cabloy 5.1.225 → 5.1.227

package/vona/src/suite/a-commerce/modules/commerce-trade/test/paymentOutcome.test.ts

@@ -1,23 +1,25 @@
+import type { TableIdentity } from 'table-identity';
+
 import assert from 'node:assert';
 import { createHmac, randomUUID } from 'node:crypto';
 import { after, before, describe, it } from 'node:test';
 import { acquireTestLock, app } from 'vona-mock';
 
 interface IFixture {
-  categoryId?: number;
-  productId?: number;
-  skuId?: number;
-  balanceId?: number;
-  templateId?: number;
-  grantId?: number;
-  addressId?: number;
-  cartId?: number;
-  userId?: number;
+  categoryId?: TableIdentity;
+  productId?: TableIdentity;
+  skuId?: TableIdentity;
+  balanceId?: TableIdentity;
+  templateId?: TableIdentity;
+  grantId?: TableIdentity;
+  addressId?: TableIdentity;
+  cartId?: TableIdentity;
+  userId?: TableIdentity;
   customerName?: string;
   checkoutCorrelationId?: string;
-  orderId?: number;
-  paymentAttemptId?: number;
-  paymentSessionId?: number;
+  orderId?: TableIdentity;
+  paymentAttemptId?: TableIdentity;
+  paymentSessionId?: TableIdentity;
 }
 
 async function cleanup(fixture: IFixture) {
@@ -112,6 +114,7 @@ async function createCheckoutFixture(suffix: string, withCoupon = true): Promise
       lifecycle: 'active',
     },
   });
+  assert.ok(fixture.skuId !== undefined);
   fixture.balanceId = (
     await app.scope('commerce-trade').service.stockBalance.adjustStock({
       skuId: fixture.skuId,
@@ -173,6 +176,7 @@ async function createCheckoutFixture(suffix: string, withCoupon = true): Promise
     quantity: 1,
   });
   fixture.checkoutCorrelationId = `payment-checkout-${suffix}`;
+  assert.ok(fixture.addressId !== undefined);
   const checkout = await app.scope('commerce-trade').service.order.checkout({
     addressId: fixture.addressId,
     couponGrantId: fixture.grantId,
@@ -184,7 +188,7 @@ async function createCheckoutFixture(suffix: string, withCoupon = true): Promise
   return fixture;
 }
 
-describe('paymentOutcome.test.ts', { concurrency: false, sequential: true }, () => {
+describe('paymentOutcome.test.ts', { concurrency: false }, () => {
   const releaseTestLocks: Array<() => void> = [];
 
   before(async () => {
@@ -223,8 +227,9 @@ describe('paymentOutcome.test.ts', { concurrency: false, sequential: true }, ()
           providerCaptureId: `capture-${eventId}`,
         });
         const options = app.bean.payProvider.getOptions('pay-mock:mock', 'default');
-        assert.equal(typeof options.secretWebhook, 'string');
-        const signature = createHmac('sha256', options.secretWebhook).update(rawBody).digest('hex');
+        const secretWebhook = options.secretWebhook;
+        assert.ok(typeof secretWebhook === 'string');
+        const signature = createHmac('sha256', secretWebhook).update(rawBody).digest('hex');
         const webhookPath = app.util.getAbsoluteUrlByApiPath('/pay/webhook/pay-mock:mock/default');
         const webhookUrl = webhookPath.startsWith('http')
           ? webhookPath
@@ -635,17 +640,23 @@ describe('paymentOutcome.test.ts', { concurrency: false, sequential: true }, ()
             innerAccess: false,
           }),
         () =>
-          app.bean.executor.performAction('get', '/commerce/trade/order/viewMine/1', {
+          app.bean.executor.performAction('get', '/commerce/trade/order/viewMine/:id', {
+            params: { id: 1 },
             innerAccess: false,
           }),
         () =>
-          app.bean.executor.performAction('get', '/commerce/trade/order/1', {
+          app.bean.executor.performAction('get', '/commerce/trade/order/:id', {
+            params: { id: 1 },
             innerAccess: false,
           }),
         () =>
-          app.bean.executor.performAction('get', '/pay/payment-session/1', {
-            innerAccess: false,
-          }),
+          app
+            .scope('a-executor')
+            .service.executor.performActionInner(
+              'get',
+              app.util.combineApiPath('/pay/payment-session/1', '', true, true),
+              { innerAccess: false },
+            ),
       ];
       for (const request of requests) {
         await assert.rejects(request(), (error: any) => error.code === 401);

package/vona/src/suite/a-commerce/modules/commerce-trade/test/refundLifecycle.test.ts

