@things-factory/notification 10.1.104 → 10.1.105

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@things-factory/notification",
-  "version": "10.1.104",
+  "version": "10.1.105",
   "main": "dist-server/index.js",
   "browser": "dist-client/index.js",
   "things-factory": true,
@@ -32,13 +32,13 @@
     "@operato/styles": "^10.0.0",
     "@things-factory/auth-base": "^10.1.79",
     "@things-factory/i18n-base": "^10.1.104",
-    "@things-factory/organization": "^10.1.104",
-    "@things-factory/setting-base": "^10.1.79",
+    "@things-factory/organization": "^10.1.105",
+    "@things-factory/setting-base": "^10.1.105",
     "@things-factory/shell": "^10.1.79",
     "clipboard": "^2.0.6",
     "firebase": "^9.14.0",
     "firebase-admin": "^11.3.0",
     "google": "^2.1.0"
   },
-  "gitHead": "0d05c7573220c6da2dec2654a4b86d7bd8e3c4fb"
+  "gitHead": "c8ad9b40d57709beefd5e3d6167fd9cab6efea3a"
 }

package/tests/open-doors.test.ts

@@ -0,0 +1,54 @@
+/*
+ * Every mutation of notification declares a privilege, and the domain owner may call it.
+ *
+ * Until 2026-10-01 no mutation of notification declared anything: any member of a domain could call them. Notification rules ask for `notification-rule:mutation`.
+ * The queries are not gated yet and are not measured here.
+ */
+import { gatesOf, openFields } from '../../../test/helpers/open-doors'
+
+/** The category each mutation asks for; anything not named here asks for `notification-rule`. */
+const CATEGORY: Record<string, string> = {}
+
+/*
+ * A notification is one person's inbox entry, so a privilege category is not what guards it: these doors
+ * have to keep a caller to the notifications they own, and they do not yet (domain only). Left open
+ * until that owner check is written.
+ */
+const NOT_DECIDED = 'an inbox entry - needs an owner check, not a category; domain-scoped only for now'
+
+/** Open on purpose or not decided yet, each with its reason. */
+const OPEN: Record<string, string> = {
+  createNotification: NOT_DECIDED,
+  updateNotification: NOT_DECIDED,
+  updateMultipleNotification: NOT_DECIDED,
+  deleteNotification: NOT_DECIDED,
+  deleteNotificationes: NOT_DECIDED
+}
+
+let gates: Awaited<ReturnType<typeof gatesOf>>
+
+beforeAll(async () => {
+  gates = await gatesOf('notification')
+})
+
+it('every open mutation has a written reason', () => {
+  expect(openFields(gates.Mutation)).toEqual(Object.keys(OPEN).sort())
+})
+
+it('every declared mutation asks for its category and admits the domain owner', () => {
+  for (const [field, gate] of Object.entries(gates.Mutation)) {
+    if (field in OPEN) continue
+    expect({ field, ...gate }).toEqual({
+      field,
+      category: CATEGORY[field] ?? 'notification-rule',
+      privilege: 'mutation',
+      owner: true,
+      super: false
+    })
+  }
+})
+
+it('the walk reaches every mutation', () => {
+  /* If the resolver list shrank, the checks above would pass by having nothing to look at. */
+  expect(Object.keys(gates.Mutation)).toHaveLength(11)
+})