@bevel-software/platform-core-backend 0.15.1 → 0.19.0

package/src/modules/access/__tests__/creator-access.test.ts

@@ -1,4 +1,5 @@
 import { describe, it, expect, beforeEach, afterEach } from 'vitest';
+import { NodeFs } from '../../kb-fs/node-fs.js';
 import fs from 'node:fs/promises';
 import path from 'node:path';
 import os from 'node:os';
@@ -35,9 +36,17 @@ function stubWorkspaceService(workspaceDir: string): WorkspaceService {
     },
     readFile: async (_id: string, wsRel: string) =>
       fs.readFile(path.join(workspaceDir, wsRel), 'utf-8'),
+    readFileBinary: async (_id: string, wsRel: string) => fs.readFile(path.join(workspaceDir, wsRel)),
   } as unknown as WorkspaceService;
 }
 
+/**
+ * The creator grant covers ONE creation: a new folder directly under one of
+ * the three roots, by someone the root does not let read. Everything else is
+ * the read-before-write gate's business (`change-read-gate.test.ts`): a
+ * creation the creator cannot see is refused there, and one they can see
+ * inherits its folder's rules and needs no grant.
+ */
 describe('CreatorAccessService.planForCreate', () => {
   let root: string;
   let repo: string;
@@ -48,9 +57,11 @@ describe('CreatorAccessService.planForCreate', () => {
     const workspaceDir = path.join(root, WS);
     repo = path.join(workspaceDir, KB);
     await fs.mkdir(path.join(repo, 'KnowledgeBase'), { recursive: true });
+    await fs.mkdir(path.join(repo, 'Skills'), { recursive: true });
+    await fs.mkdir(path.join(repo, 'Plugins'), { recursive: true });
     await write(repo, 'roles.yaml', ROLES_YAML);
     const ws = stubWorkspaceService(workspaceDir);
-    svc = new CreatorAccessService(ws, new AccessControlService(ws, KB), KB);
+    svc = new CreatorAccessService(ws, new AccessControlService(ws, KB, new NodeFs()), KB, new NodeFs());
   });
 
   afterEach(async () => {
@@ -59,40 +70,37 @@ describe('CreatorAccessService.planForCreate', () => {
 
   it('returns null when the creator can already read via the folder chain', async () => {
     await write(repo, 'KnowledgeBase/access.md', '---\nread:\n  - everyone\n---\n');
-    const plan = await svc.planForCreate(WS, ALICE, `${KB}/KnowledgeBase/note.md`, 'file');
+    const plan = await svc.planForCreate(WS, ALICE, `${KB}/KnowledgeBase/Projects`, 'dir');
     expect(plan).toBeNull();
   });
 
   it('a write grant folds into read — creating where you can write needs no grant', async () => {
     await write(repo, 'KnowledgeBase/access.md', '---\nwrite:\n  - Alice <alice@example.com>\n---\n');
-    const plan = await svc.planForCreate(WS, ALICE, `${KB}/KnowledgeBase/note.md`, 'file');
+    const plan = await svc.planForCreate(WS, ALICE, `${KB}/KnowledgeBase/Projects`, 'dir');
     expect(plan).toBeNull();
   });
 