@@ -1,22 +1,24 @@
+import type { TableIdentity } from 'table-identity';
+
 import assert from 'node:assert';
 import { randomUUID } from 'node:crypto';
 import { after, before, describe, it } from 'node:test';
 import { acquireTestLock, app } from 'vona-mock';
 
 interface IFixture {
-  categoryId?: number;
-  productId?: number;
-  skuId?: number;
-  balanceId?: number;
-  templateId?: number;
-  grantId?: number;
-  addressId?: number;
-  cartId?: number;
-  userId?: number;
+  categoryId?: TableIdentity;
+  productId?: TableIdentity;
+  skuId?: TableIdentity;
+  balanceId?: TableIdentity;
+  templateId?: TableIdentity;
+  grantId?: TableIdentity;
+  addressId?: TableIdentity;
+  cartId?: TableIdentity;
+  userId?: TableIdentity;
   customerName?: string;
-  orderId?: number;
-  paymentAttemptId?: number;
-  paymentSessionId?: number;
+  orderId?: TableIdentity;
+  paymentAttemptId?: TableIdentity;
+  paymentSessionId?: TableIdentity;
 }
 
 async function cleanup(fixture: IFixture) {
@@ -117,6 +119,7 @@ async function createPaidOrder(suffix: string): Promise<IFixture> {
       lifecycle: 'active',
     },
   });
+  assert.ok(fixture.skuId !== undefined);
   fixture.balanceId = (
     await app.scope('commerce-trade').service.stockBalance.adjustStock({
       skuId: fixture.skuId,
@@ -172,6 +175,7 @@ async function createPaidOrder(suffix: string): Promise<IFixture> {
   await app
     .scope('commerce-trade')
     .model.cartItem.insert({ cartId: cart.id, skuId: fixture.skuId, quantity: 1 });
+  assert.ok(fixture.addressId !== undefined);
   const checkout = await app.scope('commerce-trade').service.order.checkout({
     addressId: fixture.addressId,
     couponGrantId: fixture.grantId,
@@ -264,7 +268,7 @@ async function waitForPostgresWaiter(waiterPid: number, holderPid: number): Prom
   assert.fail(`PostgreSQL backend ${waiterPid} was not blocked by backend ${holderPid}`);
 }
 
-describe('refundLifecycle.test.ts', { concurrency: false, sequential: true }, () => {
+describe('refundLifecycle.test.ts', { concurrency: false }, () => {
   let releaseTestLock: (() => void) | undefined;
 
