@things-factory/auth-base 10.1.278 → 10.1.280

package/tests/request-holds.test.ts

@@ -1,53 +0,0 @@
-/**
- * `requestHolds` - whether the request holds a privilege, asked as the doors ask it and once per request.
- */
-
-import { loadCompiled } from './compiled'
-
-const { requestHolds } = loadCompiled('utils/check-permission')
-const { User } = loadCompiled('service/user/user')
-
-const DOMAIN = { id: 'domain-1', subdomain: 'plant-a' } as any
-const USER = { id: 'user-1', domains: [DOMAIN] } as any
-
-beforeEach(() => {
-  ;(process as any).domainOwnerGranted = jest.fn().mockResolvedValue(false)
-  ;(process as any).superUserGranted = jest.fn().mockResolvedValue(false)
-})
-
-test('a role that holds the privilege answers yes, and the database is asked once per request', async () => {
-  User.hasPrivilege = jest.fn().mockResolvedValue(true)
-  const context = { state: { domain: DOMAIN, user: USER } }
-  expect(await requestHolds(context, 'course', 'query')).toBe(true)
-  expect(await requestHolds(context, 'course', 'query')).toBe(true)
-  expect(User.hasPrivilege).toHaveBeenCalledTimes(1)
-})
-
-test('each privilege is asked on its own - query and mutation are two answers', async () => {
-  User.hasPrivilege = jest.fn().mockImplementation(async (privilege: string) => privilege === 'query')
-  const context = { state: { domain: DOMAIN, user: USER } }
-  expect(await requestHolds(context, 'course', 'query')).toBe(true)
-  expect(await requestHolds(context, 'course', 'mutation')).toBe(false)
-  expect(await requestHolds(context, 'learning', 'query')).toBe(true)
-  expect(User.hasPrivilege).toHaveBeenCalledTimes(3)
-})
-
-test('the domain owner holds it, as `domainOwnerGranted: true` doors let them in', async () => {
-  User.hasPrivilege = jest.fn().mockResolvedValue(false)
-  ;(process as any).domainOwnerGranted = jest.fn().mockResolvedValue(true)
-  expect(await requestHolds({ state: { domain: DOMAIN, user: USER } }, 'course', 'mutation')).toBe(true)
-})
-
-test('a privilege prohibited for the request is not held', async () => {
-  User.hasPrivilege = jest.fn().mockResolvedValue(true)
-  const state = { domain: DOMAIN, user: USER, prohibitedPrivileges: [{ category: 'course', privilege: 'mutation', by: 'license' }] }
-  expect(await requestHolds({ state }, 'course', 'mutation')).toBe(false)
-})
-
-test('no domain or no user holds nothing', async () => {
-  User.hasPrivilege = jest.fn().mockResolvedValue(true)
-  expect(await requestHolds({ state: { user: USER } }, 'course')).toBe(false)
-  expect(await requestHolds({ state: { domain: DOMAIN } }, 'course')).toBe(false)
-  expect(await requestHolds(undefined, 'course')).toBe(false)
-  expect(User.hasPrivilege).not.toHaveBeenCalled()
-})

package/tests/role-inheritance-db.test.ts

@@ -1,286 +0,0 @@
-/**
- * A role name that exists in this domain **and** in the one it inherits from.
- *
- * ── How the two rows come about ─────────────────────────────────────────────
- * Roles are visible one level up: every read is scoped to `[domain.id, domain.parentId]`. The
- * four duplicate checks in `role-mutation.ts` ask only about this domain, so a domain with a
- * parent can be given a role whose name is already visible through it. Measured 2026-09-20:
- * `createRole` accepts it, and both rows then come back from every list.
- *
- * ── What was settled, and when ──────────────────────────────────────────────
- * ADR-0062 decision 3 (2026-09-20): the platform forbids it, and the operator may say otherwise.
- * The name stays the same when they do — that is the point, because moving a domain off an
- * inherited structure means standing up the same names here first (decision 2).
