@bevel-software/platform-core-backend 0.26.0 → 0.28.0

package/src/modules/embed/__tests__/embed.routes.test.ts

@@ -0,0 +1,362 @@
+import type { Server } from 'node:http';
+import type { AddressInfo } from 'node:net';
+import express from 'express';
+import cors from 'cors';
+import { afterEach, describe, expect, it, vi } from 'vitest';
+import { createEmbedLinkRoutes, createEmbedRoutes, TOKEN_REQUIRED } from '../embed.routes.js';
+import {
+  EmbedAccessError,
+  EmbedLockedError,
+  EmbedNodeNotFoundError,
+  EmbedTokenError,
+} from '../embed.errors.js';
+
+const TOKEN = 'a-valid-token';
+
+let server: Server | null = null;
+afterEach(async () => {
+  if (server) await new Promise<void>((resolve) => server!.close(() => resolve()));
+  server = null;
+});
+
+function stubService(overrides: Record<string, unknown> = {}) {
+  return {
+    sharedSecretConfigured: vi.fn(() => true),
+    verifySharedSecret: vi.fn((s?: string) => s === 'shh'),
+    mintForUser: vi.fn(async () => ({ token: TOKEN, embedUrl: 'https://hexis.example/embed?token=' + TOKEN })),
+    mintToken: vi.fn(async () => ({ token: TOKEN, embedUrl: 'https://hexis.example/embed?token=' + TOKEN })),
+    loadFile: vi.fn(async (token: string) => {
+      if (token !== TOKEN) throw new EmbedTokenError();
+      return { nodeName: 'Thing', content: '# Thing', canWrite: true };
+    }),
+    readBytes: vi.fn(async () => ({ bytes: Buffer.from([1, 2, 3]), path: 'Data/x.png' })),
+    acquireLock: vi.fn(async () => ({ acquired: true })),
+    heartbeat: vi.fn(async () => undefined),
+    cancel: vi.fn(async () => undefined),
+    save: vi.fn(async () => undefined),
+    propose: vi.fn(async () => ({ branch: 'suggestions/a-1/knowledge', number: 7, url: '/change-requests/7' })),
+    linkAccount: vi.fn(async () => undefined),
+    listLinkedAccounts: vi.fn(async () => [{ atlassianAccountId: 'acc-1', createdAt: 0 }]),
+    unlinkAccount: vi.fn(async () => true),
+    ...overrides,
+  };
+}
+
+/**
+ * The app as the server mounts it: the embed routes ahead of the JWT
+ * middleware, the link routes behind it, and a static catch-all last — the
+ * same order `create-core-server` uses, because the order is what makes the
+ * framing headers land before `index.html` is served.
+ */
+async function serve(
+  service: ReturnType<typeof stubService>,
+  opts: { session?: boolean; restrictFraming?: boolean; appWideCors?: boolean } = {},
+) {
+  const app = express();
+  // The server's own CORS, as `create-core-server` mounts it ahead of every
+  // route: any origin reflected, credentials allowed, preflights answered.
+  if (opts.appWideCors) app.use(cors({ origin: true, credentials: true }));
+  app.use(express.json());
+  // A deployment (or a later change to this app) that stamps a framing
+  // restriction on EVERY response, ahead of the embed routes — the case the
+  // embed page's own header removal exists for.
+  if (opts.restrictFraming) {
+    app.use((_req, res, next) => {
+      res.setHeader('X-Frame-Options', 'SAMEORIGIN');
+      res.setHeader('Content-Security-Policy', "frame-ancestors 'self'");
+      next();
+    });
+  }
+  app.use(createEmbedRoutes(service as never));
+  const authMiddleware: express.RequestHandler = (req, res, next) => {
+    if (!opts.session) {
+      res.status(401).json({ error: 'Unauthenticated' });
+      return;
+    }
+    req.userId = 'u-1';
+    next();
+  };
+  app.use('/api', authMiddleware, createEmbedLinkRoutes(service as never));
+  app.get('{*path}', (_req, res) => res.type('html').send('<!doctype html><title>SPA</title>'));
+
+  server = app.listen(0);
+  await new Promise<void>((r) => server!.once('listening', () => r()));
+  const base = `http://127.0.0.1:${(server!.address() as AddressInfo).port}`;
+  return {
+    base,
+    get: (path: string, headers: Record<string, string> = {}) => fetch(`${base}${path}`, { headers }),
+    post: (path: string, body: unknown, headers: Record<string, string> = {}) =>
+      fetch(`${base}${path}`, {
+        method: 'POST',
+        headers: { 'content-type': 'application/json', ...headers },
+        body: JSON.stringify(body),
+      }),
+    del: (path: string) => fetch(`${base}${path}`, { method: 'DELETE' }),
+  };
+}
+
+/**
+ * Every route that serves FILE CONTENT or changes a file. The framing rule
+ * makes the embed page reachable from any site, so the token is the whole of
+ * the security — a session fallback would let a hostile frame read and write
+ * as whoever happened to be signed in.