   before(async () => {
@@ -363,6 +367,7 @@ describe('refundLifecycle.test.ts', { concurrency: false, sequential: true }, ()
         const executed = await order.executeRefund(fixture.orderId!);
         await assert.rejects(order.executeRefund(fixture.orderId!), { status: 409 });
         const pay = app.scope('a-pay');
+        assert.ok(executed.refundOperationId !== undefined);
         const refundOperation = await pay.model.refundOperation.getById(executed.refundOperationId);
         const providerOperation = await pay.model.providerOperation.get({
           refundOperationId: refundOperation?.id,
@@ -427,7 +432,8 @@ describe('refundLifecycle.test.ts', { concurrency: false, sequential: true }, ()
             where: { refundRequestId: approved.refundRequestId },
           });
           const [audit] = audits.filter(item => item.toRefundState === 'failed');
-          assert.equal(audit?.idempotencyKey.length <= 100, true);
+          assert.ok(audit?.idempotencyKey !== undefined);
+          assert.equal(audit.idempotencyKey.length <= 100, true);
           assert.equal(audit?.correlationId.length <= 100, true);
         });
       }
@@ -844,14 +850,11 @@ describe('refundLifecycle.test.ts', { concurrency: false, sequential: true }, ()
         Object.assign(fixture, await createPaidOrder(randomUUID().slice(0, 12)));
         await app.bean.passport.signout();
         await assert.rejects(
-          app.bean.executor.performAction(
-            'post',
-            `/commerce/trade/order/${fixture.orderId}/requestRefund`,
-            {
-              innerAccess: false,
-              body: { reason: 'anonymous', idempotencyKey: 'anonymous-1' },
-            },
-          ),
+          app.bean.executor.performAction('post', '/commerce/trade/order/:id/requestRefund', {
+            params: { id: fixture.orderId },
+            innerAccess: false,
+            body: { reason: 'anonymous', idempotencyKey: 'anonymous-1' },
+          }),
           (error: any) => error.code === 401,
         );
         await app.bean.passport.signinMock(fixture.customerName as any);
@@ -860,14 +863,11 @@ describe('refundLifecycle.test.ts', { concurrency: false, sequential: true }, ()
           idempotencyKey: 'customer-1',
         });
         await assert.rejects(
-          app.bean.executor.performAction(
-            'post',
-            `/commerce/trade/order/${fixture.orderId}/approveRefund`,
-            {
-              innerAccess: false,
-              body: { reason: 'not admin', idempotencyKey: 'not-admin-1' },
-            },
-          ),
+          app.bean.executor.performAction('post', '/commerce/trade/order/:id/approveRefund', {
+            params: { id: fixture.orderId },
+            innerAccess: false,
+            body: { reason: 'not admin', idempotencyKey: 'not-admin-1' },
+          }),
           (error: any) => error.code === 403,
         );
       } finally {

package/vona/src/suite/a-commerce/modules/commerce-trade/test/reservationExpiry.test.ts

@@ -1,3 +1,5 @@
+import type { TableIdentity } from 'table-identity';
+
 import assert from 'node:assert';
 import { randomUUID } from 'node:crypto';
 import { after, before, describe, it } from 'node:test';
@@ -6,19 +8,19 @@ import { acquireTestLock, app } from 'vona-mock';
 import { BeanScheduleOrderExpiry } from '../src/bean/bean.scheduleOrderExpiry.ts';
 
 interface IFixture {
-  categoryId?: number;
-  productId?: number;
-  skuId?: number;
-  balanceId?: number;
-  userId?: number;
-  couponTemplateId?: number;
-  couponGrantId?: number;
-  cartId?: number;
-  addressId?: number;
-  orderId?: number;
-  orderLineId?: number;
-  reservationId?: number;
-  paymentAttemptId?: number;
+  categoryId?: TableIdentity;
+  productId?: TableIdentity;
+  skuId?: TableIdentity;
+  balanceId?: TableIdentity;
+  userId?: TableIdentity;
+  couponTemplateId?: TableIdentity;
+  couponGrantId?: TableIdentity;
+  cartId?: TableIdentity;
+  addressId?: TableIdentity;
+  orderId?: TableIdentity;
+  orderLineId?: TableIdentity;
+  reservationId?: TableIdentity;
+  paymentAttemptId?: TableIdentity;
 }
 
 async function cleanup(fixture: IFixture) {
@@ -92,6 +94,7 @@ async function createExpiredCheckoutFixture(suffix: string): Promise<IFixture> {
         lifecycle: 'active',
       },
     });
+    assert.ok(fixture.skuId !== undefined);
     fixture.balanceId = (
       await app.scope('commerce-trade').service.stockBalance.adjustStock({
         skuId: fixture.skuId,
@@ -122,6 +125,7 @@ async function createExpiredCheckoutFixture(suffix: string): Promise<IFixture> {
       skuId: fixture.skuId,
       quantity: 1,
     });
+    assert.ok(fixture.addressId !== undefined);
     const created = await app.scope('commerce-trade').service.order.checkout({
       addressId: fixture.addressId,
       correlationId: `schedule-expiry-${suffix}`,
@@ -144,7 +148,7 @@ async function createExpiredCheckoutFixture(suffix: string): Promise<IFixture> {
   }
 }
 
