@things-factory/auth-base 10.1.278 → 10.1.280

package/tests/role-template-gap-db.test.ts

@@ -1,268 +0,0 @@
-/**
- * What a role lacks against its base template - against a real database (ADR-0075 decision 1, amended 2026-10-26:
- * a role keeps one base template, `Role.templateId`, and is never paired by name).
- *
- * A template is a seed and nothing pushes its later grants into roles already standing. When
- * operato-plant's templates gained ai-assistant, the roles in miratek stayed without it and only
- * plant's security runner noticed. The role screen now shows the gap and the administrator adds
- * it; these are the facts that screen stands on.
- */
-
-import { closeAuthDatabase, Domain, getRepository, openAuthDatabase, resetAuthDatabase, authDataSource } from './db'
-import { loadCompiled } from './compiled'
-
-const { Role } = loadCompiled('service/role/role')
-const { Privilege } = loadCompiled('service/privilege/privilege')
-const { User } = loadCompiled('service/user/user')
-const { RoleTemplateMutation } = loadCompiled('service/role-template/role-template-mutation')
-const { RoleMutation } = loadCompiled('service/role/role-mutation')
-const { RoleTemplateGapResolver, RoleBriefTaskResolver } = loadCompiled('service/role-template/role-template-gap-resolver')
-const { RoleQuery } = loadCompiled('service/role/role-query')
-const { registerRoleTemplate } = loadCompiled('service/role-template/role-template')
-const { registerRoleTask } = loadCompiled('service/role-template/role-task')
-
-const mutation = new RoleTemplateMutation()
-const gapOf = (role: any) => new RoleTemplateGapResolver().templateGap(role)
-const reread = (role: any) => getRepository(Role).findOneBy({ id: role.id })
-/* The role screen's base template field saves through `updateRole`. */
-const baseOn = (role: any, templateId: string | null) => new RoleMutation().updateRole(role.id, { templateId } as any, { ...context(), t: (key: string) => key } as any)
-const coverageOf = (role: any) => new RoleTemplateGapResolver().taskCoverage(role)
-
-let domain: any
-let actor: any
-
-const context = () => ({ state: { domain, user: actor, tx: authDataSource().manager } }) as any
-
-/** The template as it stood when the role was made, then as it stands after it gained a door. */
-function declareTemplate(axes: string[], extra: { category: string; axes: string[] }[] = []) {
-  ;(process as any)['ROLE_TEMPLATES'] = {}
-  registerRoleTemplate({ id: 'plant.qi', name: 'QUALITY-INSPECTOR', grants: [{ category: 'board', axes }, ...extra] })
-}
-
-beforeAll(async () => {
-  await openAuthDatabase()
-})
-
-afterAll(async () => {
-  await closeAuthDatabase()
-})
-
-beforeEach(async () => {
-  await resetAuthDatabase()
-
-  const saved = await getRepository(Domain).save({ name: 'Plant A', subdomain: 'plant-a' })
-  domain = await getRepository(Domain).findOneBy({ id: saved.id })
-
-  await getRepository(Privilege).save({ name: 'query', category: 'board' })
-  await getRepository(Privilege).save({ name: 'mutation', category: 'board' })
-  ;(process as any).PRIVILEGES = {
-    'board query': ['board', 'query'],
-    'board mutation': ['board', 'mutation']
-  }
-
-  actor = await getRepository(User).save({
-    username: 'admin',
-    email: 'admin@example.com',
-    name: 'Admin',
-    salt: User.generateSalt(),
-    status: 'activated',
-    domains: [domain]
-  })
-})
-
-describe('the gap between a role and its template', () => {
-  it('is zero for a role made from the template as it stands', async () => {
-    declareTemplate(['query'])
-    const role = await mutation.createRoleFromTemplate('plant.qi', undefined, context())
-
-    expect(await gapOf(role)).toEqual({
-      templateId: 'plant.qi',
-      templateName: 'QUALITY-INSPECTOR',
-      missing: [],
-      missingCount: 0,
-      extra: [],
-      extraCount: 0
-    })
-  })
-
-  it('★ names what the template gained after the role was made', async () => {
-    declareTemplate(['query'])
-    const role = await mutation.createRoleFromTemplate('plant.qi', undefined, context())
-
-    declareTemplate(['query', 'mutation'])
-
-    const gap = await gapOf(role)
-    expect(gap.missingCount).toBe(1)
-    expect(gap.missing).toEqual([{ category: 'board', axes: ['mutation'] }])
-  })
-
-  it('★ closes when the administrator adds it - the same top-up the template button runs', async () => {
-    declareTemplate(['query'])
