@things-factory/auth-base 10.1.278 → 10.1.280

package/tests/role-name-lookup-sentinel.test.ts

@@ -1,79 +0,0 @@
-import { closeAuthDatabase, Domain, getRepository, openAuthDatabase } from './db'
-import { loadCompiled } from './compiled'
-
-const { Role } = loadCompiled('service/role/role')
-const { standingRoleQuery } = loadCompiled('utils/refuse-role-name')
-
-/**
- * The read behind the inherited-name check asks **one domain at a time**.
- *
- * ── Why this reads what we send ─────────────────────────────────────────────
- * The check has to ask this domain first and the parent only if it has nothing. One read over
- * both with `In([own, parent])` has no `ORDER BY`, so when the name stands in both, the answer
- * is whichever row the driver hands back — and if that is the parent's, the refusal is the
- * inherited one, which the operator's "stand it separately" is allowed to pass. A second row of
- * the name then stands in a domain that already has it: the state the whole rule exists to
- * prevent, reached through the rule.
- *
- * ⚠ **This harness cannot fail on that.** sqlite returned this domain's row for the combined
- * query, so the outcome was right by accident and every case in
- * `role-inheritance-db.test.ts` stayed green with the defect in place — measured 2026-09-20 by
- * putting the old shape back: 448 tests, none red.
- *
- * So this reads the query **before it is sent**, the way `domain-inheritance-sentinel.test.ts`
- * does for the same reason. What we build is the same on every driver, and that is the only
- * place this class of defect is reachable from here.
- */
-
-const OWN = '00000000-0000-4000-8000-000000000002'
-const PARENT = '00000000-0000-4000-8000-000000000001'
-
-beforeAll(async () => {
-  await openAuthDatabase()
-})
-
-afterAll(async () => {
-  await closeAuthDatabase()
-})
-
-function sent(domainId: string): { sql: string; parameters: any[] } {
-  const [sql, parameters] = standingRoleQuery(getRepository(Role), 'approver', domainId).getQueryAndParameters()
-
-  return { sql, parameters }
-}
-
-describe('the query the check sends', () => {
-  it('binds the one domain it was asked about', () => {
-    expect(sent(OWN).parameters).toContain(OWN)
-  })
-
-  it('never binds a second domain', () => {
-    /*
-     * ⚠ The assertion that holds the fix. `In([own, parent])` would put both ids in here, and
-     * from that moment which one answers is the driver's choice.
-     */
-    const { parameters } = sent(OWN)
-
-    expect(parameters.filter(parameter => parameter === PARENT)).toHaveLength(0)
-    expect(parameters.filter(parameter => typeof parameter === 'string' && parameter.startsWith('0000'))).toEqual([OWN])
-  })
-
-  it('compares the domain with one value, not a set', () => {
-    /* `IN (...)` in the text is the shape of asking about more than one domain at once. */
-    expect(sent(OWN).sql).not.toMatch(/ROLE_DOMAIN.*\bIN\b/i)
-  })
-
-  it('asks by name as well, bound rather than written in', () => {
-    /* A name is a value: written into the text it would be an injection and a cache miss. */
-    const { sql, parameters } = sent(OWN)
-
-    expect(parameters).toContain('approver')
-    expect(sql).not.toContain('approver')
-  })
-
-  it('is the same query for the parent, with the parent id', () => {
-    /* The fallback is the same read, not a second shape that could drift from this one. */
-    expect(sent(PARENT).parameters).toContain(PARENT)
-    expect(sent(PARENT).parameters.filter(parameter => parameter === OWN)).toHaveLength(0)
-  })
-})

package/tests/role-name-standing.test.ts

@@ -1,83 +0,0 @@
-import { nameStands, refusesName } from '../server/utils/role-name-standing'
-
-/**
- * Whether a role may take a name that is already standing (ADR-0062 decision 3).
- *
- * The two directions cost different things. Letting an inherited name through silently leaves
- * two rows answering to one name, which is what put an approval line in front of a role nobody
- * looks at. Refusing too widely closes the migration path of decision 2 — stand the role up
- * here, move the people to the role **of the same name**, cut the parent last — and then a
- * domain cannot get off its inherited structure at all.