-describe('reservationExpiry.test.ts', { concurrency: false, sequential: true }, () => {
+describe('reservationExpiry.test.ts', { concurrency: false }, () => {
   let releaseTestLock: (() => void) | undefined;
 
   before(async () => {
@@ -192,6 +196,7 @@ describe('reservationExpiry.test.ts', { concurrency: false, sequential: true },
             lifecycle: 'active',
           },
         });
+        assert.ok(fixture.skuId !== undefined);
         const balance = await app.scope('commerce-trade').service.stockBalance.adjustStock({
           skuId: fixture.skuId,
           delta: 1,
@@ -242,6 +247,7 @@ describe('reservationExpiry.test.ts', { concurrency: false, sequential: true },
           skuId: fixture.skuId,
           quantity: 1,
         });
+        assert.ok(fixture.addressId !== undefined);
         const created = await app.scope('commerce-trade').service.order.checkout({
           addressId: fixture.addressId,
           couponGrantId: fixture.couponGrantId,
@@ -342,9 +348,7 @@ describe('reservationExpiry.test.ts', { concurrency: false, sequential: true },
       );
 
       await app.bean.executor.mockCtx(async () => {
-        await app.bean
-          ._getBean<BeanScheduleOrderExpiry>('commerce-trade.schedule.beanScheduleOrderExpiry')
-          .execute();
+        await app.bean._getBean(BeanScheduleOrderExpiry).execute();
         const order = await app
           .scope('commerce-trade')
           .model.order.getById(defaultFixture!.orderId!);
@@ -357,9 +361,7 @@ describe('reservationExpiry.test.ts', { concurrency: false, sequential: true },
         assert.equal(order?.state, 'expired');
         assert.equal(reservation?.state, 'released');
         assert.equal(paymentAttempt?.state, 'cancelled');
-        await app.bean
-          ._getBean<BeanScheduleOrderExpiry>('commerce-trade.schedule.beanScheduleOrderExpiry')
-          .execute();
+        await app.bean._getBean(BeanScheduleOrderExpiry).execute();
         const audits = await app.scope('commerce-trade').model.orderAudit.select({
           where: { orderId: defaultFixture!.orderId! },
           orders: [['id', 'asc']],
@@ -385,9 +387,7 @@ describe('reservationExpiry.test.ts', { concurrency: false, sequential: true },
           assert.equal(reservation?.state, 'reserved');
           assert.equal(paymentAttempt?.state, 'created');
 
-          await app.bean
-            ._getBean<BeanScheduleOrderExpiry>('commerce-trade.schedule.beanScheduleOrderExpiry')
-            .execute();
+          await app.bean._getBean(BeanScheduleOrderExpiry).execute();
           assert.equal(
             (await app.scope('commerce-trade').model.order.getById(shareFixture!.orderId!))?.state,
             'expired',
@@ -408,9 +408,7 @@ describe('reservationExpiry.test.ts', { concurrency: false, sequential: true },
             )?.state,
             'cancelled',
           );
-          await app.bean
-            ._getBean<BeanScheduleOrderExpiry>('commerce-trade.schedule.beanScheduleOrderExpiry')
-            .execute();
+          await app.bean._getBean(BeanScheduleOrderExpiry).execute();
           const audits = await app.scope('commerce-trade').model.orderAudit.select({
             where: { orderId: shareFixture!.orderId! },
             orders: [['id', 'asc']],

package/vona/src/suite/a-commerce/modules/commerce-trade/test/shipment.test.ts

@@ -69,7 +69,7 @@ async function createPaidOrder(suffix: string): Promise<IFixture> {
   return fixture;
 }
 
