@things-factory/auth-base 10.1.278 → 10.1.280

package/tests/credential-features-off-db.test.ts

@@ -1,189 +0,0 @@
-import { config } from '@things-factory/env'
-
-import { closeAuthDatabase, Domain, getRepository, openAuthDatabase, resetAuthDatabase } from './db'
-import { loadCompiled } from './compiled'
-
-const jwt = require('jsonwebtoken')
-
-const { User, UserStatus } = loadCompiled('service/user/user')
-const { ApplianceMutation } = loadCompiled('service/appliance/appliance-mutation')
-
-const mutation = new ApplianceMutation()
-
-/**
- * What an installation that configures nothing sees (ADR-0085 decisions 1 and 2).
- *
- * ── Why this file exists ────────────────────────────────────────────────────
- * An appliance token lives a year, and the ones in the field were issued by the version running
- * now. The whole design rests on one claim: **taking this release changes nothing until the
- * installation asks for it.** That claim is easy to state and easy to break — a door that
- * forgets its switch, a serial that starts filling in on its own — so it is held here rather
- * than in prose.
- *
- * These cases run with no config set at all, which is what `config.get(key, false)` sees in a
- * deployment whose config file was never touched.
- *
- * `appliance-revoke-db.test.ts` holds the other side: what the features do once they are on.
- */
-
-let domain: any
-let actor: any
-
-function context(d: any = domain) {
-  return {
-    state: { domain: d, user: actor, tx: undefined },
-    throw: (code: number, message: string) => {
-      const error: any = new Error(message)
-      error.status = code
-      throw error
-    }
-  } as any
-}
-
-async function shadowUserOf(applianceId: string) {
-  return await getRepository(User).findOneBy({ reference: applianceId, userType: 'appliance' })
-}
-
-beforeAll(async () => {
-  await openAuthDatabase()
-})
-
-afterAll(async () => {
-  await closeAuthDatabase()
-})
-
-beforeEach(async () => {
-  await resetAuthDatabase()
-
-  domain = await getRepository(Domain).save({ name: 'acme', subdomain: 'acme' })
-  actor = await getRepository(User).save({
-    username: 'operator@acme.z',
-    email: 'operator@acme.z',
-    name: 'operator',
-    status: UserStatus.ACTIVATED,
-    domains: [domain]
-  })
-})
-
-describe('an installation that configures neither feature', () => {
-  it('reads both switches as off', () => {
-    /*
-     * The mechanism the rest of this file depends on. `config.get` answers the default when the
-     * key is absent, so "never configured" and "off" are one thing.
-     */
-    expect(config.get('credential/encryptAtRest', false)).toBeFalsy()
-    expect(config.get('credential/revocable', false)).toBeFalsy()
-  })
-
-  it('has no revocation door', async () => {
-    /*
-     * ⚠ The case the switch exists for. `revokeApplianceCredential` shipped before this design
-     * and went out without a switch; it belongs behind one now, and an installation that never
-     * asked for it must not find it.
-     */
-    const appliance = await mutation.createAppliance(
-      { name: 'gate-a', serialNo: 'SN-A', brand: 'Acme', model: 'X1' },
-      context()
-    )
-
-    await expect(mutation.revokeApplianceCredential(appliance.id, context())).rejects.toThrow(/not enabled/)
-  })
-
-  it('leaves the appliance untouched when the door refuses', async () => {
-    /* A refusal that half-applied would be worse than no door at all. */
-    const appliance = await mutation.createAppliance(
-      { name: 'gate-b', serialNo: 'SN-B', brand: 'Acme', model: 'X1' },
-      context()
-    )
-    const issued = await mutation.generateApplianceSecret(appliance.id, context())
-
-    await expect(mutation.revokeApplianceCredential(issued.id, context())).rejects.toThrow()
-
-    const appuser = await shadowUserOf(issued.id)
-
-    expect(appuser!.status).toEqual(UserStatus.ACTIVATED)
-    expect(appuser!.password).toEqual(issued.accessToken)
-  })
-
-  it('still issues a working credential', async () => {
-    /*
-     * Registering and issuing are not behind either switch — they are what the product already
-     * does. Only revocation and encryption are new.
