@things-factory/auth-base 10.1.278 → 10.1.280

package/tests/mail-request-answers-db.test.ts

@@ -1,142 +0,0 @@
-const mockSentMail: any[] = []
-let mockMailFails = false
-
-jest.mock('@things-factory/email-base', () => ({
-  ...jest.requireActual('@things-factory/email-base'),
-  sendEmail: async (mail: any) => {
-    if (mockMailFails) throw new Error('smtp down')
-    mockSentMail.push(mail)
-  }
-}))
-
-import { closeAuthDatabase, Domain, getRepository, openAuthDatabase, resetAuthDatabase } from './db'
-import { loadCompiled } from './compiled'
-import { i18next } from '@things-factory/i18n-base/translator'
-
-const { User } = loadCompiled('service/user/user')
-const { authPublicProcessRouter } = loadCompiled('router/auth-public-process-router')
-
-/**
- * What the two "mail me" posts answer - forgot-password and resend-verification-email.
- *
- * Both set nothing when there was no account to mail, or when the mail did not go, so koa answered
- * a bare 404 and the page showed "Not Found" - the same words for "no such address" and "the mail
- * server is down". Now they give one answer whether or not the address has an account (another
- * would tell anyone which addresses are registered), and fail only when a mail was due and did not
- * go.
- *
- * The handler is taken from the router's own table, so the path is the one the page posts to.
- */
-
-function handler(path: string) {
-  const layer = authPublicProcessRouter.stack.find((layer: any) => layer.path === path && layer.methods.includes('POST'))
-
-  return layer.stack[layer.stack.length - 1]
-}
-
-async function post(path: string, body: any) {
-  const context: any = {
-    t: (key: string) => key,
-    i18next,
-    lng: 'en-US',
-    headers: {},
-    header: {},
-    request: { protocol: 'https', host: 'acme.example.com', body }
-  }
-
-  await handler(path)(context, async () => {})
-
-  return { status: context.status, body: context.body }
-}
-
-let domain: any
-
-async function person(email: string, status: string) {
-  const salt = User.generateSalt()
-
-  return await getRepository(User).save({
-    username: email.split('@')[0],
-    email,
-    name: 'Kim',
-    salt,
-    password: User.encode('Passw0rd!', salt),
-    status,
-    domains: [domain]
-  })
-}
-
-beforeAll(async () => {
-  await openAuthDatabase()
-})
-
-beforeEach(async () => {
-  await resetAuthDatabase()
-  domain = await getRepository(Domain).save({ name: 'plant-a', subdomain: 'plant-a' })
-  mockSentMail.length = 0
-  mockMailFails = false
-})
-
-afterAll(async () => {
-  await closeAuthDatabase()
-})
-
-describe('forgot-password', () => {
-  const PATH = '/auth/forgot-password'
-
-  it('mails a registered address', async () => {
-    await person('kim@example.com', 'activated')
-
-    expect(await post(PATH, { email: 'kim@example.com' })).toEqual({ status: 200, body: 'text.password reset email sent' })
-    expect(mockSentMail.map(mail => mail.receiver)).toEqual(['kim@example.com'])
-  })
-
-  it('answers an unknown address the same way, and mails nobody', async () => {
-    await person('kim@example.com', 'activated')
-
-    expect(await post(PATH, { email: 'nobody@example.com' })).toEqual({ status: 200, body: 'text.password reset email sent' })
-    expect(mockSentMail).toEqual([])
-  })
-
-  it('says so when the mail does not go', async () => {
-    await person('kim@example.com', 'activated')
-    mockMailFails = true
-
-    expect(await post(PATH, { email: 'kim@example.com' })).toEqual({ status: 503, body: 'error.mail could not be sent' })
-  })
-})
-
-describe('resend-verification-email', () => {
-  const PATH = '/auth/resend-verification-email'
-
-  it('mails an account waiting for confirmation', async () => {
-    await person('kim@example.com', 'inactive')
-
-    expect(await post(PATH, { email: 'kim@example.com' })).toEqual({ status: 200, body: 'text.verification email sent' })
-    expect(mockSentMail.map(mail => mail.receiver)).toEqual(['kim@example.com'])
-  })
-
-  it.each([
-    ['an unknown address', 'nobody@example.com'],
-    ['an account already confirmed', 'lee@example.com']
-  ])('answers %s the same way, and mails nobody', async (_, email) => {
-    await person('lee@example.com', 'activated')
-
