@tumbaland/backend-core 1.50.0 → 1.51.0

package/dist/groups/access.d.ts

@@ -0,0 +1,13 @@
+/** Whether `groupId` is one of the groups the person belongs to. */
+export declare const isMemberOf: (groupId: string, userGroups: readonly string[] | null | undefined) => boolean;
+/**
+ * The one rule that keeps a group's data inside the group: a `groupId` that
+ * arrives in a request is never trusted, it must be one of the caller's own.
+ *
+ * No group named means the caller's personal data, which is always theirs, so
+ * `undefined` and `null` pass. A group they are not in throws a 403, never
+ * falls back to personal: reading someone else's group as "personal" would
+ * quietly show them nothing, and writing to it would not.
+ */
+export declare function assertMemberOf(groupId: string | null | undefined, userGroups: readonly string[] | null | undefined, message?: string): void;
+//# sourceMappingURL=access.d.ts.map

package/dist/groups/access.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"access.d.ts","sourceRoot":"","sources":["../../src/groups/access.ts"],"names":[],"mappings":"AAEA,oEAAoE;AACpE,eAAO,MAAM,UAAU,GAAI,SAAS,MAAM,EAAE,YAAY,SAAS,MAAM,EAAE,GAAG,IAAI,GAAG,SAAS,KAAG,OACvD,CAAC;AAEzC;;;;;;;;GAQG;AACH,wBAAgB,cAAc,CAC5B,OAAO,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EAClC,UAAU,EAAE,SAAS,MAAM,EAAE,GAAG,IAAI,GAAG,SAAS,EAChD,OAAO,SAAkB,GACxB,IAAI,CAEN"}

package/dist/groups/access.js

@@ -0,0 +1,22 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.isMemberOf = void 0;
+exports.assertMemberOf = assertMemberOf;
+const HttpError_1 = require("../errors/HttpError");
+/** Whether `groupId` is one of the groups the person belongs to. */
+const isMemberOf = (groupId, userGroups) => Boolean(userGroups?.includes(groupId));
+exports.isMemberOf = isMemberOf;
+/**
+ * The one rule that keeps a group's data inside the group: a `groupId` that
+ * arrives in a request is never trusted, it must be one of the caller's own.
+ *
+ * No group named means the caller's personal data, which is always theirs, so
+ * `undefined` and `null` pass. A group they are not in throws a 403, never
+ * falls back to personal: reading someone else's group as "personal" would
+ * quietly show them nothing, and writing to it would not.
+ */
+function assertMemberOf(groupId, userGroups, message = 'Access denied') {
+    if (groupId && !(0, exports.isMemberOf)(groupId, userGroups))
+        throw new HttpError_1.ForbiddenError(message);
+}
+//# sourceMappingURL=access.js.map

package/dist/groups/access.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"access.js","sourceRoot":"","sources":["../../src/groups/access.ts"],"names":[],"mappings":";;;AAeA,wCAMC;AArBD,mDAAqD;AAErD,oEAAoE;AAC7D,MAAM,UAAU,GAAG,CAAC,OAAe,EAAE,UAAgD,EAAW,EAAE,CACvG,OAAO,CAAC,UAAU,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;AAD5B,QAAA,UAAU,cACkB;AAEzC;;;;;;;;GAQG;AACH,SAAgB,cAAc,CAC5B,OAAkC,EAClC,UAAgD,EAChD,OAAO,GAAG,eAAe;IAEzB,IAAI,OAAO,IAAI,CAAC,IAAA,kBAAU,EAAC,OAAO,EAAE,UAAU,CAAC;QAAE,MAAM,IAAI,0BAAc,CAAC,OAAO,CAAC,CAAC;AACrF,CAAC"}

package/dist/groups/index.d.ts

@@ -3,4 +3,5 @@ export type { GroupOwner } from './client';
 export { groupOwnerSubject } from './subject';
 export type { GroupIdResolver } from './subject';
 export { getUserGroupIds, currentGroupsOf, clearMembershipCache } from './membership';
+export { assertMemberOf, isMemberOf } from './access';
 //# sourceMappingURL=index.d.ts.map