-  it('a loose .md in a pre-existing unreadable folder gets a frontmatter grant', async () => {
-    const plan = await svc.planForCreate(WS, ALICE, `${KB}/KnowledgeBase/note.md`, 'file');
-    expect(plan?.kind).toBe('frontmatter');
-    if (plan?.kind !== 'frontmatter') return;
-    const granted = plan.apply('# Hello\n');
-    expect(granted).toBe('---\nread: Alice <alice@example.com>\n---\n# Hello\n');
-  });
-
-  it('frontmatter grant splices into existing frontmatter without touching the body', async () => {
-    const plan = await svc.planForCreate(WS, ALICE, `${KB}/KnowledgeBase/node.md`, 'file');
-    expect(plan?.kind).toBe('frontmatter');
-    if (plan?.kind !== 'frontmatter') return;
-    const granted = plan.apply('---\nnodeType: Process\n---\nBody\n');
-    expect(granted).toContain('nodeType: Process');
-    expect(granted).toContain('read: Alice <alice@example.com>');
-    expect(granted).toContain('Body');
-  });
-
-  it('a new folder gets its own access.md seeded, naming the creator under read:', async () => {
+  it('a new folder directly under a root gets its own access.md seeded, naming the creator under read:', async () => {
     const plan = await svc.planForCreate(WS, ALICE, `${KB}/KnowledgeBase/Projects`, 'dir');
     expect(plan?.kind).toBe('seed-access-md');
     if (plan?.kind !== 'seed-access-md') return;
     expect(plan.wsRelPath).toBe(`${KB}/KnowledgeBase/Projects/access.md`);
-    expect(plan.apply('')).toBe('---\nread:\n  - Alice <alice@example.com>\n---\n');
+    // The platform's two-block file: a comment-only frontmatter (the file
+    // follows the folder's rules), then the body that governs the folder,
+    // explained in place, with the creator's grant as its one rule.
+    const seeded = plan.apply('');
+    expect(seeded.startsWith('---\n# THIS BLOCK (the frontmatter) governs this access.md FILE only')).toBe(true);
+    expect(seeded).toContain('\n---\n# THIS BLOCK (the body) governs the FOLDER');
+    expect(seeded.endsWith('\nread:\n  - Alice <alice@example.com>\n')).toBe(true);
+  });
+
+  it('all three roots are creatable: skills and plugins seed the same way', async () => {
+    const skill = await svc.planForCreate(WS, ALICE, `${KB}/Skills/my-skill/SKILL.md`, 'file');
+    expect(skill?.kind).toBe('seed-access-md');
+    expect(skill?.wsRelPath).toBe(`${KB}/Skills/my-skill/access.md`);
+    const plugin = await svc.planForCreate(WS, ALICE, `${KB}/Plugins/team/mcp.json`, 'file');
+    expect(plugin?.kind).toBe('seed-access-md');
+    expect(plugin?.wsRelPath).toBe(`${KB}/Plugins/team/access.md`);
   });
 
   it('the seed MERGES into existing access.md text — a concurrent creator grant survives', async () => {
@@ -108,47 +116,81 @@ describe('CreatorAccessService.planForCreate', () => {
     expect(plan.apply(merged)).toBe(merged);
   });
 
-  it('a nested create seeds at the TOPMOST new directory, not the leaf', async () => {
+  it('a nested create seeds at the new TOP-LEVEL folder, not the leaf', async () => {
     const plan = await svc.planForCreate(WS, ALICE, `${KB}/KnowledgeBase/A/B/c.md`, 'file');
     expect(plan?.kind).toBe('seed-access-md');
     if (plan?.kind !== 'seed-access-md') return;
     expect(plan.wsRelPath).toBe(`${KB}/KnowledgeBase/A/access.md`);
   });
 
-  it('never targets a pre-existing directory: only new dirs are seeded', async () => {
+  it('plans nothing inside a folder that already exists — the read gate decides there', async () => {
     await fs.mkdir(path.join(repo, 'KnowledgeBase/Existing'), { recursive: true });
-    const plan = await svc.planForCreate(WS, ALICE, `${KB}/KnowledgeBase/Existing/new.md`, 'file');
-    // Existing dir → the grant must land in the file's own frontmatter, not
-    // Existing/access.md (that would leak read on all its siblings).
-    expect(plan?.kind).toBe('frontmatter');
+    expect(await svc.planForCreate(WS, ALICE, `${KB}/KnowledgeBase/Existing/new.md`, 'file')).toBeNull();
+    expect(await svc.planForCreate(WS, ALICE, `${KB}/KnowledgeBase/Existing/Sub`, 'dir')).toBeNull();
+  });
+
+  it('plans nothing for a loose file directly at a root — it has no folder to carry a grant', async () => {
+    expect(await svc.planForCreate(WS, ALICE, `${KB}/KnowledgeBase/note.md`, 'file')).toBeNull();
+    expect(await svc.planForCreate(WS, ALICE, `${KB}/KnowledgeBase/pic.png`, 'file')).toBeNull();
+  });
+
+  it('plans nothing through a link standing where the new folder would be', async () => {
+    // Dangling on purpose: a stat that followed it would say "nothing there".
+    await fs.symlink(path.join(root, 'elsewhere'), path.join(repo, 'KnowledgeBase/Linked'));
+    expect(await svc.planForCreate(WS, ALICE, `${KB}/KnowledgeBase/Linked/a.md`, 'file')).toBeNull();
+    expect(await svc.planForCreate(WS, ALICE, `${KB}/KnowledgeBase/Linked`, 'dir')).toBeNull();
+  });
+
+  it('plans nothing under a root that is not one of the three', async () => {
+    expect(await svc.planForCreate(WS, ALICE, `${KB}/Data/Engineering`, 'dir')).toBeNull();
+    expect(await svc.planForCreate(WS, ALICE, `${KB}/Elsewhere/Thing/a.md`, 'file')).toBeNull();
   });
 