-     */
-    const appliance = await mutation.createAppliance(
-      { name: 'gate-c', serialNo: 'SN-C', brand: 'Acme', model: 'X1' },
-      context()
-    )
-    const issued = await mutation.generateApplianceSecret(appliance.id, context())
-
-    expect(issued.accessToken).toBeTruthy()
-    await expect(User.checkAuth(jwt.decode(issued.accessToken))).resolves.toBeTruthy()
-  })
-
-  it('stores the credential as it always did', async () => {
-    /*
-     * ⚠ Encryption is a write-side switch. With it off the value goes in as it always has, so a
-     * deployment that takes this release and configures nothing keeps rows in the same shape.
-     */
-    const appliance = await mutation.createAppliance(
-      { name: 'gate-d', serialNo: 'SN-D', brand: 'Acme', model: 'X1' },
-      context()
-    )
-    const issued = await mutation.generateApplianceSecret(appliance.id, context())
-
-    const appuser = await shadowUserOf(issued.id)
-
-    expect(appuser!.password).toEqual(issued.accessToken)
-    expect(appuser!.password.split('.')).toHaveLength(3)
-  })
-})
-
-describe('a token issued before this release', () => {
-  /*
-   * Such a token carries no credential serial, because the column did not exist when it was
-   * signed. Those are the tokens already in the field, and they are the ones that must not be
-   * cut off by taking this release.
-   */
-
-  it('carries no serial, and is still accepted', async () => {
-    const appliance = await mutation.createAppliance(
-      { name: 'gate-e', serialNo: 'SN-E', brand: 'Acme', model: 'X1' },
-      context()
-    )
-    const issued = await mutation.generateApplianceSecret(appliance.id, context())
-
-    /* Put the subject back the way this release found it: issued, but with no serial recorded. */
-    const appuser = await shadowUserOf(issued.id)
-    await getRepository(User).save({ ...appuser, credentialSerial: null })
-
-    const legacyToken = { ...jwt.decode(issued.accessToken) }
-    delete legacyToken.cs
-
-    await expect(User.checkAuth(legacyToken)).resolves.toBeTruthy()
-  })
-
-  it('is accepted even beside a subject that has moved on', async () => {
-    /*
-     * Two appliances in one installation, one converted and one not. The check has to be per
-     * subject — a single flag for the whole installation would cut off everything at once.
-     */
-    const a = await mutation.generateApplianceSecret(
-      (await mutation.createAppliance({ name: 'gate-f', serialNo: 'SN-F', brand: 'Acme', model: 'X1' }, context())).id,
-      context()
-    )
-    const b = await mutation.generateApplianceSecret(
-      (await mutation.createAppliance({ name: 'gate-g', serialNo: 'SN-G', brand: 'Acme', model: 'X1' }, context())).id,
-      context()
-    )
-
-    const legacy = await shadowUserOf(a.id)
-    await getRepository(User).save({ ...legacy, credentialSerial: null })
-
-    const legacyToken = { ...jwt.decode(a.accessToken) }
-    delete legacyToken.cs
-
-    await expect(User.checkAuth(legacyToken)).resolves.toBeTruthy()
-    await expect(User.checkAuth(jwt.decode(b.accessToken))).resolves.toBeTruthy()
-    expect((await shadowUserOf(b.id))!.credentialSerial).toEqual(1)
-  })
-})

package/tests/credential-serial-rule.test.ts

@@ -1,84 +0,0 @@
-import { credentialSerialMatches } from '../server/utils/credential-serial-rule'
-
-/**
- * The one line in `checkAuth` that can refuse a token whose signature is good.
- *
- * Two things have to stay true at once, and they pull in opposite directions:
- *
- *   a token issued before this release must pass    — or taking the release cuts off the field
- *   a token from an earlier generation must not     — or revocation does not revoke
- *
- * Both hang on what an absent value means on each side, which is why the cases below are mostly
- * about absence.
