@things-factory/worklist 10.1.42 → 10.1.44

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@things-factory/worklist",
-  "version": "10.1.42",
+  "version": "10.1.44",
   "main": "dist-server/index.js",
   "browser": "dist-client/index.js",
   "things-factory": true,
@@ -37,14 +37,14 @@
     "@operato/moment-timezone-es": "^10.0.0",
     "@operato/p13n": "^10.0.0",
     "@operato/popup": "^10.15.0",
-    "@things-factory/attachment-base": "^10.1.40",
-    "@things-factory/auth-base": "^10.1.40",
-    "@things-factory/board-service": "^10.1.42",
-    "@things-factory/context-ui": "^10.1.40",
-    "@things-factory/organization": "^10.1.40",
-    "@things-factory/personalization": "^10.1.40",
-    "@things-factory/scheduler-client": "^10.1.40",
-    "@things-factory/shell": "^10.1.40"
+    "@things-factory/attachment-base": "^10.1.44",
+    "@things-factory/auth-base": "^10.1.44",
+    "@things-factory/board-service": "^10.1.44",
+    "@things-factory/context-ui": "^10.1.44",
+    "@things-factory/organization": "^10.1.44",
+    "@things-factory/personalization": "^10.1.44",
+    "@things-factory/scheduler-client": "^10.1.44",
+    "@things-factory/shell": "^10.1.44"
   },
-  "gitHead": "982aa01403b979c4e348fd207a3fb4d1a7b5f521"
+  "gitHead": "7c95c4e75e155e51c714409e865d96f317232c23"
 }

package/tests/approval-line-input.test.ts

@@ -0,0 +1,112 @@
+import { join } from 'path'
+
+/**
+ * The approval line a case carries, through the real draft and issue controllers on sqlite
+ * (ADR-0091 decision 7).
+ *
+ * The comparison itself is held in node (test/approval-line-input.test.ts). What only the
+ * controllers can show: the refusal is asked with the activity's line as it was loaded, before
+ * anything is saved; the same line handed back - as plant's server doors do - still passes; and an
+ * activity with no line takes the one handed in.
+ */
+
+const { createSqliteTestDataSource } = require(join(__dirname, '..', '..', 'ops-master', 'test', 'support', 'database.cjs'))
+const DIST = join(__dirname, '..', 'dist-server')
+const { Activity } = require(join(DIST, 'service', 'activity', 'activity.js'))
+const { ActivityInstance } = require(join(DIST, 'service', 'activity-instance', 'activity-instance.js'))
+const { ActivityThread } = require(join(DIST, 'service', 'activity-thread', 'activity-thread.js'))
+const { ActivityApproval } = require(join(DIST, 'service', 'activity-approval', 'activity-approval.js'))
+const { draft } = require(join(DIST, 'controllers', 'activity-instance', 'draft.js'))
+const { issue } = require(join(DIST, 'controllers', 'activity-instance', 'issue.js'))
+const { Employee } = require('@things-factory/organization')
+const { Domain } = require('@things-factory/shell')
+const { User } = require('@things-factory/auth-base')
+
+let db: any
+let domain: any
+let raiser: any
+let approver: any
+let other: any
+
+beforeAll(async () => {
+  db = createSqliteTestDataSource([Activity, ActivityInstance, ActivityThread, ActivityApproval, Employee])
+  await db.initialize()
+
+  domain = await db.getRepository(Domain).save({ name: 'd', subdomain: 'd' })
+
+  const person = async (name: string) => {
+    const user = await db.getRepository(User).save({ name, email: `${name}@example.com`, password: 'x', status: 'activated', domains: [domain] })
+    return db.getRepository(Employee).save({ domain, name, controlNo: name, user })
+  }
+
+  raiser = await db.getRepository(User).save({ name: 'raiser', email: 'raiser@example.com', password: 'x', status: 'activated', domains: [domain] })
+  approver = await person('approver')
+  other = await person('other')
+})
+
+afterAll(async () => db?.destroy())
+
+const lineOf = (employee: any, participation?: string) => [
+  { type: 'Employee', value: employee.id, ...(participation ? { participation } : {}) }
+]
+
+async function anActivity(approvalLine: any[] | null) {
+  return db.getRepository(Activity).save({
+    domain,
+    name: `a-${Math.random().toString(36).slice(2, 8)}`,
+    activityType: 'standard',
+    startingType: 'issue',
+    approvalLine
+  })
+}
+
+const as = (tx: any) => ({ state: { domain, user: raiser, tx }, t: (key: string) => key }) as any
+
+const drafting = (activity: any, approvalLine?: any[]) =>
+  db.transaction((tx: any) => draft({ activityId: activity.id, name: 'case', ...(approvalLine ? { approvalLine } : {}) }, as(tx)))
+
+const issuing = (activity: any, approvalLine?: any[]) =>
+  db.transaction((tx: any) => issue({ activityId: activity.id, name: 'case', ...(approvalLine ? { approvalLine } : {}) }, as(tx)))
+
+const saved = () => db.getRepository(ActivityInstance).count()
+
+describe.each([
+  ['draft', drafting],
+  ['issue', issuing]
+])('%s', (_, run) => {
+  it('a line other than the activity\'s is refused by name, and nothing is saved', async () => {
+    const activity = await anActivity(lineOf(approver))
+    const before = await saved()
+
+    await expect(run(activity, lineOf(other))).rejects.toThrow('error.activity-instance approval line is set')
+    expect(await saved()).toBe(before)
+  })
+
+  it('an approver turned into a reference is refused - the line would end with nobody judging', async () => {
+    const activity = await anActivity(lineOf(approver))
+
+    await expect(run(activity, lineOf(approver, 'reference'))).rejects.toThrow('error.activity-instance approval line is set')
+  })
+
+  it('the same line handed back passes, written with its keys in another order', async () => {
+    const activity = await anActivity(lineOf(approver))
+    const handedBack = [{ value: approver.id, participation: 'approval', type: 'Employee' }]
+
+    const result = await run(activity, handedBack)
+    expect(result).toBeTruthy()
+  })
+
+  it('no line handed in takes the activity\'s', async () => {
+    const activity = await anActivity(lineOf(approver))
+
+    const result = await run(activity)
+    expect(result.approvalLine?.map((one: any) => one.value)).toEqual([approver.id])
+  })
+
+  it('an activity with no line takes the one handed in (ad hoc)', async () => {
+    const activity = await anActivity(null)
+
+    const result = await run(activity, lineOf(other))
+    expect(result.approvalLine?.map((one: any) => one.value)).toEqual([other.id])
+  })
+})