package/dist/groups/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/groups/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,oBAAoB,EAAE,oBAAoB,EAAE,MAAM,UAAU,CAAC;AACrF,YAAY,EAAE,UAAU,EAAE,MAAM,UAAU,CAAC;AAE3C,OAAO,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAC;AAC9C,YAAY,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AAEjD,OAAO,EAAE,eAAe,EAAE,eAAe,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/groups/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,oBAAoB,EAAE,oBAAoB,EAAE,MAAM,UAAU,CAAC;AACrF,YAAY,EAAE,UAAU,EAAE,MAAM,UAAU,CAAC;AAE3C,OAAO,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAC;AAC9C,YAAY,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AAEjD,OAAO,EAAE,eAAe,EAAE,eAAe,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAC;AACtF,OAAO,EAAE,cAAc,EAAE,UAAU,EAAE,MAAM,UAAU,CAAC"}

package/dist/groups/index.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.clearMembershipCache = exports.currentGroupsOf = exports.getUserGroupIds = exports.groupOwnerSubject = exports.clearGroupOwnerCache = exports.invalidateGroupOwner = exports.getGroupOwner = void 0;
+exports.isMemberOf = exports.assertMemberOf = exports.clearMembershipCache = exports.currentGroupsOf = exports.getUserGroupIds = exports.groupOwnerSubject = exports.clearGroupOwnerCache = exports.invalidateGroupOwner = exports.getGroupOwner = void 0;
 var client_1 = require("./client");
 Object.defineProperty(exports, "getGroupOwner", { enumerable: true, get: function () { return client_1.getGroupOwner; } });
 Object.defineProperty(exports, "invalidateGroupOwner", { enumerable: true, get: function () { return client_1.invalidateGroupOwner; } });
@@ -11,4 +11,7 @@ var membership_1 = require("./membership");
 Object.defineProperty(exports, "getUserGroupIds", { enumerable: true, get: function () { return membership_1.getUserGroupIds; } });
 Object.defineProperty(exports, "currentGroupsOf", { enumerable: true, get: function () { return membership_1.currentGroupsOf; } });
 Object.defineProperty(exports, "clearMembershipCache", { enumerable: true, get: function () { return membership_1.clearMembershipCache; } });
+var access_1 = require("./access");
+Object.defineProperty(exports, "assertMemberOf", { enumerable: true, get: function () { return access_1.assertMemberOf; } });
+Object.defineProperty(exports, "isMemberOf", { enumerable: true, get: function () { return access_1.isMemberOf; } });
 //# sourceMappingURL=index.js.map

package/dist/groups/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/groups/index.ts"],"names":[],"mappings":";;;AAAA,mCAAqF;AAA5E,uGAAA,aAAa,OAAA;AAAE,8GAAA,oBAAoB,OAAA;AAAE,8GAAA,oBAAoB,OAAA;AAGlE,qCAA8C;AAArC,4GAAA,iBAAiB,OAAA;AAG1B,2CAAsF;AAA7E,6GAAA,eAAe,OAAA;AAAE,6GAAA,eAAe,OAAA;AAAE,kHAAA,oBAAoB,OAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/groups/index.ts"],"names":[],"mappings":";;;AAAA,mCAAqF;AAA5E,uGAAA,aAAa,OAAA;AAAE,8GAAA,oBAAoB,OAAA;AAAE,8GAAA,oBAAoB,OAAA;AAGlE,qCAA8C;AAArC,4GAAA,iBAAiB,OAAA;AAG1B,2CAAsF;AAA7E,6GAAA,eAAe,OAAA;AAAE,6GAAA,eAAe,OAAA;AAAE,kHAAA,oBAAoB,OAAA;AAC/D,mCAAsD;AAA7C,wGAAA,cAAc,OAAA;AAAE,oGAAA,UAAU,OAAA"}