-    expect(await post(PATH, { email })).toEqual({ status: 200, body: 'text.verification email sent' })
-    expect(mockSentMail).toEqual([])
-  })
-
-  it('mails nobody for a post without an address', async () => {
-    /* ⚠ TypeORM drops an undefined condition - this matched the first account and mailed it. */
-    await person('kim@example.com', 'inactive')
-
-    expect(await post(PATH, {})).toEqual({ status: 200, body: 'text.verification email sent' })
-    expect(mockSentMail).toEqual([])
-  })
-
-  it('says so when the mail does not go', async () => {
-    await person('kim@example.com', 'inactive')
-    mockMailFails = true
-
-    expect(await post(PATH, { email: 'kim@example.com' })).toEqual({ status: 503, body: 'error.mail could not be sent' })
-  })
-})

package/tests/open-doors.test.ts

@@ -1,121 +0,0 @@
-import { buildSchema } from 'type-graphql'
-import { GraphQLSchema } from 'graphql'
-
-import { loadCompiled } from './compiled'
-
-/**
- * Which of auth-base's doors are open, and why each one is allowed to be.
- *
- * ── The thing this catches ──────────────────────────────────────────────────
- * `@privilege` is opt-in. A root field that declares nothing is recorded as open, and that is
- * indistinguishable from a field somebody decided to open — no error, no warning, nothing to
- * grep for. So a door goes in ungated the way `deleteAppBinding` did, and only a reader who
- * happens to look at that one file ever finds out.
- *
- * The list below turns the absence into a statement. Anything open that is not on it fails, and
- * the reason has to be written before it can be added.
- *
- * ── Why this is measured and not read off the source ────────────────────────
- * The schema is built from `service/index.ts`'s own `resolverClasses` — the list the server
- * boots from — and the directive fills `PRIVILEGE_OF_FIELD` while it walks it. A regular
- * expression over the files would answer about the text; this answers about the schema that
- * actually gets served, including every field the walk reaches that a hand-written pattern
- * would not.
- *
- * ── What it does not cover ──────────────────────────────────────────────────
- * Only auth-base. The other packages have their own resolvers and their own open doors, and
- * `docs/design/auth-rebuild.md` §7 is where the policy for those is still undecided.
- */
-
-const { schema: declared } = loadCompiled('service/index')
-const { privilegeDirectiveResolver, privilegeOfField } = loadCompiled('service/privilege/privilege-directive')
-
-/*
- * Open on purpose — read from the module's own declaration (`server/service/open-fields.ts`), which is
- * also what the directive enforces against. It used to be a copy kept here, and two copies of one
- * list are two lists.
- */
-const { openFields: declaration } = loadCompiled('service/open-fields')
-
-const OPEN_BY_DECISION: Record<string, Record<string, string>> = { Query: {}, Mutation: {} }
-
-for (const [where, reason] of Object.entries(declaration.byDesign as Record<string, string>)) {
-  const [typeName, field] = where.split('.')
-  OPEN_BY_DECISION[typeName][field] = reason
-}
-
-let schema: GraphQLSchema
-
-beforeAll(async () => {
-  schema = await buildSchema({ resolvers: declared.resolverClasses, validate: false })
-
-  /* No modules: this file measures what is open, not what would be refused. */
-  privilegeDirectiveResolver(schema, { modules: [] })
-})
-
-function openFields(typeName: 'Query' | 'Mutation'): string[] {
-  const type = typeName === 'Query' ? schema.getQueryType() : schema.getMutationType()
-
-  return Object.keys(type?.getFields() || {}).filter(field => {
-    const declaredGate = privilegeOfField(typeName, field)
-
-    return declaredGate.known && declaredGate['gate'] === null
-  })
-}
-
-describe('every open door is one somebody chose', () => {
-  it.each(['Query', 'Mutation'] as const)('%s', typeName => {
-    expect(openFields(typeName).sort()).toEqual(Object.keys(OPEN_BY_DECISION[typeName]).sort())
-  })
-})
-
-describe('the doors that were closed', () => {
-  /*
-   * ⚠ These were all open on 2026-09-20, every one of them reachable by anyone holding a valid
-   * token. They are listed by name so that reopening one is a visible act rather than a
-   * deletion nobody reads.