package/tests/delegate-thread.test.ts

@@ -0,0 +1,101 @@
+import { join } from 'path'
+
+/**
+ * Handing a thread on, through the real controller on sqlite (ADR-0091 decision 4).
+ *
+ * The thread controller used to save the assignee object as the client sent it - any id, any tenant,
+ * active or not. Now it looks the receiver up: active, in this domain, not the thread's own holder.
+ * Unlike an approval seat, a thread may go to whoever raised the case - doing the work is not judging.
+ */
+
+const { createSqliteTestDataSource } = require(join(__dirname, '..', '..', 'ops-master', 'test', 'support', 'database.cjs'))
+const DIST = join(__dirname, '..', 'dist-server')
+const { Activity } = require(join(DIST, 'service', 'activity', 'activity.js'))
+const { ActivityInstance } = require(join(DIST, 'service', 'activity-instance', 'activity-instance.js'))
+const { ActivityThread } = require(join(DIST, 'service', 'activity-thread', 'activity-thread.js'))
+const { ActivityApproval } = require(join(DIST, 'service', 'activity-approval', 'activity-approval.js'))
+const { delegate } = require(join(DIST, 'controllers', 'activity-thread', 'delegate.js'))
+const { Domain } = require('@things-factory/shell')
+const { User } = require('@things-factory/auth-base')
+
+let db: any
+let here: any
+let holder: any
+let colleague: any
+let issuer: any
+let stranger: any
+let retired: any
+
+beforeAll(async () => {
+  db = createSqliteTestDataSource([Activity, ActivityInstance, ActivityThread, ActivityApproval])
+  await db.initialize()
+
+  here = await db.getRepository(Domain).save({ name: 'here', subdomain: 'here' })
+  const elsewhere = await db.getRepository(Domain).save({ name: 'elsewhere', subdomain: 'elsewhere' })
+
+  const person = (name: string, domains: any[], status = 'activated') =>
+    db.getRepository(User).save({ name, email: `${name}@example.com`, password: 'x', status, domains })
+
+  holder = await person('holder', [here])
+  colleague = await person('colleague', [here])
+  issuer = await person('issuer', [here])
+  stranger = await person('stranger', [elsewhere])
+  retired = await person('retired', [here], 'inactive')
+})
+
+afterAll(async () => db?.destroy())
+
+async function aThread() {
+  const activity = await db.getRepository(Activity).save({ domain: here, name: `a-${Math.random().toString(36).slice(2, 8)}`, activityType: 'standard' })
+  const instance = await db.getRepository(ActivityInstance).save({ domain: here, name: 'i', state: 'assigned', issuer, activity })
+
+  return db.getRepository(ActivityThread).save({ domain: here, name: 't', round: 1, state: 'assigned', assignee: holder, activityInstance: instance })
+}
+
+const handOn = (thread: any, to: any) =>
+  db.transaction((tx: any) =>
+    delegate({ id: thread.id, assignee: { id: to.id }, reason: 'away' }, { state: { domain: here, user: holder, tx }, t: (key: string) => key } as any)
+  )
+
+const assigneeOf = async (thread: any) => (await db.getRepository(ActivityThread).findOne({ where: { id: thread.id } })).assigneeId
+
+it('a colleague in this domain receives the thread', async () => {
+  const thread = await aThread()
+
+  await handOn(thread, colleague)
+  expect(await assigneeOf(thread)).toBe(colleague.id)
+})
+
+it('whoever raised the case may receive it - doing the work is not judging', async () => {
+  const thread = await aThread()
+
+  await handOn(thread, issuer)