- */
-
-describe('a subject that has never been through the new path', () => {
-  it('accepts a token that carries no serial', () => {
-    /*
-     * ⚠ The tokens already in the field. They were signed before the column existed, and the
-     * subjects they name have nothing recorded. If this refused, every appliance would stop on
-     * the day the release lands.
-     */
-    expect(credentialSerialMatches({ credentialSerial: null }, {})).toBe(true)
-    expect(credentialSerialMatches({ credentialSerial: undefined }, {})).toBe(true)
-    expect(credentialSerialMatches({}, {})).toBe(true)
-  })
-
-  it('accepts a token that carries one anyway', () => {
-    /* Nothing to compare against. The subject decides whether the rule applies, not the token. */
-    expect(credentialSerialMatches({ credentialSerial: null }, { cs: 7 })).toBe(true)
-  })
-
-  it('does not fall over on a missing subject or missing claims', () => {
-    expect(credentialSerialMatches(undefined as any, {})).toBe(true)
-    expect(credentialSerialMatches({ credentialSerial: null }, undefined as any)).toBe(true)
-  })
-})
-
-describe('a subject that has moved on', () => {
-  it('accepts the generation it is on', () => {
-    expect(credentialSerialMatches({ credentialSerial: 3 }, { cs: 3 })).toBe(true)
-  })
-
-  it('refuses an earlier generation', () => {
-    /* ⚠ What revocation rests on. Without this the old token keeps working. */
-    expect(credentialSerialMatches({ credentialSerial: 3 }, { cs: 2 })).toBe(false)
-  })
-
-  it('refuses a later one too', () => {
-    /* Not a thing we issue, so it is a token from somewhere we did not sign it. */
-    expect(credentialSerialMatches({ credentialSerial: 3 }, { cs: 4 })).toBe(false)
-  })
-
-  it('refuses a token with no serial at all', () => {
-    /*
-     * ⚠ The case the whole design turns on. Once a subject has a serial, the tokens it had
-     * before that — the ones with nothing in them — are the revoked ones.
-     */
-    expect(credentialSerialMatches({ credentialSerial: 1 }, {})).toBe(false)
-    expect(credentialSerialMatches({ credentialSerial: 1 }, { cs: null })).toBe(false)
-  })
-
-  it('refuses the first generation once it has moved past it', () => {
-    expect(credentialSerialMatches({ credentialSerial: 2 }, { cs: 1 })).toBe(false)
-  })
-})
-
-describe('what it compares', () => {
-  it('does not take a string for the number', () => {
-    /*
-     * A claim arrives from a decoded token, so its type is whatever was signed. `'3'` is not the
-     * third generation — leaning the other way would let a shaped-but-wrong claim through.
-     */
-    expect(credentialSerialMatches({ credentialSerial: 3 }, { cs: '3' as any })).toBe(false)
-  })
-
-  it('treats generation zero as a generation', () => {
-    /*
-     * We start at 1, so 0 should not appear. But if it ever did, zero is a value and not an
-     * absence — reading it as absent would let everything through for that subject.
-     */
-    expect(credentialSerialMatches({ credentialSerial: 0 }, { cs: 0 })).toBe(true)
-    expect(credentialSerialMatches({ credentialSerial: 0 }, {})).toBe(false)
-  })
-})

package/tests/declare-privileges.test.ts

@@ -1,29 +0,0 @@
-/**
- * A privilege asked in code only - an issued document kind's rule (ADR-0176) - is declared with `declarePrivileges`, so
- * the sync makes its rows and a role task naming it can be applied. 10.1.81 asked `employee-certificate` with
- * `checkPermission` alone; no row was ever made and the template naming it was refused (2026-10-30).