-    const role = await mutation.createRoleFromTemplate('plant.qi', undefined, context())
-    declareTemplate(['query', 'mutation'])
-
-    await mutation.createRoleFromTemplate('plant.qi', 'QUALITY-INSPECTOR', context())
-
-    expect((await gapOf(role)).missingCount).toBe(0)
-  })
-
-  it('★ does not count what this installation does not declare', async () => {
-    declareTemplate(['query'], [{ category: 'order', axes: ['query'] }])
-    const role = await mutation.createRoleFromTemplate('plant.qi', undefined, context())
-
-    expect((await gapOf(role)).missingCount).toBe(0)
-  })
-
-  it('★ a role made under a name of its own is still based on the template', async () => {
-    declareTemplate(['query'])
-    const role = await mutation.createRoleFromTemplate('plant.qi', 'NIGHT-INSPECTOR', context())
-    declareTemplate(['query', 'mutation'])
-
-    expect((await reread(role)).templateId).toBe('plant.qi')
-    expect(await gapOf(await reread(role))).toMatchObject({ templateId: 'plant.qi', missingCount: 1 })
-  })
-
-  it('★ is null for a role that is based on no template, even when a template carries its name', async () => {
-    declareTemplate(['query'])
-    const role = await getRepository(Role).save({ domain, name: 'QUALITY-INSPECTOR', privileges: [] })
-
-    expect(await gapOf(role)).toBeNull()
-  })
-
-  it('★ refuses to top up a role based on another template, and changes nothing', async () => {
-    declareTemplate(['query'])
-    registerRoleTemplate({ id: 'plant.qm', name: 'QUALITY-MANAGER', grants: [{ category: 'board', axes: ['query', 'mutation'] }] })
-    const role = await mutation.createRoleFromTemplate('plant.qi', undefined, context())
-
-    await expect(mutation.createRoleFromTemplate('plant.qm', 'QUALITY-INSPECTOR', context())).rejects.toThrow(/based on role template "plant.qi", not "plant.qm"/)
-
-    const stored = await getRepository(Role).findOne({ where: { id: role.id }, relations: ['privileges'] })
-    expect(stored.templateId).toBe('plant.qi')
-    expect(stored.privileges.map((p: any) => p.name)).toEqual(['query'])
-  })
-
-  it('★ tops up a standing role that has no base and makes the template its base', async () => {
-    declareTemplate(['query', 'mutation'])
-    const role = await getRepository(Role).save({ domain, name: 'QUALITY-INSPECTOR', privileges: [] })
-
-    await mutation.createRoleFromTemplate('plant.qi', undefined, context())
-
-    expect((await reread(role)).templateId).toBe('plant.qi')
-    expect((await gapOf(await reread(role))).missingCount).toBe(0)
-  })
-
-  it('★ is null when the base is a template this installation no longer declares', async () => {
-    declareTemplate(['query'])
-    const role = await mutation.createRoleFromTemplate('plant.qi', undefined, context())
-    ;(process as any)['ROLE_TEMPLATES'] = {}
-
-    expect(await gapOf(await reread(role))).toBeNull()
-  })
-
-  it('does not take away what the administrator added beyond the template', async () => {
-    declareTemplate(['query'])
-    const role = await mutation.createRoleFromTemplate('plant.qi', undefined, context())
-    const stored = await getRepository(Role).findOne({ where: { id: role.id }, relations: ['privileges'] })
-    stored.privileges = [
-      ...stored.privileges,
-      await getRepository(Privilege).findOneBy({ category: 'board', name: 'mutation' })
-    ]
-    await getRepository(Role).save(stored)
-
-    const gap = await gapOf(role)
-    expect(gap.missingCount).toBe(0)
-    /* Shown as wider than the template - not a fault, and nothing takes it away. */
-    expect(gap.extra).toEqual([{ category: 'board', axes: ['mutation'] }])
-    expect(gap.extraCount).toBe(1)
-  })
-
-  it('★ lays a role named in the site\'s own words against the base the administrator gives it', async () => {
-    declareTemplate(['query', 'mutation'])
-    const role = await getRepository(Role).save({ domain, name: '품질검사', privileges: [await getRepository(Privilege).findOneBy({ category: 'board', name: 'query' })] })
-
-    expect(await gapOf(role)).toBeNull()
-
-    await baseOn(role, 'plant.qi')
-    expect(await gapOf(await reread(role))).toMatchObject({ templateId: 'plant.qi', missing: [{ category: 'board', axes: ['mutation'] }], extraCount: 0 })
-
-    await baseOn(role, null)
-    expect((await reread(role)).templateId).toBeNull()
-    expect(await gapOf(await reread(role))).toBeNull()
-  })
-