+  expect(await assigneeOf(thread)).toBe(issuer.id)
+})
+
+it('someone of another tenant is refused, and the thread stays with its holder', async () => {
+  const thread = await aThread()
+
+  await expect(handOn(thread, stranger)).rejects.toThrow('error.activity-approval delegate outside domain')
+  expect(await assigneeOf(thread)).toBe(holder.id)
+})
+
+it('someone no longer active is nobody to receive it', async () => {
+  const thread = await aThread()
+
+  await expect(handOn(thread, retired)).rejects.toThrow('error.user not found')
+  expect(await assigneeOf(thread)).toBe(holder.id)
+})
+
+it('an id that is nobody at all is refused, not saved', async () => {
+  const thread = await aThread()
+
+  await expect(handOn(thread, { id: '00000000-0000-0000-0000-000000000000' })).rejects.toThrow('error.user not found')
+  expect(await assigneeOf(thread)).toBe(holder.id)
+})
+
+it('to its own holder is refused', async () => {
+  const thread = await aThread()
+
+  await expect(handOn(thread, holder)).rejects.toThrow('error.activity-approval delegate to self')
+})

package/tests/discard-draft.test.ts

@@ -104,42 +104,80 @@ it('an id that is not here is refused by name', async () => {
 
 describe('attachment files and the commit', () => {
   /*
-   * deleteAttachmentsByRef removes the files from storage while the transaction is still open. The
-   * @transaction directive commits after the resolver returns, so if the commit then fails the rows
-   * come back and the files do not. Pointed out 2026-09-24 (architect); there is no after-commit hook
-   * in @transaction and no rows-now-files-later shape in attachment-base, so the fix waits for a ruling.
-   *
-   * test.failing: this is red in intent - it passes while the hole is open, and turns red the day files
-   * wait for the commit, which is the signal to make it a plain test.
+   * deleteAttachmentsByRef used to remove the files from storage while the transaction was still open,
+   * so a commit that then failed brought the rows back without their files. Now @transaction hands the
+   * request an after-commit list and attachment-base puts the file deletes on it (ADR-0091 decision 8).
+   * These run the discard the way the directive does, through shell's runTransaction.
    */
   const attachmentConst = require(join(__dirname, '..', '..', 'attachment-base', 'dist-server', 'attachment-const.js'))
+  const { runTransaction } = require('@things-factory/shell')
+  const { ActivityInstanceMutation } = require(join(DIST, 'service', 'activity-instance', 'activity-instance-mutation.js'))
   const deletedFiles: string[] = []
 
   beforeAll(() => {
     attachmentConst.STORAGE = { ...(attachmentConst.STORAGE || {}), deleteFile: async (path: string) => deletedFiles.push(path) }
   })
 
-  it.failing('a transaction that rolls back after the discard leaves the file in storage', async () => {
-    const draft = await aCase('draft')
-    await db.getRepository(Attachment).save({
+  beforeEach(() => (deletedFiles.length = 0))
+
+  const attachTo = (instance: any) =>
+    db.getRepository(Attachment).save({
       domain,
       name: 'a.txt',
-      refBy: draft.id,
+      refBy: instance.id,
       refType: 'ActivityInstance',
-      path: `files/${draft.id}.txt`,
+      path: `files/${instance.id}.txt`,
       mimetype: 'text/plain',
       encoding: '7bit',
       size: '1'
     })
 