   it('returns null for paths that already exist (an edit, not a create)', async () => {
-    await write(repo, 'KnowledgeBase/existing.md', 'x');
-    const plan = await svc.planForCreate(WS, ALICE, `${KB}/KnowledgeBase/existing.md`, 'file');
+    await write(repo, 'KnowledgeBase/Mine/existing.md', 'x');
+    const plan = await svc.planForCreate(WS, ALICE, `${KB}/KnowledgeBase/Mine/existing.md`, 'file');
     expect(plan).toBeNull();
   });
 
   it('returns null for access.md, roles.yaml, .gitkeep, and non-KB paths', async () => {
-    expect(await svc.planForCreate(WS, ALICE, `${KB}/KnowledgeBase/access.md`, 'file')).toBeNull();
+    expect(await svc.planForCreate(WS, ALICE, `${KB}/KnowledgeBase/New/access.md`, 'file')).toBeNull();
     expect(await svc.planForCreate(WS, ALICE, `${KB}/roles.yaml`, 'file')).toBeNull();
-    expect(await svc.planForCreate(WS, ALICE, `${KB}/KnowledgeBase/.gitkeep`, 'file')).toBeNull();
+    expect(await svc.planForCreate(WS, ALICE, `${KB}/KnowledgeBase/New/.gitkeep`, 'file')).toBeNull();
     expect(await svc.planForCreate(WS, ALICE, 'reserved-config.json', 'file')).toBeNull();
   });
 
-  it('returns null (never throws) for a non-markdown loose file in an existing folder', async () => {
-    const plan = await svc.planForCreate(WS, ALICE, `${KB}/KnowledgeBase/pic.png`, 'file');
-    expect(plan).toBeNull();
+  it('plans nothing when the probe for the new top-level folder fails — a failed probe is not "not there"', async () => {
+    // A disk that cannot say whether `KnowledgeBase/Projects` exists: planning
+    // on "not there" would seed a grant into a folder that may well exist.
+    const real = new NodeFs();
+    const failing = new Proxy(real, {
+      get(target, prop, receiver) {
+        if (prop !== 'lstatOrNull') return Reflect.get(target, prop, receiver) as unknown;
+        return async (abs: string) => {
+          if (abs.endsWith(path.join('KnowledgeBase', 'Projects'))) {
+            throw Object.assign(new Error('EACCES: permission denied'), { code: 'EACCES' });
+          }
+          return real.lstatOrNull(abs);
+        };
+      },
+    });
+    const ws = stubWorkspaceService(path.join(root, WS));
+    const withFailingDisk = new CreatorAccessService(ws, new AccessControlService(ws, KB, real), KB, failing);
+    expect(await withFailingDisk.planForCreate(WS, ALICE, `${KB}/KnowledgeBase/Projects`, 'dir')).toBeNull();
+    expect(await withFailingDisk.planForCreate(WS, ALICE, `${KB}/KnowledgeBase/Projects/a.md`, 'file')).toBeNull();
+    // The same creation on a disk that answers is planned, so it was the
+    // probe's failure and not the path that made the difference.
+    expect(await svc.planForCreate(WS, ALICE, `${KB}/KnowledgeBase/Projects`, 'dir')).not.toBeNull();
   });
 
   it('returns null (never throws) when the access config is unusable', async () => {
     await fs.rm(path.join(repo, 'roles.yaml'));
-    const plan = await svc.planForCreate(WS, ALICE, `${KB}/KnowledgeBase/note.md`, 'file');
+    const plan = await svc.planForCreate(WS, ALICE, `${KB}/KnowledgeBase/Projects`, 'dir');
     expect(plan).toBeNull();
   });
 
