@things-factory/auth-base 10.1.79 → 10.1.107

package/tests/access-assistant-db.test.ts

@@ -0,0 +1,155 @@
+/**
+ * What the assistant reads to draft access decisions (ADR-0103 decision 6).
+ *
+ * Two facts are held here. The read tool answers only this domain, only to someone who may decide, never the
+ * caller's own requests. And a pending request handed over as the screen's context does not reach the model's
+ * prompt - which is why the tool exists; if that ever changes, this file says so.
+ */
+import { registryAssistantChat } from '../../ai-client-base/server/service/assistant/registry-assistant'
+import { clearToolRegistry, registerToolCategory } from '../../ai-client-base/server/service/tool-registry/index.js'
+
+import { closeAuthDatabase, Domain, getRepository, openAuthDatabase, resetAuthDatabase } from './db'
+import { loadCompiled } from './compiled'
+
+import uiEn from '../../auth-ui/translations/en.json'
+import uiKo from '../../auth-ui/translations/ko.json'
+
+const { Role } = loadCompiled('service/role/role')
+const { Privilege } = loadCompiled('service/privilege/privilege')
+const { User } = loadCompiled('service/user/user')
+const { DomainOwner } = loadCompiled('service/domain-owner/domain-owner')
+const { AccessRequest } = loadCompiled('service/access-request/access-request')
+const access = loadCompiled('controllers/access-request')
+const assistant = loadCompiled('ai-entry/access-assistant')
+const targets = loadCompiled('ai-entry/access-entry-targets')
+
+let domain: any
+let other: any
+let kim: any
+let lee: any
+let park: any
+let owner: any
+let worker: any
+let otherAdmin: any
+
+async function makeUser(name: string, domains: any[], roles: any[] = []) {
+  return await getRepository(User).save({
+    username: name, email: `${name}@example.com`, name, salt: User.generateSalt(), status: 'activated', domains, roles
+  })
+}
+
+const ask = (user: any, privilege = 'mutation', inDomain = domain) =>
+  access.requestAccess({ category: 'warehouse', privilege, reason: 'needed for work' }, { state: { domain: inDomain, user, afterCommit: [] } } as any)
+
+beforeAll(async () => {
+  await openAuthDatabase()
+})
+
+afterAll(async () => {
+  await closeAuthDatabase()
+})
+
+beforeEach(async () => {
+  await resetAuthDatabase()
+  ;(process as any).domainOwnerGranted = async (d: any, u: any) =>
+    !!(await getRepository(DomainOwner).findOne({ where: { domain: { id: d.id }, user: { id: u.id } } }))
+  ;(process as any).superUserGranted = async () => false
+
+  domain = await getRepository(Domain).findOneBy({ id: (await getRepository(Domain).save({ name: 'Plant A', subdomain: 'plant-a' })).id })
+  other = await getRepository(Domain).findOneBy({ id: (await getRepository(Domain).save({ name: 'Other', subdomain: 'other' })).id })
+
+  const mutation = await getRepository(Privilege).save({ name: 'mutation', category: 'warehouse' })
+  await getRepository(Privilege).save({ name: 'query', category: 'warehouse' })
+  const grant = await getRepository(Privilege).save({ name: 'mutation', category: 'user' })
+  await getRepository(Role).save({ name: 'inbound', domain, privileges: [mutation] })
+  const admins = await getRepository(Role).save({ name: 'admins', domain, privileges: [grant] })
+  const otherAdmins = await getRepository(Role).save({ name: 'admins', domain: other, privileges: [grant] })
+
+  kim = await makeUser('kim', [domain])
+  lee = await makeUser('lee', [domain])
+  park = await makeUser('park', [domain], [admins])
+  owner = await makeUser('owner', [domain])
+  worker = await makeUser('worker', [domain])
+  otherAdmin = await makeUser('otheradmin', [other], [otherAdmins])
+  await getRepository(DomainOwner).save({ domain, user: owner })
+})
+
+afterEach(() => {
+  delete (process as any).domainOwnerGranted
+  delete (process as any).superUserGranted
+})
+
+describe('listPendingAccessRequests', () => {
+  it('★ a decider reads this domain\'s waiting requests with the roles that grant each', async () => {
+    await ask(kim)
