jinaga-server 3.5.5 → 3.7.0

package/src/jinaga-server.ts

@@ -5,7 +5,9 @@ import {
     AuthorizationNoOp,
     AuthorizationRules,
     DistributionRules,
+    FactFeed,
     FactManager,
+    FactReference,
     FeedCache,
     FetchConnection,
     Fork,
@@ -20,6 +22,7 @@ import {
     PassThroughFork,
     PersistentFork,
     PurgeConditions,
+    ReferencesByName,
     Specification,
     Storage,
     SyncStatusNotifier,
@@ -33,7 +36,8 @@ import { Pool } from "pg";
 
 import { AuthenticationDevice } from "./authentication/authentication-device";
 import { AuthenticationSession } from "./authentication/authentication-session";
-import { AuthorizationKeystore } from "./authorization/authorization-keystore";
+import { AuthorizationKeystore, DistributionBranchesResult, FeedResult, SubscriptionAuthorizer } from "./authorization/authorization-keystore";
+import { FeedStreamSessionConfig } from "./feeds/feed-stream-session";
 import { HttpRouter, RequestUser } from "./http/router";
 import { Keystore } from "./keystore";
 import { PostgresKeystore } from "./postgres/postgres-keystore";
@@ -53,7 +57,13 @@ export type JinagaServerConfig = {
     authorization?: (a: AuthorizationRules) => AuthorizationRules,
     distribution?: (d: DistributionRules) => DistributionRules,
     purgeConditions?: (p: PurgeConditions) => PurgeConditions,
-    origin?: string | string[] | ((origin: string, callback: (err: Error | null, allow?: boolean) => void) => void)
+    origin?: string | string[] | ((origin: string, callback: (err: Error | null, allow?: boolean) => void) => void),
+    /**
+     * Tuning for the per-connection feed streaming session
+     * (/feeds/:hash with Accept: application/x-jinaga-feed-stream).
+     * See FeedStreamSessionConfig for the available limits and defaults.
+     */
+    feedStream?: Partial<FeedStreamSessionConfig>
 };
 
 export type JinagaServerInstance = {
@@ -88,7 +98,7 @@ export class JinagaServer {
         const purgeConditions = createPurgeConditions(config);
         const factManager = new FactManager(fork, source, store, network, purgeConditions);
         const authorization = createAuthorization(authorizationRules, distributionRules, factManager, store, keystore);
-        const router = new HttpRouter(factManager, authorization, feedCache, config.origin || '*');
+        const router = new HttpRouter(factManager, authorization, feedCache, config.origin || '*', config.feedStream || {});
         const j: Jinaga = new Jinaga(authentication, factManager, syncStatusNotifier);
 
         async function close() {
@@ -186,13 +196,43 @@ function createKeystore(config: JinagaServerConfig, pools: { [uri: string]: Pool
     }
 }
 
-function createAuthorization(authorizationRules: AuthorizationRules | null, distributionRules: DistributionRules | null, factManager: FactManager, store: Storage, keystore: Keystore | null): Authorization {
+class AuthorizationNoOpWithSubscriptions extends AuthorizationNoOp implements SubscriptionAuthorizer {
+    async verifyDistributionOrIntersect(
+        _userIdentity: UserIdentity | null,
+        specification: Specification,
+        namedStart: ReferencesByName
+    ): Promise<DistributionBranchesResult> {
+        const start = specification.given.map(g => namedStart[g.label.name]);
+        return { type: "success", branches: [{ start, specification }] };
+    }
+
+    feedPreVerified(
+        userIdentity: UserIdentity | null,
+        specification: Specification,
+        start: FactReference[],
+        bookmark: string
+    ): Promise<FactFeed> {
+        return this.feed(userIdentity!, specification, start, bookmark);
+    }
+
+    async feedWithDistribution(
+        userIdentity: UserIdentity | null,
+        specification: Specification,
+        start: FactReference[],
+        bookmark: string
+    ): Promise<FeedResult> {
+        const feed = await this.feed(userIdentity!, specification, start, bookmark);
+        return { type: "success", feed };
+    }
+}
+
+function createAuthorization(authorizationRules: AuthorizationRules | null, distributionRules: DistributionRules | null, factManager: FactManager, store: Storage, keystore: Keystore | null): Authorization & SubscriptionAuthorizer {
     if (keystore) {
         const authorization = new AuthorizationKeystore(factManager, store, keystore, authorizationRules, distributionRules);
         return authorization;
     }
     else {
-        return new AuthorizationNoOp(factManager, store);
+        return new AuthorizationNoOpWithSubscriptions(factManager, store);
     }
 }
 