-describe('shipment.test.ts', { concurrency: false, sequential: true }, () => {
+describe('shipment.test.ts', { concurrency: false }, () => {
   let releaseTestLock: (() => void) | undefined;
 
   before(async () => {
@@ -85,9 +85,11 @@ describe('shipment.test.ts', { concurrency: false, sequential: true }, () => {
       const fixture: IFixture = {};
       try {
         Object.assign(fixture, await createPaidOrder(randomUUID().slice(0, 12)));
-        const actionPath = `/commerce/trade/order/${fixture.orderId}/ship`;
+        const actionPath = '/commerce/trade/order/:id/ship';
+        const params = { id: fixture.orderId };
         const [_, anonymousError] = await catchError(() =>
           app.bean.executor.performAction('post', actionPath, {
+            params,
             body: { carrier: 'Cabloy Express', trackingNumber: 'CAB-100' },
             innerAccess: false,
           }),
@@ -96,6 +98,7 @@ describe('shipment.test.ts', { concurrency: false, sequential: true }, () => {
         await app.bean.passport.signinMock(fixture.customerName as any);
         const [__, customerError] = await catchError(() =>
           app.bean.executor.performAction('post', actionPath, {
+            params,
             body: { carrier: 'Cabloy Express', trackingNumber: 'CAB-100' },
             innerAccess: false,
           }),
@@ -104,10 +107,12 @@ describe('shipment.test.ts', { concurrency: false, sequential: true }, () => {
         await app.bean.passport.signout();
         await app.bean.passport.signinMock();
         const first = await app.bean.executor.performAction('post', actionPath, {
+          params,
           body: { carrier: '  Cabloy Express  ', trackingNumber: '  CAB-100  ' },
           innerAccess: false,
         });
         const replay = await app.bean.executor.performAction('post', actionPath, {
+          params,
           body: { carrier: 'Cabloy Express', trackingNumber: 'CAB-100' },
           innerAccess: false,
         });

package/vona/src/suite/a-commerce/modules/commerce-trade/test/shipmentRefundRace.test.ts

@@ -168,7 +168,7 @@ async function assertPersistedRefundOutcome(
   assert.deepEqual(refundAudits.map(item => item.toRefundState).sort(), expected.refundAuditStates);
 }
 
-describe('shipmentRefundRace.test.ts', { concurrency: false, sequential: true }, () => {
+describe('shipmentRefundRace.test.ts', { concurrency: false }, () => {
   let releaseTestLock: (() => void) | undefined;
 
   before(async () => {
@@ -321,7 +321,12 @@ describe('shipmentRefundRace.test.ts', { concurrency: false, sequential: true },
       const releaseShipment = Promise.withResolvers<void>();
       let shipmentPid: number | undefined;
       let ship: Promise<unknown> | undefined;
-      let results: PromiseSettledResult<unknown>[] | undefined;
+      let results:
+        | [
+            PromiseSettledResult<Awaited<typeof approveRefund>>,
+            PromiseSettledResult<Awaited<typeof ship>>,
+          ]
+        | undefined;
       try {
         await waitForHolderStage(entered.promise, approveRefund, 'refund approval');
         assert.notEqual(holderPid, undefined);
@@ -352,7 +357,7 @@ describe('shipmentRefundRace.test.ts', { concurrency: false, sequential: true },
       } finally {
         releaseShipment.resolve();
         release.resolve();
-        results = await Promise.allSettled([approveRefund, ship].filter(Boolean));
+        results = await Promise.allSettled([approveRefund, ship]);
       }
       const [approvalResult, shipmentResult] = results!;
       const message = JSON.stringify(results);
@@ -431,7 +436,12 @@ describe('shipmentRefundRace.test.ts', { concurrency: false, sequential: true },
       const releaseShipment = Promise.withResolvers<void>();
       let shipmentPid: number | undefined;
       let ship: Promise<unknown> | undefined;
-      let results: PromiseSettledResult<unknown>[] | undefined;
+      let results:
+        | [
+            PromiseSettledResult<Awaited<typeof executeRefund>>,
+            PromiseSettledResult<Awaited<typeof ship>>,
+          ]
+        | undefined;
       try {
         await waitForHolderStage(entered.promise, executeRefund, 'refund execution');
         assert.notEqual(holderPid, undefined);
@@ -462,7 +472,7 @@ describe('shipmentRefundRace.test.ts', { concurrency: false, sequential: true },
       } finally {
         releaseShipment.resolve();
         release.resolve();
-        results = await Promise.allSettled([executeRefund, ship].filter(Boolean));
+        results = await Promise.allSettled([executeRefund, ship]);
       }
       const [refundResult, shipmentResult] = results!;
       const message = JSON.stringify(results);

package/vona/src/suite/a-commerce/modules/commerce-trade/test/stockBalance.test.ts