-   *
-   *   the five auth provider writes  reading the configuration needed a privilege; replacing it
-   *                                  did not. An auth provider is how an external identity
-   *                                  signs in, so adding one is not an edit to a settings row
-   *   domainUserRoleRegister         makes a domain, its roles and its users. `domainRegister`
-   *                                  beside it makes only a domain and is super-user only
-   *   loginHistories                 everybody's sign-ins - now the audit's, behind `audit:query` (ADR-0141)
-   *   inviteUser
-   */
-  const CLOSED = {
-    Mutation: [
-      'createAuthProvider',
-      'updateAuthProvider',
-      'updateMultipleAuthProvider',
-      'deleteAuthProvider',
-      'deleteAuthProviders',
-      'domainUserRoleRegister',
-      'inviteUser'
-    ],
-    Query: ['auditRecords', 'auditPeople', 'auditDoors', 'auditHealth']
-  }
-
-  it.each(Object.entries(CLOSED).flatMap(([t, fields]) => fields.map(f => [t, f])))('%s.%s', (typeName, field) => {
-    const declaredGate = privilegeOfField(typeName, field)
-
-    expect(declaredGate.known).toBe(true)
-    expect(declaredGate['gate']).not.toBeNull()
-  })
-})
-
-describe('what the walk itself has to be true for', () => {
-  it('reaches the whole schema, not a handful of fields', () => {
-    /*
-     * If the resolver list shrank to nothing the two assertions above would pass by having
-     * nothing to look at. This is the floor under them.
-     */
-    expect(Object.keys(schema.getQueryType()?.getFields() || {}).length).toBeGreaterThan(30)
-    expect(Object.keys(schema.getMutationType()?.getFields() || {}).length).toBeGreaterThan(40)
-  })
-
-  it('tells an undeclared field from one the schema does not have', () => {
-    /* `known: false` must never read as open — that is how a typo becomes a gate that is not there. */
-    expect(privilegeOfField('Query', 'noSuchField')).toEqual({ known: false })
-  })
-})

package/tests/open-fields-enforcement.test.ts

@@ -1,215 +0,0 @@
-import { buildSchema } from 'type-graphql'
-import { graphql, GraphQLSchema } from 'graphql'
-import { makeExecutableSchema } from '@graphql-tools/schema'
-
-import { loadCompiled } from './compiled'
-
-const { schema: declared } = loadCompiled('service/index')
-const { privilegeDirectiveResolver, privilegeDirectiveTypeDefs } = loadCompiled('service/privilege/privilege-directive')
-const { coverageOf, judgeUndeclared } = loadCompiled('service/privilege/open-field-rule')
-
-/**
- * A field that declares no `@privilege` and that its module does not list — what happens to it
- * (`docs/design/auth-rebuild.md` §8 step 1; question sheet Q1 · Q2 · Q5).
- *
- * ── The four answers ────────────────────────────────────────────────────────
- *   byDesign          open, and the module says why
- *   notYetDeclared    open, and on the module's list to close
- *   unlisted          the module opted in and says nothing: boot refuses in development, the field
- *                     refuses in production
- *   not opted in      the module declared no lists at all: exactly as before
- *
- * The last one is deliberate. The four products serve resolvers of their own from another
- * repository, and enforcing on them the day this lands would stop all four from booting.
- *
- * These build auth-base's real schema from the `resolverClasses` the server boots from, and vary
- * only the module's declaration — so what is tested is the directive against real fields, not
- * against a model of them.