package/dist/testing/openapi.d.ts

@@ -0,0 +1,34 @@
+import { type Application } from 'express';
+/** Makes every `use()` remember its path on the layers it adds. Idempotent. */
+export declare function recordMountPaths(): void;
+export interface Endpoint {
+    method: string;
+    /** In OpenAPI form: `/api/things/{id}`. */
+    path: string;
+}
+/** Every method and path the app answers, as OpenAPI would write them. */
+export declare function listRoutes(app: Application): Endpoint[];
+/**
+ * Every method and path a spec documents. A path item may live in a file of its
+ * own (`$ref: 'paths/thing.yml'`), as file-service's source spec does, so a
+ * relative `$ref` is followed.
+ */
+export declare function listDocumented(specFile: string): Endpoint[];
+/**
+ * Served by backend-core in every service, for the platform rather than for API
+ * callers: Kubernetes-style liveness and Prometheus. Not expected in each spec.
+ */
+export declare const PLATFORM_ROUTES: string[];
+export interface OpenApiDrift {
+    /** Routes the app serves that the spec does not mention. */
+    undocumented: string[];
+    /** Operations the spec describes that the app does not serve. */
+    stale: string[];
+}
+/**
+ * What the spec and the app disagree on. `ignore` takes routes that are
+ * deliberately left out of the docs (`'GET /docs'`, or a pattern), on top of
+ * the platform routes.
+ */
+export declare function openApiDrift(app: Application, specFile: string, ignore?: Array<string | RegExp>): OpenApiDrift;
+//# sourceMappingURL=openapi.d.ts.map

package/dist/testing/openapi.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"openapi.d.ts","sourceRoot":"","sources":["../../src/testing/openapi.ts"],"names":[],"mappings":"AAEA,OAAgB,EAAE,KAAK,WAAW,EAAE,MAAM,SAAS,CAAC;AAyBpD,+EAA+E;AAC/E,wBAAgB,gBAAgB,IAAI,IAAI,CAavC;AAED,MAAM,WAAW,QAAQ;IACvB,MAAM,EAAE,MAAM,CAAC;IACf,2CAA2C;IAC3C,IAAI,EAAE,MAAM,CAAC;CACd;AAYD,0EAA0E;AAC1E,wBAAgB,UAAU,CAAC,GAAG,EAAE,WAAW,GAAG,QAAQ,EAAE,CAsBvD;AAID;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,QAAQ,EAAE,MAAM,GAAG,QAAQ,EAAE,CAY3D;AAMD;;;GAGG;AACH,eAAO,MAAM,eAAe,UAAuC,CAAC;AAEpE,MAAM,WAAW,YAAY;IAC3B,4DAA4D;IAC5D,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,iEAAiE;IACjE,KAAK,EAAE,MAAM,EAAE,CAAC;CACjB;AAED;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,GAAG,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,GAAE,KAAK,CAAC,MAAM,GAAG,MAAM,CAAM,GAAG,YAAY,CAalH"}