   it('sanitises a display name that would break the Name <email> entry shape', async () => {
-    const evil = { name: 'Al<ce # ', email: 'alice@example.com' };
+    const evil = { name: 'Al<ce # ', email: 'alice@example.com' };
     const plan = await svc.planForCreate(WS, evil, `${KB}/KnowledgeBase/Dir`, 'dir');
     expect(plan?.kind).toBe('seed-access-md');
     if (plan?.kind !== 'seed-access-md') return;
@@ -157,7 +199,7 @@ describe('CreatorAccessService.planForCreate', () => {
 
   it('the seeded grant makes the new folder readable — including via the batched tree check', async () => {
     const ws = stubWorkspaceService(path.join(root, WS));
-    const access = new AccessControlService(ws, KB);
+    const access = new AccessControlService(ws, KB, new NodeFs());
     const plan = await svc.planForCreate(WS, ALICE, `${KB}/KnowledgeBase/Mine`, 'dir');
     expect(plan?.kind).toBe('seed-access-md');
     if (plan?.kind !== 'seed-access-md') return;
@@ -170,48 +212,4 @@ describe('CreatorAccessService.planForCreate', () => {
     expect(batch.get('KnowledgeBase/Mine')).toBe(true);
     expect(batch.get('KnowledgeBase/Mine/anything.md')).toBe(true);
   });
-
-  it('the frontmatter grant makes a loose file readable via the FULL check', async () => {
-    const ws = stubWorkspaceService(path.join(root, WS));
-    const access = new AccessControlService(ws, KB);
-    const plan = await svc.planForCreate(WS, ALICE, `${KB}/KnowledgeBase/loose.md`, 'file');
-    expect(plan?.kind).toBe('frontmatter');
-    if (plan?.kind !== 'frontmatter') return;
-    await write(repo, 'KnowledgeBase/loose.md', plan.apply('# Loose\n'));
-    expect(await access.canRead(WS, ALICE.email, 'KnowledgeBase/loose.md')).toBe(true);
-  });
-});
-
-describe('CreatorAccessService.grantInExtractedFile', () => {
-  let root: string;
-  let repo: string;
-  let svc: CreatorAccessService;
-
-  beforeEach(async () => {
-    root = await mkTmpRoot();
-    const workspaceDir = path.join(root, WS);
-    repo = path.join(workspaceDir, KB);
-    await fs.mkdir(path.join(repo, 'KnowledgeBase'), { recursive: true });
-    await write(repo, 'roles.yaml', ROLES_YAML);
-    const ws = stubWorkspaceService(workspaceDir);
-    svc = new CreatorAccessService(ws, new AccessControlService(ws, KB), KB);
-  });
-
-  afterEach(async () => {
-    await fs.rm(root, { recursive: true, force: true });
-  });
-
-  it('splices the creator grant into an on-disk .md the creator cannot read', async () => {
-    await write(repo, 'KnowledgeBase/extracted.md', '# From zip\n');
-    const text = await svc.grantInExtractedFile(WS, ALICE, `${KB}/KnowledgeBase/extracted.md`);
-    expect(text).toBe('---\nread: Alice <alice@example.com>\n---\n# From zip\n');
-  });
-
-  it('returns null when the file is already readable, non-markdown, or non-KB', async () => {
-    await write(repo, 'KnowledgeBase/access.md', '---\nread:\n  - everyone\n---\n');
-    await write(repo, 'KnowledgeBase/extracted.md', '# From zip\n');
-    expect(await svc.grantInExtractedFile(WS, ALICE, `${KB}/KnowledgeBase/extracted.md`)).toBeNull();
-    expect(await svc.grantInExtractedFile(WS, ALICE, `${KB}/KnowledgeBase/pic.png`)).toBeNull();
-    expect(await svc.grantInExtractedFile(WS, ALICE, 'reserved.md')).toBeNull();
-  });
 });