- *
- * So most of these are about the inherited case and about what the operator is allowed to say.
- */
-
-const ROOT = { id: 'domain-root' }
-const CHILD = { id: 'domain-child', parentId: 'domain-root' }
-
-describe('where the name stands', () => {
-  it('nowhere, when nothing was found', () => {
-    expect(nameStands(null, CHILD)).toEqual('nowhere')
-    expect(nameStands(undefined, CHILD)).toEqual('nowhere')
-    expect(nameStands({}, CHILD)).toEqual('nowhere')
-  })
-
-  it('here, when this domain has it', () => {
-    expect(nameStands({ domainId: 'domain-child' }, CHILD)).toEqual('here')
-  })
-
-  it('inherited, when the parent has it', () => {
-    expect(nameStands({ domainId: 'domain-root' }, CHILD)).toEqual('inherited')
-  })
-
-  it('nowhere, when the row belongs to some third domain', () => {
-    /*
-     * ⚠ Another tenant's role is not this domain's business, and reading it as a collision would
-     * let one tenant's naming block another's.
-     */
-    expect(nameStands({ domainId: 'domain-other' }, CHILD)).toEqual('nowhere')
-  })
-
-  it('never says inherited for a domain with no parent', () => {
-    /* A root domain inherits from nobody, so `here` is the only collision it can have. */
-    expect(nameStands({ domainId: 'domain-root' }, ROOT)).toEqual('here')
-    expect(nameStands({ domainId: 'domain-child' }, ROOT)).toEqual('nowhere')
-  })
-
-  it('does not match an absent parent against an absent domain', () => {
-    /* ⚠ Two missing values are equal to each other, which would make every row inherited. */
-    expect(nameStands({ domainId: null }, { id: 'domain-child', parentId: null })).toEqual('nowhere')
-    expect(nameStands({ domainId: undefined }, CHILD)).toEqual('nowhere')
-  })
-})
-
-describe('whether it refuses', () => {
-  it('always, for a name this domain already has', () => {
-    /*
-     * ⚠ Not something to opt into. Two rows in one domain with one name would be
-     * indistinguishable in every respect — there is nothing for a screen to show and nothing for
-     * a person to choose between.
-     */
-    expect(refusesName('here')).toBe(true)
-    expect(refusesName('here', true)).toBe(true)
-  })
-
-  it('for an inherited name, unless the operator said this domain stands its own', () => {
-    expect(refusesName('inherited')).toBe(true)
-    expect(refusesName('inherited', false)).toBe(true)
-    expect(refusesName('inherited', true)).toBe(false)
-  })
-
-  it('not at all when the name is free', () => {
-    expect(refusesName('nowhere')).toBe(false)
-    expect(refusesName('nowhere', true)).toBe(false)
-  })
-
-  it('treats a missing answer as not said', () => {
-    /*
-     * ⚠ The default has to be refuse. Standing a second role of an inherited name is the
-     * deliberate act; a caller that says nothing has not made it.
-     */
-    expect(refusesName('inherited', undefined)).toBe(true)
-  })
-})

package/tests/role-privileges-db.test.ts

@@ -1,252 +0,0 @@
-/**
- * `rolePrivileges` — 권한 편집 화면이 드는 **한 번의 질의**를 실 DB 로 태운다.
- *
- * 이 질의는 두 가지를 함께 답한다: 「무엇이 있나」와 「이 역할이 무엇을 갖나」. 화면이 그것을
- * 질의 둘로 받으면 짝짓기를 화면이 해야 하는데, 옛 화면은 그 짝을 역할 **이름**으로 맞췄고
- * 부모 도메인에 같은 이름의 역할이 있으면 남의 권한을 그렸다.
- *
- * 그리고 이 질의는 얼마 전까지 **원시 SQL** 이었다. 셋을 동시에 잃고 있었다 —
- * `roleId` 문자열 이어 붙이기, `THEN true`(MSSQL 에 없는 리터럴), 도메인 무시. 아래 시험이
- * 그 셋 중 되돌아올 수 있는 둘을 붙잡는다.