package/dist/testing/openapi.js

@@ -0,0 +1,110 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PLATFORM_ROUTES = void 0;
+exports.recordMountPaths = recordMountPaths;
+exports.listRoutes = listRoutes;
+exports.listDocumented = listDocumented;
+exports.openApiDrift = openApiDrift;
+const fs_1 = __importDefault(require("fs"));
+const path_1 = __importDefault(require("path"));
+const express_1 = __importDefault(require("express"));
+const yaml_1 = require("yaml");
+let recording = false;
+/** Makes every `use()` remember its path on the layers it adds. Idempotent. */
+function recordMountPaths() {
+    if (recording)
+        return;
+    recording = true;
+    const proto = express_1.default.Router.prototype;
+    const use = proto.use;
+    proto.use = function (...args) {
+        const before = this.stack.length;
+        const result = use.apply(this, args);
+        const first = args[0];
+        const mountPath = typeof first === 'string' || Array.isArray(first) ? first : '/';
+        for (const layer of this.stack.slice(before))
+            layer.mountPath = mountPath;
+        return result;
+    };
+}
+const METHODS = ['get', 'post', 'put', 'patch', 'delete'];
+const join = (prefix, path) => {
+    const joined = `${prefix}/${path}`.replace(/\/+/g, '/');
+    return joined.length > 1 ? joined.replace(/\/$/, '') : joined;
+};
+/** `/:id` and Express 5's `/*fileId` as OpenAPI writes them: `/{id}`, `/{fileId}`. */
+const toOpenApiPath = (path) => path.replace(/[:*](\w+)/g, '{$1}');
+/** Every method and path the app answers, as OpenAPI would write them. */
+function listRoutes(app) {
+    const router = app.router ?? app._router;
+    if (!router)
+        throw new Error('The app has no router yet: build it before listing its routes');
+    const found = [];
+    const walk = (stack, prefix) => {
+        for (const layer of stack) {
+            if (layer.route) {
+                const paths = Array.isArray(layer.route.path) ? layer.route.path : [layer.route.path];
+                for (const path of paths) {
+                    for (const method of Object.keys(layer.route.methods).filter((m) => METHODS.includes(m))) {
+                        found.push({ method, path: toOpenApiPath(join(prefix, path)) });
+                    }
+                }
+            }
+            else if (layer.handle?.stack) {
+                const mounts = layer.mountPath === undefined ? ['/'] : [].concat(layer.mountPath);
+                for (const mount of mounts)
+                    walk(layer.handle.stack, join(prefix, mount));
+            }
+        }
+    };
+    walk(router.stack, '/');
+    return found;
+}
+const readYaml = (file) => (0, yaml_1.parse)(fs_1.default.readFileSync(file, 'utf8'));
+/**
+ * Every method and path a spec documents. A path item may live in a file of its
+ * own (`$ref: 'paths/thing.yml'`), as file-service's source spec does, so a
+ * relative `$ref` is followed.
+ */
+function listDocumented(specFile) {
+    const spec = readYaml(specFile);
+    return Object.entries(spec.paths ?? {}).flatMap(([path, item]) => {
+        const ref = item?.$ref;
+        const operations = typeof ref === 'string' && !ref.startsWith('#')
+            ? readYaml(path_1.default.resolve(path_1.default.dirname(specFile), ref))
+            : item;
+        return Object.keys(operations ?? {})
+            .filter((method) => METHODS.includes(method))
+            .map((method) => ({ method, path }));
+    });
+}
+/** A route's identity regardless of what its parameters are called: `{id}` and `{conversationId}` match. */
+const key = ({ method, path }) => `${method.toUpperCase()} ${path.replace(/\{[^}]+\}/g, '{}')}`;
+const label = ({ method, path }) => `${method.toUpperCase()} ${path}`;
+/**
+ * Served by backend-core in every service, for the platform rather than for API
+ * callers: Kubernetes-style liveness and Prometheus. Not expected in each spec.
+ */
+exports.PLATFORM_ROUTES = ['GET /health/live', 'GET /metrics'];
+/**
+ * What the spec and the app disagree on. `ignore` takes routes that are
+ * deliberately left out of the docs (`'GET /docs'`, or a pattern), on top of
+ * the platform routes.
+ */
+function openApiDrift(app, specFile, ignore = []) {
+    const rules = [...exports.PLATFORM_ROUTES, ...ignore];
+    const skipped = (endpoint) => rules.some((rule) => (typeof rule === 'string' ? rule === label(endpoint) : rule.test(label(endpoint))));
+    const routes = listRoutes(app).filter((endpoint) => !skipped(endpoint));
+    const documented = listDocumented(specFile).filter((endpoint) => !skipped(endpoint));
+    const routeKeys = new Set(routes.map(key));
+    const documentedKeys = new Set(documented.map(key));
+    const unique = (labels) => [...new Set(labels)].sort();
+    return {
+        undocumented: unique(routes.filter((endpoint) => !documentedKeys.has(key(endpoint))).map(label)),
+        stale: unique(documented.filter((endpoint) => !routeKeys.has(key(endpoint))).map(label))
+    };
+}
+//# sourceMappingURL=openapi.js.map