package/src/memory/memory-keystore.ts

@@ -75,6 +75,6 @@ export class MemoryKeystore implements Keystore {
     private generateKeyPair(key: string) {
         const keyPair = generateKeyPair();
         this.keyPairs[key] = keyPair;
-        return keyPair.privatePem;
+        return keyPair.publicPem;
     }
 }

package/src/postgres/query-description.ts

@@ -116,6 +116,40 @@ export class QueryDescription {
         }
     }
 
+    public withInputOnExistingFact(label: Label, factTypeId: number, factHash: string, factIndex: number, path: number[]): QueryDescription {
+        const factTypeParameter = this.parameters.length + 1;
+        const factHashParameter = factTypeParameter + 1;
+        const input: InputDescription = {
+            label: label.name,
+            type: label.type,
+            factIndex,
+            factTypeParameter,
+            factHashParameter
+        };
+        const parameters = this.parameters.concat(factTypeId, factHash);
+        if (path.length === 0) {
+            return new QueryDescription(
+                [...this.inputs, input],
+                parameters,
+                this.outputs,
+                this.facts,
+                this.edges,
+                this.existentialConditions
+            );
+        }
+        else {
+            const existentialConditions = existentialsWithInput(this.existentialConditions, input, path);
+            return new QueryDescription(
+                this.inputs,
+                parameters,
+                this.outputs,
+                this.facts,
+                this.edges,
+                existentialConditions
+            );
+        }
+    }
+
     public withFact(type: string): { query: QueryDescription; factIndex: number; } {
         const factIndex = this.facts.length + 1;
         const fact = { factIndex, type };
@@ -327,17 +361,38 @@ export class QueryDescriptionBuilder {
             if (!factTypeId) {
                 return { queryDescription: QueryDescription.unsatisfiable, knownFacts };
             }
-            const { queryDescription: newQueryDescription, factDescription } = queryDescription.withInputParameter(
-                given[givenIndex],
-                factTypeId,
-                start[givenIndex].hash,
-                path
-            );
-            queryDescription = newQueryDescription;
-            knownFacts = {
-                ...knownFacts,
-                [condition.labelRight]: factDescription
-            };
+            // When this is an identity path condition (no roles on either side)
+            // and the unknown has already been allocated, unify the given with
+            // the existing fact: register the type+hash filter on the existing
+            // factIndex rather than allocating a disconnected fact node.
+            const existingUnknown = knownFacts[unknown.name];
+            const isIdentity = condition.rolesLeft.length === 0 && condition.rolesRight.length === 0;
+            if (isIdentity && existingUnknown) {
+                queryDescription = queryDescription.withInputOnExistingFact(
+                    given[givenIndex],
+                    factTypeId,
+                    start[givenIndex].hash,
+                    existingUnknown.factIndex,
+                    path
+                );
+                knownFacts = {
+                    ...knownFacts,
+                    [condition.labelRight]: existingUnknown
+                };
+            }
+            else {
+                const { queryDescription: newQueryDescription, factDescription } = queryDescription.withInputParameter(
+                    given[givenIndex],
+                    factTypeId,
+                    start[givenIndex].hash,
+                    path
+                );
+                queryDescription = newQueryDescription;
+                knownFacts = {
+                    ...knownFacts,
+                    [condition.labelRight]: factDescription
+                };
+            }
         }
 
         // Determine whether we have already written the output.