package/src/modules/access/__tests__/grant-sources.test.ts

@@ -1,4 +1,5 @@
 import { describe, it, expect, beforeEach, afterEach } from 'vitest';
+import { NodeFs } from '../../kb-fs/node-fs.js';
 import fs from 'node:fs/promises';
 import path from 'node:path';
 import os from 'node:os';
@@ -50,7 +51,7 @@ describe('AccessControlService.grantSources', () => {
     repo = path.join(workspaceDir, PROCESS_MAP_DIR);
     await fs.mkdir(repo, { recursive: true });
     await writeFile(repo, 'roles.yaml', ROLES_YAML);
-    svc = new AccessControlService(stubWorkspaceService(workspaceId, workspaceDir), PROCESS_MAP_DIR);
+    svc = new AccessControlService(stubWorkspaceService(workspaceId, workspaceDir), PROCESS_MAP_DIR, new NodeFs());
   });
 
   afterEach(async () => {
@@ -218,7 +219,7 @@ describe('grantSources — principal kind under group shadowing', () => {
     // A GROUP named Engineer shadows the Engineer ROLE: the bare token is the
     // group's, `role/engineer` is the role's.
     await writeFile(repo, 'groups.yaml', 'groups:\n  Engineer:\n    - pat@x.io\n');
-    svc = new AccessControlService(stubWorkspaceService(workspaceId, workspaceDir), PROCESS_MAP_DIR);
+    svc = new AccessControlService(stubWorkspaceService(workspaceId, workspaceDir), PROCESS_MAP_DIR, new NodeFs());
   });
 
   afterEach(async () => {

package/src/modules/access/__tests__/groups-admin.service.test.ts

@@ -1,4 +1,5 @@
 import { describe, it, expect, beforeEach, afterEach } from 'vitest';
+import { NodeFs } from '../../kb-fs/node-fs.js';
 import fs from 'node:fs/promises';
 import path from 'node:path';
 import os from 'node:os';
@@ -106,7 +107,7 @@ describe('GroupsAdminService', () => {
     service = new GroupsAdminService(
       workspace,
       workflow.svc,
-      new AccessControlService(workspace as never, KB),
+      new AccessControlService(workspace as never, KB, new NodeFs()),
       KB,
       () => DEFAULT_BRANCH,
     );
@@ -301,7 +302,7 @@ describe('GroupsAdminService', () => {
     const svc = new GroupsAdminService(
       workspace,
       workflow.svc,
-      new AccessControlService(workspace as never, KB),
+      new AccessControlService(workspace as never, KB, new NodeFs()),
       KB,
       () => DEFAULT_BRANCH,
     );
@@ -347,7 +348,7 @@ describe('GroupsAdminService', () => {
     const svc = new GroupsAdminService(
       workspace,
       workflow.svc,
-      new AccessControlService(workspace as never, KB),
+      new AccessControlService(workspace as never, KB, new NodeFs()),
       KB,
       () => DEFAULT_BRANCH,
     );
@@ -386,7 +387,7 @@ describe('GroupsAdminService', () => {
     const svc = new GroupsAdminService(
       workspace,
       workflow.svc,
-      new AccessControlService(workspace as never, KB),
+      new AccessControlService(workspace as never, KB, new NodeFs()),
       KB,
       () => DEFAULT_BRANCH,
     );
@@ -434,7 +435,7 @@ describe('groups roster referencedBy — the mirror of the roles roster attribut
       const svc = new GroupsAdminService(
         workspace,
         stubWorkflow().svc,
-        new AccessControlService(workspace as never, KB),
+        new AccessControlService(workspace as never, KB, new NodeFs()),
         KB,
         () => DEFAULT_BRANCH,
       );