- *
- * Resolving the name was already deterministic before that, and had to be either way. `In([own, parent])`
- * with no `ORDER BY` answered whichever the driver handed back first — the same call could
- * answer the parent's role on one installation and this domain's on another, and a role is what
- * a privilege check reads. So these cases pin **determinism and direction**, not the semantics.
- *
- * ⚠ sqlite (`tests/db.ts`). This harness cannot reproduce another driver's ordering, which is
- * the point: the fix is to stop depending on ordering at all, and that is visible here as the
- * parent's row never being the answer while this domain has one.
- */
-
-import { closeAuthDatabase, Domain, getRepository, openAuthDatabase, resetAuthDatabase } from './db'
-import { loadCompiled } from './compiled'
-
-const { Role } = loadCompiled('service/role/role')
-const { RoleQuery } = loadCompiled('service/role/role-query')
-const { RoleMutation } = loadCompiled('service/role/role-mutation')
-const { User, UserStatus } = loadCompiled('service/user/user')
-
-const query = new RoleQuery()
-const mutation = new RoleMutation()
-
-let parent: any
-let child: any
-let orphan: any
-let actor: any
-
-function context(d: any) {
-  return {
-    state: { domain: d, user: actor, tx: undefined },
-    throw: (code: number, message: string) => {
-      const error: any = new Error(message)
-      error.status = code
-      throw error
-    }
-  } as any
-}
-
-/** `context.state.domain` carries `parentId`; the repository does not fill it in for us. */
-async function withParentId(domain: any, parentId: string | null) {
-  return { ...(await getRepository(Domain).findOneBy({ id: domain.id })), parentId }
-}
-
-beforeAll(async () => {
-  await openAuthDatabase()
-})
-
-afterAll(async () => {
-  await closeAuthDatabase()
-})
-
-beforeEach(async () => {
-  await resetAuthDatabase()
-
-  const p = await getRepository(Domain).save({ name: 'system', subdomain: 'system' })
-  const c = await getRepository(Domain).save({ name: 'acme', subdomain: 'acme', parent: p })
-  const o = await getRepository(Domain).save({ name: 'beta', subdomain: 'beta' })
-
-  parent = await withParentId(p, null)
-  child = await withParentId(c, p.id)
-  orphan = await withParentId(o, null)
-
-  actor = await getRepository(User).save({
-    username: 'operator@acme.z',
-    email: 'operator@acme.z',
-    name: 'operator',
-    status: UserStatus.ACTIVATED,
-    domains: [c]
-  })
-})
-
-/** 거절의 이름을 본다 — 영어 문장이 아니라 `code` 가 계약이다(ADR-0054). */
-async function refusalCodeOf(promise: Promise<unknown>): Promise<string> {
-  try {
-    await promise
-  } catch (error: any) {
-    return error?.code || error?.extensions?.refusal?.code || `not a refusal: ${error?.message}`
-  }
-
-  return 'nothing was thrown'
-}
-
-/** 거절이 싣고 온 값. 화면이 물음을 만드는 재료다. */
-async function refusalParamsOf(promise: Promise<unknown>): Promise<Record<string, any>> {
-  try {
-    await promise
-  } catch (error: any) {
-    return error?.params || error?.extensions?.refusal?.params || {}
-  }
-
-  return {}
-}
-
-async function roleIn(domain: any, name: string, description: string) {
-  return await getRepository(Role).save({ name, description, domain: { id: domain.id } })
-}
-
-describe('one role, no ambiguity', () => {
-  it('answers this domain own role', async () => {
-    await roleIn(child, 'approver', 'ours')
-
-    expect(await query.role('approver', context(child))).toMatchObject({ description: 'ours' })
-  })
-
-  it('answers a role that only the parent has', async () => {
-    /* Inheritance still works — this is the case the whole one-level scope exists for. */
-    await roleIn(parent, 'auditor', 'theirs')
-
-    expect(await query.role('auditor', context(child))).toMatchObject({ description: 'theirs' })
-  })
-
-  it('answers nothing for a name neither has', async () => {
-    expect(await query.role('nobody', context(child))).toBeNull()
-  })
-
-  it('does not reach a parent that is not ours', async () => {
-    /* A root domain inherits from nobody, and another tenant is not a parent. */
-    await roleIn(parent, 'auditor', 'theirs')
-
-    expect(await query.role('auditor', context(orphan))).toBeNull()
-  })
-})
-
-describe('the same name in both', () => {
-  it('is refused unless the operator says this domain stands its own', async () => {
-    /*
-     * ⚠ ADR-0062 decision 3, settled 2026-09-20. Until then the duplicate checks looked at this
-     * domain only and nothing refused a name already visible through the parent, so the two rows
-     * appeared silently.