- */
-import { loadCompiled } from './compiled'
-
-const { declarePrivileges } = loadCompiled('service/privilege/privilege-directive')
-const { undeclaredTaskGrants } = loadCompiled('service/role-template/role-task')
-
-describe('declarePrivileges', () => {
-  it('declares the pairs, so a task naming them is whole', () => {
-    declarePrivileges('test kind', [
-      ['test-certificate', 'query'],
-      ['test-certificate', 'mutation']
-    ])
-    expect(process['PRIVILEGES']['test-certificate query']).toEqual(['test-certificate', 'query'])
-    expect(undeclaredTaskGrants({ id: 'test.issuing', grants: [{ category: 'test-certificate', axes: ['query', 'mutation'] }] })).toEqual([])
-  })
-
-  it('refuses an axis the installation does not declare, as @privilege does', () => {
-    expect(() => declarePrivileges('test kind', [['test-certificate', 'mutaiton']])).toThrow(/axis "mutaiton"/)
-    expect(process['PRIVILEGES']['test-certificate mutaiton']).toBeUndefined()
-  })
-
-  it('refuses an empty category', () => {
-    expect(() => declarePrivileges('test kind', [['', 'query']])).toThrow(/empty/)
-  })
-})

package/tests/domain-assignees-db.test.ts

@@ -1,95 +0,0 @@
-/**
- * Who work in a domain may be given to - its activated members and its activated owners (ADR-0138, architect's
- * ruling 2026-10-17). A license's recipient and a sales opportunity's owner ask the same question; the answer is here
- * once. Before it, Office listed members and owners, sales members only, and an owner without a membership row could
- * take a license but not an opportunity.
- *
- * And `getDomainUsers`: it read the users outside the caller's transaction, and looked a domain given without an id
- * up by the id it did not have.
- */
-
-import { closeAuthDatabase, Domain, getRepository, openAuthDatabase, resetAuthDatabase, ENTITIES } from './db'
-import { loadCompiled } from './compiled'
-
-const { DataSource } = require('typeorm')
-const shell = require('@things-factory/shell')
-
-const { User } = loadCompiled('service/user/user')
-const { DomainOwner } = loadCompiled('service/domain-owner/domain-owner')
-const { getDomainAssignees, entersDomainAsAssignee, getDomainUsers } = loadCompiled('utils/get-domain-users')
-
-let domain: any
-let other: any
-
-async function makeUser(name: string, domains: any[], status = 'activated') {
-  return await getRepository(User).save({ username: name, email: `${name}@example.com`, name, salt: User.generateSalt(), status, domains })
-}
-
-beforeAll(async () => {
-  await openAuthDatabase()
-})
-
-afterAll(async () => {
-  await closeAuthDatabase()
-})
-
-beforeEach(async () => {
-  await resetAuthDatabase()
-  domain = await getRepository(Domain).save({ name: 'hatiolab', subdomain: 'hatiolab' })
-  other = await getRepository(Domain).save({ name: 'other', subdomain: 'other' })
-})
-
-describe('the people work in a domain may be given to', () => {
-  it('are its activated members and its activated owners, by name, each once', async () => {
-    await makeUser('bora', [domain])
-    await makeUser('chul', [domain], 'inactive')
-    const owner = await makeUser('ahn', [other])
-    await getRepository(DomainOwner).save({ domain, user: owner })
-    const memberOwner = await makeUser('dana', [domain])
-    await getRepository(DomainOwner).save({ domain, user: memberOwner })
-    const columnOwner = await makeUser('eun', [])
-    await getRepository(Domain).update({ id: domain.id }, { owner: columnOwner.id })
-    const lockedOwner = await makeUser('fin', [], 'locked')
-    await getRepository(DomainOwner).save({ domain, user: lockedOwner })