- *
- * ⚠ sqlite 로는 방언 문제를 **못 본다**(`tests/db.ts`). 그것은 원시 SQL 을 안 쓰는 것으로만
- *   막힌다. 그래서 이 시험은 「관계로 읽는다」는 결과를 지키고, 방언은 코드에서 지운다.
- */
-
-import { closeAuthDatabase, Domain, getRepository, openAuthDatabase, resetAuthDatabase } from './db'
-import { loadCompiled } from './compiled'
-
-const { Role } = loadCompiled('service/role/role')
-const { Privilege } = loadCompiled('service/privilege/privilege')
-const { User } = loadCompiled('service/user/user')
-const { RoleQuery } = loadCompiled('service/role/role-query')
-
-const query = new RoleQuery()
-
-let parent: any
-let child: any
-let stranger: any
-let boardQuery: any
-let boardMutation: any
-
-/** `parentId` 는 `@RelationId` 라 저장소로 읽은 도메인에만 실린다. */
-async function loadDomain(id: string) {
-  return await getRepository(Domain).findOneBy({ id })
-}
-
-/** 지시자가 없으므로 리졸버 본문을 직접 부른다 — 게이트는 `privilege-directive.test.ts` 가 본다. */
-function ask(roleId: string, domain: any) {
-  return query.rolePrivileges(roleId, { state: { domain } } as any)
-}
-
-function askUserRoles(userId: string, domain: any) {
-  return query.userRoles(userId, { state: { domain } } as any)
-}
-
-beforeAll(async () => {
-  await openAuthDatabase()
-})
-
-afterAll(async () => {
-  await closeAuthDatabase()
-})
-
-beforeEach(async () => {
-  await resetAuthDatabase()
-
-  const domainRepository = getRepository(Domain)
-
-  const savedParent = await domainRepository.save({ name: 'HQ', subdomain: 'hq' })
-  const savedChild = await domainRepository.save({ name: 'Plant A', subdomain: 'plant-a', parent: savedParent })
-  const savedStranger = await domainRepository.save({ name: 'Other', subdomain: 'other' })
-
-  parent = await loadDomain(savedParent.id)
-  child = await loadDomain(savedChild.id)
-  stranger = await loadDomain(savedStranger.id)
-
-  const privilegeRepository = getRepository(Privilege)
-  boardQuery = await privilegeRepository.save({ name: 'query', category: 'board' })
-  boardMutation = await privilegeRepository.save({ name: 'mutation', category: 'board' })
-})
-
-describe('가진 것과 안 가진 것', () => {
-  it('전체 권한을 돌려주고, 가진 것에만 표시한다', async () => {
-    const role = await getRepository(Role).save({ name: 'viewer', domain: child, privileges: [boardQuery] })
-
-    const rows = await ask(role.id, child)
-
-    expect(rows).toHaveLength(2)
-    expect(rows.find(row => row.id === boardQuery.id).assigned).toBe(true)
-    expect(rows.find(row => row.id === boardMutation.id).assigned).toBe(false)
-  })
-
-  it('아무것도 없는 역할에도 목록을 준다 — 편집을 시작할 수 있어야 한다', async () => {
-    const role = await getRepository(Role).save({ name: 'blank', domain: child, privileges: [] })
-
-    const rows = await ask(role.id, child)
-
-    expect(rows).toHaveLength(2)
-    expect(rows.every(row => row.assigned === false)).toBe(true)
-  })
-})
-
-describe('도메인 범위', () => {
-  it('부모 도메인의 역할은 볼 수 있다 — 상속으로 목록에 나오는 것과 같은 범위다', async () => {
-    const role = await getRepository(Role).save({ name: 'shared', domain: parent, privileges: [boardMutation] })
-
-    const rows = await ask(role.id, child)
-
-    expect(rows.find(row => row.id === boardMutation.id).assigned).toBe(true)
-  })
-
-  it('남의 도메인 역할은 못 본다 — id 를 알아도 답하지 않는다', async () => {
-    const role = await getRepository(Role).save({ name: 'theirs', domain: stranger, privileges: [boardMutation] })
-
-    expect(await ask(role.id, child)).toEqual([])
-  })
-
-  it('자식 도메인의 역할도 못 본다 — 상속은 위로 한 단이고 아래로는 없다', async () => {
-    const role = await getRepository(Role).save({ name: 'local', domain: child, privileges: [boardQuery] })
-
-    expect(await ask(role.id, parent)).toEqual([])
-  })
-})
-
-describe('없는 역할', () => {
-  it('빈 목록을 준다 — 「전체 권한을 아무것도 안 가진 역할」로 보이지 않는다', async () => {
-    /*
-     * 이 구별이 화면에서 중요하다. 전체 목록을 주면서 `assigned` 를 전부 거짓으로 두면
-     * 화면은 「권한이 하나도 없는 역할」을 그리고, 관리자가 저장하면 **실제로** 그렇게 된다.