-     *
-     * The refusal names the domain the other one stands in, because that is what the operator
-     * needs to decide — they may not have known the parent had it.
-     */
-    await roleIn(parent, 'approver', 'theirs')
-
-    expect(await refusalCodeOf(mutation.createRole({ name: 'approver' } as any, context(child)))).toEqual(
-      'role-name-stands-inherited'
-    )
-  })
-
-  it('names the domain the other one stands in', async () => {
-    /*
-     * ⚠ What makes the refusal answerable. The operator's next move is to decide whether this
-     * domain stands its own of that name, and they cannot decide without knowing where the other
-     * one is — they may not have known the parent had it. A refusal that only said "duplicated"
-     * would leave them guessing.
-     *
-     * The value rides in `params`, not in the sentence: the sentence is built in the reader's
-     * language and the screen puts its own question together from these (ADR-0054).
-     */
-    await roleIn(parent, 'approver', 'theirs')
-
-    expect(await refusalParamsOf(mutation.createRole({ name: 'approver' } as any, context(child)))).toMatchObject({
-      name: 'approver',
-      domain: 'system'
-    })
-  })
-
-  it('stands when the operator does say so, under the same name', async () => {
-    /*
-     * ⚠ The escape is not "call it something else". Standing up the same names here is the first
-     * step of moving a domain off an inherited structure (decision 2) — the child's role replaces
-     * what it inherits, and cutting the parent last leaves one name again. Requiring a different
-     * name would close that route.
-     */
-    await roleIn(parent, 'approver', 'theirs')
-
-    const created = await mutation.createRole(
-      { name: 'approver', description: 'ours', separately: true } as any,
-      context(child)
-    )
-
-    expect(created).toMatchObject({ name: 'approver', description: 'ours' })
-  })
-
-  it('refuses when the name stands in both, whatever the operator says', async () => {
-    /*
-     * ⚠ The state the migration of decision 2 passes through for its whole length: this domain's
-     * own role is standing beside the inherited one until the parent is cut, last. Trying to
-     * stand a second one during that window must be refused as `here` — there is already one
-     * here — and the operator's "stand it separately" must not reach it.
-     *
-     * It depends on the lookup asking this domain first. A single read over both domains with no
-     * ORDER BY can answer with the parent's row, and then the refusal is the inherited one,
-     * which `separately` is allowed to pass. That was the same defect this file already pins for
-     * `role(name)`, reintroduced in the checking path.
-     *
-     * ⚠ This case could not see that version of it. sqlite answered the combined query with this
-     * domain's row, so the outcome was right by accident — measured 2026-09-20 by putting the old
-     * shape back: 448 tests, none red. `role-name-lookup-sentinel.test.ts` reads the query before
-     * it is sent, which is where that shape is reachable from here. What this case does catch,
-     * now that the order is in our code rather than the driver's, is the order being wrong.
-     */
-    await roleIn(parent, 'approver', 'theirs')
-    await roleIn(child, 'approver', 'ours')
-
-    expect(
-      await refusalCodeOf(mutation.createRole({ name: 'approver', separately: true } as any, context(child)))
-    ).toEqual('role-name-taken-here')
-  })
-
-  it('refuses the same way whichever row was written first', async () => {
-    await roleIn(child, 'approver', 'ours')
-    await roleIn(parent, 'approver', 'theirs')
-
-    expect(
-      await refusalCodeOf(mutation.createRole({ name: 'approver', separately: true } as any, context(child)))
-    ).toEqual('role-name-taken-here')
-  })
-
-  it('refuses a name this domain already has, whatever the operator says', async () => {
-    /*
-     * ⚠ Not something to opt into. Two rows in one domain under one name would be
-     * indistinguishable in every respect — nothing for a screen to show, nothing to choose
-     * between.
