@things-factory/auth-base 10.1.31 → 10.1.33

package/tests/invitation-db.test.ts

@@ -0,0 +1,416 @@
+import { closeAuthDatabase, Domain, getRepository, openAuthDatabase, resetAuthDatabase } from './db'
+import { loadCompiled } from './compiled'
+
+const { Invitation } = loadCompiled('service/invitation/invitation')
+const { InvitationMutation } = loadCompiled('service/invitation/invitation-mutation')
+const { InvitationQuery } = loadCompiled('service/invitation/invitation-query')
+const { Privilege } = loadCompiled('service/privilege/privilege')
+const { Role } = loadCompiled('service/role/role')
+const { User, UserStatus } = loadCompiled('service/user/user')
+const { acceptInvitation } = loadCompiled('controllers/invitation')
+const { InvitationStatus } = loadCompiled('utils/invitation-state')
+
+const mutation = new InvitationMutation()
+const query = new InvitationQuery()
+
+/**
+ * Inviting somebody into a domain, and their accepting it.
+ *
+ * ── What this replaced ──────────────────────────────────────────────────────
+ * `invitation-surface-db.test.ts` stood here and pinned the old shape: a row with no domain, no
+ * status and no expiry, read by `{ email, reference, type }` from any tenant, deleted the moment
+ * anybody accepted. It existed so that nobody could build on `reference` or remove it quietly.
+ * It failed the moment this was built, which is what it was for.
+ *
+ * ── The token ───────────────────────────────────────────────────────────────
+ * It travels in the link's fragment, so the server never sees it in a request line. Accepting
+ * asks for the invited address too, because a forwarded mail is the one way the token can still
+ * reach somebody else and no amount of hiding closes that.
+ *
+ * ⚠ sqlite (`tests/db.ts`). Mail is not sent here — `@things-factory/email-base` is stubbed by
+ * the harness the same way the other mailing paths are, and what is asserted is the row.
+ */
+
+let ours: any
+let theirs: any
+let admin: any
+
+function context(d: any) {
+  return {
+    state: { domain: d, user: admin, tx: undefined },
+    lng: 'en',
+    headers: {},
+    request: { protocol: 'http', host: 'acme.test' },
+    throw: (code: number, message: string) => {
+      const error: any = new Error(message)
+      error.status = code
+      throw error
+    }
+  } as any
+}
+
+async function refusalCodeOf(promise: Promise<unknown>): Promise<string> {
+  try {
+    await promise
+  } catch (error: any) {
+    return error?.code || error?.extensions?.refusal?.code || `not a refusal: ${error?.message}`
+  }
+
+  return 'nothing was thrown'
+}
+
+async function roleIn(domain: any, name: string) {
+  const privilege = await getRepository(Privilege).save({ name: 'query', category: `board-${name}` })
+
+  return await getRepository(Role).save({ name, domain: { id: domain.id }, privileges: [privilege] })
+}
+
+async function personWithAccount(email: string, domains: any[] = []) {
+  return await getRepository(User).save({
+    username: email,
+    email,
+    name: email,
+    userType: 'user',
+    status: UserStatus.ACTIVATED,
+    domains: domains.map(d => ({ id: d.id }))
+  })
+}
+
+/** The row as it stands, with its token — which no client is ever given. */
+async function stored(id: string) {
+  return await getRepository(Invitation).findOne({ where: { id }, relations: ['domain', 'roles'] })
+}
+
+beforeAll(async () => {
+  await openAuthDatabase()
+})
+
+afterAll(async () => {
+  await closeAuthDatabase()
+})
+
+beforeEach(async () => {
+  await resetAuthDatabase()
+
+  ours = await getRepository(Domain).save({ name: 'acme', subdomain: 'acme' })
+  theirs = await getRepository(Domain).save({ name: 'beta', subdomain: 'beta' })
+  admin = await personWithAccount('admin@acme.z', [ours])
+})
+
+describe('sending one', () => {
+  it('stands a pending invitation to this domain, with an expiry and a token', async () => {
+    const sent = await mutation.sendInvitation('kim@acme.z', context(ours))
+    const row = await stored(sent.id)
+
+    expect(row.status).toEqual(InvitationStatus.PENDING)
+    expect(row.domain.id).toEqual(ours.id)
+    expect(row.expiresAt).toBeTruthy()
+    expect(row.token).toHaveLength(32)
+  })
+
+  it('takes the domain from the request, not from the caller', async () => {
+    /*
+     * ⚠ It used to be `reference`, a string the caller passed. That is how a door ends up
+     * writing and reading other tenants' rows.