+    const answer = await assistant.pendingRequestsToDecide({ domain, user: park })
+    expect(answer.requests).toEqual([
+      expect.objectContaining({ requester: 'kim', privilege: 'warehouse:mutation', roles: [{ name: 'inbound', privilegeCount: 1 }] })
+    ])
+  })
+
+  it('★ another domain\'s requests are not read - even by a decider there', async () => {
+    await ask(kim)
+    const there = await assistant.pendingRequestsToDecide({ domain: other, user: otherAdmin })
+    expect(there.requests).toEqual([])
+  })
+
+  it('★ someone who may not decide is refused - nothing is read', async () => {
+    await ask(kim)
+    expect(await assistant.pendingRequestsToDecide({ domain, user: worker })).toEqual({ refused: 'not-a-decider' })
+  })
+
+  it('★ the caller\'s own requests are left out - they cannot decide them', async () => {
+    await ask(kim)
+    await ask(owner, 'query')
+    const answer = await assistant.pendingRequestsToDecide({ domain, user: owner })
+    expect(answer.requests.map((r: any) => r.requester)).toEqual(['kim'])
+  })
+
+  it('decided and expired requests are left out', async () => {
+    const decided = await ask(kim)
+    await access.decideAccessRequest({ requestId: decided.id, decision: 'DENY', reason: 'no' }, { state: { domain, user: park, afterCommit: [] } } as any)
+    const late = await ask(lee)
+    await getRepository(AccessRequest).update({ id: late.id }, { expiresAt: new Date(Date.now() - 1000) })
+    expect((await assistant.pendingRequestsToDecide({ domain, user: park })).requests).toEqual([])
+  })
+})
+
+describe('the declarations fit together', () => {
+  afterEach(() => clearToolRegistry())
+
+  it('the category registers, the mode names it and the decision target, the words exist', () => {
+    const category = assistant.accessToolCategory()
+    expect(() => registerToolCategory(category)).not.toThrow()
+    const mode = assistant.accessAssistantMode()
+    expect(mode.toolCategories).toEqual([category.name])
+    expect(mode.entryTargets).toEqual([targets.AUTH_ACCESS_DECISION])
+    expect(mode.subjects).toEqual([assistant.ACCESS_REQUESTS_SUBJECT])
+    for (const dict of [uiEn, uiKo] as Record<string, string>[])
+      for (const key of [mode.labelKey, mode.placeholderKey]) expect([key, typeof dict[key]]).toEqual([key, 'string'])
+  })
+
+  it('★ requests handed over as the screen\'s context do not reach the model\'s prompt - the tool is how it reads them', async () => {
+    registerToolCategory(assistant.accessToolCategory())
+    const seen: any[] = []
+    const client = {
+      chatWithTools: async (messages: any, tools: any[], options: any) => {
+        seen.push({ messages, tools, options })
+        return { text: 'ok', toolCalls: [], stopReason: 'end_turn' }
+      }
+    }
+    await registryAssistantChat({
+      client,
+      messages: [{ role: 'user', content: 'sort out the access requests' }],
+      systemPrompt: assistant.accessAssistantMode().systemPrompt,
+      toolCategories: [assistant.AUTH_ACCESS_TOOLS],
+      hostContext: { pendingRequests: ['MARKER-kim-warehouse-mutation'] },
+      state: { domain, user: park },
+      toolAccess: async () => true
+    } as any)
+
+    expect(JSON.stringify(seen[0].options)).not.toContain('MARKER-kim')
+    expect(JSON.stringify(seen[0].messages)).not.toContain('MARKER-kim')
+    expect(seen[0].tools.map((t: any) => t.name)).toEqual(['listPendingAccessRequests'])
+  })
+})

package/tests/access-entry-targets-db.test.ts

@@ -0,0 +1,138 @@
+/**
+ * The access request's AI 입력 declarations (ADR-0103 decision 4).
+ *
+ * The model drafts and a person presses; the card's check is the review the list screen asks. That last point is
+ * what this file holds above all: the card's findings for a decision equal `reviewDecision` for the same decision.
+ *
+ * The declarations are read from the compiled package so their check reaches the same entities as the database.
+ * The assistant's own validation is asked through its source file, which needs only `graphql`.