-  it('refuses a base template id that does not exist rather than storing it', async () => {
-    declareTemplate(['query'])
-    const role = await mutation.createRoleFromTemplate('plant.qi', undefined, context())
-
-    await expect(baseOn(role, 'plant.nobody')).rejects.toThrow(/no role template "plant.nobody"/)
-    expect((await reread(role)).templateId).toBe('plant.qi')
-  })
-})
-
-describe('a template built from tasks (ADR-0139 decision 11)', () => {
-  beforeEach(async () => {
-    ;(process as any)['ROLE_TASKS'] = {}
-    ;(process as any)['ROLE_TEMPLATES'] = {}
-    await getRepository(Privilege).save({ name: 'query', category: 'order' })
-    ;(process as any).PRIVILEGES['order query'] = ['order', 'query']
-    registerRoleTask({ id: 'board.reading', grants: [{ category: 'board', axes: ['query'] }] })
-    registerRoleTask({ id: 'order.reading', grants: [{ category: 'order', axes: ['query'] }, { category: 'board', axes: ['query'] }] })
-  })
-
-  it('★ holds every privilege of every task once, plus its own grants', async () => {
-    registerRoleTemplate({ id: 'plant.reader', name: 'READER', tasks: ['board.reading', 'order.reading'], grants: [{ category: 'board', axes: ['mutation'] }] })
-    const role = await mutation.createRoleFromTemplate('plant.reader', undefined, context())
-
-    const held = (await getRepository(Role).findOne({ where: { id: role.id }, relations: ['privileges'] })).privileges.map((p: any) => `${p.category}:${p.name}`).sort()
-    expect(held).toEqual(['board:mutation', 'board:query', 'order:query'])
-    expect((await gapOf(role)).missingCount).toBe(0)
-  })
-
-  it('★ is refused whole when a task is not registered - no role is made, no privilege added', async () => {
-    registerRoleTemplate({ id: 'plant.reader', name: 'READER', tasks: ['board.reading', 'board.writting'] })
-
-    await expect(mutation.createRoleFromTemplate('plant.reader', undefined, context())).rejects.toThrow(/task "board.writting" is not registered/)
-    expect(await getRepository(Role).findOneBy({ name: 'READER' })).toBeNull()
-  })
-
-  it('★ is refused whole when a task names a privilege this installation does not declare', async () => {
-    registerRoleTask({ id: 'board.exporting', grants: [{ category: 'board-export', axes: ['query'] }] })
-    registerRoleTemplate({ id: 'plant.reader', name: 'READER', tasks: ['board.reading', 'board.exporting'] })
-    const standing = await getRepository(Role).save({ domain, name: 'READER', privileges: [] })
-
-    await expect(mutation.createRoleFromTemplate('plant.reader', undefined, context())).rejects.toThrow(/board-export:query/)
-    expect((await getRepository(Role).findOne({ where: { id: standing.id }, relations: ['privileges'] })).privileges).toEqual([])
-  })
-
-  it('★ the role screen sees a role by task: all, some, none, and what no task names', async () => {
-    const role = await getRepository(Role).save({
-      domain,
-      name: '판독',
-      privileges: [await getRepository(Privilege).findOneBy({ category: 'board', name: 'query' }), await getRepository(Privilege).findOneBy({ category: 'board', name: 'mutation' })]
-    })
-
-    const coverage = await coverageOf(role)
-    expect(coverage.tasks.map((task: any) => [task.taskId, task.status])).toEqual([
-      ['board.reading', 'all'],
-      ['order.reading', 'some']
-    ])
-    expect(coverage.tasks[1].missing).toEqual([{ category: 'order', axes: ['query'] }])
-    expect(coverage.unclassified).toEqual([{ category: 'board', axes: ['mutation'] }])
-  })
-
-  it('★ a person reads their own roles with the same reading - name, description and the work each holds (§11-11)', async () => {
-    const role = await getRepository(Role).save({
-      domain,
-      name: '판독',
-      description: '도면을 읽는다',
-      privileges: [await getRepository(Privilege).findOneBy({ category: 'board', name: 'query' })]
-    })
-    await getRepository(Role).save({ domain, name: '남의 역할', privileges: [] })
-    actor.roles = [role]
-    await getRepository(User).save(actor)
-
-    const mine = await new RoleQuery().myRoles(context())
-    expect(mine.map((one: any) => [one.name, one.description])).toEqual([['판독', '도면을 읽는다']])
-    expect(await new RoleBriefTaskResolver().taskCoverage(mine[0])).toEqual(await coverageOf(role))
-  })
-})

package/tests/role-template-seed-db.test.ts

@@ -1,180 +0,0 @@
-/**
- * Seeding a role from a template — against a real database.