@@ -1,3 +1,4 @@
+import type { TableIdentity } from 'table-identity';
 import type { DtoStockAdjust, EntityStockBalance } from 'vona-module-commerce-trade';
 
 import { catchError } from '@cabloy/utils';
@@ -145,12 +146,13 @@ describe('stockBalance.test.ts', { concurrency: false }, () => {
       let fixture: IStockFixture | undefined;
       await app.bean.passport.signinMock();
       try {
-        fixture = await createSku(createTestId());
+        const createdFixture = await createSku(createTestId());
+        fixture = createdFixture;
         const balance = await adjustStock(
-          stockAdjust(fixture.skuId, 2, `${fixture.skuId}-initial`),
+          stockAdjust(createdFixture.skuId, 2, `${createdFixture.skuId}-initial`),
         );
         const [_, err] = await catchError(() =>
-          adjustStock(stockAdjust(fixture.skuId, -3, `${fixture.skuId}-reject`)),
+          adjustStock(stockAdjust(createdFixture.skuId, -3, `${createdFixture.skuId}-reject`)),
         );
         assert.equal(err?.code, 409);
         assert.match(err?.message ?? '', /negative/);
@@ -294,8 +296,8 @@ describe('stockBalance.test.ts', { concurrency: false }, () => {
   it('hides foreign stock balances and audits from operator read APIs', async () => {
     const suffix = createTestId();
     let fixture: IStockFixture | undefined;
-    let balanceId!: number;
-    let auditId!: number;
+    let balanceId!: TableIdentity;
+    let auditId!: TableIdentity;
     const reason = `stock read isolation ${suffix}`;
     const correlationId = `stock-read-isolation-${suffix}`;
     try {

package/vona/src/suite/a-home/modules/home-user/test/account.test.ts

@@ -57,7 +57,8 @@ describe('account.test.ts', { concurrency: false }, () => {
       await app.bean.executor.mockCtx(async () => {
         const user = await app.bean.user.findOneById(fixture!.userId);
         assert.equal(user?.name, `${fixture!.name}-updated`);
-        assert.equal((user as Record<string, unknown>)?.ignored, undefined);
+        assert.ok(user);
+        assert.equal('ignored' in user, false);
       });
 
       await app.bean.executor.mockCtx(async () => {
@@ -117,7 +118,6 @@ describe('account.test.ts', { concurrency: false }, () => {
               clientName: policy.clientName,
               imageScene: policy.imageScene,
               meta: policy.meta,
-              public: policy.public,
             },
           );
           imageId = uploaded.id;

package/vona/src/suite/a-home/modules/home-user/test/accountActivation.test.ts

@@ -7,7 +7,7 @@ const activationConsumePath = '/home/user/account/activation/consume';
 const activationConsumerUrl = 'https://account.example.test/home/user/activation';
 const activationConsumerUrlAdmin = 'https://account.example.test/admin/home/user/activation';
 
-describe('accountActivation.test.ts', { concurrency: false, sequential: true }, () => {
+describe('accountActivation.test.ts', { concurrency: false }, () => {
   const releases: Array<() => void> = [];
   let restoreConfig: (() => void) | undefined;
 