+     */
+    const sent = await mutation.sendInvitation('kim@acme.z', context(ours))
+
+    expect((await stored(sent.id)).domain.id).toEqual(ours.id)
+    expect((await stored(sent.id)).domain.id).not.toEqual(theirs.id)
+  })
+
+  it('carries the roles the person arrives with', async () => {
+    /* Without them they sign in and have no screens at all. */
+    const viewer = await roleIn(ours, 'viewer')
+
+    const sent = await mutation.sendInvitation('kim@acme.z', context(ours), [viewer.id])
+
+    expect((await stored(sent.id)).roles.map((role: any) => role.id)).toEqual([viewer.id])
+  })
+
+  it('does not take a role from another domain', async () => {
+    const foreign = await roleIn(theirs, 'viewer')
+
+    const sent = await mutation.sendInvitation('kim@acme.z', context(ours), [foreign.id])
+
+    expect((await stored(sent.id)).roles).toEqual([])
+  })
+
+  it('re-issues the standing invitation rather than making a second one', async () => {
+    /*
+     * ⚠ One pending invitation per person and domain. The history keeps every row, so this
+     * cannot be a unique index without forbidding "invited, left, invited again" — it is held
+     * here instead.
+     */
+    const first = await mutation.sendInvitation('kim@acme.z', context(ours))
+    const again = await mutation.sendInvitation('kim@acme.z', context(ours))
+
+    expect(again.id).toEqual(first.id)
+    expect(await getRepository(Invitation).count()).toEqual(1)
+  })
+
+  it('gives the re-issued one a new token', async () => {
+    /* Two live links for one invitation is one more than anybody meant to send. */
+    const first = await mutation.sendInvitation('kim@acme.z', context(ours))
+    const before = (await stored(first.id)).token
+
+    await mutation.sendInvitation('kim@acme.z', context(ours))
+
+    expect((await stored(first.id)).token).not.toEqual(before)
+  })
+
+  it('refuses somebody who is already here', async () => {
+    await personWithAccount('kim@acme.z', [ours])
+
+    expect(await refusalCodeOf(mutation.sendInvitation('kim@acme.z', context(ours)))).toEqual(
+      'invitation-already-a-member'
+    )
+  })
+})
+
+describe('accepting', () => {
+  async function pending(email = 'kim@acme.z', roleNames: string[] = []) {
+    const roles = []
+
+    for (const name of roleNames) {
+      roles.push(await roleIn(ours, name))
+    }
+
+    const sent = await mutation.sendInvitation(
+      email,
+      context(ours),
+      roles.map(role => role.id)
+    )
+
+    return await stored(sent.id)
+  }
+
+  it('lets somebody who already has an account in, with their roles', async () => {
+    const invitation = await pending('kim@acme.z', ['viewer'])
+    const kim = await personWithAccount('kim@acme.z')
+
+    const { created } = await acceptInvitation({
+      token: invitation.token,
+      email: 'kim@acme.z',
+      context: context(ours)
+    })
+
+    const joined = await getRepository(User).findOne({ where: { id: kim.id }, relations: ['domains', 'roles'] })
+
+    expect(created).toBe(false)
+    expect(joined.domains.map((d: any) => d.id)).toContain(ours.id)
+    expect(joined.roles.map((role: any) => role.name)).toEqual(['viewer'])
+  })
+
+  it('creates the account for somebody who has none', async () => {
+    /*
+     * ⚠ The case this whole feature is for. The `user-invite` screen records that an installation
+     * with no default password has no path at all for a person who does not exist yet — nobody
+     * can set their password for them.