- */
-
-const MODULE = 'auth-base'
-const REAL = declared.openFields
-
-function modules(openFields: any) {
-  return [{ name: MODULE, schema: { resolverClasses: declared.resolverClasses, openFields } }]
-}
-
-/** auth-base's declaration with one reason taken out — the shape of a field somebody forgot to list. */
-function without(where: string) {
-  const byDesign = { ...REAL.byDesign }
-  delete byDesign[where]
-  return { ...REAL, byDesign }
-}
-
-async function built(): Promise<GraphQLSchema> {
-  return await buildSchema({ resolvers: declared.resolverClasses, validate: false })
-}
-
-async function refusalCodeOf(promise: Promise<any>): Promise<string> {
-  const result = await promise
-  return result?.errors?.[0]?.extensions?.refusal?.code || result?.errors?.[0]?.extensions?.code || 'no error'
-}
-
-describe('who is covered', () => {
-  it('attributes each root field to the module whose class declared it', async () => {
-    const coverage = coverageOf(modules(REAL))
-
-    expect(coverage.get('Query.myRoles')).toEqual({ module: MODULE, listed: 'by-design' })
-    expect(coverage.get('Mutation.createRole')).toEqual({ module: MODULE, listed: null })
-  })
-
-  it('covers nothing for a module that declared no lists', () => {
-    /* ⚠ The line that keeps the four products booting. */
-    expect(coverageOf(modules(undefined)).size).toBe(0)
-  })
-
-  it('does not cover a field of a class the module did not name', () => {
-    const coverage = coverageOf([{ name: 'other', schema: { resolverClasses: [], openFields: {} } }])
-
-    expect(judgeUndeclared('Query.myRoles', coverage)).toEqual('not-opted-in')
-  })
-})
-
-describe('the verdicts', () => {
-  const coverage = () =>
-    coverageOf(modules({ byDesign: { 'Query.myRoles': 'mine' }, notYetDeclared: ['Query.passwordRule'] }))
-
-  it('open by design', () => {
-    expect(judgeUndeclared('Query.myRoles', coverage())).toEqual('open-by-design')
-  })
-
-  it('open, not yet declared', () => {
-    expect(judgeUndeclared('Query.passwordRule', coverage())).toEqual('open-not-yet-declared')
-  })
-
-  it('unlisted', () => {
-    expect(judgeUndeclared('Query.hasPrivilege', coverage())).toEqual('unlisted')
-  })
-
-  it('not opted in', () => {
-    expect(judgeUndeclared('Query.somethingElse', coverage())).toEqual('not-opted-in')
-  })
-})
-
-describe('in development — the schema refuses to build', () => {
-  it('builds with the declaration auth-base ships', async () => {
-    /* Every undeclared field of auth-base is in `byDesign`; nothing is unlisted today. */
-    const schema = await built()
-
-    expect(() => privilegeDirectiveResolver(schema, { modules: modules(REAL), mode: 'boot' })).not.toThrow()
-  })
-
-  it('names the field that is unlisted', async () => {
-    /* ⚠ The case the step exists for: a field arrived and nobody said who may call it. */
-    const schema = await built()
-
-    expect(() => privilegeDirectiveResolver(schema, { modules: modules(without('Query.myRoles')), mode: 'boot' })).toThrow(
-      /Query\.myRoles/
-    )
-  })
-
-  it('names every unlisted field at once, not the first', async () => {
-    const schema = await built()
-    const declaration = without('Query.myRoles')
-    delete declaration.byDesign['Query.passwordRule']
-
-    let message = ''
-    try {
-      privilegeDirectiveResolver(schema, { modules: modules(declaration), mode: 'boot' })
-    } catch (e: any) {
-      message = e.message
-    }
-
-    expect(message).toMatch(/2 field\(s\)/)
-    expect(message).toMatch(/Query\.myRoles/)
-    expect(message).toMatch(/Query\.passwordRule/)
-  })
-
-  it('accepts the field once it is listed as not yet declared', async () => {
-    const schema = await built()
-    const declaration = { ...without('Query.myRoles'), notYetDeclared: ['Query.myRoles'] }
-
-    expect(() => privilegeDirectiveResolver(schema, { modules: modules(declaration), mode: 'boot' })).not.toThrow()
-  })
-
-  it('leaves a module that declared no lists exactly as it was', async () => {
-    const schema = await built()
-
-    expect(() => privilegeDirectiveResolver(schema, { modules: modules(undefined), mode: 'boot' })).not.toThrow()
-  })
-})
-
-describe('in production — only that field refuses', () => {
-  it('still builds', async () => {
-    const schema = await built()
-
-    expect(() =>
-      privilegeDirectiveResolver(schema, { modules: modules(without('Query.passwordRule')), mode: 'request' })
-    ).not.toThrow()
-  })
-
-  it('refuses the unlisted field, with a name the screen can read', async () => {
-    /*
-     * ⚠ Never the other way. An unlisted field in production answers nobody — wrong in the worst case
-     * means one field refuses, never one field opens.
