@bevel-software/platform-core-backend 0.21.0 → 0.23.0

package/src/modules/access/__tests__/access-control.prospective.test.ts

@@ -9,11 +9,12 @@ import { AccessControlService } from '../access-control.service.js';
 import { holderPrincipals } from '../access-view.js';
 
 /**
- * `prospectiveHolders`: who can open and edit a file where it sits, and who
- * could once a move puts it somewhere else. Driven over a real on-disk tree
- * through the public resolver, because the whole point is that the "after"
- * side must be the SAME resolution as a real one — the destination's folder
- * chain with the file's own frontmatter on top — for a path that does not
+ * `prospectiveHolders`: who can open and edit a file or folder where it
+ * sits, and who could once a move puts it somewhere else. Driven over a real
+ * on-disk tree through the public resolver, because the whole point is that
+ * the "after" side must be the SAME resolution as a real one — the
+ * destination's folder chain with whatever travels laid over it, a file's own
+ * frontmatter or a folder's `access.md` files — for a path that does not
  * exist yet and therefore cannot be asked for in the ordinary way.
  */
 
@@ -136,25 +137,100 @@ describe('AccessControlService.prospectiveHolders', () => {
     expect(holderPrincipals(before.read)).toContainEqual({ kind: 'group', name: 'Engineering' });
   });
 
-  it('refuses a folder source rather than resolving it as a file', async () => {
+  /**
+   * A folder carries its own `access.md`, and that file MOVES WITH IT. The
+   * resolver used to refuse the question rather than answer it as if the
+   * folder were a file — the right refusal for the wrong reason, since the
+   * answer it could not give is the one a folder move actually needs.
+   */
+  it('answers a folder source with the rules it carries, at the path they land on', async () => {
     const svc = await makeService(TREE);
 
-    // `Knowledge/Legal` carries its own access.md and governs everything under
-    // it. Resolved as a file it would report the rules of the folder ABOVE it
-    // and none of its own — a confident, wrong answer.
-    await expect(
-      svc.prospectiveHolders(workspaceId, 'Knowledge/Legal', 'Knowledge/Sales/Legal'),
-    ).rejects.toThrow(/folder/i);
+    const { before, after } = await svc.prospectiveHolders(
+      workspaceId,
+      'Knowledge/Legal',
+      'Knowledge/Sales/Legal',
+    );
+
+    // `Knowledge/Legal/access.md` travels, so Engineering keeps both verbs at
+    // the new path — the rules the folder brings, not the ones it is landing
+    // among. Read as a FILE the answer would have been Product's, from
+    // `Knowledge/Sales/access.md` alone.
+    expect(names(before.read)).toContain('Engineering');
+    expect(names(before.write)).toContain('Engineering');
+    expect(names(after.read)).toContain('Engineering');
+    expect(names(after.write)).toContain('Engineering');
+  });
+
+  it('leaves the old parent behind and picks the new one up', async () => {
+    const svc = await makeService({
+      ...TREE,
+      // Engineering's write on Team comes from Legal above it, not from Team.
+      'Knowledge/Legal/Team/access.md': rules('read:\n  - Product\n'),
+      'Knowledge/Legal/Team/plan.md': '# Plan\n',
+    });
+
+    const { before, after } = await svc.prospectiveHolders(
+      workspaceId,
+      'Knowledge/Legal/Team',
+      'Knowledge/Sales/Team',
+    );
+
+    expect(names(before.write)).toContain('Engineering');
+    // Sales grants nobody write, and Team's own file grants only read — so
+    // the write Team held by inheritance does not come along.
+    expect(names(after.write)).not.toContain('Engineering');
+    expect(names(after.read)).toContain('Product');
+  });
+
+  it('a rename of a folder that grants its own access changes nothing', async () => {
+    const svc = await makeService(TREE);
+
+    const { before, after } = await svc.prospectiveHolders(
+      workspaceId,
+      'Knowledge/Legal',
+      'Knowledge/Revenue',
+    );
+
+    expect(names(after.read)).toEqual(names(before.read));
+    expect(names(after.write)).toEqual(names(before.write));
+  });
+
+  /**
+   * A SYMLINK is neither of the two shapes the preview knows. `move_file`
+   * refuses a symlink source outright (`assertNoSymlinkOnPath`), so a link to
+   * a directory must not be described as a folder taking its `access.md`
+   * files along — that would promise the target's rules at a path nothing is
+   * ever going to arrive at. Nothing is read through the link either.
+   */
+  it('a symlink to a folder is not previewed as the folder it points at', async () => {
+    const svc = await makeService(TREE);
+    const repo = path.join(root, workspaceId, KB_DIR);
+    await fs.symlink(path.join(repo, 'Knowledge/Legal'), path.join(repo, 'Knowledge/Sales/alias'));
+
+    const { after } = await svc.prospectiveHolders(
+      workspaceId,
+      'Knowledge/Sales/alias',
+      'Knowledge/alias',
+    );
+
+    // Legal's own rules stayed behind the link: `Knowledge/` has no
+    // `access.md`, so nobody holds anything at the destination.
+    expect(names(after.read)).not.toContain('Engineering');
+    expect(names(after.write)).not.toContain('Engineering');
   });
 