-     */
-    await roleIn(child, 'approver', 'ours')
-
-    expect(
-      await refusalCodeOf(mutation.createRole({ name: 'approver', separately: true } as any, context(child)))
-    ).toEqual('role-name-taken-here')
-  })
-
-  it('leaves a name that stands only in some third domain alone', async () => {
-    /* Another tenant's naming does not reach us. */
-    await roleIn(orphan, 'approver', 'theirs')
-
-    const created = await mutation.createRole({ name: 'approver', description: 'ours' } as any, context(child))
-
-    expect(created).toMatchObject({ description: 'ours' })
-  })
-
-  it('answers this domain own, never the parent', async () => {
-    /*
-     * ⚠ The case the fix is for. Before it, both rows matched one `In([own, parent])` with no
-     * ORDER BY, so the answer was whichever row the driver handed back first.
-     */
-    await roleIn(parent, 'approver', 'theirs')
-    await roleIn(child, 'approver', 'ours')
-
-    expect(await query.role('approver', context(child))).toMatchObject({ description: 'ours' })
-  })
-
-  it('answers the same way whichever row was written first', async () => {
-    /* ⚠ Insertion order is the thing that must stop mattering. */
-    await roleIn(child, 'approver', 'ours')
-    await roleIn(parent, 'approver', 'theirs')
-
-    expect(await query.role('approver', context(child))).toMatchObject({ description: 'ours' })
-  })
-
-  it('leaves the parent domain reading its own', async () => {
-    /* Shadowing runs one way. The parent is not affected by what a child called something. */
-    await roleIn(parent, 'approver', 'theirs')
-    await roleIn(child, 'approver', 'ours')
-
-    expect(await query.role('approver', context(parent))).toMatchObject({ description: 'theirs' })
-  })
-
-  it('still shows both to a screen that lists them', async () => {
-    /*
-     * ⚠ Deliberate, and the reason the screen has to say where each came from. Resolving a name
-     * is not the same act as offering a list to choose from: hiding the parent's row here would
-     * silently drop a role somebody may still be assigned.
-     */
-    await roleIn(parent, 'approver', 'theirs')
-    await roleIn(child, 'approver', 'ours')
-
-    const offered = await query.userRoles(actor.id, context(child))
-
-    expect(offered.filter(role => role.name === 'approver')).toHaveLength(2)
-  })
-})

package/tests/role-mutation-db.test.ts

@@ -1,293 +0,0 @@
-/**
- * 역할 만들기·고치기·지우기 — **실패했을 때 무엇을 말하나**를 실 DB 로 태운다.
- *
- * 이 셋은 권한 편집 화면이 서는 자리인데, 세 갈래의 실패가 전부 잘못된 말로 나가고 있었다.
- *
- *  ① 부모 도메인의 역할을 고치려 하면 `role.name` 에서 TypeError → 500. 화면은 이유를 모른다.
- *     목록은 상속으로 부모 역할까지 보여 주므로(`inherited: Include`) **실제로 자주 닿는다.**
- *  ② `privileges` 없는 patch(이름만 고치기)도 `patch.privileges.map` 에서 500.
- *  ③ `deleteRole` 의 catch 가 무엇이 났든 「사용 중이라 지울 수 없다」로 401 을 던졌다 —
- *     못 찾은 것도 그렇게 말했다. 관리자는 있지도 않은 사용자를 떼러 갔다.
- *
- * 그리고 `deleteRoles`(복수)는 **도메인을 아예 안 봤다** — id 만 알면 남의 도메인 역할이 지워졌다.
- *
- * 지시자는 여기서 안 돈다(스키마 층이다). 게이트는 `privilege-directive.test.ts` 가 본다.