-     */
-    const schema = privilegeDirectiveResolver(await built(), {
-      modules: modules(without('Query.passwordRule')),
-      mode: 'request'
-    })
-
-    expect(await refusalCodeOf(graphql({ schema, source: '{ passwordRule { lowerCase } }', contextValue: { state: {} } }))).toEqual(
-      'field-declares-no-privilege'
-    )
-  })
-
-  it('leaves a listed field answering', async () => {
-    const schema = privilegeDirectiveResolver(await built(), {
-      modules: modules(without('Query.myRoles')),
-      mode: 'request'
-    })
-
-    const result = await graphql({ schema, source: '{ passwordRule { lowerCase } }', contextValue: { state: {} } })
-
-    expect(result.errors?.[0]?.extensions?.refusal).toBeUndefined()
-  })
-})
-
-describe('a subscription is stopped where it opens', () => {
-  /*
-   * ⚠ The directive used to wrap `resolve` only. A declared subscription then connected for anyone
-   * and failed on every event — it leaked nothing and refused nothing. Built from SDL because
-   * auth-base has no subscription of its own; the directive sees the same field configuration.
-   */
-  const typeDefs = `
-    type Query { ok: Boolean }
-    type Subscription {
-      guarded: String @privilege(category: "board", privilege: "query")
-    }
-  `
-
-  function schemaWith(subscribe: () => any) {
-    return privilegeDirectiveResolver(
-      makeExecutableSchema({
-        typeDefs: [privilegeDirectiveTypeDefs, typeDefs],
-        resolvers: { Query: { ok: () => true }, Subscription: { guarded: { subscribe, resolve: (v: any) => v } } }
-      }),
-      { modules: [] }
-    )
-  }
-
-  it('refuses at subscribe for somebody without the privilege', async () => {
-    let opened = false
-    const schema = schemaWith(() => {
-      opened = true
-      return (async function* () {})()
-    })
-
-    const field = schema.getSubscriptionType()!.getFields().guarded as any
-
-    await expect(
-      field.subscribe({}, {}, { state: { user: { id: 'u', domains: [] }, domain: { id: 'd' } } }, {} as any)
-    ).rejects.toBeTruthy()
-    expect(opened).toBe(false)
-  })
-})

package/tests/open-fields-framework.test.ts

@@ -1,212 +0,0 @@
-import { buildSchema, getMetadataStorage } from 'type-graphql'
-import { createPubSub } from '@graphql-yoga/subscription'
-import { existsSync, readdirSync, readFileSync, writeFileSync } from 'fs'
-import { join } from 'path'
-
-import { loadCompiled } from './compiled'
-
-const { privilegeDirectiveResolver } = loadCompiled('service/privilege/privilege-directive')
-const companion = loadCompiled('service/index').schema.resolverClasses
-
-/**
- * Every things-factory module with resolvers says which of its fields are open (§8 step 1).
- *
- * ── Two modes ───────────────────────────────────────────────────────────────
- * Normally this is the check. For each module that declares `schema.openFields`, the directive
- * must accept it in boot mode — no field is open without being listed — and no name on its lists
- * may be stale (a field that has since been given @privilege, or that no longer exists). A list
- * that keeps names after they are closed stops telling anyone what is left.