package/dist/testing/openapi.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"openapi.js","sourceRoot":"","sources":["../../src/testing/openapi.ts"],"names":[],"mappings":";;;;;;AA4BA,4CAaC;AAmBD,gCAsBC;AASD,wCAYC;AAwBD,oCAaC;AA5ID,4CAAoB;AACpB,gDAA4B;AAC5B,sDAAoD;AACpD,+BAA6B;AAsB7B,IAAI,SAAS,GAAG,KAAK,CAAC;AAEtB,+EAA+E;AAC/E,SAAgB,gBAAgB;IAC9B,IAAI,SAAS;QAAE,OAAO;IACtB,SAAS,GAAG,IAAI,CAAC;IACjB,MAAM,KAAK,GAAI,iBAAO,CAAC,MAA6E,CAAC,SAAS,CAAC;IAC/G,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC;IACtB,KAAK,CAAC,GAAG,GAAG,UAAyB,GAAG,IAAe;QACrD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC;QACjC,MAAM,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QACrC,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QACtB,MAAM,SAAS,GAAG,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAE,KAA2B,CAAC,CAAC,CAAC,GAAG,CAAC;QACzG,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC;YAAE,KAAK,CAAC,SAAS,GAAG,SAAS,CAAC;QAC1E,OAAO,MAAM,CAAC;IAChB,CAAC,CAAC;AACJ,CAAC;AAQD,MAAM,OAAO,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;AAE1D,MAAM,IAAI,GAAG,CAAC,MAAc,EAAE,IAAY,EAAU,EAAE;IACpD,MAAM,MAAM,GAAG,GAAG,MAAM,IAAI,IAAI,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IACxD,OAAO,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;AAChE,CAAC,CAAC;AAEF,sFAAsF;AACtF,MAAM,aAAa,GAAG,CAAC,IAAY,EAAU,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;AAEnF,0EAA0E;AAC1E,SAAgB,UAAU,CAAC,GAAgB;IACzC,MAAM,MAAM,GAAI,GAA0D,CAAC,MAAM,IAAK,GAAuC,CAAC,OAAO,CAAC;IACtI,IAAI,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,+DAA+D,CAAC,CAAC;IAC9F,MAAM,KAAK,GAAe,EAAE,CAAC;IAE7B,MAAM,IAAI,GAAG,CAAC,KAAc,EAAE,MAAc,EAAE,EAAE;QAC9C,KAAK,MAAM,KAAK,IAAI,KAAK,EAAE,CAAC;YAC1B,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;gBAChB,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;gBACtF,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;oBACzB,KAAK,MAAM,MAAM,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;wBACzF,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,aAAa,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC;oBAClE,CAAC;gBACH,CAAC;YACH,CAAC;iBAAM,IAAI,KAAK,CAAC,MAAM,EAAE,KAAK,EAAE,CAAC;gBAC/B,MAAM,MAAM,GAAG,KAAK,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAE,EAAe,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;gBAChG,KAAK,MAAM,KAAK,IAAI,MAAM;oBAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC;YAC5E,CAAC;QACH,CAAC;IACH,CAAC,CAAC;IACF,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IACxB,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,QAAQ,GAAG,CAAC,IAAY,EAAW,EAAE,CAAC,IAAA,YAAK,EAAC,YAAE,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;AAEjF;;;;GAIG;AACH,SAAgB,cAAc,CAAC,QAAgB;IAC7C,MAAM,IAAI,GAAG,QAAQ,CAAC,QAAQ,CAAwD,CAAC;IACvF,OAAO,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,EAAE;QAC/D,MAAM,GAAG,GAAG,IAAI,EAAE,IAAI,CAAC;QACvB,MAAM,UAAU,GACd,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC;YAC7C,CAAC,CAAE,QAAQ,CAAC,cAAQ,CAAC,OAAO,CAAC,cAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,GAAG,CAAC,CAA6B;YAC1F,CAAC,CAAC,IAAI,CAAC;QACX,OAAO,MAAM,CAAC,IAAI,CAAC,UAAU,IAAI,EAAE,CAAC;aACjC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;aAC5C,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;IACzC,CAAC,CAAC,CAAC;AACL,CAAC;AAED,4GAA4G;AAC5G,MAAM,GAAG,GAAG,CAAC,EAAE,MAAM,EAAE,IAAI,EAAY,EAAE,EAAE,CAAC,GAAG,MAAM,CAAC,WAAW,EAAE,IAAI,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,IAAI,CAAC,EAAE,CAAC;AAC1G,MAAM,KAAK,GAAG,CAAC,EAAE,MAAM,EAAE,IAAI,EAAY,EAAE,EAAE,CAAC,GAAG,MAAM,CAAC,WAAW,EAAE,IAAI,IAAI,EAAE,CAAC;AAEhF;;;GAGG;AACU,QAAA,eAAe,GAAG,CAAC,kBAAkB,EAAE,cAAc,CAAC,CAAC;AASpE;;;;GAIG;AACH,SAAgB,YAAY,CAAC,GAAgB,EAAE,QAAgB,EAAE,SAAiC,EAAE;IAClG,MAAM,KAAK,GAAG,CAAC,GAAG,uBAAe,EAAE,GAAG,MAAM,CAAC,CAAC;IAC9C,MAAM,OAAO,GAAG,CAAC,QAAkB,EAAE,EAAE,CACrC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,KAAK,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;IAC3G,MAAM,MAAM,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC;IACxE,MAAM,UAAU,GAAG,cAAc,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC;IACrF,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3C,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;IACpD,MAAM,MAAM,GAAG,CAAC,MAAgB,EAAE,EAAE,CAAC,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACjE,OAAO;QACL,YAAY,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAChG,KAAK,EAAE,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;KACzF,CAAC;AACJ,CAAC"}