-     */
-    expect(await ask('00000000-0000-0000-0000-000000000000', child)).toEqual([])
-  })
-})
-
-describe('부러지지 않는다', () => {
-  it('id 자리에 SQL 을 넣어도 던지지 않고 빈 목록을 준다', async () => {
-    /*
-     * 옛 구현은 이 문자열을 SQL 에 그대로 이어 붙였다. `user:query` 를 가진 사람이 닿는
-     * 자리이므로 그것으로 충분히 위험했다. 지금은 값으로만 쓰인다.
-     */
-    expect(await ask("' OR 1=1 --", child)).toEqual([])
-  })
-})
-
-/**
- * 목록이 쓰는 **수**.
- *
- * 목록이 「이 역할이 무엇을 여나」를 말하려고 권한 **행**을 받고 있었다 — 역할 20개에
- * 5,731 bytes · 69ms 대 518 bytes · 7ms(UX 레인 실측). 행을 안 받고 수를 받는다.
- */
-describe('권한 수', () => {
-  it('가진 것만 센다', async () => {
-    const role = await getRepository(Role).save({ name: 'viewer', domain: child, privileges: [boardQuery] })
-
-    expect(await query.privilegeCount(role)).toBe(1)
-  })
-
-  it('하나도 없으면 0 이다 — 「모른다」가 아니라 0 이다', async () => {
-    const role = await getRepository(Role).save({ name: 'blank', domain: child, privileges: [] })
-
-    expect(await query.privilegeCount(role)).toBe(0)
-  })
-
-  it('다른 역할의 권한을 세지 않는다', async () => {
-    await getRepository(Role).save({ name: 'other', domain: child, privileges: [boardQuery, boardMutation] })
-    const mine = await getRepository(Role).save({ name: 'mine', domain: child, privileges: [boardQuery] })
-
-    expect(await query.privilegeCount(mine)).toBe(1)
-  })
-})
-
-/* 가진 사람 수 — 가진 사람이 있는 역할은 지우지 않으므로 목록이 지우기 전에 보인다(2026-10-28). */
-describe('가진 사람 수', () => {
-  async function holder(roles: any[]) {
-    const salt = User.generateSalt()
-    const tag = Math.random().toString(36).slice(2, 8)
-    return await getRepository(User).save({ username: `h-${tag}`, email: `h-${tag}@example.com`, name: 'Lee', salt, status: 'activated', roles })
-  }
-
-  it('그 역할을 가진 사람만 센다', async () => {
-    const mine = await getRepository(Role).save({ name: 'mine', domain: child, privileges: [] })
-    const other = await getRepository(Role).save({ name: 'other', domain: child, privileges: [] })
-    await holder([mine])
-    await holder([mine, other])
-    await holder([other])
-
-    expect(await query.userCount(mine)).toBe(2)
-    expect(await query.userCount(other)).toBe(2)
-  })
-
-  it('아무도 없으면 0 이다', async () => {
-    const role = await getRepository(Role).save({ name: 'blank', domain: child, privileges: [] })
-
-    expect(await query.userCount(role)).toBe(0)
-  })
-})
-
-/**
- * 한 사람의 역할 — `rolePrivileges` 와 **같은 결함을 갖고 있던** 자리.