+ */
+import { parse } from 'graphql'
+
+import { clearEntryTargets, declareEntryTarget } from '../../ai-assistant/server/service/data-entry/entry-target'
+
+import { closeAuthDatabase, Domain, getRepository, openAuthDatabase, resetAuthDatabase } from './db'
+import { loadCompiled } from './compiled'
+
+import uiEn from '../../auth-ui/translations/en.json'
+import uiKo from '../../auth-ui/translations/ko.json'
+
+const { Role } = loadCompiled('service/role/role')
+const { Privilege } = loadCompiled('service/privilege/privilege')
+const { User } = loadCompiled('service/user/user')
+const access = loadCompiled('controllers/access-request')
+const targets = loadCompiled('ai-entry/access-entry-targets')
+
+const rootFields = (document: string) =>
+  ((parse(document).definitions[0] as any).selectionSet.selections as any[]).map(one => one.name.value)
+
+const row = (values: Record<string, unknown>, index = 0) => ({ index, values, sources: [], issues: [] })
+
+describe('the declarations', () => {
+  afterEach(() => clearEntryTargets())
+
+  it('are accepted by the assistant as declared', () => {
+    for (const target of targets.accessEntryTargets()) expect(() => declareEntryTarget(target)).not.toThrow()
+  })
+
+  it('★ the decision card writes through decideAccessRequest - the person presses it; nothing else is a door', () => {
+    const decision = targets.accessDecisionEntryTarget()
+    expect(rootFields(decision.mutation)).toEqual(['decideAccessRequest'])
+    expect(rootFields(decision.fields.find((f: any) => f.name === 'request').reference.query)).toEqual(['accessRequests'])
+    expect(rootFields(targets.accessRequestEntryTarget().mutation)).toEqual(['requestAccess'])
+  })
+
+  it('a denial carries no role, a grant carries its role id', () => {
+    expect(targets.decisionOf(row({ request: { id: 'q' }, decision: 'DENY', role: { id: 'r' }, reason: 'no' }))).toEqual({
+      requestId: 'q',
+      decision: 'DENY',
+      roleId: undefined,
+      reason: 'no'
+    })
+    expect(targets.decisionOf(row({ request: { id: 'q' }, decision: 'GRANT', role: { id: 'r' } })).roleId).toBe('r')
+  })
+
+  it('a request is named by person or privilege; only pending ones; several stay several', () => {
+    const items = [
+      { id: '1', state: 'PENDING', category: 'warehouse', privilege: 'mutation', requester: { name: '김민수' } },
+      { id: '2', state: 'PENDING', category: 'board', privilege: 'query', requester: { name: '김민지' } },
+      { id: '3', state: 'GRANTED', category: 'warehouse', privilege: 'mutation', requester: { name: '김민수' } }
+    ]
+    expect(targets.requestsNamed(items, '김민수').map((r: any) => r.id)).toEqual(['1'])
+    expect(targets.requestsNamed(items, '김민').map((r: any) => r.id)).toEqual(['1', '2'])
+    expect(targets.requestsNamed(items, 'board:query').map((r: any) => r.label)).toEqual(['김민지 · board:query'])
+  })
+
+  it('every word the card shows is in the screen words', () => {
+    const decision = targets.accessDecisionEntryTarget()
+    const keys = [
+      decision.labelKey,
+      targets.accessRequestEntryTarget().labelKey,
+      ...[...decision.fields, ...targets.accessRequestEntryTarget().fields].map((f: any) => f.labelKey),
+      'access-request.decision.grant',
+      'access-request.decision.deny',
+      'access-request.issue.not-by-role'
+    ]
+    for (const dict of [uiEn, uiKo] as Record<string, string>[]) for (const key of keys) expect([key, typeof dict[key]]).toEqual([key, 'string'])
