  it('does not make two rows with the same secret look the same at rest', async () => {
-    /* The IV is per write. Without it, matching rows would say which appliances share a token. */
-    const a = await saveAppliance('gate-e', 'same-token')
-    const b = await saveAppliance('gate-f', 'same-token')
-
-    expect(await storedAccessToken(a.id)).not.toEqual(await storedAccessToken(b.id))
-  })
-})
-
-describe('turning it on over rows that are already there', () => {
-  it('still reads a row written before the switch', async () => {
-    /*
-     * ⚠ The case that lets the switch be turned on at all. Every row in the table is plaintext
-     * on the day it goes on. If reading them answered nothing, the credentials would vanish from
-     * the screens while sitting in the table.
-     */
-    const saved = await saveAppliance('gate-g', 'written-before')
-
-    encryptionOn()
-
-    expect((await getRepository(Appliance).findOneBy({ id: saved.id })).accessToken).toEqual('written-before')
-    expect(await storedAccessToken(saved.id)).toEqual('written-before')
-  })
-
-  it('converts that row the next time it is written', async () => {
-    /* One row at a time, as each is touched. There is no pass over the table. */
-    const saved = await saveAppliance('gate-h', 'written-before')
-
-    encryptionOn()
-    await getRepository(Appliance).save({ ...saved, accessToken: 'written-after' })
-
-    expect(await storedAccessToken(saved.id)).toMatch(CIPHERTEXT)
-    expect((await getRepository(Appliance).findOneBy({ id: saved.id })).accessToken).toEqual('written-after')
-  })
-
-  it('leaves untouched rows alone', async () => {
-    const converted = await saveAppliance('gate-i', 'one')
-    const untouched = await saveAppliance('gate-j', 'two')
-
-    encryptionOn()
-    await getRepository(Appliance).save({ ...converted, accessToken: 'one-again' })
-
-    expect(await storedAccessToken(converted.id)).toMatch(CIPHERTEXT)
-    expect(await storedAccessToken(untouched.id)).toEqual('two')
-
-    /* And both still read. That is the state a half-converted installation is in. */
-    expect((await getRepository(Appliance).findOneBy({ id: converted.id })).accessToken).toEqual('one-again')
-    expect((await getRepository(Appliance).findOneBy({ id: untouched.id })).accessToken).toEqual('two')
-  })
-})
-
-describe('turning it off after it has been on', () => {
-  it('keeps reading the rows written while it was on', async () => {
-    /*
-     * ⚠ What makes the switch safe to try. The switch governs writing only — if it governed
-     * reading, turning it off would strand every row written while it was on.
-     */
-    encryptionOn()
-    const saved = await saveAppliance('gate-k', 'written-while-on')
-
-    expect(await storedAccessToken(saved.id)).toMatch(CIPHERTEXT)
-
-    encryptionOff()
-
-    expect((await getRepository(Appliance).findOneBy({ id: saved.id })).accessToken).toEqual('written-while-on')
-  })
-
-  it('writes plaintext again from then on', async () => {
-    encryptionOn()
-    const saved = await saveAppliance('gate-l', 'written-while-on')
-
-    encryptionOff()
-    await getRepository(Appliance).save({ ...saved, accessToken: 'written-while-off' })
-
-    expect(await storedAccessToken(saved.id)).toEqual('written-while-off')
-  })
-})
-
-describe('what this does not touch', () => {
-  it('leaves User.password alone', async () => {
-    /*
-     * ⚠ Deliberate, and the reason is in `credential-at-rest.ts`. That column holds an HMAC for a
-     * person and a token for a machine, and a column transformer cannot tell them apart.
-     * Encrypting everybody's password hash to reach the machines' tokens is the wrong trade; the
-     * machine credential needs a column of its own (§8 step 4).
-     */
-    encryptionOn()
-
-    const user = await getRepository(User).save({
-      username: 'operator@acme.z',
-      email: 'operator@acme.z',
-      name: 'operator',
-      status: UserStatus.ACTIVATED,
-      password: 'hashed-value',
-      domains: [domain]
-    })
-
-    const [row] = await getRepository(User).query('select password from users where id = ?', [user.id])
-
-    expect(row.password).toEqual('hashed-value')
-  })
-})