package/dist/testing/serviceTestSetup.js

@@ -2,6 +2,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 const session_1 = require("../auth/session");
 const membership_1 = require("../groups/membership");
+const openapi_1 = require("./openapi");
 /**
  * Jest setup for service test suites: they sign session tokens without a
  * session and run with no database or group-service, so every token's session
@@ -15,4 +16,6 @@ const membership_1 = require("../groups/membership");
 // No group-service either: a test token's own `groups` claim is taken as the
 // person's membership. The live lookup is tested in groups/membership.test.ts.
 (0, membership_1.overrideMembershipLookupForTests)(async (user) => user.groups ?? []);
+// Before any app is built, so the OpenAPI drift check can see where routers are mounted.
+(0, openapi_1.recordMountPaths)();
 //# sourceMappingURL=serviceTestSetup.js.map

package/dist/testing/serviceTestSetup.js.map

@@ -1 +1 @@
-{"version":3,"file":"serviceTestSetup.js","sourceRoot":"","sources":["../../src/testing/serviceTestSetup.ts"],"names":[],"mappings":";;AAAA,6CAA+D;AAC/D,qDAAwE;AAExE;;;;;;;;GAQG;AACH,IAAA,sCAA4B,EAAC,KAAK,IAAI,EAAE,CAAC,IAAI,CAAC,CAAC;AAE/C,6EAA6E;AAC7E,+EAA+E;AAC/E,IAAA,6CAAgC,EAAC,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC"}
+{"version":3,"file":"serviceTestSetup.js","sourceRoot":"","sources":["../../src/testing/serviceTestSetup.ts"],"names":[],"mappings":";;AAAA,6CAA+D;AAC/D,qDAAwE;AACxE,uCAA6C;AAE7C;;;;;;;;GAQG;AACH,IAAA,sCAA4B,EAAC,KAAK,IAAI,EAAE,CAAC,IAAI,CAAC,CAAC;AAE/C,6EAA6E;AAC7E,+EAA+E;AAC/E,IAAA,6CAAgC,EAAC,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC;AAEpE,yFAAyF;AACzF,IAAA,0BAAgB,GAAE,CAAC"}

package/package.json

@@ -1,12 +1,13 @@
 {
   "name": "@tumbaland/backend-core",
-  "version": "1.50.0",
+  "version": "1.51.0",
   "description": "Core shared functionality for Tumbaland backend services",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
   "files": [
     "dist",
-    "testing.js"
+    "testing.js",
+    "testing.d.ts"
   ],
   "scripts": {
     "build": "tsc -p tsconfig.build.json",
@@ -60,6 +61,7 @@
     "prom-client": "^15.1.3",
     "uuid": "^14.0.3",
     "winston": "^3.19.0",
+    "yaml": "^2.9.1",
     "zod": "^4.6.7"
   },
   "peerDependencies": {

package/testing.d.ts

@@ -0,0 +1 @@
+export * from './dist/testing/openapi';

package/testing.js

@@ -8,3 +8,6 @@
  * The session check itself is tested in backend-core (src/auth/session.test.ts).
  */
 require('./dist/testing/serviceTestSetup');
+
+// The OpenAPI drift check, for a service's docs test.
+module.exports = require('./dist/testing/openapi');