- *
- * `role-template.test.ts` covers what the registry accepts. What it cannot cover is the
- * part that touches rows, and that is where the rules with teeth are:
- *
- *  - the plant names the seat, not the template;
- *  - an existing name is reused rather than duplicated, because approval lines hold a
- *    role's id and a second row would leave them pointing at the one nobody edits;
- *  - two templates on one name make the union, and privileges are never taken away;
- *  - a privilege this installation does not declare is skipped, never invented.
- */
-
-import { closeAuthDatabase, Domain, getRepository, openAuthDatabase, resetAuthDatabase } from './db'
-import { authDataSource } from './db'
-import { loadCompiled } from './compiled'
-
-const { Role } = loadCompiled('service/role/role')
-const { Privilege } = loadCompiled('service/privilege/privilege')
-const { User } = loadCompiled('service/user/user')
-const { RoleTemplateMutation } = loadCompiled('service/role-template/role-template-mutation')
-const { registerRoleTemplate } = loadCompiled('service/role-template/role-template')
-
-const mutation = new RoleTemplateMutation()
-
-let domain: any
-let actor: any
-let boardQuery: any
-let boardMutation: any
-
-function context() {
-  return {
-    state: { domain, user: actor, tx: authDataSource().manager }
-  } as any
-}
-
-async function privilegesOf(id: string): Promise<string[]> {
-  const role = await getRepository(Role).findOne({ where: { id }, relations: ['privileges'] })
-
-  return (role!.privileges || []).map((one: any) => `${one.category}:${one.name}`).sort()
-}
-
-beforeAll(async () => {
-  await openAuthDatabase()
-})
-
-afterAll(async () => {
-  await closeAuthDatabase()
-})
-
-beforeEach(async () => {
-  await resetAuthDatabase()
-  ;(process as any)['ROLE_TEMPLATES'] = {}
-
-  const saved = await getRepository(Domain).save({ name: 'Plant A', subdomain: 'plant-a' })
-  domain = await getRepository(Domain).findOneBy({ id: saved.id })
-
-  const privilegeRepository = getRepository(Privilege)
-  boardQuery = await privilegeRepository.save({ name: 'query', category: 'board' })
-  boardMutation = await privilegeRepository.save({ name: 'mutation', category: 'board' })
-
-  /* The gate reads this; seeding reads the rows above. Both have to agree. */
-  ;(process as any).PRIVILEGES = {
-    'board query': ['board', 'query'],
-    'board mutation': ['board', 'mutation']
-  }
-
-  actor = await getRepository(User).save({
-    username: 'admin',
-    email: 'admin@example.com',
-    name: 'Admin',
-    salt: User.generateSalt(),
-    status: 'activated',
-    domains: [domain]
-  })
-})
-
-describe('seeding', () => {
-  it('creates the role with the privileges the template names', async () => {
-    registerRoleTemplate({
-      id: 'plant.qi',
-      name: 'QUALITY-INSPECTOR',
-      grants: [{ category: 'board', axes: ['query'] }]
-    })
-
-    const role = await mutation.createRoleFromTemplate('plant.qi', undefined, context())
-
-    expect(role.name).toBe('QUALITY-INSPECTOR')
-    expect(await privilegesOf(role.id)).toEqual(['board:query'])
-  })
-
-  it('lets the plant name the seat itself', async () => {
-    registerRoleTemplate({ id: 'plant.qi', name: 'QUALITY-INSPECTOR', grants: [{ category: 'board', axes: ['query'] }] })
-
-    const role = await mutation.createRoleFromTemplate('plant.qi', '품질검사원', context())
-
-    expect(role.name).toBe('품질검사원')
-    expect(await privilegesOf(role.id)).toEqual(['board:query'])
-  })
-
-  it('makes a second seat from one template when the name differs — day shift and night shift', async () => {