-    await makeUser('gil', [other])
-
-    const read = await getRepository(Domain).findOneBy({ id: domain.id })
-    expect((await getDomainAssignees(read)).map((one: any) => one.name)).toEqual(['ahn', 'bora', 'dana', 'eun'])
-  })
-
-  it('a member or an owner enters; the status is the caller\'s to refuse', async () => {
-    const read = async () => await getRepository(Domain).findOneBy({ id: domain.id })
-    const inactive = await makeUser('chul', [domain], 'inactive')
-    const owner = await makeUser('ahn', [other])
-    await getRepository(DomainOwner).save({ domain, user: owner })
-    const stranger = await makeUser('gil', [other])
-
-    expect(await entersDomainAsAssignee(await read(), inactive)).toBe(true)
-    expect(await entersDomainAsAssignee(await read(), owner)).toBe(true)
-    expect(await entersDomainAsAssignee(await read(), stranger)).toBe(false)
-    expect(await entersDomainAsAssignee(await read(), { id: undefined })).toBe(false)
-  })
-})
-
-describe('getDomainUsers', () => {
-  it('reads through the manager it is given, not past it', async () => {
-    /* A second database the framework registry does not know: only the manager reaches it. */
-    const elsewhere = await new DataSource({ type: 'sqlite', database: ':memory:', synchronize: true, namingStrategy: new shell.NamingStrategy(), entities: ENTITIES }).initialize()
-    try {
-      const there = await elsewhere.getRepository(Domain).save({ name: 'there', subdomain: 'there' })
-      await elsewhere.getRepository(User).save({ username: 'han', email: 'han@example.com', name: 'han', salt: User.generateSalt(), status: 'activated', domains: [there] })
-
-      expect((await getDomainUsers(there, elsewhere.manager)).map((one: any) => one.name)).toEqual(['han'])
-      expect((await getDomainAssignees(there, elsewhere.manager)).map((one: any) => one.name)).toEqual(['han'])
-    } finally {
-      await elsewhere.destroy()
-    }
-  })
-
-  it('finds a domain given without its id by the fields it has', async () => {
-    await makeUser('bora', [domain])
-    expect((await getDomainUsers({ subdomain: 'hatiolab' })).map((one: any) => one.name)).toEqual(['bora'])
-    await expect(getDomainUsers({ subdomain: 'nowhere' })).rejects.toThrow(/Failed to find domain/)
-    await expect(getDomainUsers({})).rejects.toThrow(/Failed to find domain/)
-  })
-})

package/tests/domain-inheritance-sentinel.test.ts

@@ -1,93 +0,0 @@
-/**
- * What `inherited: Only` binds when the domain has no parent.
- *
- * ── What was here until 2026-09-15 ───────────────────────────────────────────
- *     qb.andWhere(`${alias}.domain = :domain`, { domain: domain.parentId || 'Impossible' })
- *
- * "Match nothing" is the right intent — a root domain inherits from nobody — but it was
- * spelled as a **value** bound to a uuid column. sqlite compares it as text and returns zero
- * rows, which is the intended answer arrived at by accident, so it was green through three
- * years of development. postgres parses it and refuses the whole query:
- *
- *     invalid input syntax for type uuid: "Impossible"   (observed 2026-09-15, path ["roles"])
- *
- * ── Why this test is written against the parameters, not the rows ────────────
- * This harness is sqlite and cannot fail the way the server does; `tests/db.ts` says as much
- * about column dialects. So it reads what TypeORM is about to **send** instead of what comes
- * back. The defect lived in what we build, and what we build is the same on every driver —
- * which makes this the way to reach the whole class our sqlite development cannot see.