- */
-
-import { closeAuthDatabase, Domain, getRepository, openAuthDatabase, resetAuthDatabase } from './db'
-import { authDataSource } from './db'
-import { loadCompiled } from './compiled'
-
-const { Role } = loadCompiled('service/role/role')
-const { Privilege } = loadCompiled('service/privilege/privilege')
-const { User } = loadCompiled('service/user/user')
-const { RoleMutation } = loadCompiled('service/role/role-mutation')
-
-const mutation = new RoleMutation()
-
-let parent: any
-let child: any
-let stranger: any
-let actor: any
-let boardQuery: any
-let boardMutation: any
-
-async function loadDomain(id: string) {
-  return await getRepository(Domain).findOneBy({ id })
-}
-
-/** 리졸버가 실제로 쓰는 것만 담는다 — `tx`·`domain`·`user`·`t`·`throw`. */
-function context(domain: any) {
-  return {
-    state: { domain, user: actor, tx: authDataSource().manager },
-    t: (key: string, params: any = {}) => `${key}${params.x ? `:${params.x}` : ''}`,
-    throw: (status: number, message: string) => {
-      throw new Error(`${status} ${message}`)
-    }
-  } as any
-}
-
-beforeAll(async () => {
-  await openAuthDatabase()
-})
-
-afterAll(async () => {
-  await closeAuthDatabase()
-})
-
-beforeEach(async () => {
-  await resetAuthDatabase()
-
-  const domainRepository = getRepository(Domain)
-  const savedParent = await domainRepository.save({ name: 'HQ', subdomain: 'hq' })
-  const savedChild = await domainRepository.save({ name: 'Plant A', subdomain: 'plant-a', parent: savedParent })
-  const savedStranger = await domainRepository.save({ name: 'Other', subdomain: 'other' })
-
-  parent = await loadDomain(savedParent.id)
-  child = await loadDomain(savedChild.id)
-  stranger = await loadDomain(savedStranger.id)
-
-  const privilegeRepository = getRepository(Privilege)
-  boardQuery = await privilegeRepository.save({ name: 'query', category: 'board' })
-  boardMutation = await privilegeRepository.save({ name: 'mutation', category: 'board' })
-
-  const salt = User.generateSalt()
-  actor = await getRepository(User).save({
-    username: 'admin',
-    email: 'admin@example.com',
-    name: 'Admin',
-    salt,
-    status: 'activated',
-    domains: [child]
-  })
-})
-
-async function makeRole(name: string, domain: any, privileges: any[] = [], users: any[] = []) {
-  return await getRepository(Role).save({ name, domain, privileges, users })
-}
-
-/**
- * 거절의 이름을 본다. 영어 문장이 아니라 `code` 가 계약이다(ADR-0054) — 문장은 요청의 언어가
- * 알려진 자리에서 만들어지므로, 문장을 시험에 박으면 번역이 붙는 날 같이 깨진다.
- */
-async function refusalCodeOf(promise: Promise<unknown>): Promise<string> {
-  try {
-    await promise
-  } catch (error: any) {
-    return error?.code || error?.extensions?.refusal?.code || `not a refusal: ${error?.message}`
-  }
-
-  return 'nothing was thrown'
-}
-
-describe('고치기', () => {
-  it('권한을 갈아 끼운다', async () => {
-    const role = await makeRole('viewer', child, [boardQuery])
-
-    await mutation.updateRole(role.id, { privileges: [{ id: boardMutation.id }] } as any, context(child))
-
-    const saved = await getRepository(Role).findOne({ where: { id: role.id }, relations: ['privileges'] })
-    expect(saved.privileges.map((p: any) => p.id)).toEqual([boardMutation.id])
-  })
-
-  it('`privileges` 를 안 보내면 권한을 건드리지 않는다 — 이름만 고치는 호출이 있다', async () => {
-    /* 예전에는 이 호출이 `patch.privileges.map` 에서 TypeError 로 500 이었다. */
-    const role = await makeRole('viewer', child, [boardQuery])
-
-    await mutation.updateRole(role.id, { name: 'reader' } as any, context(child))
-
-    const saved = await getRepository(Role).findOne({ where: { id: role.id }, relations: ['privileges'] })
-    expect(saved.name).toBe('reader')
-    expect(saved.privileges.map((p: any) => p.id)).toEqual([boardQuery.id])
-  })
-
-  it('부모 도메인의 역할은 어디서 고치는지 말하고 거절한다', async () => {
-    /*
-     * 목록에 보이는 것과 고칠 수 있는 것이 다르다. 예전에는 여기서 TypeError 가 나 500 이었고
-     * 화면은 「알 수 없는 오류」만 보여 줬다.