package/src/modules/access/__tests__/roles-admin.security.test.ts

@@ -0,0 +1,196 @@
+import type { Server } from 'node:http';
+import type { AddressInfo } from 'node:net';
+import fs from 'node:fs/promises';
+import path from 'node:path';
+import os from 'node:os';
+import express from 'express';
+import { describe, it, expect, beforeEach, afterEach } from 'vitest';
+
+import { NodeFs } from '../../kb-fs/node-fs.js';
+import { AccessControlService } from '../access-control.service.js';
+import { RolesAdminService } from '../roles-admin.service.js';
+import { AdminAccessService } from '../../admin/admin-access.service.js';
+import { createAccountRoutes } from '../../auth/account.routes.js';
+import { workspaceIdForBranch } from '../../../shared/workspace-id.js';
+import type { WorkspaceService } from '../../workspace/workspace.service.js';
+import type { WorkflowService } from '../../workflow/workflow.service.js';
+import type { AuthService } from '../../auth/auth.service.js';
+import type { IAccountErasureService } from '../../auth/account-erasure.service.js';
+import type { AuthUser } from '@bevel-software/platform-shared';
+import { DEFAULT_BRANCH } from '@bevel-software/platform-shared';
+
+/**
+ * SECURITY: the revocation the tester could not reproduce.
+ *
+ * The report was "I removed an account from Admin and it kept every admin
+ * screen" — true only because that account was the DEPLOYMENT ADMIN
+ * (`ADMIN_EMAIL`), which the resolver admits ahead of `roles.yaml` on purpose
+ * (the rescue path for a roles file with no Admin left). For a REGULAR
+ * account, removal must bite on the very next request, with no sign-out and
+ * no cache to wait out.
+ *
+ * So this pins both halves end-to-end, against a real `roles.yaml` on disk, a
+ * real resolver, and a real admin-only HTTP route (`GET /api/admin/accounts`,
+ * gated by the same `AdminAccessService.isAdmin` every admin surface uses):
+ *   1. remove a regular admin  → their next admin-only request is 403;
+ *   2. remove the deployment admin's address from the FILE → still 200,
+ *      because the server configuration, not the file, makes them an admin.
+ */
+
+const KB = 'knowledge-base';
+const WS = workspaceIdForBranch(DEFAULT_BRANCH);
+
+const OWNER = 'owner@bevel.software';
+const ACTOR: AuthUser = { id: 'u-actor', email: 'razvan@bevel.software', name: 'Razvan' } as AuthUser;
+const ALICE = 'alice@bevel.software';
+
+const ROLES = `roles:
+  Admin:
+    - razvan@bevel.software
+    - ${ALICE}
+  Sales:
+    - felix@example.com
+`;
+
+/** Minimal WorkspaceService over a real temp workspace dir. */
+function stubWorkspace(workspaceDir: string): WorkspaceService {
+  const resolve = (wsRel: string) => path.join(workspaceDir, wsRel);
+  return {
+    getWorkspacePath: async () => workspaceDir,
+    getOrCreateForBranch: async () => ({}) as unknown,
+    listFiles: async () => ({
+      name: path.basename(workspaceDir),
+      relativePath: '.',
+      type: 'directory',
+      children: [],
+    }),
+    readFile: async (_id: string, wsRel: string) => fs.readFile(resolve(wsRel), 'utf-8'),
+    writeFile: async (_id: string, wsRel: string, content: string) => {
+      await fs.mkdir(path.dirname(resolve(wsRel)), { recursive: true });
+      await fs.writeFile(resolve(wsRel), content, 'utf-8');
+    },
+  } as unknown as WorkspaceService;
+}
+
+/** Lock/commit stub: the real LockingFilesystem writes the bytes to disk. */
+function stubWorkflow(): WorkflowService {
+  const locks = new Map<string, AuthUser>();
+  const row = (h: AuthUser) => ({ holderUserId: h.id, holderName: h.name });
+  return {
+    getLock: async (_w: string, _b: string, p: string) => {
+      const h = locks.get(p);
+      return h ? row(h) : null;
+    },
+    acquireLock: async (_w: string, _b: string, p: string, user: AuthUser) => {
+      const h = locks.get(p);
+      if (h) return { acquired: false, lock: row(h) };
+      locks.set(p, user);
+      return { acquired: true, lock: row(user) };
+    },
+    releaseLock: async (_w: string, _b: string, p: string) => void locks.delete(p),
+    releaseLockNoCommit: async (_w: string, _b: string, p: string) => void locks.delete(p),
+    commitChanges: async () => ({}) as unknown,
+  } as unknown as WorkflowService;
+}
+
+function close(s: Server): Promise<void> {
+  return new Promise((resolve, reject) => s.close((e) => (e ? reject(e) : resolve())));