+     */
+    const invitation = await pending('new@acme.z', ['viewer'])
+
+    const { created } = await acceptInvitation({
+      token: invitation.token,
+      email: 'new@acme.z',
+      name: 'New Person',
+      password: 'Passw0rd!x',
+      context: context(ours)
+    })
+
+    const person = await getRepository(User).findOne({
+      where: { email: 'new@acme.z' },
+      relations: ['domains', 'roles']
+    })
+
+    expect(created).toBe(true)
+    expect(person.status).toEqual(UserStatus.ACTIVATED)
+    expect(person.domains.map((d: any) => d.id)).toEqual([ours.id])
+    expect(person.roles.map((role: any) => role.name)).toEqual(['viewer'])
+  })
+
+  it('will not create an account without a password', async () => {
+    const invitation = await pending('new@acme.z')
+
+    expect(
+      await refusalCodeOf(
+        acceptInvitation({ token: invitation.token, email: 'new@acme.z', context: context(ours) })
+      )
+    ).toEqual('invitation-needs-a-password')
+  })
+
+  it('marks the row accepted instead of deleting it', async () => {
+    /* ⚠ The reason the table exists. Deleting takes the fact that they were invited with it. */
+    const invitation = await pending()
+    await personWithAccount('kim@acme.z')
+
+    await acceptInvitation({ token: invitation.token, email: 'kim@acme.z', context: context(ours) })
+
+    const row = await stored(invitation.id)
+
+    expect(row).not.toBeNull()
+    expect(row.status).toEqual(InvitationStatus.ACCEPTED)
+    expect(row.acceptedAt).toBeTruthy()
+  })
+
+  it('cannot be used twice', async () => {
+    const invitation = await pending()
+    await personWithAccount('kim@acme.z')
+
+    await acceptInvitation({ token: invitation.token, email: 'kim@acme.z', context: context(ours) })
+
+    expect(
+      await refusalCodeOf(
+        acceptInvitation({ token: invitation.token, email: 'kim@acme.z', context: context(ours) })
+      )
+    ).toEqual('invitation-not-open')
+  })
+})
+
+describe('⚠ what the token alone is not enough for', () => {
+  async function pending(email = 'kim@acme.z') {
+    return await stored((await mutation.sendInvitation(email, context(ours))).id)
+  }
+
+  it('refuses when the address given is not the one invited', async () => {
+    /*
+     * ⚠ The mitigation for the one leak that hiding the token cannot close: the mail being
+     * forwarded. Holding the link is not enough on its own.
+     */
+    const invitation = await pending('kim@acme.z')
+    await personWithAccount('someone.else@acme.z')
+
+    expect(
+      await refusalCodeOf(
+        acceptInvitation({ token: invitation.token, email: 'someone.else@acme.z', context: context(ours) })
+      )
+    ).toEqual('invitation-not-open')
+  })
+
+  it('accepts the invited address whatever case it is typed in', async () => {
+    const invitation = await pending('Kim@Acme.Z')
+    await personWithAccount('kim@acme.z')
+
+    await expect(
+      acceptInvitation({ token: invitation.token, email: '  KIM@acme.z  ', context: context(ours) })
+    ).resolves.toBeTruthy()
+  })
+
+  it('refuses an expired invitation', async () => {
+    const invitation = await pending()
+    await personWithAccount('kim@acme.z')
+
+    await getRepository(Invitation).save({ ...invitation, expiresAt: new Date(Date.now() - 1000) })
+
+    expect(
+      await refusalCodeOf(
+        acceptInvitation({ token: invitation.token, email: 'kim@acme.z', context: context(ours) })
+      )
+    ).toEqual('invitation-not-open')
+  })
+
+  it('refuses a cancelled one whose expiry is still ahead', async () => {
+    const invitation = await pending()
+    await personWithAccount('kim@acme.z')
+
+    await mutation.cancelInvitation(invitation.id, context(ours))
+
+    expect(
+      await refusalCodeOf(
+        acceptInvitation({ token: invitation.token, email: 'kim@acme.z', context: context(ours) })
+      )
+    ).toEqual('invitation-not-open')
+  })
+
+  it('refuses a token that is not one of ours, the same way', async () => {
+    /*
+     * One answer for a wrong token, a wrong address, an expired one and a cancelled one. Telling
+     * them apart would let somebody learn which tokens are real.