+  })
+})
+
+describe('the card says what the screen says', () => {
+  let domain: any
+  let kim: any
+  let park: any
+  let inbound: any
+  let manager: any
+
+  beforeAll(async () => {
+    await openAuthDatabase()
+  })
+
+  afterAll(async () => {
+    await closeAuthDatabase()
+  })
+
+  beforeEach(async () => {
+    await resetAuthDatabase()
+    const saved = await getRepository(Domain).save({ name: 'Plant A', subdomain: 'plant-a' })
+    domain = await getRepository(Domain).findOneBy({ id: saved.id })
+    const mutation = await getRepository(Privilege).save({ name: 'mutation', category: 'warehouse' })
+    const query = await getRepository(Privilege).save({ name: 'query', category: 'warehouse' })
+    const grant = await getRepository(Privilege).save({ name: 'mutation', category: 'user' })
+    inbound = await getRepository(Role).save({ name: 'inbound', domain, privileges: [mutation] })
+    manager = await getRepository(Role).save({ name: 'manager', domain, privileges: [mutation, query, grant] })
+    const admins = await getRepository(Role).save({ name: 'admins', domain, privileges: [grant] })
+    const make = (name: string, roles: any[]) =>
+      getRepository(User).save({ username: name, email: `${name}@example.com`, name, salt: User.generateSalt(), status: 'activated', domains: [domain], roles })
+    kim = await make('kim', [])
+    park = await make('park', [admins])
+  })
+
+  const state = (user: any) => ({ domain, user })
+
+  it('★ the card\'s findings are reviewDecision\'s, for grant and for deny', async () => {
+    const request = await access.requestAccess({ category: 'warehouse', privilege: 'mutation', reason: 'inbound' }, { state: { ...state(kim), afterCommit: [] } } as any)
+    const rows = [
+      row({ request: { id: request.id }, decision: 'GRANT', role: { id: manager.id } }, 0),
+      row({ request: { id: request.id }, decision: 'GRANT', role: { id: inbound.id } }, 1),
+      row({ request: { id: request.id }, decision: 'DENY', reason: '' }, 2)
+    ]
+
+    const card = await targets.accessDecisionEntryTarget().check(rows, { state: state(park) })
+
+    for (const [index, one] of rows.entries()) {
+      const screen = await access.reviewDecision(targets.decisionOf(one), { state: state(park) } as any)
+      expect(card[index].map((issue: any) => [issue.code, issue.blocking])).toEqual(screen.map((issue: any) => [issue.code, issue.blocking]))
+    }
+    expect(card[0].map((issue: any) => issue.code)).toContain('role-grants-admin')
+    expect(card[2].map((issue: any) => issue.code)).toEqual(['deny-needs-reason'])
+  })
+
+  it('★ the request card refuses what the door would - already held', async () => {
+    const lee = await getRepository(User).save({
+      username: 'lee', email: 'lee@example.com', name: 'lee', salt: User.generateSalt(), status: 'activated', domains: [domain], roles: [inbound]
+    })
+    const [issues] = await targets.accessRequestEntryTarget().check([row({ category: 'warehouse', privilege: 'mutation' })], { state: state(lee) })
+    expect(issues).toEqual([expect.objectContaining({ code: 'already-holds', blocking: true })])
+  })
+})

package/tests/access-request-db.test.ts

@@ -0,0 +1,273 @@
+/**
+ * Asking, deciding, telling - the access request end to end on the database (ADR-0103).
+ *
+ * The controller is called with a request state as the doors receive it. `notify` is a spy: the notification
+ * module is optional and the row is the record.