package/src/postgres/specification-sql.ts

@@ -140,7 +140,13 @@ function generateNotExistsWhereClause(schema: string, notExistsWhereClause: Exis
     }
     const tailJoins: string[] = generateJoins(schema, notExistsWhereClause.edges.slice(1), writtenFactIndexes);
     const joins = firstJoin.concat(tailJoins);
-    return `SELECT 1 FROM ${schema}.edge e${firstEdge.edgeIndex}${joins.join("")} WHERE ${whereClause.join(" AND ")}`;
+    const inputWhereClauses = notExistsWhereClause.inputs
+        .map(input => ` AND f${input.factIndex}.fact_type_id = $${input.factTypeParameter} AND f${input.factIndex}.hash = $${input.factHashParameter}`)
+        .join("");
+    const nestedExistsWhereClauses = notExistsWhereClause.existentialConditions
+        .map(nested => ` AND ${nested.exists ? "EXISTS" : "NOT EXISTS"} (${generateNotExistsWhereClause(schema, nested, writtenFactIndexes)})`)
+        .join("");
+    return `SELECT 1 FROM ${schema}.edge e${firstEdge.edgeIndex}${joins.join("")} WHERE ${whereClause.join(" AND ")}${inputWhereClauses}${nestedExistsWhereClauses}`;
 }
 