@@ -211,6 +211,7 @@ async function configureActivation() {
   return await app.bean.executor.mockCtx(async () => {
     const options =
       app.bean.onion.middlewareSystem.getOnionSlice('a-security:cors').beanOptions.options;
+    assert.ok(options);
     const whiteListPrevious = options.whiteList;
     options.whiteList = ['https://account.example.test'];
     return () => {

package/vona/src/suite/a-home/modules/home-user/test/accountOpenapi.test.ts

@@ -1,3 +1,11 @@
+import type {
+  OpenAPIObject,
+  OperationObject,
+  ReferenceObject,
+  SchemaObject,
+} from 'openapi3-ts/oas31';
+import type { ISchemaObjectExtensionField } from 'vona-module-a-openapi';
+
 import assert from 'node:assert';
 import { describe, it } from 'node:test';
 import { app } from 'vona-mock';
@@ -59,44 +67,23 @@ describe('accountOpenapi.test.ts', () => {
         assert.deepEqual(operation.tags, ['HomeUserAccount']);
         assert.equal(!operation.security, expectation.isPublic);
         if (['issuePasswordSetLink', 'requestPasswordReset'].includes(expectation.action)) {
-          assert.ok(operation.requestBody);
-          const schema = (
-            operation.requestBody as { content?: { 'application/json'?: { schema?: any } } }
-          ).content?.['application/json']?.schema;
-          assert.ok(schema);
-          const schemaRef = (schema as { $ref?: string }).$ref;
-          assert.ok(schemaRef);
-          const schemaName = schemaRef.replace('#/components/schemas/', '');
-          const schemaResolved = doc.components?.schemas?.[schemaName];
-          assert.ok(schemaResolved);
+          const schemaResolved = requestSchema(doc, operation);
           assert.ok(schemaResolved.properties?.consumerUrl);
           assert.ok(schemaResolved.required?.includes('consumerUrl'));
           if (expectation.action === 'issuePasswordSetLink') {
-            assert.equal(schemaResolved.properties?.email?.format, 'email');
+            assert.equal(inlineSchema(schemaResolved.properties?.email).format, 'email');
             assert.ok(schemaResolved.required?.includes('email'));
           }
         }
         if (expectation.action === 'consumeActivation') {
-          const schema = (
-            operation.requestBody as { content?: { 'application/json'?: { schema?: any } } }
-          ).content?.['application/json']?.schema;
-          const schemaRef = (schema as { $ref?: string })?.$ref;
-          assert.ok(schemaRef);
-          const schemaName = schemaRef.replace('#/components/schemas/', '');
-          const schemaResolved = doc.components?.schemas?.[schemaName];
+          const schemaResolved = requestSchema(doc, operation);
           assert.deepEqual(Object.keys(schemaResolved?.properties ?? {}), ['token']);
           assert.deepEqual(schemaResolved?.required, ['token']);
-          assert.equal(schemaResolved?.properties?.token?.minLength, 32);
-          assert.equal(schemaResolved?.properties?.token?.maxLength, 255);
+          assert.equal(inlineSchema(schemaResolved.properties?.token).minLength, 32);
+          assert.equal(inlineSchema(schemaResolved.properties?.token).maxLength, 255);
         }
         if (expectation.action === 'changePassword') {
-          const schema = (
-            operation.requestBody as { content?: { 'application/json'?: { schema?: any } } }
-          ).content?.['application/json']?.schema;
-          const schemaRef = (schema as { $ref?: string })?.$ref;
-          assert.ok(schemaRef);
-          const schemaName = schemaRef.replace('#/components/schemas/', '');
-          const schemaResolved = doc.components?.schemas?.[schemaName];
+          const schemaResolved = requestSchema(doc, operation);
           assert.deepEqual(Object.keys(schemaResolved?.properties ?? {}), [
             'currentPassword',
             'newPassword',
@@ -112,23 +99,19 @@ describe('accountOpenapi.test.ts', () => {
             ['newPassword', 'home-user::NewPassword'],
             ['passwordConfirm', 'home-user::PasswordConfirm'],
           ]) {
-            const property = schemaResolved?.properties?.[field];