- *
- * 원시 SQL 로 `userId` 를 이어 붙이고, MSSQL 에 없는 `THEN true` 를 쓰고, `FROM roles` 로
- * **도메인을 아예 안 봤다.** 한 자리를 고쳤으면 두 번째 자리도 재야 한다.
- */
-describe('사용자의 역할', () => {
-  async function makeUser(roles: any[]) {
-    const salt = User.generateSalt()
-    return await getRepository(User).save({
-      username: `u-${Math.random().toString(36).slice(2, 8)}`,
-      email: `u-${Math.random().toString(36).slice(2, 8)}@example.com`,
-      name: 'Kim',
-      salt,
-      status: 'activated',
-      domains: [child],
-      roles
-    })
-  }
-
-  it('부여할 수 있는 전체를 주고, 가진 것에만 표시한다', async () => {
-    const held = await getRepository(Role).save({ name: 'held', domain: child })
-    await getRepository(Role).save({ name: 'free', domain: child })
-    const user = await makeUser([held])
-
-    const rows = await askUserRoles(user.id, child)
-
-    expect(rows).toHaveLength(2)
-    expect(rows.find(row => row.id === held.id).assigned).toBe(true)
-    expect(rows.find(row => row.name === 'free').assigned).toBe(false)
-  })
-
-  it('부모 도메인의 역할도 준다 — 상속이 부여 범위다', async () => {
-    await getRepository(Role).save({ name: 'shared', domain: parent })
-    const user = await makeUser([])
-
-    expect((await askUserRoles(user.id, child)).map((row: any) => row.name)).toEqual(['shared'])
-  })
-
-  it('남의 도메인 역할은 주지 않는다 — 예전에는 전부 줬다', async () => {
-    await getRepository(Role).save({ name: 'theirs', domain: stranger })
-    await getRepository(Role).save({ name: 'mine', domain: child })
-    const user = await makeUser([])
-
-    expect((await askUserRoles(user.id, child)).map((row: any) => row.name)).toEqual(['mine'])
-  })
-
-  it('없는 사용자에게도 목록을 준다 — 가진 것이 0 인 것과 같다', async () => {
-    await getRepository(Role).save({ name: 'mine', domain: child })
-
-    const rows = await askUserRoles('00000000-0000-0000-0000-000000000000', child)
-
-    expect(rows).toHaveLength(1)
-    expect(rows[0].assigned).toBe(false)
-  })
-
-  it('id 자리에 SQL 을 넣어도 던지지 않는다', async () => {
-    await getRepository(Role).save({ name: 'mine', domain: child })
-
-    const rows = await askUserRoles("' OR 1=1 --", child)
-
-    expect(rows).toHaveLength(1)
-    expect(rows[0].assigned).toBe(false)
-  })
-})

package/tests/role-task.test.ts

@@ -1,168 +0,0 @@
-/**
- * Role tasks — the registry, what it refuses, and how a role is laid against tasks (ADR-0139 decision 11).
- *
- * The comparison is pure: a role's held privileges, the registered tasks, the declared privileges. The role screen
- * draws exactly this, so what "all", "some", "none" and "broken" mean is pinned here.