- */
-
-import { closeAuthDatabase, Domain, getRepository, openAuthDatabase } from './db'
-import { loadCompiled } from './compiled'
-
-const { Role } = loadCompiled('service/role/role')
-
-const shell = require('@things-factory/shell')
-
-const ROOT = { id: '00000000-0000-4000-8000-000000000001', parentId: null }
-const CHILD = { id: '00000000-0000-4000-8000-000000000002', parentId: ROOT.id }
-
-beforeAll(async () => {
-  await openAuthDatabase()
-})
-
-afterAll(async () => {
-  await closeAuthDatabase()
-})
-
-function builderFor(domain: { id: string; parentId: string | null }, inherited: string) {
-  return shell.getQueryBuilderFromListParams({
-    repository: getRepository(Role),
-    params: { filters: [], inherited },
-    domain,
-    searchables: ['name', 'description']
-  })
-}
-
-function parametersFor(domain: { id: string; parentId: string | null }, inherited: string): any[] {
-  return builderFor(domain, inherited).getQueryAndParameters()[1]
-}
-
-function queryFor(domain: { id: string; parentId: string | null }, inherited: string): string {
-  return builderFor(domain, inherited).getQueryAndParameters()[0]
-}
-
-describe('inherited: Only', () => {
-  it('binds the parent id when there is one', () => {
-    expect(parametersFor(CHILD, 'Only')).toContain(ROOT.id)
-  })
-
-  it('binds nothing at all when there is no parent', () => {
-    /*
-     * The sentinel is gone. "A root domain inherits from nobody" is a condition, and it is now
-     * written as one — `1 = 0` — rather than as a value that has to survive a uuid parser.
-     */
-    expect(parametersFor(ROOT, 'Only')).not.toContain('Impossible')
-
-    const sql = queryFor(ROOT, 'Only')
-
-    expect(sql).toContain('1 = 0')
-  })
-
-  it('refuses a value that is not one of the three', () => {
-    /*
-     * An empty result would be read as "nothing matched". This is a tenant isolation filter;
-     * a malfunction here has to be loud, and the enum means no current caller can reach it.
-     */
-    expect(() => parametersFor(ROOT, 'Onyl')).toThrow(/unknown inherited value/)
-  })
-
-  it('binds nothing that is not a uuid for the other two scopes', () => {
-    /* None and Include are fine, which is why this went unnoticed: two of three scopes work. */
-    const uuidish = /^[0-9a-f-]{36}$/i
-
-    for (const scope of ['None', 'Include']) {
-      for (const parameter of parametersFor(ROOT, scope)) {
-        if (typeof parameter === 'string') {
-          expect(parameter).toMatch(uuidish)
-        }
-      }
-    }
-  })
-})

package/tests/domain-required.test.ts

@@ -1,127 +0,0 @@
-import { decideDomainRedirect, DOMAIN_REDIRECT_WINDOW_MS, domainRequiredTarget } from '../client/domain-required'
-
-/**
- * Where a screen that came up before the shell settled on a domain is sent.
- *
- * Every query on such a screen answers 403, and "try again" answers 403 again, forever. The shell
- * sends the reader to check-in - the same place the server already sends an HTML request - and
- * never from check-in or sign-in themselves, where it would go round in a circle.
- */
-
-describe('domainRequiredTarget', () => {
-  test('a screen without a domain segment goes to check-in, carrying where it was', () => {
-    const target = new URL(domainRequiredTarget('http://localhost:4000/activity-catalog')!)
-
-    expect(target.pathname).toBe('/auth/checkin')
-    expect(target.searchParams.get('redirect_to')).toBe('http://localhost:4000/activity-catalog')
-  })
-
-  test('a screen on a domain the reader may not enter also goes to check-in - the server names why', () => {
-    const target = new URL(domainRequiredTarget('http://localhost:4000/domain/other/activity-catalog')!)
-
-    expect(target.pathname).toBe('/auth/checkin')
-    expect(target.searchParams.get('redirect_to')).toBe('http://localhost:4000/domain/other/activity-catalog')
-  })
-
-  test('the query string and hash of the screen survive the round trip', () => {
-    const from = 'http://localhost:4000/activity-detail?name=MES%20Disposition%20Approval#line'
-    const target = new URL(domainRequiredTarget(from)!)