+  const asDirective = (user: any, work: (context: any) => Promise<any>) =>
+    runTransaction(
+      (body: any) => db.transaction(body),
+      (tx: any, afterCommit: any) => work({ state: { domain, user, tx, afterCommit }, t: (key: string) => key }),
+      () => {}
+    )
+
+  it('a discard that commits removes the file, after the commit', async () => {
+    const draft = await aCase('draft')
+    await attachTo(draft)
+
+    await asDirective(writer, context => discardDraft(draft.id, context))
+
+    expect(deletedFiles).toEqual([`files/${draft.id}.txt`])
+  })
+
+  it('a transaction that rolls back after the discard leaves the file in storage', async () => {
+    const draft = await aCase('draft')
+    await attachTo(draft)
+
     await expect(
-      db.transaction(async (tx: any) => {
-        await discardDraft(draft.id, { state: { domain, user: writer, tx }, t: (key: string) => key } as any)
+      asDirective(writer, async context => {
+        await discardDraft(draft.id, context)
         throw new Error('the commit fails')
       })
     ).rejects.toThrow('the commit fails')
 
     expect(await left(draft.id)).toEqual({ instance: true, threads: 1, approvals: 1 })
-    expect(deletedFiles).not.toContain(`files/${draft.id}.txt`)
+    expect(deletedFiles).toEqual([])
+  })
+
+  it('discarding several where the last has gone out keeps every file - the first two roll back with it', async () => {
+    mockManages = true
+    const first = await aCase('draft')
+    const second = await aCase('draft')
+    const issued = await aCase('issued')
+    for (const one of [first, second, issued]) await attachTo(one)
+
+    await expect(
+      asDirective(someoneElse, context =>
+        new ActivityInstanceMutation().deleteDraftActivityInstances([first.id, second.id, issued.id], context)
+      )
+    ).rejects.toThrow('error.activity-instance not a draft any more')
+
+    expect(await left(first.id)).toMatchObject({ instance: true })
+    expect(await left(second.id)).toMatchObject({ instance: true })
+    expect(deletedFiles).toEqual([])
   })
 })