   it('a probe that fails for any reason but absence throws, never a silent "file"', async () => {
     const svc = await makeService(TREE);
-    // A disk fault (EACCES here) must never read as "not a directory": that is
-    // exactly how a folder source would slip past the refusal above, and the
-    // answer it slips into names the wrong principals. Spied rather than
-    // staged with mode bits, so the property holds as root and on Windows too.
-    const real = fs.stat;
-    const spy = vi.spyOn(fs, 'stat').mockImplementation(((p: string) =>
+    // A disk fault (EACCES here) must never read as "not a directory": the
+    // probe is what chooses between the two resolutions, so a folder read as
+    // a file would be answered with frontmatter it does not have and without
+    // the `access.md` files it carries — the wrong principals, named with
+    // the same confidence as the right ones. Spied rather than staged with
+    // mode bits, so the property holds as root and on Windows too. `lstat`,
+    // because that is the probe: a symlink is classified by what it IS.
+    const real = fs.lstat;
+    const spy = vi.spyOn(fs, 'lstat').mockImplementation(((p: string) =>
       String(p).endsWith('contract.md')
         ? Promise.reject(Object.assign(new Error('EACCES: permission denied'), { code: 'EACCES' }))
         : (real as (p: string) => Promise<unknown>).call(fs, p)) as never);