- *
- * With `GENERATE_OPEN_FIELDS=<package>[,<package>…]` it writes that module's declaration from
- * what its schema serves today: every undeclared root field goes under `notYetDeclared`, and the
- * module's `server/service/index.ts` gains the one key. Behaviour does not change — everything
- * that was open is listed. Sorting a field into `byDesign` with its reason, or closing it, is the
- * work of step 2 and is done by hand.
- *
- * ── How a module is measured ────────────────────────────────────────────────
- * The way the server builds it: the module's own `resolverClasses`, `buildSchema` with a pub/sub
- * (modules with subscriptions do not build without one), and the privilege directive's record of
- * what each field declares. A module with mutations and no query cannot build alone, so every
- * build carries auth-base's resolvers beside it, and only the module's own fields — by the class
- * that declared them, from type-graphql's metadata — are counted.
- *
- * ⚠ Reads `dist-server`. After editing a module, build it before this means anything.
- */
-
-const PACKAGES = join(__dirname, '..', '..')
-
-/**
- * The modules that have declared their lists. Named rather than counted, the way `screen-words` names
- * the packages that owe words: a module that opts in is added here in the same commit, and the day
- * every module with resolvers is on it, the "not yet" half of this file goes.
- *
- * 2026-09-24: auth-base only. The generator below writes the rest; running it for the framework is
- * the next step of §8 step 1 and was held back from the 10.1.38 cut so it could be verified first.
- */
-const OPTED_IN = ['auth-base', 'pdf']
-
-/** Modules that cannot be measured here, and why. Adding one needs its reason. */
-const CANNOT_MEASURE: Record<string, string> = {
-  calendar:
-    "its compiled entry throws on load when required on its own (`events` of `Attendee` has no inferable type). None of the four products loads it."
-}
-
-type Measured = { name: string; own: string[]; undeclared: string[]; schema: any }
-
-function modulesWithResolvers(): string[] {
-  return readdirSync(PACKAGES)
-    .filter(name => existsSync(join(PACKAGES, name, 'dist-server', 'service', 'index.js')))
-    .filter(name => {
-      const source = join(PACKAGES, name, 'server', 'service', 'index.ts')
-      return existsSync(source) && readFileSync(source, 'utf-8').includes('resolverClasses')
-    })
-    .sort()
-}
-
-async function measure(name: string): Promise<Measured> {
-  const schema = require(join(PACKAGES, name, 'dist-server', 'service', 'index.js')).schema
-  const classes = new Set<Function>(schema?.resolverClasses || [])
-
-  const storage = getMetadataStorage() as any
-  const own: string[] = []
-  for (const [typeName, bucket] of [
-    ['Query', 'queries'],
-    ['Mutation', 'mutations'],
-    ['Subscription', 'subscriptions']
-  ]) {
-    for (const field of storage[bucket] || []) {
-      if (classes.has(field.target)) own.push(`${typeName}.${field.schemaName}`)
-    }
-  }
-
-  process['PRIVILEGE_OF_FIELD'] = {}
-  const built = await buildSchema({
-    resolvers: (name === 'auth-base' ? [...classes] : [...companion, ...classes]) as any,
-    validate: false,
-    pubSub: createPubSub() as any
-  })
-  privilegeDirectiveResolver(built, { modules: [] })
-
-  const record = process['PRIVILEGE_OF_FIELD'] as Record<string, unknown>
-  const undeclared = own.filter(where => record[where] === null).sort()
-
-  return { name, own: own.sort(), undeclared, schema }
-}
-
-function declarationSource(name: string, undeclared: string[]): string {
-  return `/**
- * ${name}'s root fields that carry no \`@privilege\` (auth-base \`docs/design/auth-rebuild.md\` §8).
- *
- * Written from what this module served on the day it opted in, so nothing that was open stopped
- * working. Every name starts under \`notYetDeclared\`: nobody has yet decided what each one guards.
- * Closing one means giving it \`@privilege(category: …, privilege: …)\` and taking it off this list.
- * A field that is open on purpose moves to \`byDesign\`, with its reason.
- *
- * A new root field that is on neither list, and has no \`@privilege\`, stops the development server
- * and is refused in production — see \`privilege/open-field-rule.ts\` in auth-base.