package/tests/discard-versus-issue.pg.test.ts

@@ -0,0 +1,127 @@
+import { join } from 'path'
+
+/**
+ * Issuing and discarding the same draft at the same moment, on postgres (ADR-0091 decision 3).
+ *
+ * sqlite holds one connection and cannot run two transactions side by side, so what it says about this
+ * is no evidence either way. This needs a real server, and runs only when WORKLIST_PG_URL names one:
+ *
+ *   docker run -d --name wl-ux-pg -e POSTGRES_PASSWORD=wlux -e POSTGRES_USER=wlux -e POSTGRES_DB=wlux \
+ *     -p 55433:5432 postgres:14-alpine
+ *   WORKLIST_PG_URL=postgres://wlux:wlux@localhost:55433/wlux npx jest packages/worklist/tests/discard-versus-issue.pg.test.ts
+ *
+ * Each round must end one way or the other - the discard won (the draft is gone, the issue failed) or
+ * the issue won (the case is out, the discard was refused by name). Both succeeding, or a case that
+ * comes back after it was discarded, is the defect.
+ */
+
+const url = process.env.WORKLIST_PG_URL
+const maybe = url ? describe : describe.skip
+
+jest.mock('@things-factory/auth-base', () => {
+  const actual = jest.requireActual('@things-factory/auth-base')
+  return { ...actual, checkPermission: async () => false }
+})
+
+/* Attachments are not what this measures, and their entity declares a sqlite-only blob column. */
+jest.mock('@things-factory/attachment-base', () => {
+  const actual = jest.requireActual('@things-factory/attachment-base')
+  return { ...actual, deleteAttachmentsByRef: async () => false }
+})
+
+maybe('discard and issue at once, on postgres', () => {
+  const { DataSource } = require('typeorm')
+  const { entityClosure } = require(join(__dirname, '..', '..', 'ops-master', 'test', 'support', 'database.cjs'))
+  const { NamingStrategy } = require('@things-factory/shell/dist-server/initializers/naming-strategy.js')
+  const DIST = join(__dirname, '..', 'dist-server')
+  const { Activity } = require(join(DIST, 'service', 'activity', 'activity.js'))
+  const { ActivityInstance } = require(join(DIST, 'service', 'activity-instance', 'activity-instance.js'))
+  const { ActivityThread } = require(join(DIST, 'service', 'activity-thread', 'activity-thread.js'))
+  const { ActivityApproval } = require(join(DIST, 'service', 'activity-approval', 'activity-approval.js'))
+  const { discardDraft } = require(join(DIST, 'controllers', 'activity-instance', 'discard-draft.js'))
+  const { issue } = require(join(DIST, 'controllers', 'activity-instance', 'issue.js'))
+  const { draft: saveDraft } = require(join(DIST, 'controllers', 'activity-instance', 'draft.js'))
+  const { Employee } = require('@things-factory/organization')
+  const { Domain } = require('@things-factory/shell')
+  const { User } = require('@things-factory/auth-base')
+
+  let db: any
+  let domain: any
+  let writer: any
+  let activity: any
+
+  beforeAll(async () => {
+    db = new DataSource({
+      type: 'postgres',
+      url,
+      synchronize: true,
+      dropSchema: true,
+      entities: entityClosure([Activity, ActivityInstance, ActivityThread, ActivityApproval, Employee]),
+      namingStrategy: new NamingStrategy()
+    })
+    await db.initialize()
+
+    domain = await db.getRepository(Domain).save({ name: 'd', subdomain: 'd' })
+    writer = await db.getRepository(User).save({ name: 'w', email: 'w@example.com', password: 'x', status: 'activated', domains: [domain] })
+    activity = await db.getRepository(Activity).save({ domain, name: 'race', activityType: 'standard', startingType: 'issue' })
+  }, 60000)
+
+  afterAll(async () => db?.destroy())
+
+  const as = (tx: any) => ({ state: { domain, user: writer, tx }, t: (key: string) => key }) as any
+
+  it('each round ends with exactly one of them having happened', async () => {
+    const outcomes: string[] = []
+
+    for (let round = 0; round < 25; round++) {
+      const draft = await db.getRepository(ActivityInstance).save({ domain, name: `r${round}`, state: 'draft', creator: writer, activity })
+
+      const [discarded, issued] = await Promise.allSettled([
+        db.transaction((tx: any) => discardDraft(draft.id, as(tx))),
+        db.transaction((tx: any) => issue({ id: draft.id, activityId: activity.id, name: `r${round}` }, as(tx)))
+      ])
+
+      const row = await db.getRepository(ActivityInstance).findOne({ where: { id: draft.id } })
+      const verdict = `${discarded.status}/${issued.status}/${row ? row.state : 'gone'}`
+      outcomes.push(verdict)
+
+      /* The only two endings that are allowed. */
+      expect(['fulfilled/rejected/gone', 'rejected/fulfilled/' + (row?.state ?? 'gone')]).toContain(verdict)
+
+      if (discarded.status === 'fulfilled') {
+        expect(row).toBeNull()
+      } else {
+        expect(row?.state).not.toBe('draft')
+      }
+    }
+
+    /* Say which endings were seen - a run where only one side ever wins proves less. */
+    console.log('endings', [...new Set(outcomes)].join(' · '))
+  }, 120000)
+
+  it('saving a draft while it is discarded never brings it back', async () => {
+    const outcomes: string[] = []
+
+    for (let round = 0; round < 25; round++) {
+      const draft = await db.getRepository(ActivityInstance).save({ domain, name: `s${round}`, state: 'draft', creator: writer, activity })
+
+      const [discarded, saved] = await Promise.allSettled([
+        db.transaction((tx: any) => discardDraft(draft.id, as(tx))),
+        db.transaction((tx: any) => saveDraft({ id: draft.id, name: `s${round}-edited` }, as(tx)))
+      ])
+
+      const row = await db.getRepository(ActivityInstance).findOne({ where: { id: draft.id } })
+      const verdict = `${discarded.status}/${saved.status}/${row ? row.state : 'gone'}`
+      outcomes.push(verdict)
+
+      /*
+       * Saving then discarding is a fine order, and ends gone. What must never happen is a draft that was
+       * reported thrown away and is still there - the save writing back what it had read.
+       */
+      if (discarded.status === 'fulfilled') expect(row).toBeNull()
+      else expect(row?.state).toBe('draft')
+    }
+
+    console.log('endings', [...new Set(outcomes)].join(' · '))
+  }, 120000)
+})