+            const property = inlineSchema(schemaResolved.properties?.[field]);
             assert.equal(property?.title?.toString(), title);
             assert.equal(property?.minLength, 6);
             assert.equal(property?.maxLength, 20);
             assert.equal(property?.rest?.form?.render, 'basic-input:formFieldInput');
-            assert.deepEqual(property?.rest?.form?.options, { type: 'password' });
+            const form = property.rest?.form;
+            assert.ok(form && 'options' in form);
+            assert.deepEqual(form.options, { type: 'password' });
             assert.equal(property?.rest?.form?.required, true);
           }
         }
         if (expectation.action === 'updateProfile') {
-          const schema = (
-            operation.requestBody as { content?: { 'application/json'?: { schema?: any } } }
-          ).content?.['application/json']?.schema;
-          const schemaRef = (schema as { $ref?: string })?.$ref;
-          assert.ok(schemaRef);
-          const schemaName = schemaRef.replace('#/components/schemas/', '');
-          const schemaResolved = doc.components?.schemas?.[schemaName];
+          const schemaResolved = requestSchema(doc, operation);
           assert.deepEqual(Object.keys(schemaResolved?.properties ?? {}), [
             'name',
             'avatar',
@@ -142,13 +125,19 @@ describe('accountOpenapi.test.ts', () => {
             ['locale', 'home-user::AccountLocale'],
             ['tz', 'home-user::AccountTimezone'],
           ]) {
-            assert.equal(schemaResolved?.properties?.[field]?.title?.toString(), title);
+            assert.equal(inlineSchema(schemaResolved.properties?.[field]).title?.toString(), title);
           }
-          assert.equal(schemaResolved?.properties?.name?.minLength, 1);
-          assert.equal(schemaResolved?.properties?.name?.maxLength, 100);
-          assert.deepEqual(schemaResolved?.properties?.avatar?.type, ['string', 'null']);
-          assert.deepEqual(schemaResolved?.properties?.locale?.type, ['string', 'null']);
-          assert.deepEqual(schemaResolved?.properties?.tz?.type, ['string', 'null']);
+          assert.equal(inlineSchema(schemaResolved.properties?.name).minLength, 1);
+          assert.equal(inlineSchema(schemaResolved.properties?.name).maxLength, 100);
+          assert.deepEqual(inlineSchema(schemaResolved.properties?.avatar).type, [
+            'string',
+            'null',
+          ]);
+          assert.deepEqual(inlineSchema(schemaResolved.properties?.locale).type, [
+            'string',
+            'null',
+          ]);
+          assert.deepEqual(inlineSchema(schemaResolved.properties?.tz).type, ['string', 'null']);
           assert.equal(schemaResolved?.properties?.avatarImageId, undefined);
           assert.equal(schemaResolved?.properties?.avatarFileId, undefined);
         }
@@ -156,3 +145,25 @@ describe('accountOpenapi.test.ts', () => {
     });
   });
 });
+
+function inlineSchema(
+  schema: ReferenceObject | SchemaObject | undefined,
+): ISchemaObjectExtensionField {
+  assert.ok(schema);
+  assert.ok(!('$ref' in schema));
+  return schema;
+}
+
+function requestSchema(
+  doc: OpenAPIObject,
+  operation: OperationObject,
+): ISchemaObjectExtensionField {
+  const body = operation.requestBody;
+  assert.ok(body);
+  assert.ok(!('$ref' in body));
+  const schema = body.content['application/json']?.schema;
+  assert.ok(schema && '$ref' in schema);
+  assert.ok(typeof schema.$ref === 'string');
+  const schemaName = schema.$ref.replace('#/components/schemas/', '');
+  return inlineSchema(doc.components?.schemas?.[schemaName]);
+}

package/vona/src/suite/a-home/modules/home-user/test/accountPasswordReset.test.ts

@@ -521,6 +521,7 @@ async function configurePasswordReset(
   return await app.bean.executor.mockCtx(async () => {
     const options =
       app.bean.onion.middlewareSystem.getOnionSlice('a-security:cors').beanOptions.options;
+    assert.ok(options);
     const whiteListPrevious = options.whiteList;
     options.whiteList = Array.isArray(whiteList) ? [...whiteList] : whiteList;
     return () => {