@things-factory/organization 10.1.183 → 10.1.184

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@things-factory/organization",
-  "version": "10.1.183",
+  "version": "10.1.184",
   "main": "dist-server/index.js",
   "browser": "dist-client/index.js",
   "things-factory": true,
@@ -41,5 +41,5 @@
     "@things-factory/contact": "^10.1.183",
     "@things-factory/shell": "^10.1.179"
   },
-  "gitHead": "c36684e0db8353f5f4523ed55111df3154bae19e"
+  "gitHead": "69039d4057bc24eeb566889fe03b6e6a28f012a9"
 }

package/tests/employee-private.test.ts

@@ -1,11 +1,11 @@
 import { readFileSync } from 'fs'
 import { join } from 'path'
 
-import { EMPLOYEE_PRIVATE_FIELDS, privateFieldsOf } from '../server/service/employee/employee-private'
+import { EMPLOYEE_PRIVATE_FIELDS, privateFieldsOf, refusePrivateWrite } from '../server/service/employee/employee-private'
 
 /**
  * An employee's pay account is HR-payroll's (ADR-0139): read under `employee-private`, apart from the roster every
- * seat reads, and written only by whoever may change it.
+ * seat reads, and written through its own door - a door is what declares the privilege (no directive, no privilege row).
  */
 describe("an employee's pay account", () => {
   it('★ is declared under employee-private on the employee and its history - the declaration, not a resolver', () => {
@@ -23,4 +23,15 @@ describe("an employee's pay account", () => {
     expect(privateFieldsOf({ bankName: '' })).toEqual(['bankName'])
     expect(privateFieldsOf(null)).toEqual([])
   })
+
+  it('★ the roster writes refuse it; its own door asks employee-private:mutation', () => {
+    expect(() => refusePrivateWrite([{ name: '홍길동' }, { bankAccount: '123' }])).toThrow(/updateEmployeePayAccount/)
+    expect(() => refusePrivateWrite([{ name: '홍길동' }])).not.toThrow()
+    const source = readFileSync(join(__dirname, '..', 'server', 'service', 'employee', 'employee-mutation.ts'), 'utf8')
+    expect(source).toMatch(/@privilege\(category: "employee-private", privilege: "mutation"[^\n]*\n(?:  @[^\n]*\n)*  async updateEmployeePayAccount\(/)
+    for (const door of ['createEmployee', 'updateEmployee', 'updateMultipleEmployee', 'importEmployees']) {
+      const body = source.slice(source.indexOf(`async ${door}(`), source.indexOf(`async ${door}(`) + 600)
+      expect([door, /refusePrivateWrite\(/.test(body)]).toEqual([door, true])
+    }
+  })
 })