package/tests/org-member-domain.test.ts

@@ -0,0 +1,87 @@
+import { join } from 'path'
+
+/**
+ * A person named on an approval line or as an assignee is found in the case's domain only.
+ *
+ * getSystemUserFromOrgMemberItem turns a line entry - an employee, a department (its manager) or a
+ * role - into the person who holds the seat. It looked each up by id alone, so an entry naming
+ * another tenant's employee made that tenant's person an approver here. assign found users by
+ * email alone, with the same effect for assignees. Real entities on sqlite.
+ */
+
+const { createSqliteTestDataSource } = require(join(__dirname, '..', '..', 'ops-master', 'test', 'support', 'database.cjs'))
+const DIST = join(__dirname, '..', 'dist-server')
+const { ActivityInstance } = require(join(DIST, 'service', 'activity-instance', 'activity-instance.js'))
+const { getSystemUserFromOrgMemberItem } = require(join(DIST, 'controllers', 'common.js'))
+const { assign } = require(join(DIST, 'controllers', 'activity-instance', 'assign.js'))
+const { ActivityThread } = require(join(DIST, 'service', 'activity-thread', 'activity-thread.js'))
+const { Employee, Department } = require('@things-factory/organization')
+const { Domain } = require('@things-factory/shell')
+const { Role, User } = require('@things-factory/auth-base')
+
+let db: any
+let here: any
+let elsewhere: any
+let mine: any
+let theirs: any
+
+beforeAll(async () => {
+  db = createSqliteTestDataSource([ActivityInstance, ActivityThread, Employee, Department])
+  await db.initialize()
+
+  here = await db.getRepository(Domain).save({ name: 'here', subdomain: 'here' })
+  elsewhere = await db.getRepository(Domain).save({ name: 'elsewhere', subdomain: 'elsewhere' })
+
+  const person = async (name: string, domain: any) => {
+    const user = await db.getRepository(User).save({ name, email: `${name}@example.com`, password: 'x', status: 'activated', domains: [domain] })
+    const employee = await db.getRepository(Employee).save({ domain, name, controlNo: name, user })
+    const department = await db.getRepository(Department).save({ domain, name: `${name}-dept`, controlNo: `${name}-dept`, manager: employee })
+    const role = await db.getRepository(Role).save({ domain, name: `${name}-role`, users: [user] })
+
+    return { user, employee, department, role }
+  }
+
+  mine = await person('mine', here)
+  theirs = await person('theirs', elsewhere)
+})
+
+afterAll(async () => db?.destroy())
+
+const resolve = (item: any) =>
+  db.transaction((tx: any) => getSystemUserFromOrgMemberItem(item, { state: { domain: here, user: mine.user, tx }, t: (k: string) => k } as any))
+
+it.each([
+  ['Employee', 'employee'],
+  ['Department', 'department'],
+  ['Role', 'role']
+])('an entry of type %s names the person of this domain', async (type, key) => {
+  expect(await resolve({ type, value: mine[key].id })).toMatchObject({ id: mine.user.id })
+})
+
+it.each([
+  ['Employee', 'employee'],
+  ['Department', 'department'],
+  ['Role', 'role']
+])("an entry of type %s naming another tenant's is nobody here", async (type, key) => {
+  expect(await resolve({ type, value: theirs[key].id })).toBeFalsy()
+})
+
+describe('assign', () => {
+  const assignTo = (instance: any, emails: string[]) =>
+    db.transaction((tx: any) =>
+      assign({ id: instance.id, assignees: emails }, { state: { domain: here, user: mine.user, tx }, t: (k: string) => k } as any)
+    )
+
+  it("another tenant's address is refused by name, and no thread is made", async () => {
+    const instance = await db.getRepository(ActivityInstance).save({ domain: here, name: 'i', state: 'issued' })
+
+    await expect(assignTo(instance, [theirs.user.email])).rejects.toThrow('error.activity-instance assignee not in this domain')
+    expect(await db.getRepository(ActivityThread).count({ where: { activityInstance: { id: instance.id } } })).toBe(0)
+  })
+
+  it('an address that is nobody at all is refused by name too, not dropped', async () => {
+    const instance = await db.getRepository(ActivityInstance).save({ domain: here, name: 'i', state: 'issued' })
+
+    await expect(assignTo(instance, ['nobody@example.com'])).rejects.toThrow('error.activity-instance assignee not in this domain')
+  })
+})