-     */
-    const role = await makeRole('shared', parent, [boardQuery])
-
-    await expect(mutation.updateRole(role.id, { name: 'mine' } as any, context(child))).rejects.toThrow(
-      /parent domain/
-    )
-  })
-
-  it('같은 이름이 이미 있으면 거절한다', async () => {
-    await makeRole('viewer', child)
-    const role = await makeRole('editor', child)
-
-    expect(await refusalCodeOf(mutation.updateRole(role.id, { name: 'viewer' } as any, context(child)))).toEqual(
-      'role-name-taken-here'
-    )
-  })
-})
-
-describe('지우기 — 하나', () => {
-  it('아무도 안 가진 역할은 지운다', async () => {
-    const role = await makeRole('unused', child, [boardQuery])
-
-    expect(await mutation.deleteRole(role.id, context(child))).toBe(true)
-    expect(await getRepository(Role).findOneBy({ id: role.id })).toBeNull()
-  })
-
-  it('가진 사람이 있으면 그 이유로 거절한다', async () => {
-    const role = await makeRole('in-use', child, [boardQuery], [actor])
-
-    expect(await refusalCodeOf(mutation.deleteRole(role.id, context(child)))).toBe('role-in-use')
-    expect(await getRepository(Role).findOneBy({ id: role.id })).not.toBeNull()
-  })
-
-  it('부모 도메인의 역할을 「사용 중」이라고 말하지 않는다', async () => {
-    /*
-     * 이것이 옛 구현의 가장 나쁜 점이었다 — 못 찾은 것을 「사용 중」이라고 말했으므로 관리자는
-     * 있지도 않은 사용자를 찾아 떼려 했다.
-     */
-    const role = await makeRole('shared', parent)
-
-    await expect(mutation.deleteRole(role.id, context(child))).rejects.toThrow(/parent domain/)
-    await expect(mutation.deleteRole(role.id, context(child))).rejects.not.toThrow(/in use/)
-  })
-})
-
-describe('지우기 — 여럿', () => {
-  it('남의 도메인 역할은 id 를 알아도 안 지운다', async () => {
-    const mine = await makeRole('mine', child)
-    const theirs = await makeRole('theirs', stranger)
-
-    await mutation.deleteRoles([mine.id, theirs.id], context(child))
-
-    expect(await getRepository(Role).findOneBy({ id: mine.id })).toBeNull()
-    expect(await getRepository(Role).findOneBy({ id: theirs.id })).not.toBeNull()
-  })
-
-  it('★ 사용 중인 역할이 하나라도 있으면 아무것도 안 지우고 그 이름과 사람 수로 거절한다 — 하나 지우기와 같은 거절이다', async () => {
-    const unused = await makeRole('unused', child)
-    const inUse = await makeRole('in-use', child, [], [actor])
-
-    let refusal: any
-    try {
-      await mutation.deleteRoles([unused.id, inUse.id], context(child))
-    } catch (error) {
-      refusal = error
-    }
-
-    expect(refusal?.code).toBe('role-in-use')
-    expect(refusal?.params).toEqual({ names: 'in-use (1)' })
-    expect(await getRepository(Role).findOneBy({ id: unused.id })).not.toBeNull()
-    expect(await getRepository(Role).findOneBy({ id: inUse.id })).not.toBeNull()
-  })
-
-  it('아무도 안 가진 역할은 함께 지운다', async () => {
-    const one = await makeRole('one', child)
-    const two = await makeRole('two', child)
-
-    expect(await mutation.deleteRoles([one.id, two.id], context(child))).toBe(true)
-    expect(await getRepository(Role).findOneBy({ id: one.id })).toBeNull()
-    expect(await getRepository(Role).findOneBy({ id: two.id })).toBeNull()
-  })
-})
-
-/**
- * 격자에서 여러 줄을 고쳐 한 번에 보내는 길.