package/src/modules/access/__tests__/access-requests.recut.test.ts

@@ -0,0 +1,134 @@
+import { describe, it, expect, beforeEach, afterEach } from 'vitest';
+import { execFile } from 'node:child_process';
+import { promisify } from 'node:util';
+import fs from 'node:fs/promises';
+import path from 'node:path';
+import os from 'node:os';
+
+import { spliceGrant } from '../../access-model/access-splice.js';
+import { pendingProposals } from '../../plugins/join-proposals.js';
+
+const execFileAsync = promisify(execFile);
+
+/**
+ * WHY A REQUEST BRANCH IS CUT AGAIN FROM LIVE, proved against real git.
+ *
+ * Opening a change request merges the target branch INTO its source branch.
+ * A request branch survives being declined — that is what lets the dialog say
+ * "your last request wasn't accepted" — so the next request finds a branch
+ * whose base may be old. Writing the new proposal onto it and opening the
+ * request then asks git to merge live into a branch that edited the same
+ * rules file from a different starting point, and git does what git does.
+ *
+ * The person asking is told to "resolve on reader2/join-artest3-04i7dr4", a
+ * branch they cannot reach, and every retry says the same thing. There is no
+ * route out of it for them, which is what made this worth a fix rather than a
+ * better error message.
+ *
+ * Everything below is plain git on a scratch repo: no app, no doubles. The
+ * first case is the bug, kept so the fix cannot quietly stop being necessary;
+ * the second is the fix.
+ */
+describe('a request branch whose base has moved', () => {
+  let root: string;
+  let repo: string;
+
+  const RULES = 'Research/access.md';
+  const LIVE = 'live';
+  const REQUEST = 'reader2/join-research-abc1234-def5678';
+  const RITA = { kind: 'user' as const, email: 'rita@x.io', displayName: 'Rita' };
+  const RAVI = { kind: 'user' as const, email: 'ravi@x.io', displayName: 'Ravi' };
+
+  const git = (...args: string[]) => execFileAsync('git', ['-C', repo, ...args]);
+
+  const readRules = async () => fs.readFile(path.join(repo, RULES), 'utf-8');
+  const writeRules = async (text: string) => {
+    await fs.mkdir(path.dirname(path.join(repo, RULES)), { recursive: true });
+    await fs.writeFile(path.join(repo, RULES), text);
+  };
+  const commit = async (message: string) => {
+    await git('add', '-A');
+    await git('commit', '-q', '-m', message);
+  };
+
+  /** What opening a change request does: merge live INTO the request branch. */
+  async function mergeLiveIntoRequest(): Promise<{ ok: boolean; conflicted: string[] }> {
+    try {
+      await git('merge', '--no-edit', LIVE);
+      return { ok: true, conflicted: [] };
+    } catch {
+      const { stdout } = await execFileAsync('git', [
+        '-C',
+        repo,
+        'diff',
+        '--name-only',
+        '--diff-filter=U',
+      ]);
+      await git('merge', '--abort');
+      return { ok: false, conflicted: stdout.split('\n').filter(Boolean) };
+    }
+  }
+
+  beforeEach(async () => {
+    root = await fs.mkdtemp(path.join(os.tmpdir(), 'bevel-recut-'));
+    repo = path.join(root, 'kb');
+    await fs.mkdir(repo, { recursive: true });
+    await git('init', '-q', '-b', LIVE);
+    await git('config', 'user.email', 'test@bevel.software');
+    await git('config', 'user.name', 'Test');
+    await writeRules('---\n---\nowner:\n  - Ed <ed@x.io>\n');
+    await commit('the rules as they were');
+
+    // Ravi asked for Owner, and it was declined. The branch stays behind.
+    await git('checkout', '-q', '-b', REQUEST);
+    await writeRules(spliceGrant(await readRules(), 'owner', RAVI, { target: 'folder' }).text);
+    await commit('Request owner access to Research');
+    await git('checkout', '-q', LIVE);
+
+    // Then an editor grants somebody else Can edit here — an ordinary click in
+    // the dialog, and the only thing this scenario needs to go wrong.
+    await writeRules(spliceGrant(await readRules(), 'write', RITA, { target: 'folder' }).text);
+    await commit('Ed grants Rita Can edit');
+  });
+
+  afterEach(async () => {
+    await fs.rm(root, { recursive: true, force: true });
+  });
+
+  it('CONFLICTS when the stale branch is written to and the request opened on it', async () => {
+    // What this did before: splice onto live's text, write it to the branch as
+    // it stands, open the request. The content is right; the history is not.
+    await git('checkout', '-q', REQUEST);
+    const live = await execFileAsync('git', ['-C', repo, 'show', `${LIVE}:${RULES}`]);
+    await writeRules(spliceGrant(live.stdout, 'write', RAVI, { target: 'folder' }).text);
+    await commit('Request can edit access to Research');
+
+    const merged = await mergeLiveIntoRequest();
+    expect(merged.ok).toBe(false);
+    expect(merged.conflicted).toEqual([RULES]);
+  });
+
+  it('is CLEAN once the branch is cut again from live first', async () => {
+    // The fix: the answered request's branch is deleted and recut from live,
+    // so live's tip is the merge base and there is nothing to reconcile.
+    await git('branch', '-q', '-D', REQUEST);
+    await git('checkout', '-q', '-b', REQUEST, LIVE);
+    await writeRules(spliceGrant(await readRules(), 'write', RAVI, { target: 'folder' }).text);
+    await commit('Request can edit access to Research');
+
+    const merged = await mergeLiveIntoRequest();
+    expect(merged.ok).toBe(true);
+
+    // And the branch proposes exactly one thing — asked of the function the
+    // app itself asks, rather than of the diff's line-by-line shape (a splice
+    // may rewrite a whole block without proposing anything more). Rita's
+    // grant is already on live, so it is nothing new; the declined Owner
+    // proposal went with the branch that carried it.
+    const branchText = (await execFileAsync('git', ['-C', repo, 'show', `${REQUEST}:${RULES}`]))
+      .stdout;
+    const liveText = (await execFileAsync('git', ['-C', repo, 'show', `${LIVE}:${RULES}`])).stdout;
+    expect(pendingProposals(branchText, liveText, RULES)).toEqual([
+      expect.objectContaining({ verb: 'write', id: `user:${RAVI.email}` }),
+    ]);
+  });
+});