 function parseBookmark(bookmark: string): number[] {

package/test/authorization/intermediateProjectionFeedSpec.ts

@@ -0,0 +1,189 @@
+import {
+    AuthorizationRules,
+    buildModel,
+    dehydrateFact,
+    DistributionRules,
+    FactManager,
+    Forbidden,
+    MemoryStore,
+    NetworkNoOp,
+    ObservableSource,
+    PassThroughFork,
+    User
+} from "jinaga";
+
+import { AuthorizationKeystore } from "../../src/authorization/authorization-keystore";
+import { MemoryKeystore } from "../../src/memory/memory-keystore";
+
+// Integration coverage for jinaga issue #204: a distribution rule whose
+// `.select()` projection traverses *through* an intermediate fact (here
+// `Finalist`, used only to reach the `competitor` it projects) must authorize an
+// authorized user's direct query for that intermediate fact. The same
+// DistributionEngine that JinagaTest uses also backs this server-side
+// authorization path (`AuthorizationKeystore.read` -> `canDistributeToAll`,
+// constructed with isTest=false), so the behavior must match.
+//
+// The sub-feed authorization relaxation this exercises landed in jinaga 6.8.2.
+
+class Tenant {
+    public static Type = "Tenant" as const;
+    public type = Tenant.Type;
+    constructor(public creator: User) { }
+}
+
+class Administrator {
+    public static Type = "Administrator" as const;
+    public type = Administrator.Type;
+    constructor(public tenant: Tenant, public user: User, public createdAt: Date | string) { }
+}
+
+class Event {
+    public static Type = "Event" as const;
+    public type = Event.Type;
+    constructor(public tenant: Tenant, public id: string) { }
+}
+
+class Competitor {
+    public static Type = "Competitor" as const;
+    public type = Competitor.Type;
+    constructor(public tenant: Tenant) { }
+}
+
+// Finalist is the intermediate: the projection joins Event -> Finalist only to
+// reach the Competitor predecessor; Finalist is never a named component.
+class Finalist {
+    public static Type = "Finalist" as const;
+    public type = Finalist.Type;
+    constructor(public competitor: Competitor, public event: Event) { }
+}
+
+class CompetitorName {
+    public static Type = "CompetitorName" as const;
+    public type = CompetitorName.Type;
+    constructor(public competitor: Competitor, public value: string, public prior: CompetitorName[]) { }
+}
+
+const model = buildModel(b => b
+    .type(User)
+    .type(Tenant, m => m.predecessor("creator", User))
+    .type(Administrator, m => m
+        .predecessor("tenant", Tenant)
+        .predecessor("user", User))
+    .type(Event, m => m.predecessor("tenant", Tenant))
+    .type(Competitor, m => m.predecessor("tenant", Tenant))
+    .type(Finalist, m => m
+        .predecessor("competitor", Competitor)
+        .predecessor("event", Event))
+    .type(CompetitorName, m => m
+        .predecessor("competitor", Competitor)
+        .predecessor("prior", CompetitorName))
+);
+
+const finalistsOfEvent = model.given(Event).match((event, facts) =>
+    facts.ofType(Finalist).join(finalist => finalist.event, event)
+).specification;
+
+const subscriberIdentity = { provider: "mock", id: "subscriber" };
+const creatorIdentity = { provider: "mock", id: "creator" };
+
+describe("AuthorizationKeystore.read with intermediate projection facts (jinaga #204)", () => {
+    it("authorizes an administrator's direct query for an intermediate projection fact", async () => {
+        const setup = await givenAuthorization(/* subscriberIsAdmin */ true);
+
+        const eventRef = dehydrateFact(setup.event).find(f => f.type === Event.Type)!;
+
+        // Should resolve (not throw Forbidden) and return the seeded finalist.
+        const results = await setup.authorization.read(
+            subscriberIdentity, [eventRef], finalistsOfEvent);
+
+        expect(results).toHaveLength(1);
+    });
+
+    it("still denies a non-administrator's direct query for the same fact", async () => {
+        const setup = await givenAuthorization(/* subscriberIsAdmin */ false);
+
+        const eventRef = dehydrateFact(setup.event).find(f => f.type === Event.Type)!;
+
+        // Assert the specific authorization denial, not just any error, so a
+        // setup/engine failure can't masquerade as a passing regression guard.
+        const read = setup.authorization.read(subscriberIdentity, [eventRef], finalistsOfEvent);
+        await expect(read).rejects.toThrow(Forbidden);
+        await expect(read).rejects.toThrow(/Cannot distribute/);
+    });
+});
+
+async function givenAuthorization(subscriberIsAdmin: boolean) {
+    const storage = new MemoryStore();
+    const keystore = new MemoryKeystore();
+
+    const subscriberFact = await keystore.getOrCreateUserFact(subscriberIdentity);
+    const creatorFact = await keystore.getOrCreateUserFact(creatorIdentity);
+    const subscriber = new User(subscriberFact.fields.publicKey);
+    const creator = new User(creatorFact.fields.publicKey);
+
+    const tenant = new Tenant(creator);
+    const event = new Event(tenant, "event-id");
+    const competitor = new Competitor(tenant);
+    const finalist = new Finalist(competitor, event);
+
+    const facts = [
+        ...dehydrateFact(subscriber),
+        ...dehydrateFact(creator),
+        ...dehydrateFact(event),
+        ...dehydrateFact(competitor),
+        ...dehydrateFact(finalist)
+    ];
+    if (subscriberIsAdmin) {
+        const administrator = new Administrator(tenant, subscriber, new Date("2024-01-01"));
+        facts.push(...dehydrateFact(administrator));
+    }
+
+    // Dedupe by hash+type to avoid double-saving shared predecessors.
+    const seenKeys = new Set<string>();
+    const uniqueFacts = facts.filter(f => {
+        const k = `${f.type}|${f.hash}`;
+        if (seenKeys.has(k)) return false;
+        seenKeys.add(k);
+        return true;
+    });
+    await storage.save(uniqueFacts.map(f => ({ fact: f, signatures: [] })));
+
+    const fork = new PassThroughFork(storage);
+    const observable = new ObservableSource(storage);
+    const network = new NetworkNoOp();
+    const factManager = new FactManager(fork, observable, storage, network, []);
+
+    const authorizationRules = new AuthorizationRules(model)
+        .no(User)
+        .any(Tenant)
+        .any(Administrator)
+        .any(Event)
+        .any(Competitor)
+        .any(Finalist)
+        .any(CompetitorName);
+
+    const distributionRules = new DistributionRules([])
+        .share(model.given(Event).select((event, facts) => ({
+            // Finalist is only a traversal step toward the competitor projection.
+            finalists: facts.ofType(Finalist)
+                .join(finalist => finalist.event, event)
+                .selectMany(finalist => finalist.competitor.predecessor()
+                    .select(competitor => ({
+                        competitorNames: facts.ofType(CompetitorName)
+                            .join(name => name.competitor, competitor)
+                            .notExists(name => facts.ofType(CompetitorName)
+                                .join(next => next.prior, name)
+                            )
+                    }))
+                )
+        })))
+        .with(model.given(Event).match((event, facts) =>
+            facts.ofType(Administrator)
+                .join(a => a.tenant, event.tenant)
+                .selectMany(a => facts.ofType(User).join(u => u, a.user))
+        ));
+
+    const authorization = new AuthorizationKeystore(
+        factManager, storage, keystore, authorizationRules, distributionRules);
+    return { authorization, event };
+}