+     */
+    expect(
+      await refusalCodeOf(acceptInvitation({ token: 'no-such-token', email: 'kim@acme.z', context: context(ours) }))
+    ).toEqual('invitation-not-open')
+  })
+})
+
+describe('withdrawing one', () => {
+  it('marks it cancelled and keeps the row', async () => {
+    const sent = await mutation.sendInvitation('kim@acme.z', context(ours))
+
+    expect(await mutation.cancelInvitation(sent.id, context(ours))).toBe(true)
+    expect((await stored(sent.id)).status).toEqual(InvitationStatus.CANCELLED)
+  })
+
+  it('does not reach another tenant', async () => {
+    /* ⚠ It used to delete by `{ email, reference, type }`, which took an id from anywhere. */
+    const foreign = await getRepository(Invitation).save({
+      email: 'lee@beta.z',
+      domain: { id: theirs.id },
+      status: InvitationStatus.PENDING,
+      token: 'theirs',
+      expiresAt: new Date(Date.now() + 3600_000)
+    })
+
+    expect(await mutation.cancelInvitation(foreign.id, context(ours))).toBe(false)
+    expect((await stored(foreign.id)).status).toEqual(InvitationStatus.PENDING)
+  })
+
+  it('says no for one that is already finished', async () => {
+    const sent = await mutation.sendInvitation('kim@acme.z', context(ours))
+    await mutation.cancelInvitation(sent.id, context(ours))
+
+    expect(await mutation.cancelInvitation(sent.id, context(ours))).toBe(false)
+  })
+})
+
+describe('the list', () => {
+  it('shows this domain and not another', async () => {
+    await mutation.sendInvitation('kim@acme.z', context(ours))
+    await getRepository(Invitation).save({
+      email: 'lee@beta.z',
+      domain: { id: theirs.id },
+      status: InvitationStatus.PENDING,
+      token: 'theirs',
+      expiresAt: new Date(Date.now() + 3600_000)
+    })
+
+    const { items, total } = await query.invitations({ filters: [] } as any, context(ours))
+
+    expect(total).toEqual(1)
+    expect(items[0].email).toEqual('kim@acme.z')
+  })
+
+  it('keeps accepted invitations in it', async () => {
+    /* ⚠ The history. This is what there was nothing to put on a screen before. */
+    const sent = await mutation.sendInvitation('kim@acme.z', context(ours))
+    await personWithAccount('kim@acme.z')
+
+    await acceptInvitation({ token: (await stored(sent.id)).token, email: 'kim@acme.z', context: context(ours) })
+
+    const { items, total } = await query.invitations({ filters: [] } as any, context(ours))
+
+    expect(total).toEqual(1)
+    expect(await query.state(items[0])).toEqual(InvitationStatus.ACCEPTED)
+  })
+
+  it('calls a pending row past its expiry expired, before anything writes that', async () => {
+    const sent = await mutation.sendInvitation('kim@acme.z', context(ours))
+    const row = await stored(sent.id)
+
+    await getRepository(Invitation).save({ ...row, expiresAt: new Date(Date.now() - 1000) })
+
+    expect(await query.state(await stored(sent.id))).toEqual(InvitationStatus.EXPIRED)
+  })
+
+  it('does not answer for an id from another tenant', async () => {
+    const foreign = await getRepository(Invitation).save({
+      email: 'lee@beta.z',
+      domain: { id: theirs.id },
+      status: InvitationStatus.PENDING,
+      token: 'theirs',
+      expiresAt: new Date(Date.now() + 3600_000)
+    })
+
+    expect(await query.invitation(foreign.id, context(ours))).toBeNull()
+  })
+})

package/tests/invitation-state.test.ts

@@ -0,0 +1,92 @@
+import { InvitationStatus, invitationState, mayAccept } from '../server/utils/invitation-state'
+
+/**
+ * What state an invitation is in, and whether its token still opens anything.
+ *
+ * The token in an invitation email is a credential: whoever holds it joins a domain. So the
+ * cases below lean the way credentials lean — an invitation that cannot say it is live is not
+ * live. The opposite mistake is a link that works forever, which is what the table had before
+ * (no expiry column at all).
+ */
+
+const NOW = new Date('2026-09-20T12:00:00Z')
+const LATER = new Date('2026-09-21T12:00:00Z')
+const EARLIER = new Date('2026-09-19T12:00:00Z')
+
+describe('a pending invitation', () => {
+  it('is pending while its expiry is ahead', () => {
+    expect(invitationState({ status: 'pending', expiresAt: LATER }, NOW)).toEqual(InvitationStatus.PENDING)
+    expect(mayAccept({ status: 'pending', expiresAt: LATER }, NOW)).toBe(true)
+  })
+
+  it('is expired once the expiry has passed, before anything writes that down', () => {
+    /*
+     * ⚠ The guard is the clock, not the column. If `expired` were only a written value, the gap
+     * between the expiry passing and something running to record it would be a window where the
+     * token still works.