-
-    expect(target.searchParams.get('redirect_to')).toBe(from)
-  })
-
-  test('it stays on the same origin', () => {
-    expect(new URL(domainRequiredTarget('https://plant.example.com/x')!).origin).toBe('https://plant.example.com')
-  })
-
-  test('check-in itself is never sent to check-in', () => {
-    expect(domainRequiredTarget('http://localhost:4000/auth/checkin?redirect_to=%2F')).toBeNull()
-  })
-
-  test('sign-in and the other auth screens are left alone', () => {
-    expect(domainRequiredTarget('http://localhost:4000/auth/signin')).toBeNull()
-    expect(domainRequiredTarget('http://localhost:4000/auth')).toBeNull()
-  })
-
-  test('a path that only starts with the letters auth is not an auth screen', () => {
-    expect(domainRequiredTarget('http://localhost:4000/authority-list')).not.toBeNull()
-  })
-
-  test('something that is not an address is not guessed at', () => {
-    expect(domainRequiredTarget('')).toBeNull()
-    expect(domainRequiredTarget('not a url')).toBeNull()
-  })
-
-  /*
-   * A 403 is not only "no domain". The shell also answers 403 to an address on the site's IP block list
-   * (shell/server/middlewares/domain-middleware.ts). That reader has a domain; check-in sends them
-   * straight back and the screen gets 403 again. Without this guard the tab goes round forever.
-   */
-  describe('after one round trip it stops', () => {
-    const now = 1_000_000_000
-    const here = 'http://localhost:4000/domain/miratek/activity-catalog'
-
-    test('sent a moment ago: not sent again, whatever the reason for the 403', () => {
-      expect(domainRequiredTarget(here, now - 2_000, now)).toBeNull()
-    })
-
-    test('it is the time that counts, not the address - the server changed the address on the way back', () => {
-      expect(domainRequiredTarget('http://localhost:4000/activity-catalog', now - 2_000, now)).toBeNull()
-      expect(domainRequiredTarget(here, now - 2_000, now)).toBeNull()
-    })
-
-    test('once the window has passed, a new 403 is a new case and is sent', () => {
-      expect(domainRequiredTarget(here, now - DOMAIN_REDIRECT_WINDOW_MS, now)).not.toBeNull()
-    })
-
-    test('never sent before: sent', () => {
-      expect(domainRequiredTarget(here, null, now)).not.toBeNull()
-      expect(domainRequiredTarget(here, undefined, now)).not.toBeNull()
-    })
-
-    test('a stamp from the future (a clock that moved back) does not block for ever', () => {
-      expect(domainRequiredTarget(here, now + 60_000, now)).not.toBeNull()
-    })
-  })
-
-  /*
-   * The stamp is the only thing that knows "we just came back". A browser that blocks storage would lose it,
-   * and a reader on the IP block list would go round again. So storage that does not work means: do not send.
-   */
-  describe('decideDomainRedirect - the stamp must work or nothing is sent', () => {
-    const now = 1_000_000_000
-    const here = 'http://localhost:4000/activity-catalog'
-    const store = (saved: string | null = null) => {
-      const box = { value: saved, written: [] as string[] }
-      return { box, stamp: { read: () => box.value, write: (v: string) => { box.written.push(v); box.value = v } } }
-    }
-
-    test('first time: sent, and the stamp is written before leaving', () => {
-      const { box, stamp } = store()
-      expect(decideDomainRedirect(here, stamp, now)).not.toBeNull()
-      expect(box.written).toEqual([String(now)])
-    })
-
-    test('just came back: not sent, and the stamp is left as it was', () => {
-      const { box, stamp } = store(String(now - 2_000))
-      expect(decideDomainRedirect(here, stamp, now)).toBeNull()
-      expect(box.written).toEqual([])
-    })
-
-    test('storage that cannot be read: not sent', () => {
-      const stamp = { read: () => { throw new Error('blocked') }, write: () => {} }
-      expect(decideDomainRedirect(here, stamp, now)).toBeNull()
-    })
-
-    test('storage that cannot be written: not sent - a trip we cannot remember could loop', () => {
-      const stamp = { read: () => null, write: () => { throw new Error('quota') } }
-      expect(decideDomainRedirect(here, stamp, now)).toBeNull()
-    })
-
-    test('a stamp that is not a number is treated as none, and the trip goes ahead', () => {
-      const { stamp } = store('garbage')
-      expect(decideDomainRedirect(here, stamp, now)).not.toBeNull()
-    })
-  })
-})
-