-    registerRoleTemplate({ id: 'plant.qi', name: 'QUALITY-INSPECTOR', grants: [{ category: 'board', axes: ['query'] }] })
-
-    const day = await mutation.createRoleFromTemplate('plant.qi', 'QI-DAY', context())
-    const night = await mutation.createRoleFromTemplate('plant.qi', 'QI-NIGHT', context())
-
-    expect(day.id).not.toBe(night.id)
-    expect(await privilegesOf(day.id)).toEqual(['board:query'])
-    expect(await privilegesOf(night.id)).toEqual(['board:query'])
-  })
-
-  it('reuses an existing role of that name instead of creating a second one', async () => {
-    registerRoleTemplate({ id: 'plant.qi', name: 'QUALITY-INSPECTOR', grants: [{ category: 'board', axes: ['query'] }] })
-
-    const existing = await getRepository(Role).save({ name: 'QUALITY-INSPECTOR', domain, privileges: [] })
-    const role = await mutation.createRoleFromTemplate('plant.qi', undefined, context())
-
-    expect(role.id).toBe(existing.id)
-    expect(await getRepository(Role).count()).toBe(1)
-  })
-
-  /* A role has one base template (ADR-0075 decision 1, amended 2026-10-26) - two apps declaring one name no longer union. */
-  it('refuses a second template onto a role of the same name based on the first', async () => {
-    registerRoleTemplate({ id: 'plant.qi', name: 'QUALITY-INSPECTOR', grants: [{ category: 'board', axes: ['query'] }] })
-    registerRoleTemplate({
-      id: 'twin.qi',
-      name: 'QUALITY-INSPECTOR',
-      grants: [{ category: 'board', axes: ['mutation'] }]
-    })
-
-    const role = await mutation.createRoleFromTemplate('plant.qi', undefined, context())
-    await expect(mutation.createRoleFromTemplate('twin.qi', undefined, context())).rejects.toThrow(/based on role template "plant.qi", not "twin.qi"/)
-
-    expect(await privilegesOf(role.id)).toEqual(['board:query'])
-    expect(await getRepository(Role).count()).toBe(1)
-  })
-
-  it('leaves privileges the administrator added, and takes nothing away', async () => {
-    registerRoleTemplate({ id: 'plant.qi', name: 'QUALITY-INSPECTOR', grants: [{ category: 'board', axes: ['query'] }] })
-
-    const existing = await getRepository(Role).save({
-      name: 'QUALITY-INSPECTOR',
-      domain,
-      privileges: [boardMutation]
-    })
-
-    await mutation.createRoleFromTemplate('plant.qi', undefined, context())
-
-    expect(await privilegesOf(existing.id)).toEqual(['board:mutation', 'board:query'])
-  })
-
-  it('skips a privilege this installation does not declare rather than inventing the row', async () => {
-    registerRoleTemplate({
-      id: 'plant.x',
-      name: 'X',
-      grants: [
-        { category: 'board', axes: ['query'] },
-        { category: 'board-ai', axes: ['query'] }
-      ]
-    })
-
-    const role = await mutation.createRoleFromTemplate('plant.x', undefined, context())
-
-    expect(await privilegesOf(role.id)).toEqual(['board:query'])
-    expect(await getRepository(Privilege).count()).toBe(2)
-  })
-
-  it('refuses a template this installation does not have', async () => {
-    await expect(mutation.createRoleFromTemplate('plant.missing', undefined, context())).rejects.toThrow(
-      /no role template/
-    )
-  })
-
-  it('seeds the framework-computed administrator without any application declaring it', async () => {
-    const role = await mutation.createRoleFromTemplate('framework.administrator', undefined, context())
-
-    expect(role.name).toBe('ADMINISTRATOR')
-    expect(await privilegesOf(role.id)).toEqual(['board:mutation', 'board:query'])
-  })
-})

package/tests/role-template.test.ts

@@ -1,162 +0,0 @@
-/**
- * Role templates — the registry and what it refuses.