+     */
+    expect(invitationState({ status: 'pending', expiresAt: EARLIER }, NOW)).toEqual(InvitationStatus.EXPIRED)
+    expect(mayAccept({ status: 'pending', expiresAt: EARLIER }, NOW)).toBe(false)
+  })
+
+  it('is expired exactly at the moment it runs out', () => {
+    /* The boundary belongs to the dead side — a credential does not get its last instant. */
+    expect(mayAccept({ status: 'pending', expiresAt: NOW }, NOW)).toBe(false)
+  })
+
+  it('reads a stored timestamp string the same as a Date', () => {
+    expect(mayAccept({ status: 'pending', expiresAt: LATER.toISOString() }, NOW)).toBe(true)
+    expect(mayAccept({ status: 'pending', expiresAt: EARLIER.toISOString() }, NOW)).toBe(false)
+  })
+})
+
+describe('what an absent value means', () => {
+  it('no status reads as pending', () => {
+    /* That is what a row existing meant in the old table, which had no status column. */
+    expect(invitationState({ expiresAt: LATER }, NOW)).toEqual(InvitationStatus.PENDING)
+  })
+
+  it('⚠ no expiry reads as expired', () => {
+    /*
+     * ⚠ Rows written before this existed have no expiry, and they come from a flow that never
+     * completed — the link in the email led to no route at all. Reading them as live would keep
+     * alive tokens that never worked. A credential that cannot say when it dies does not open
+     * anything.
+     */
+    expect(invitationState({ status: 'pending' }, NOW)).toEqual(InvitationStatus.EXPIRED)
+    expect(invitationState({}, NOW)).toEqual(InvitationStatus.EXPIRED)
+    expect(mayAccept({ status: 'pending', expiresAt: null }, NOW)).toBe(false)
+  })
+
+  it('an unreadable timestamp reads as expired too', () => {
+    expect(mayAccept({ status: 'pending', expiresAt: 'not a date' }, NOW)).toBe(false)
+  })
+
+  it('no invitation at all is not acceptable', () => {
+    expect(mayAccept(null, NOW)).toBe(false)
+    expect(mayAccept(undefined, NOW)).toBe(false)
+  })
+})
+
+describe('a row that is already finished', () => {
+  it('stays accepted however long ago it was', () => {
+    /*
+     * ⚠ Time does not rewrite history. If an accepted row expired later, the list would stop
+     * being able to say that this person was invited and came in — which is the whole reason the
+     * row is kept.
+     */
+    expect(invitationState({ status: 'accepted', expiresAt: EARLIER }, NOW)).toEqual(InvitationStatus.ACCEPTED)
+    expect(invitationState({ status: 'accepted' }, NOW)).toEqual(InvitationStatus.ACCEPTED)
+  })
+
+  it('stays cancelled', () => {
+    expect(invitationState({ status: 'cancelled', expiresAt: LATER }, NOW)).toEqual(InvitationStatus.CANCELLED)
+  })
+
+  it('cannot be accepted, whatever its expiry says', () => {
+    /* ⚠ A cancelled invitation whose expiry is still ahead must not open anything. */
+    expect(mayAccept({ status: 'cancelled', expiresAt: LATER }, NOW)).toBe(false)
+    expect(mayAccept({ status: 'accepted', expiresAt: LATER }, NOW)).toBe(false)
+    expect(mayAccept({ status: 'expired', expiresAt: LATER }, NOW)).toBe(false)
+  })
+})

package/tests/open-doors.test.ts

@@ -0,0 +1,132 @@
+import { buildSchema } from 'type-graphql'
+import { GraphQLSchema } from 'graphql'
+
+import { loadCompiled } from './compiled'
+
+/**
+ * Which of auth-base's doors are open, and why each one is allowed to be.
+ *
+ * ── The thing this catches ──────────────────────────────────────────────────
+ * `@privilege` is opt-in. A root field that declares nothing is recorded as open, and that is
+ * indistinguishable from a field somebody decided to open — no error, no warning, nothing to
+ * grep for. So a door goes in ungated the way `deleteAppBinding` did, and only a reader who
+ * happens to look at that one file ever finds out.
+ *
+ * The list below turns the absence into a statement. Anything open that is not on it fails, and
+ * the reason has to be written before it can be added.
+ *
+ * ── Why this is measured and not read off the source ────────────────────────
+ * The schema is built from `service/index.ts`'s own `resolverClasses` — the list the server
+ * boots from — and the directive fills `PRIVILEGE_OF_FIELD` while it walks it. A regular
+ * expression over the files would answer about the text; this answers about the schema that
+ * actually gets served, including every field the walk reaches that a hand-written pattern
+ * would not.
+ *
+ * ── What it does not cover ──────────────────────────────────────────────────
+ * Only auth-base. The other packages have their own resolvers and their own open doors, and
+ * `docs/design/auth-rebuild.md` §7 is where the policy for those is still undecided.