+ */
+
+import { closeAuthDatabase, Domain, getRepository, openAuthDatabase, resetAuthDatabase } from './db'
+import { loadCompiled } from './compiled'
+
+const { Role } = loadCompiled('service/role/role')
+const { Privilege } = loadCompiled('service/privilege/privilege')
+const { User } = loadCompiled('service/user/user')
+const { DomainOwner } = loadCompiled('service/domain-owner/domain-owner')
+const { AccessRequest } = loadCompiled('service/access-request/access-request')
+const access = loadCompiled('controllers/access-request')
+
+let domain: any
+let other: any
+let warehouseMutation: any
+let warehouseQuery: any
+let userMutation: any
+let inbound: any
+let manager: any
+let admins: any
+let kim: any
+let park: any
+let owner: any
+
+async function makeUser(name: string, domains: any[], roles: any[] = [], over: any = {}) {
+  const tag = Math.random().toString(36).slice(2, 8)
+  return await getRepository(User).save({
+    username: `${name}-${tag}`,
+    email: `${name}-${tag}@example.com`,
+    name,
+    salt: User.generateSalt(),
+    status: 'activated',
+    domains,
+    roles,
+    ...over
+  })
+}
+
+function contextOf(user: any, over: any = {}) {
+  const notify = jest.fn().mockResolvedValue(undefined)
+  const afterCommit: any[] = []
+  return {
+    state: { domain, user, afterCommit, notify, ...over },
+    t: (key: string) => key,
+    afterCommit,
+    notify
+  } as any
+}
+
+async function commit(context: any) {
+  for (const step of context.afterCommit) await step.run()
+}
+
+async function holds(user: any, category: string, privilege: string) {
+  return await User.hasPrivilege(privilege, category, domain, user)
+}
+
+beforeAll(async () => {
+  await openAuthDatabase()
+})
+
+afterAll(async () => {
+  await closeAuthDatabase()
+})
+
+beforeEach(async () => {
+  await resetAuthDatabase()
+
+  const saved = await getRepository(Domain).save({ name: 'Plant A', subdomain: 'plant-a' })
+  domain = await getRepository(Domain).findOneBy({ id: saved.id })
+  other = await getRepository(Domain).save({ name: 'Other', subdomain: 'other' })
+
+  warehouseMutation = await getRepository(Privilege).save({ name: 'mutation', category: 'warehouse' })
+  warehouseQuery = await getRepository(Privilege).save({ name: 'query', category: 'warehouse' })
+  userMutation = await getRepository(Privilege).save({ name: 'mutation', category: 'user' })
+
+  inbound = await getRepository(Role).save({ name: 'inbound', domain, privileges: [warehouseMutation] })
+  manager = await getRepository(Role).save({ name: 'manager', domain, privileges: [warehouseMutation, warehouseQuery, userMutation] })
+  admins = await getRepository(Role).save({ name: 'admins', domain, privileges: [userMutation, warehouseQuery] })
+
+  kim = await makeUser('kim', [domain])
+  park = await makeUser('park', [domain], [admins])
+  owner = await makeUser('owner', [domain])
+  await getRepository(DomainOwner).save({ domain, user: owner })
+})
+
+const ASK = { category: 'warehouse', privilege: 'mutation', operationName: 'updateInboundPlan', reason: 'inbound from today' }
+
+describe('asking', () => {
+  it('★ a request is a row - pending, fourteen days, and the people who decide are told once', async () => {
+    const context = contextOf(kim)
+    const request = await access.requestAccess(ASK, context)
+    await commit(context)
+
+    expect(request).toMatchObject({ state: 'PENDING', category: 'warehouse', privilege: 'mutation', count: 1, reason: 'inbound from today' })
+    expect(context.notify).toHaveBeenCalledTimes(1)
+    expect([...context.notify.mock.calls[0][0].receivers].sort()).toEqual([owner.id, park.id].sort())
+    expect(context.notify.mock.calls[0][0].url).toBe(`access-requests?id=${request.id}`)
+  })
+
+  it('★ asking again adds to the pending one - no second row, nobody told again', async () => {
+    await access.requestAccess(ASK, contextOf(kim))
+    const again = contextOf(kim)
+    const merged = await access.requestAccess({ ...ASK, reason: 'still needed' }, again)
+    await commit(again)
+
+    expect(merged.count).toBe(2)
+    expect(merged.reason).toBe('still needed')
+    expect(await getRepository(AccessRequest).count()).toBe(1)
+    expect(again.notify).not.toHaveBeenCalled()
+  })
+
+  it('★ a privilege the caller holds is not asked for', async () => {
+    const kimWithRole = await makeUser('lee', [domain], [inbound])
+    await expect(access.requestAccess(ASK, contextOf(kimWithRole))).rejects.toMatchObject({ code: 'access-request-already-holds' })