package/test/authorization/subscriptionIntersectionSpec.ts

@@ -0,0 +1,220 @@
+import {
+    AuthorizationRules,
+    buildModel,
+    dehydrateFact,
+    DistributionRules,
+    FactManager,
+    MemoryStore,
+    NetworkNoOp,
+    ObservableSource,
+    PassThroughFork,
+    ReferencesByName,
+    User
+} from "jinaga";
+
+import { AuthorizationKeystore } from "../../src/authorization/authorization-keystore";
+import { MemoryKeystore } from "../../src/memory/memory-keystore";
+
+class Company {
+    public static Type = "Company" as const;
+    public type = Company.Type;
+    constructor(public creator: User, public name: string) { }
+}
+
+class Office {
+    public static Type = "Office" as const;
+    public type = Office.Type;
+    constructor(public company: Company, public name: string) { }
+}
+
+class Administrator {
+    public static Type = "Administrator" as const;
+    public type = Administrator.Type;
+    constructor(public company: Company, public user: User, public createdAt: Date | string) { }
+}
+
+const model = buildModel(b => b
+    .type(User)
+    .type(Company, m => m.predecessor("creator", User))
+    .type(Office, m => m.predecessor("company", Company))
+    .type(Administrator, m => m
+        .predecessor("company", Company)
+        .predecessor("user", User))
+);
+
+const subscriberIdentity = { provider: "mock", id: "subscriber" };
+const creatorIdentity = { provider: "mock", id: "creator" };
+
+describe("AuthorizationKeystore.verifyDistributionOrIntersect", () => {
+    it("returns the original spec when the user is already authorized", async () => {
+        const setup = await givenAuthorizationWithDistribution(true, async (subscriber, creator) => {
+            const company = new Company(creator, "Acme");
+            const admin = new Administrator(company, subscriber, new Date("2026-05-26"));
+            return { company, admin };
+        });
+
+        const officeSpec = model.given(Company).match((c, facts) =>
+            facts.ofType(Office).join(o => o.company, c)
+        ).specification;
+        const companyRef = dehydrateFact(setup.seeded.company)
+            .find(f => f.type === Company.Type)!;
+        const namedStart: ReferencesByName = { [officeSpec.given[0].label.name]: companyRef };
+
+        const result = await setup.authorization.verifyDistributionOrIntersect(
+            subscriberIdentity, officeSpec, namedStart);
+
+        expect(result.type).toBe("success");
+        if (result.type !== "success") return;
+        expect(result.branches).toHaveLength(1);
+        expect(result.branches[0].specification).toBe(officeSpec);
+        expect(result.branches[0].start).toEqual([companyRef]);
+        // Pass-through authorized: no engine denial is carried.
+        expect(result.denial).toBeUndefined();
+    });
+
+    it("returns intersected branches when the user is not yet authorized", async () => {
+        const setup = await givenAuthorizationWithDistribution(true, async (subscriber, creator) => {
+            const company = new Company(creator, "Acme");
+            // No Administrator yet — subscriber is not authorized.
+            return { company };
+        });
+
+        const officeSpec = model.given(Company).match((c, facts) =>
+            facts.ofType(Office).join(o => o.company, c)
+        ).specification;
+        const companyRef = dehydrateFact(setup.seeded.company)
+            .find(f => f.type === Company.Type)!;
+        const namedStart: ReferencesByName = { [officeSpec.given[0].label.name]: companyRef };
+
+        const result = await setup.authorization.verifyDistributionOrIntersect(
+            subscriberIdentity, officeSpec, namedStart);
+
+        // Intersection produced an alternate branch that lifts the rule's
+        // user-spec into the subscription. The intersected spec has an
+        // additional synthetic given and a different shape than the original.
+        expect(result.type).toBe("success");
+        if (result.type !== "success") return;
+        expect(result.branches.length).toBeGreaterThanOrEqual(1);
+        expect(result.branches[0].specification).not.toBe(officeSpec);
+        expect(result.branches[0].specification.given.length).toBe(2);
+        // The synthetic given is bound to the subscriber's user fact.
+        expect(result.branches[0].start[1]).toEqual({
+            type: setup.subscriberFact.type,
+            hash: setup.subscriberFact.hash
+        });
+        // Authorized-via-intersection (reactive) carries the engine failure
+        // that triggered it: the authenticated subscriber is excluded until
+        // the authorizing Administrator fact arrives.
+        expect(result.denial).toBeDefined();