+}
+
+describe('SECURITY: Admin-role removal takes effect on the next request', () => {
+  let repo: string;
+  let access: AccessControlService;
+  let rolesAdmin: RolesAdminService;
+  let baseUrl: string;
+  // Both stay undefined until `beforeEach` gets that far. Vitest runs
+  // `afterEach` even when setup threw, so tear-down must not throw over the
+  // top of the real failure.
+  let root: string | undefined;
+  let server: Server | undefined;
+
+  /** The admin-only request under test, made AS `email`. */
+  async function adminOnlyRequest(email: string): Promise<number> {
+    const res = await fetch(`${baseUrl}/api/admin/accounts`, { headers: { 'x-test-email': email } });
+    return res.status;
+  }
+
+  beforeEach(async () => {
+    root = await fs.mkdtemp(path.join(os.tmpdir(), 'bevel-roles-security-'));
+    const workspaceDir = path.join(root, WS);
+    repo = path.join(workspaceDir, KB);
+    await fs.mkdir(repo, { recursive: true });
+    await fs.writeFile(path.join(repo, 'roles.yaml'), ROLES, 'utf-8');
+
+    const ws = stubWorkspace(workspaceDir);
+    // ONE resolver instance shared by the mutation path and the gate — exactly
+    // how the composition root wires it. A second instance would have its own
+    // cache and could pass this test while production still served stale
+    // verdicts, which is the failure mode worth guarding.
+    access = new AccessControlService(ws, KB, new NodeFs(), [OWNER]);
+    rolesAdmin = new RolesAdminService(ws, stubWorkflow(), access, KB, () => DEFAULT_BRANCH, undefined, [
+      OWNER,
+    ]);
+    const adminAccess = new AdminAccessService(access, ws, DEFAULT_BRANCH, [OWNER]);
+
+    const authService = {
+      listAccounts: async () => [],
+    } as unknown as AuthService;
+    const erasure = { eraseUser: async () => undefined } as unknown as Pick<
+      IAccountErasureService,
+      'eraseUser'
+    >;
+
+    const app = express();
+    app.use(express.json());
+    app.use('/api', (req, _res, next) => {
+      (req as unknown as { userEmail?: string }).userEmail = req.header('x-test-email') ?? undefined;
+      next();
+    });
+    app.use('/api', createAccountRoutes(authService, adminAccess, erasure));
+    server = await new Promise<Server>((resolve) => {
+      const s = app.listen(0, () => resolve(s));
+    });
+    baseUrl = `http://127.0.0.1:${(server.address() as AddressInfo).port}`;
+  });
+
+  afterEach(async () => {
+    if (server) await close(server);
+    server = undefined;
+    if (root) await fs.rm(root, { recursive: true, force: true });
+    root = undefined;
+  });
+
+  it('a regular account removed from Admin is denied its NEXT admin-only request', async () => {
+    // Before: Alice holds Admin through roles.yaml and the gate lets her in.
+    expect(await adminOnlyRequest(ALICE)).toBe(200);
+
+    await rolesAdmin.removeMember(ACTOR, 'admin', ALICE, false);
+    // The write really landed — the gate is reading a file that no longer
+    // names her, not a stubbed verdict.
+    expect(await fs.readFile(path.join(repo, 'roles.yaml'), 'utf-8')).not.toContain(ALICE);
+
+    // After: denied immediately. No sign-out, no token refresh, no TTL wait —
+    // this is the same process, the very next request.
+    expect(await adminOnlyRequest(ALICE)).toBe(403);
+    // And the removal is surgical: the remaining admin is untouched.
+    expect(await adminOnlyRequest(ACTOR.email)).toBe(200);
+  });
+
+  it('the deployment admin keeps access even when the roles FILE never named them', async () => {
+    // The by-design half of the report. `owner@` is not in roles.yaml at all,
+    // yet the server configuration makes them an admin — this is the rescue
+    // path, and it is why the page now lists them as a fixed member.
+    expect(ROLES).not.toContain(OWNER);
+    expect(await adminOnlyRequest(OWNER)).toBe(200);
+
+    // Rewriting the file without them changes nothing, which is exactly the
+    // confusion the fixed member row exists to explain.
+    await fs.writeFile(path.join(repo, 'roles.yaml'), `roles:\n  Admin:\n    - ${ACTOR.email}\n`, 'utf-8');
+    access.invalidate(WS);
+    expect(await adminOnlyRequest(OWNER)).toBe(200);
+  });
+
+  it('an account that never held Admin is refused throughout', async () => {
+    expect(await adminOnlyRequest('felix@example.com')).toBe(403);
+  });
+});