+ */
+
+const { schema: declared } = loadCompiled('service/index')
+const { privilegeDirectiveResolver, privilegeOfField } = loadCompiled('service/privilege/privilege-directive')
+
+/**
+ * Open on purpose. Each of these answers about the caller, or about the installation rather
+ * than about anybody's data.
+ */
+const OPEN_BY_DECISION: Record<string, Record<string, string>> = {
+  Query: {
+    /* The caller's own. */
+    myLoginHistories: 'the caller\'s own sign-ins',
+    myRoles: 'the caller\'s own roles',
+    hasPrivilege: 'whether the caller has one — a gate here would need the answer to itself',
+    domainsWithPrivilege: 'the domains where the caller has one',
+    checkUserBelongsDomain: 'whether the caller belongs to this domain',
+    checkResettablePasswordToDefault: 'about the caller\'s own password',
+    checkDefaultPassword: 'whether the caller is still on the default password',
+
+    /* Neither tenant data nor about a person. */
+    passwordRule:
+      'the installation\'s password policy. The change-password screen needs it before the caller has any privilege — and after a forced reset they may have none',
+    authProviderTypes: 'which provider types this build supports. A catalogue, not a tenant\'s configuration'
+  },
+  Mutation: {}
+}
+
+let schema: GraphQLSchema
+
+beforeAll(async () => {
+  schema = await buildSchema({ resolvers: declared.resolverClasses, validate: false })
+
+  privilegeDirectiveResolver(schema)
+})
+
+function openFields(typeName: 'Query' | 'Mutation'): string[] {
+  const type = typeName === 'Query' ? schema.getQueryType() : schema.getMutationType()
+
+  return Object.keys(type?.getFields() || {}).filter(field => {
+    const declaredGate = privilegeOfField(typeName, field)
+
+    return declaredGate.known && declaredGate['gate'] === null
+  })
+}
+
+describe('every open door is one somebody chose', () => {
+  it.each(['Query', 'Mutation'] as const)('%s', typeName => {
+    expect(openFields(typeName).sort()).toEqual(Object.keys(OPEN_BY_DECISION[typeName]).sort())
+  })
+})
+
+describe('the doors that were closed', () => {
+  /*
+   * ⚠ These were all open on 2026-09-20, every one of them reachable by anyone holding a valid
+   * token. They are listed by name so that reopening one is a visible act rather than a
+   * deletion nobody reads.
+   *
+   *   the five auth provider writes  reading the configuration needed a privilege; replacing it
+   *                                  did not. An auth provider is how an external identity
+   *                                  signs in, so adding one is not an edit to a settings row
+   *   domainUserRoleRegister         makes a domain, its roles and its users. `domainRegister`
+   *                                  beside it makes only a domain and is super-user only
+   *   loginHistories                 everybody's sign-ins
+   *   invitation / invitations       and neither of them scopes by tenant at all
+   *   sendInvitation / cancelInvitation / inviteUser
+   */
+  const CLOSED = {
+    Mutation: [
+      'createAuthProvider',
+      'updateAuthProvider',
+      'updateMultipleAuthProvider',
+      'deleteAuthProvider',
+      'deleteAuthProviders',
+      'domainUserRoleRegister',
+      'sendInvitation',
+      'cancelInvitation',
+      'inviteUser'
+    ],
+    Query: ['loginHistories', 'invitation', 'invitations']
+  }
+
+  it.each(Object.entries(CLOSED).flatMap(([t, fields]) => fields.map(f => [t, f])))('%s.%s', (typeName, field) => {
+    const declaredGate = privilegeOfField(typeName, field)
+
+    expect(declaredGate.known).toBe(true)
+    expect(declaredGate['gate']).not.toBeNull()
+  })
+})
+
+describe('what the walk itself has to be true for', () => {
+  it('reaches the whole schema, not a handful of fields', () => {
+    /*
+     * If the resolver list shrank to nothing the two assertions above would pass by having
+     * nothing to look at. This is the floor under them.
+     */
+    expect(Object.keys(schema.getQueryType()?.getFields() || {}).length).toBeGreaterThan(30)
+    expect(Object.keys(schema.getMutationType()?.getFields() || {}).length).toBeGreaterThan(40)
+  })
+
+  it('tells an undeclared field from one the schema does not have', () => {
+    /* `known: false` must never read as open — that is how a typo becomes a gate that is not there. */
+    expect(privilegeOfField('Query', 'noSuchField')).toEqual({ known: false })
+  })
+})