- */
-
-import { loadCompiled } from './compiled'
-
-const { registerRoleTask, roleTasks, roleTaskById, mergeGrants, taskCoverageOf, undeclaredTaskGrants } = loadCompiled('service/role-template/role-task')
-const { registerRoleTemplate, templateGrantsOf, templateDefinitionErrors, unknownTemplateGrants } = loadCompiled('service/role-template/role-template')
-
-const DECLARED = {
-  'board query': ['board', 'query'],
-  'board mutation': ['board', 'mutation'],
-  'order query': ['order', 'query'],
-  'worklist query': ['worklist', 'query'],
-  'worklist mutation': ['worklist', 'mutation']
-}
-
-beforeEach(() => {
-  ;(process as any)['ROLE_TASKS'] = {}
-  ;(process as any)['ROLE_TEMPLATES'] = {}
-  ;(process as any).PRIVILEGES = { ...DECLARED }
-})
-
-const held = (...pairs: string[]) => new Set(pairs.map(pair => pair.replace(':', ' ')))
-
-describe('declaring a task', () => {
-  it('can be found again by id', () => {
-    registerRoleTask({ id: 'board.reading', grants: [{ category: 'board', axes: ['query'] }] })
-
-    expect(roleTaskById('board.reading')).toEqual({ id: 'board.reading', grants: [{ category: 'board', axes: ['query'] }] })
-    expect(roleTasks()).toHaveLength(1)
-  })
-
-  it.each([['reading'], [''], ['.reading']])('refuses the id "%s" - the declaring module comes first', id => {
-    expect(() => registerRoleTask({ id, grants: [{ category: 'board', axes: ['query'] }] })).toThrow(/<module>.<work>/)
-  })
-
-  it('refuses a task that holds no privileges', () => {
-    expect(() => registerRoleTask({ id: 'board.nothing', grants: [] })).toThrow(/holds no privileges/)
-  })
-
-  it('refuses a grant with no axes - axes are listed one by one', () => {
-    expect(() => registerRoleTask({ id: 'board.reading', grants: [{ category: 'board', axes: [] }] })).toThrow(/one by one/)
-  })
-
-  it('refuses the same task declared twice - one piece of work is one task', () => {
-    registerRoleTask({ id: 'board.reading', grants: [{ category: 'board', axes: ['query'] }] })
-
-    expect(() => registerRoleTask({ id: 'board.reading', grants: [{ category: 'order', axes: ['query'] }] })).toThrow(/declared twice/)
-  })
-
-  it('holds a privilege written twice once', () => {
-    registerRoleTask({ id: 'board.reading', grants: [{ category: 'board', axes: ['query'] }, { category: 'board', axes: ['query'] }] })
-
-    expect(roleTaskById('board.reading').grants).toEqual([{ category: 'board', axes: ['query'] }])
-  })
-
-  it('★ lets two tasks share a privilege - that is not a duplicate', () => {
-    registerRoleTask({ id: 'board.reading', grants: [{ category: 'board', axes: ['query'] }] })
-    registerRoleTask({ id: 'order.reading', grants: [{ category: 'order', axes: ['query'] }, { category: 'board', axes: ['query'] }] })
-
-    expect(roleTasks()).toHaveLength(2)
-  })
-
-  it('keeps a change-only grant as written - nothing adds query to it', () => {
-    registerRoleTask({ id: 'worklist.putting-up', grants: [{ category: 'worklist', axes: ['mutation'] }] })
-
-    expect(roleTaskById('worklist.putting-up').grants).toEqual([{ category: 'worklist', axes: ['mutation'] }])
-  })
-})
-
-describe('a template built from tasks', () => {
-  beforeEach(() => {
-    registerRoleTask({ id: 'board.reading', grants: [{ category: 'board', axes: ['query'] }] })
-    registerRoleTask({ id: 'order.reading', grants: [{ category: 'order', axes: ['query'] }, { category: 'board', axes: ['query'] }] })
-  })
-
-  it('★ holds the union of its tasks and its own grants, each privilege once', () => {
-    registerRoleTemplate({ id: 'plant.reader', name: 'READER', tasks: ['board.reading', 'order.reading'], grants: [{ category: 'board', axes: ['mutation', 'query'] }] })
-
-    expect(templateGrantsOf({ id: 'plant.reader', name: 'READER', tasks: ['board.reading', 'order.reading'], grants: [{ category: 'board', axes: ['mutation', 'query'] }] })).toEqual([
-      { category: 'board', axes: ['query', 'mutation'] },
-      { category: 'order', axes: ['query'] }
-    ])
-  })
-
-  it('may be written with tasks and no grants', () => {
-    expect(() => registerRoleTemplate({ id: 'plant.reader', name: 'READER', tasks: ['board.reading'] })).not.toThrow()