- *
- * The refusals are the interesting part. A template that registers happily and then grants
- * nothing is the quiet failure this design exists to avoid, so the checks that make noise
- * are the ones pinned here.
- */
-
-import { loadCompiled } from './compiled'
-
-const {
-  registerRoleTemplate,
-  roleTemplates,
-  roleTemplateById,
-  computedRoleTemplates,
-  allRoleTemplates,
-  unknownTemplateGrants
-} = loadCompiled('service/role-template/role-template')
-
-const { declareAxes } = loadCompiled('service/privilege/privilege-axis')
-
-beforeEach(() => {
-  /* Nobody declared, so the defaults apply — query/mutation with query read-only. */
-  delete (process as any).PRIVILEGE_AXES
-  ;(process as any)['ROLE_TEMPLATES'] = {}
-  ;(process as any).PRIVILEGES = {
-    'board query': ['board', 'query'],
-    'board mutation': ['board', 'mutation'],
-    'order query': ['order', 'query'],
-    'worklist query': ['worklist', 'query'],
-    'worklist mutation': ['worklist', 'mutation']
-  }
-})
-
-describe('declaring a template', () => {
-  it('can be found again by id', () => {
-    registerRoleTemplate({
-      id: 'plant.production-lead',
-      name: 'PRODUCTION-LEAD',
-      grants: [{ category: 'worklist', axes: ['query', 'mutation'] }]
-    })
-
-    expect(roleTemplateById('plant.production-lead')!.name).toBe('PRODUCTION-LEAD')
-    expect(roleTemplates()).toHaveLength(1)
-  })
-})
-
-describe('what registration refuses', () => {
-  it('refuses a template with no grants written at all', () => {
-    expect(() => registerRoleTemplate({ id: 'x', name: 'X' } as any)).toThrow(/no grants/)
-  })
-
-  it('accepts an empty list — a seat that opens nothing on purpose, for approval routing', () => {
-    registerRoleTemplate({ id: 'twin.quality-inspector', name: 'QUALITY-INSPECTOR', grants: [] })
-
-    expect(roleTemplateById('twin.quality-inspector')!.grants).toEqual([])
-  })
-
-  it('refuses a grant with no axes', () => {
-    expect(() => registerRoleTemplate({ id: 'x', name: 'X', grants: [{ category: 'board', axes: [] }] })).toThrow(
-      /no axes/
-    )
-  })
-
-  it('refuses the same id twice', () => {
-    registerRoleTemplate({ id: 'x', name: 'X', grants: [] })
-
-    expect(() => registerRoleTemplate({ id: 'x', name: 'Y', grants: [] })).toThrow(/declared twice/)
-  })
-
-  it('accepts the same role name from two applications — one seat, declared twice', () => {
-    registerRoleTemplate({ id: 'plant.qi', name: 'QUALITY-INSPECTOR', grants: [{ category: 'board', axes: ['query'] }] })
-    registerRoleTemplate({ id: 'twin.qi', name: 'QUALITY-INSPECTOR', grants: [] })
-
-    expect(roleTemplates().filter(one => one.name === 'QUALITY-INSPECTOR')).toHaveLength(2)
-  })
-})
-
-describe('names this installation does not declare', () => {
-  it('points at grants that would silently open nothing after a category rename', () => {
-    registerRoleTemplate({
-      id: 'plant.x',
-      name: 'X',
-      grants: [
-        { category: 'board', axes: ['query'] },
-        { category: 'board-ai', axes: ['query', 'mutation'] }
-      ]
-    })
-
-    expect(unknownTemplateGrants(roleTemplateById('plant.x')!)).toEqual(['board-ai:query', 'board-ai:mutation'])
-  })
-
-  it('reports nothing when every named privilege is installed', () => {
-    registerRoleTemplate({ id: 'plant.y', name: 'Y', grants: [{ category: 'order', axes: ['query'] }] })
-
-    expect(unknownTemplateGrants(roleTemplateById('plant.y')!)).toEqual([])
-  })
-})
-
-describe('the two templates the framework computes', () => {
-  it('gives the viewer every category that declares a query axis', () => {
-    const viewer = computedRoleTemplates().find(one => one.id === 'framework.viewer')!