+  })
+
+  it('★ refused by the license, not by a role - not taken, whatever the screen sent', async () => {
+    const context = contextOf(kim, { prohibitedPrivileges: [{ category: 'warehouse', privilege: 'mutation', by: 'license' }] })
+    await expect(access.requestAccess(ASK, context)).rejects.toMatchObject({ code: 'access-request-not-by-role', params: { because: 'license' } })
+  })
+
+  it('a privilege nobody declared is not asked for', async () => {
+    await expect(access.requestAccess({ category: 'nothing', privilege: 'here', reason: 'x' }, contextOf(kim))).rejects.toMatchObject({
+      code: 'access-request-unknown-privilege'
+    })
+  })
+
+  it('the requester withdraws their own, and nobody else can', async () => {
+    const request = await access.requestAccess(ASK, contextOf(kim))
+    await expect(access.withdrawAccessRequest(request.id, contextOf(park))).rejects.toMatchObject({ code: 'access-request-not-withdrawable' })
+    expect((await access.withdrawAccessRequest(request.id, contextOf(kim))).state).toBe('WITHDRAWN')
+  })
+})
+
+describe('who decides', () => {
+  it('★ owners and holders of user:mutation in this domain, never the requester', async () => {
+    const outsider = await makeUser('outsider', [other], [admins])
+    const ids = await access.findDeciderIds(domain, park.id)
+    expect(ids).toEqual([owner.id].sort())
+    expect(ids).not.toContain(outsider.id)
+  })
+})
+
+describe('deciding', () => {
+  it('★ grant puts the requester into the role - they pass the gate on the next request', async () => {
+    const request = await access.requestAccess(ASK, contextOf(kim))
+    const context = contextOf(park)
+    const decided = await access.decideAccessRequest({ requestId: request.id, decision: 'GRANT', roleId: inbound.id }, context)
+    await commit(context)
+
+    expect(decided).toMatchObject({ state: 'GRANTED', grantedRole: { id: inbound.id } })
+    expect(await holds(kim, 'warehouse', 'mutation')).toBe(true)
+    expect(context.notify).toHaveBeenCalledWith(
+      expect.objectContaining({ receivers: [kim.id], title: 'access-request.notify.granted.title', url: 'my-access-requests' })
+    )
+  })
+
+  it('★ deny keeps the reason and tells the requester', async () => {
+    const request = await access.requestAccess(ASK, contextOf(kim))
+    const context = contextOf(park)
+    const decided = await access.decideAccessRequest({ requestId: request.id, decision: 'DENY', reason: 'IT only' }, context)
+    await commit(context)
+
+    expect(decided).toMatchObject({ state: 'DENIED', decisionReason: 'IT only' })
+    expect(await holds(kim, 'warehouse', 'mutation')).toBe(false)
+    expect(context.notify).toHaveBeenCalledWith(expect.objectContaining({ title: 'access-request.notify.denied.title' }))
+  })
+
+  it('★ the second decision is refused - the first one stands', async () => {
+    const request = await access.requestAccess(ASK, contextOf(kim))
+    await access.decideAccessRequest({ requestId: request.id, decision: 'DENY', reason: 'no' }, contextOf(owner))
+    await expect(access.decideAccessRequest({ requestId: request.id, decision: 'GRANT', roleId: inbound.id }, contextOf(park))).rejects.toMatchObject({
+      code: 'access-decision-request-not-pending'
+    })
+    expect(await holds(kim, 'warehouse', 'mutation')).toBe(false)
+  })
+
+  it('★ two people deciding at once - exactly one wins (both reviews read PENDING before either writes)', async () => {
+    const request = await access.requestAccess(ASK, contextOf(kim))
+    const results = await Promise.allSettled([
+      access.decideAccessRequest({ requestId: request.id, decision: 'DENY', reason: 'no' }, contextOf(owner)),
+      access.decideAccessRequest({ requestId: request.id, decision: 'GRANT', roleId: inbound.id }, contextOf(park))
+    ])
+
+    expect(results.map(r => r.status).sort()).toEqual(['fulfilled', 'rejected'])
+    const lost = results.find(r => r.status === 'rejected') as PromiseRejectedResult
+    expect(lost.reason).toMatchObject({ code: 'access-decision-request-not-pending' })
+  })
+
+  it('★ the review blocks inside the door too - a role without the privilege is refused', async () => {
+    const request = await access.requestAccess(ASK, contextOf(kim))
+    await expect(access.decideAccessRequest({ requestId: request.id, decision: 'GRANT', roleId: admins.id }, contextOf(park))).rejects.toMatchObject({
+      code: 'access-decision-role-does-not-grant'
+    })