-  })
-
-  it('still refuses a template with neither - leaving both out is forgetting', () => {
-    expect(() => registerRoleTemplate({ id: 'plant.reader', name: 'READER' } as any)).toThrow(/has no grants/)
-  })
-
-  it('★ names an unregistered task as a definition error', () => {
-    expect(templateDefinitionErrors({ id: 'plant.reader', name: 'READER', tasks: ['board.reading', 'board.writting'] })).toEqual(['task "board.writting" is not registered'])
-  })
-
-  it('★ names a task privilege this installation does not declare as a definition error', () => {
-    registerRoleTask({ id: 'board.exporting', grants: [{ category: 'board-export', axes: ['query'] }] })
-
-    expect(undeclaredTaskGrants(roleTaskById('board.exporting'))).toEqual(['board-export:query'])
-    expect(templateDefinitionErrors({ id: 'plant.reader', name: 'READER', tasks: ['board.exporting'] })).toEqual([
-      'task "board.exporting" names board-export:query, which this installation does not declare'
-    ])
-  })
-
-  it("keeps a template's own undeclared grants as before - skipped, not a definition error", () => {
-    const template = { id: 'plant.reader', name: 'READER', grants: [{ category: 'kpi', axes: ['query'] }] }
-
-    expect(templateDefinitionErrors(template)).toEqual([])
-    expect(unknownTemplateGrants(template)).toEqual(['kpi:query'])
-  })
-})
-
-describe('a role laid against the tasks', () => {
-  beforeEach(() => {
-    registerRoleTask({ id: 'board.reading', grants: [{ category: 'board', axes: ['query'] }] })
-    registerRoleTask({ id: 'board.keeping', grants: [{ category: 'board', axes: ['query', 'mutation'] }] })
-    registerRoleTask({ id: 'order.reading', grants: [{ category: 'order', axes: ['query'] }, { category: 'board', axes: ['query'] }] })
-  })
-
-  const statuses = (coverage: any) => Object.fromEntries(coverage.tasks.map((task: any) => [task.taskId, task.status]))
-
-  it('★ says all, some and none by what the role holds of each task', () => {
-    const coverage = taskCoverageOf(held('board:query'))
-
-    expect(statuses(coverage)).toEqual({ 'board.reading': 'all', 'board.keeping': 'some', 'order.reading': 'some' })
-    expect(coverage.tasks.find((task: any) => task.taskId === 'board.keeping').missing).toEqual([{ category: 'board', axes: ['mutation'] }])
-  })
-
-  it('★ a shared privilege alone makes every task that names it "some" - reported, not supplied', () => {
-    const coverage = taskCoverageOf(held('board:query'))
-
-    expect(coverage.tasks.find((task: any) => task.taskId === 'order.reading')).toMatchObject({
-      status: 'some',
-      held: [{ category: 'board', axes: ['query'] }],
-      missing: [{ category: 'order', axes: ['query'] }]
-    })
-  })
-
-  it('says none for a role that holds nothing of a task', () => {
-    expect(statuses(taskCoverageOf(held('worklist:query')))).toEqual({ 'board.reading': 'none', 'board.keeping': 'none', 'order.reading': 'none' })
-  })
-
-  it('★ keeps what no task names apart - and leaves out what nothing declares any more', () => {
-    const coverage = taskCoverageOf(held('board:query', 'worklist:query', 'worklist:mutation', 'retired:query'))
-
-    expect(coverage.unclassified).toEqual([{ category: 'worklist', axes: ['mutation', 'query'] }])
-  })
-
-  it('★ says broken for a task naming an undeclared privilege, whatever the role holds', () => {
-    registerRoleTask({ id: 'board.exporting', grants: [{ category: 'board', axes: ['query'] }, { category: 'board-export', axes: ['query'] }] })
-
-    const task = taskCoverageOf(held('board:query')).tasks.find((one: any) => one.taskId === 'board.exporting')
-    expect(task).toMatchObject({ status: 'broken', module: 'board', undeclared: [{ category: 'board-export', axes: ['query'] }] })
-  })
-
-  it('merges grants by category in the order first written', () => {
-    expect(mergeGrants([[{ category: 'b', axes: ['x'] }], [{ category: 'a', axes: ['y'] }, { category: 'b', axes: ['z', 'x'] }]])).toEqual([
-      { category: 'b', axes: ['x', 'z'] },
-      { category: 'a', axes: ['y'] }
-    ])
-  })
-})