-
-    expect(viewer.grants.map(grant => grant.category).sort()).toEqual(['board', 'order', 'worklist'])
-    expect(viewer.grants.every(grant => grant.axes.join() === 'query')).toBe(true)
-  })
-
-  it('gives the administrator everything declared', () => {
-    const administrator = computedRoleTemplates().find(one => one.id === 'framework.administrator')!
-    const pairs = administrator.grants.flatMap(grant => grant.axes.map(axis => `${grant.category}:${axis}`)).sort()
-
-    expect(pairs).toEqual(['board:mutation', 'board:query', 'order:query', 'worklist:mutation', 'worklist:query'])
-  })
-
-  it('widens only the administrator when a new axis is declared', () => {
-    ;(process as any).PRIVILEGES['board execute'] = ['board', 'execute']
-
-    const administrator = computedRoleTemplates().find(one => one.id === 'framework.administrator')!
-    const viewer = computedRoleTemplates().find(one => one.id === 'framework.viewer')!
-
-    expect(administrator.grants.find(grant => grant.category === 'board')!.axes).toContain('execute')
-    expect(viewer.grants.find(grant => grant.category === 'board')!.axes).toEqual(['query'])
-  })
-
-  it('builds the viewer from the declared read-only axes, not from the word "query"', () => {
-    /*
-     * A house that spells its read axis `read` gets a viewer over `read`. Matching the literal
-     * `query` was right here and wrong there — dssp's `kpi` has eight axes and none of them is
-     * `query`, so its main module would have gone missing from VIEWER without a word anywhere.
-     */
-    declareAxes(['read', 'input'], { readOnly: ['read'] })
-    ;(process as any).PRIVILEGES = {
-      'kpi read': ['kpi', 'read'],
-      'kpi input': ['kpi', 'input']
-    }
-
-    const viewer = computedRoleTemplates().find(one => one.id === 'framework.viewer')!
-
-    expect(viewer.grants).toEqual([{ category: 'kpi', axes: ['read'] }])
-  })
-
-  it('does not offer a viewer at all when nobody said which axes are read-only', () => {
-    /*
-     * ⚠ The point of this one. Offering an empty VIEWER would let an administrator pick it,
-     * get a role, and open nothing — and the role list would count that zero correctly and
-     * present it as fact. "We do not know" is not "there are none", so the template is
-     * withheld and `reportDeclaredAxes` says so at boot.
-     */
-    declareAxes(['read', 'input'])
-
-    const ids = computedRoleTemplates().map(one => one.id)
-
-    expect(ids).toEqual(['framework.administrator'])
-    expect(ids).not.toContain('framework.viewer')
-  })
-
-  it('offers the computed two alongside whatever applications declared', () => {
-    registerRoleTemplate({ id: 'plant.z', name: 'Z', grants: [] })
-
-    expect(allRoleTemplates().map(one => one.id)).toEqual(['framework.viewer', 'framework.administrator', 'plant.z'])
-  })
-})

package/tests/role-users-gate.test.ts

@@ -1,22 +0,0 @@
-import { buildSchema } from 'type-graphql'
-
-import { loadCompiled } from './compiled'
-
-/**
- * Reading roles does not list who holds them (ADR-0139).
- *
- * The `user:query` gate stood on `RoleQuery.users`, a field resolver, while `Role` declared `users` itself - and
- * type-graphql keeps the declaration's directives, so the gate was never in the served schema: `role:query` alone listed
- * every role's people. It now stands on the declaration; this reads the schema that is served, not the source.
- */
-const { schema: declared } = loadCompiled('service/index')
-const { privilegeDirectiveResolver, privilegeOfField } = loadCompiled('service/privilege/privilege-directive')
-
-describe("a role's people", () => {
-  it('★ Role.users asks user:query in the served schema', async () => {
-    const schema = await buildSchema({ resolvers: declared.resolverClasses, validate: false })
-    privilegeDirectiveResolver(schema, { modules: [] })
-    const gate = privilegeOfField('Role', 'users')
-    expect([gate.known, gate['gate']?.category, gate['gate']?.privilege]).toEqual([true, 'user', 'query'])
-  })
-})