+    expect((await getRepository(AccessRequest).findOneBy({ id: request.id })).state).toBe('PENDING')
+  })
+
+  it('★ another tenant\'s role is refused - it is not this domain\'s to give', async () => {
+    const foreign = await getRepository(Role).save({ name: 'foreign', domain: other, privileges: [warehouseMutation] })
+    const request = await access.requestAccess(ASK, contextOf(kim))
+    await expect(access.decideAccessRequest({ requestId: request.id, decision: 'GRANT', roleId: foreign.id }, contextOf(park))).rejects.toMatchObject({
+      code: 'access-decision-role-not-assignable'
+    })
+  })
+
+  it('a request of another domain is not found from this one', async () => {
+    const request = await access.requestAccess(ASK, contextOf(kim))
+    const stranger = await makeUser('stranger', [other], [admins])
+    const fromThere = contextOf(stranger, { domain: await getRepository(Domain).findOneBy({ id: other.id }) })
+    await expect(access.decideAccessRequest({ requestId: request.id, decision: 'DENY', reason: 'x' }, fromThere)).rejects.toMatchObject({
+      code: 'access-decision-access-request-not-found'
+    })
+  })
+
+  it('★ a grant closes the same person\'s other requests it now answers', async () => {
+    const first = await access.requestAccess(ASK, contextOf(kim))
+    const second = await access.requestAccess({ category: 'warehouse', privilege: 'query', reason: 'checking stock' }, contextOf(kim))
+    await access.decideAccessRequest({ requestId: first.id, decision: 'GRANT', roleId: manager.id }, contextOf(owner))
+
+    expect((await getRepository(AccessRequest).findOneBy({ id: second.id })).state).toBe('GRANTED')
+  })
+})
+
+describe('the review as the screen asks it', () => {
+  it('★ candidates smallest first, and the review of a big role names what else it gives', async () => {
+    const request = await access.requestAccess(ASK, contextOf(kim))
+    const candidates = await access.rolesGranting('warehouse', 'mutation', domain)
+    expect(candidates.map((c: any) => c.name)).toEqual(['inbound', 'manager'])
+
+    const issues = await access.reviewDecision({ requestId: request.id, decision: 'GRANT', roleId: manager.id }, contextOf(park))
+    expect(issues.map((i: any) => i.code).sort()).toEqual(['decider-lacks-it', 'role-grants-admin', 'role-grants-more', 'smaller-role-exists'])
+  })
+})
+
+describe('asking is not a reflex (questions Q9)', () => {
+  it('★ no reason, no request - blank is no reason', async () => {
+    for (const reason of [undefined, '', '   ']) {
+      await expect(access.requestAccess({ ...ASK, reason }, contextOf(kim))).rejects.toMatchObject({ code: 'access-request-needs-reason' })
+    }
+    expect(await getRepository(AccessRequest).count()).toBe(0)
+  })
+
+  it('★ denied lately: the same words are refused, new words are taken', async () => {
+    const first = await access.requestAccess(ASK, contextOf(kim))
+    await access.decideAccessRequest({ requestId: first.id, decision: 'DENY', reason: 'IT only' }, contextOf(park))
+
+    await expect(access.requestAccess(ASK, contextOf(kim))).rejects.toMatchObject({
+      code: 'access-request-same-reason-as-denied',
+      params: { reason: 'IT only' }
+    })
+    const again = await access.requestAccess({ ...ASK, reason: 'moved to the inbound team this week' }, contextOf(kim))
+    expect(again.state).toBe('PENDING')
+  })
+
+  it('a denial older than seven days holds nothing against the same words', async () => {
+    const first = await access.requestAccess(ASK, contextOf(kim))
+    await access.decideAccessRequest({ requestId: first.id, decision: 'DENY', reason: 'not now' }, contextOf(park))
+    await getRepository(AccessRequest).update({ id: first.id }, { decidedAt: new Date(Date.now() - 8 * 24 * 60 * 60 * 1000) })
+    expect((await access.requestAccess(ASK, contextOf(kim))).state).toBe('PENDING')
+  })
+
+  it('★ the popup can say how many people a request reaches - not who', async () => {
+    const { AccessRequestQuery } = loadCompiled('service/access-request/access-request-query')
+    expect(await new AccessRequestQuery().accessRequestDeciderCount(contextOf(kim))).toBe(2)
+    expect(await new AccessRequestQuery().accessRequestDeciderCount(contextOf(park))).toBe(1)
+  })
+})

package/tests/access-request-pg.test.ts

@@ -0,0 +1,72 @@
+/**
+ * The access request under real concurrency - postgres only (`AUTH_TEST_PG`). sqlite holds one connection and
+ * cannot show two transactions racing (feedback: verify concurrency on postgres).