- *
- * 목록 화면이 `dirtyRecords` 를 `cuFlag` 와 함께 보낸다. 여기서 지키는 것은 하나가 제일 크다 —
- * **`privileges` 를 안 보낸 patch 가 권한을 비우지 않는 것.** 격자는 이름만 고치는데 그것이
- * 권한을 지우면 그 역할이 아무것도 안 여는 역할이 된다.
- */
-describe('격자에서 여럿 저장', () => {
-  it('`+` 는 만들고 `M` 은 고친다', async () => {
-    const existing = await makeRole('viewer', child, [boardQuery])
-
-    await mutation.updateMultipleRole(
-      [
-        { cuFlag: '+', name: 'operator', description: '현장' },
-        { cuFlag: 'M', id: existing.id, name: 'reader' }
-      ] as any,
-      context(child)
-    )
-
-    const roles = await getRepository(Role).find({ where: { domain: { id: child.id } } })
-    expect(roles.map((r: any) => r.name).sort()).toEqual(['operator', 'reader'])
-  })
-
-  it('이름만 고쳐도 권한은 그대로다 — 격자는 권한을 안 보낸다', async () => {
-    /*
-     * 이것이 이 자리의 가장 조용한 결함이 될 수 있었다. 관리자가 격자에서 오타를 고쳤는데
-     * 그 역할이 아무것도 안 여는 역할이 되면, 그 역할을 가진 사람들이 다음 로그인에 막힌다.
-     */
-    const role = await makeRole('viewer', child, [boardQuery, boardMutation])
-
-    await mutation.updateMultipleRole([{ cuFlag: 'M', id: role.id, name: 'reader' }] as any, context(child))
-
-    const saved = await getRepository(Role).findOne({ where: { id: role.id }, relations: ['privileges'] })
-    expect(saved.privileges.map((p: any) => p.id).sort()).toEqual([boardMutation.id, boardQuery.id].sort())
-  })
-
-  it('`cuFlag` 가 없는 줄은 아무것도 하지 않는다 — 짐작해서 만들지 않는다', async () => {
-    await mutation.updateMultipleRole([{ name: 'ghost' }] as any, context(child))
-
-    expect(await getRepository(Role).findOneBy({ name: 'ghost' })).toBeNull()
-  })
-
-  it('부모 도메인의 역할을 고치려 하면 어디서 고치는지 말한다', async () => {
-    const role = await makeRole('shared', parent)
-
-    await expect(
-      mutation.updateMultipleRole([{ cuFlag: 'M', id: role.id, name: 'mine' }] as any, context(child))
-    ).rejects.toThrow(/parent domain/)
-  })
-
-  it('이름 없이 만들려 하면 거절한다', async () => {
-    await expect(mutation.updateMultipleRole([{ cuFlag: '+', name: '  ' }] as any, context(child))).rejects.toThrow()
-  })
-
-  it('같은 이름으로 만들려 하면 거절한다', async () => {
-    await makeRole('operator', child)
-
-    expect(
-      await refusalCodeOf(mutation.updateMultipleRole([{ cuFlag: '+', name: 'operator' }] as any, context(child)))
-    ).toEqual('role-name-taken-here')
-  })
-})
-
-describe('만들기', () => {
-  it('내 도메인에 만들고 고른 권한을 붙인다', async () => {
-    const created = await mutation.createRole(
-      { name: 'operator', privileges: [{ id: boardQuery.id }] } as any,
-      context(child)
-    )
-
-    const saved = await getRepository(Role).findOne({ where: { id: created.id }, relations: ['privileges', 'domain'] })
-    expect(saved.domain.id).toBe(child.id)
-    expect(saved.privileges.map((p: any) => p.id)).toEqual([boardQuery.id])
-  })
-
-  it('같은 도메인에 같은 이름은 안 만든다', async () => {
-    await makeRole('operator', child)
-
-    expect(await refusalCodeOf(mutation.createRole({ name: 'operator' } as any, context(child)))).toEqual(
-      'role-name-taken-here'
-    )
-  })
-})