@things-factory/organization 10.1.183 → 10.1.185

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@things-factory/organization",
-  "version": "10.1.183",
+  "version": "10.1.185",
   "main": "dist-server/index.js",
   "browser": "dist-client/index.js",
   "things-factory": true,
@@ -41,5 +41,5 @@
     "@things-factory/contact": "^10.1.183",
     "@things-factory/shell": "^10.1.179"
   },
-  "gitHead": "c36684e0db8353f5f4523ed55111df3154bae19e"
+  "gitHead": "3cfe5c959e7e82d772f46fd280037900fa89fcaa"
 }

package/tests/employee-private.test.ts

@@ -1,18 +1,18 @@
 import { readFileSync } from 'fs'
 import { join } from 'path'
 
-import { EMPLOYEE_PRIVATE_FIELDS, privateFieldsOf } from '../server/service/employee/employee-private'
+import { EMPLOYEE_PRIVATE_FIELDS, privateFieldsOf, refusePrivateWrite } from '../server/service/employee/employee-private'
 
 /**
  * An employee's pay account is HR-payroll's (ADR-0139): read under `employee-private`, apart from the roster every
- * seat reads, and written only by whoever may change it.
+ * seat reads, and written through its own door - a door is what declares the privilege (no directive, no privilege row).
  */
 describe("an employee's pay account", () => {
   it('★ is declared under employee-private on the employee and its history - the declaration, not a resolver', () => {
     for (const file of ['employee.ts', 'employee-history.ts']) {
       const source = readFileSync(join(__dirname, '..', 'server', 'service', 'employee', file), 'utf8')
       for (const field of EMPLOYEE_PRIVATE_FIELDS) {
-        expect([file, field, new RegExp(`@privilege\\(category: "employee-private", privilege: "query"[^\\n]*\\n  @Field\\(\\{ nullable: true \\}\\)\\n  ${field}\\?:`).test(source)]).toEqual([file, field, true])
+        expect([file, field, new RegExp(`@privilege\\(category: "employee-private", privilege: "query", domainOwnerGranted: false\\)[^\\n]*\\n  @Field\\(\\{ nullable: true \\}\\)\\n  ${field}\\?:`).test(source)]).toEqual([file, field, true])
       }
     }
   })
@@ -23,4 +23,15 @@ describe("an employee's pay account", () => {
     expect(privateFieldsOf({ bankName: '' })).toEqual(['bankName'])
     expect(privateFieldsOf(null)).toEqual([])
   })
+
+  it('★ the roster writes refuse it; its own door asks employee-private:mutation', () => {
+    expect(() => refusePrivateWrite([{ name: '홍길동' }, { bankAccount: '123' }])).toThrow(/updateEmployeePayAccount/)
+    expect(() => refusePrivateWrite([{ name: '홍길동' }])).not.toThrow()
+    const source = readFileSync(join(__dirname, '..', 'server', 'service', 'employee', 'employee-mutation.ts'), 'utf8')
+    expect(source).toMatch(/@privilege\(category: "employee-private", privilege: "mutation", domainOwnerGranted: false\)[^\n]*\n(?:  @[^\n]*\n)*  async updateEmployeePayAccount\(/)
+    for (const door of ['createEmployee', 'updateEmployee', 'updateMultipleEmployee', 'importEmployees']) {
+      const body = source.slice(source.indexOf(`async ${door}(`), source.indexOf(`async ${door}(`) + 600)
+      expect([door, /refusePrivateWrite\(/.test(body)]).toEqual([door, true])
+    }
+  })
 })