- */
-export const openFields = {
-  byDesign: {} as Record<string, string>,
-  notYetDeclared: [
-${undeclared.map(where => `    '${where}'`).join(',\n')}${undeclared.length ? '\n' : ''}  ]
-}
-`
-}
-
-function optIn(name: string, undeclared: string[]) {
-  const dir = join(PACKAGES, name, 'server', 'service')
-  writeFileSync(join(dir, 'open-fields.ts'), declarationSource(name, undeclared))
-
-  const indexPath = join(dir, 'index.ts')
-  let index = readFileSync(indexPath, 'utf-8')
-
-  if (!index.includes("from './open-fields.js'")) {
-    /* After the last import line, so the module's own import order is left as it was. */
-    const lines = index.split('\n')
-    let last = -1
-    lines.forEach((line, i) => {
-      if (/^import .* from '.*'$/.test(line) || /^} from '.*'$/.test(line)) last = i
-    })
-    lines.splice(last + 1, 0, "import { openFields } from './open-fields.js'")
-    index = lines.join('\n')
-  }
-
-  if (!/export const schema = \{\n\s*openFields,/.test(index)) {
-    index = index.replace('export const schema = {', 'export const schema = {\n  openFields,')
-  }
-
-  writeFileSync(indexPath, index)
-}
-
-const GENERATE = (process.env.GENERATE_OPEN_FIELDS || '').split(',').map(s => s.trim()).filter(Boolean)
-
-if (GENERATE.length) {
-  it(`writes the declarations for ${GENERATE.join(', ')}`, async () => {
-    for (const name of GENERATE) {
-      const measured = await measure(name)
-      optIn(name, measured.undeclared)
-    }
-  }, 600000)
-} else {
-  const names = modulesWithResolvers().filter(name => !(name in CANNOT_MEASURE))
-
-  describe('every module with resolvers', () => {
-    it('finds the modules it means to check', () => {
-      /* A walk that finds nothing passes whatever the modules say. */
-      expect(names.length).toBeGreaterThan(50)
-      expect(names).toContain('auth-base')
-      expect(names).toContain('shell')
-    })
-
-    it('the modules that have opted in are exactly the ones named', async () => {
-      /*
-       * ⚠ Both directions. A module that declares lists without being named here is caught, and so is
-       * one named here that has lost its lists — either way the name list stops saying what is true.
-       */
-      const optedIn: string[] = []
-      for (const name of names) {
-        const schema = require(join(PACKAGES, name, 'dist-server', 'service', 'index.js')).schema
-        if (schema?.openFields) optedIn.push(name)
-      }
-
-      expect(optedIn.sort()).toEqual([...OPTED_IN].sort())
-    })
-
-    it.each(OPTED_IN)('%s says which of its fields are open', async name => {
-      const measured = await measure(name)
-
-      expect(measured.schema?.openFields).toBeTruthy()
-
-      /* The directive in boot mode is the check the development server runs. */
-      process['PRIVILEGE_OF_FIELD'] = {}
-      const built = await buildSchema({
-        resolvers: (name === 'auth-base'
-          ? measured.schema.resolverClasses
-          : [...companion, ...measured.schema.resolverClasses]) as any,
-        validate: false,
-        pubSub: createPubSub() as any
-      })
-
-      expect(() =>
-        privilegeDirectiveResolver(built, {
-          modules: [{ name, schema: measured.schema }],
-          mode: 'boot'
-        })
-      ).not.toThrow()
-
-      /* No stale names: every listed field is one this module serves and has not yet closed. */
-      const declaration = measured.schema.openFields
-      const listed = [...Object.keys(declaration.byDesign || {}), ...(declaration.notYetDeclared || [])]
-      const stale = listed.filter(where => !measured.undeclared.includes(where))
-
-      expect(stale).toEqual([])
-    }, 120000)
-  })
-
-  describe('what cannot be measured here', () => {
-    it.each(Object.entries(CANNOT_MEASURE))('%s — %s', name => {
-      /* Still listed as a module with resolvers — the day it can be measured, this fails and it moves. */
-      expect(modulesWithResolvers()).toContain(name)
-    })
-  })
-}