+ *
+ * Each call runs in its own transaction, as the `@transaction` door gives it.
+ */
+import { authDataSource, closeAuthDatabase, Domain, getRepository, openAuthDatabase, resetAuthDatabase } from './db'
+import { loadCompiled } from './compiled'
+
+const { Role } = loadCompiled('service/role/role')
+const { Privilege } = loadCompiled('service/privilege/privilege')
+const { User } = loadCompiled('service/user/user')
+const { AccessRequest } = loadCompiled('service/access-request/access-request')
+const access = loadCompiled('controllers/access-request')
+
+const onPostgres = process.env.AUTH_TEST_PG ? describe : describe.skip
+
+onPostgres('on postgres', () => {
+  let domain: any
+  let kim: any
+  let park: any
+  let owner: any
+  let inbound: any
+
+  const inTransaction = <T>(user: any, run: (context: any) => Promise<T>) =>
+    authDataSource().transaction(tx => run({ state: { domain, user, tx, afterCommit: [] }, t: (key: string) => key }))
+
+  beforeAll(async () => {
+    await openAuthDatabase()
+  })
+
+  afterAll(async () => {
+    await closeAuthDatabase()
+  })
+
+  beforeEach(async () => {
+    await resetAuthDatabase()
+    domain = await getRepository(Domain).findOneBy({ id: (await getRepository(Domain).save({ name: 'Plant A', subdomain: 'plant-a' })).id })
+    const mutation = await getRepository(Privilege).save({ name: 'mutation', category: 'warehouse' })
+    const grant = await getRepository(Privilege).save({ name: 'mutation', category: 'user' })
+    inbound = await getRepository(Role).save({ name: 'inbound', domain, privileges: [mutation] })
+    const admins = await getRepository(Role).save({ name: 'admins', domain, privileges: [grant] })
+    const make = (name: string, roles: any[] = []) =>
+      getRepository(User).save({ username: name, email: `${name}@example.com`, name, salt: User.generateSalt(), status: 'activated', domains: [domain], roles })
+    kim = await make('kim')
+    park = await make('park', [admins])
+    owner = await make('owner', [admins])
+  })
+
+  it('★ two people deciding at once, each in a transaction - exactly one wins, and the loser leaves nothing', async () => {
+    const request = await inTransaction(kim, context => access.requestAccess({ category: 'warehouse', privilege: 'mutation', reason: 'inbound' }, context))
+
+    const results = await Promise.allSettled([
+      inTransaction(owner, context => access.decideAccessRequest({ requestId: request.id, decision: 'DENY', reason: 'no' }, context)),
+      inTransaction(park, context => access.decideAccessRequest({ requestId: request.id, decision: 'GRANT', roleId: inbound.id }, context))
+    ])
+
+    expect(results.map(r => r.status).sort()).toEqual(['fulfilled', 'rejected'])
+    const stored = await getRepository(AccessRequest).findOne({ where: { id: request.id }, relations: ['grantedRole'] })
+    const holds = await User.hasPrivilege('mutation', 'warehouse', domain, kim)
+    /* The role is given exactly when the stored decision is a grant - a losing grant does not leave the role behind. */
+    expect(holds).toBe(stored.state === 'GRANTED')
+  })
+
+  it('★ the same person asking twice at once - one pending request, not two', async () => {
+    await Promise.allSettled([
+      inTransaction(kim, context => access.requestAccess({ category: 'warehouse', privilege: 'mutation', reason: 'inbound' }, context)),
+      inTransaction(kim, context => access.requestAccess({ category: 'warehouse', privilege: 'mutation', reason: 'inbound' }, context))
+    ])
+    expect(await getRepository(AccessRequest).count({ where: { state: 'PENDING' } })).toBe(1)
+  })
+})