+        expect(result.denial?.code).toBe("principal-excluded");
+        expect(result.denial?.reason).toBeTruthy();
+    });
+
+    it("returns denied when no distribution rule applies to the spec", async () => {
+        const setup = await givenAuthorizationWithDistribution(true, async (_subscriber, creator) => {
+            const company = new Company(creator, "Acme");
+            return { company };
+        });
+
+        // A spec the rule doesn't cover at all (different fact type).
+        const unrelatedSpec = model.given(Company).match((c, facts) =>
+            facts.ofType(Administrator).join(a => a.company, c)
+        ).specification;
+        const companyRef = dehydrateFact(setup.seeded.company)
+            .find(f => f.type === Company.Type)!;
+        const namedStart: ReferencesByName = { [unrelatedSpec.given[0].label.name]: companyRef };
+
+        const result = await setup.authorization.verifyDistributionOrIntersect(
+            subscriberIdentity, unrelatedSpec, namedStart);
+
+        expect(result.type).toBe("denied");
+        if (result.type !== "denied") return;
+        expect(result.reason).toBeTruthy();
+        // No rule covers this spec at all.
+        expect(result.code).toBe("no-matching-rule");
+    });
+
+    it("returns a passthrough branch when there are no distribution rules at all", async () => {
+        const setup = await givenAuthorizationWithDistribution(false, async (_subscriber, creator) => {
+            const company = new Company(creator, "Acme");
+            return { company };
+        });
+
+        const officeSpec = model.given(Company).match((c, facts) =>
+            facts.ofType(Office).join(o => o.company, c)
+        ).specification;
+        const companyRef = dehydrateFact(setup.seeded.company)
+            .find(f => f.type === Company.Type)!;
+        const namedStart: ReferencesByName = { [officeSpec.given[0].label.name]: companyRef };
+
+        const result = await setup.authorization.verifyDistributionOrIntersect(
+            subscriberIdentity, officeSpec, namedStart);
+
+        expect(result.type).toBe("success");
+        if (result.type !== "success") return;
+        expect(result.branches).toHaveLength(1);
+        expect(result.branches[0].specification).toBe(officeSpec);
+        // No distribution engine, so nothing is denied — pure pass-through.
+        expect(result.denial).toBeUndefined();
+    });
+});
+
+async function givenAuthorizationWithDistribution<T extends Record<string, any>>(
+    withDistributionRules: boolean,
+    buildFacts: (subscriber: User, creator: User) => Promise<T>
+) {
+    const storage = new MemoryStore();
+    const keystore = new MemoryKeystore();
+
+    const subscriberFact = await keystore.getOrCreateUserFact(subscriberIdentity);
+    const creatorFact = await keystore.getOrCreateUserFact(creatorIdentity);
+    const subscriber = new User(subscriberFact.fields.publicKey);
+    const creator = new User(creatorFact.fields.publicKey);
+
+    const seeded = await buildFacts(subscriber, creator);
+    const facts = [
+        ...dehydrateFact(subscriber),
+        ...dehydrateFact(creator),
+        ...Object.values(seeded).flatMap(v => dehydrateFact(v))
+    ];
+    // Dedupe by hash+type to avoid double-saving the shared predecessors.
+    const seenKeys = new Set<string>();
+    const uniqueFacts = facts.filter(f => {
+        const k = `${f.type}|${f.hash}`;
+        if (seenKeys.has(k)) return false;
+        seenKeys.add(k);
+        return true;
+    });
+    await storage.save(uniqueFacts.map(f => ({ fact: f, signatures: [] })));
+
+    const fork = new PassThroughFork(storage);
+    const observable = new ObservableSource(storage);
+    const network = new NetworkNoOp();
+    const factManager = new FactManager(fork, observable, storage, network, []);
+
+    const authorizationRules = new AuthorizationRules(model)
+        .no(User)
+        .any(Company)
+        .any(Office)
+        .any(Administrator);
+
+    const distributionRules = withDistributionRules
+        ? new DistributionRules([])
+            .share(model.given(Company).match((c, facts) =>
+                facts.ofType(Office).join(o => o.company, c)
+            ))
+            .with(model.given(Company).match((c, facts) =>
+                facts.ofType(Administrator)
+                    .join(a => a.company, c)
+                    .selectMany(a => facts.ofType(User).join(u => u, a.user))
+            ))
+        : null;
+
+    const authorization = new AuthorizationKeystore(
+        factManager, storage, keystore, authorizationRules, distributionRules);
+    return {
+        authorization,
+        subscriberFact,
+        seeded: seeded as T & { company: Company }
+    };
+}