+ */
+const DATA_ROUTES = [
+  ['GET', '/api/embed/load'],
+  ['GET', '/api/embed/raw'],
+  ['POST', '/api/embed/lock'],
+  ['POST', '/api/embed/heartbeat'],
+  ['POST', '/api/embed/cancel'],
+  ['POST', '/api/embed/save'],
+  ['POST', '/api/embed/propose'],
+] as const;
+
+describe('the embed data routes take the token and nothing else', () => {
+  it.each(DATA_ROUTES)('%s %s refuses a request with a valid session and no token', async (method, path) => {
+    const client = await serve(stubService(), { session: true });
+    const res =
+      method === 'GET'
+        ? await client.get(path, { cookie: 'bevel_token=a-real-session' })
+        : await client.post(path, { content: 'x' }, { cookie: 'bevel_token=a-real-session' });
+    expect(res.status).toBe(401);
+    expect((await res.json()).error).toBe(TOKEN_REQUIRED);
+  });
+
+  it.each(DATA_ROUTES)('%s %s answers a request with a token and no session', async (method, path) => {
+    const client = await serve(stubService());
+    const res =
+      method === 'GET'
+        ? await client.get(`${path}?token=${TOKEN}`)
+        : await client.post(path, { token: TOKEN, content: 'x' });
+    expect(res.status).toBeLessThan(400);
+  });
+
+  it('refuses an expired or rejected token with 401, so the view can say it expired', async () => {
+    const client = await serve(stubService());
+    const res = await client.get('/api/embed/load?token=stale');
+    expect(res.status).toBe(401);
+  });
+});
+
+describe('framing', () => {
+  /**
+   * Any host may frame the embed page — that is what makes it work in every
+   * host's sandbox without an admin entry per host, and the token is what
+   * secures it. `X-Frame-Options` is REMOVED rather than merely unset, so a
+   * header added globally later cannot silently break every host's embed.
+   */
+  it('sends no framing restriction on the embed page, even under a global one', async () => {
+    const client = await serve(stubService(), { restrictFraming: true });
+    // The restriction is really there on every other page…
+    const other = await client.get('/workspace/main');
+    expect(other.headers.get('x-frame-options')).toBe('SAMEORIGIN');
+    // …and the embed page clears it.
+    const res = await client.get('/embed?token=' + TOKEN);
+    expect(res.status).toBe(200);
+    expect(res.headers.get('x-frame-options')).toBeNull();
+    expect(res.headers.get('content-security-policy')).toBeNull();
+    // And it still falls through to the SPA.
+    expect(await res.text()).toContain('<!doctype html>');
+  });
+
+  /**
+   * The account-link page acts under the SIGNED-IN SESSION, so a page that
+   * could frame it could link a foreign account to a victim.
+   */
+  it('refuses every framing ancestor on the account-link page', async () => {
+    const client = await serve(stubService(), { restrictFraming: true });
+    const res = await client.get('/embed/link?token=' + TOKEN);
+    expect(res.status).toBe(200);
+    expect(res.headers.get('content-security-policy')).toBe("frame-ancestors 'none'");
+    expect(res.headers.get('x-frame-options')).toBe('DENY');
+  });
+});
+
+describe('the connector mint', () => {
+  it('mints from the shared secret, an account id and a reference', async () => {
+    const service = stubService();
+    const client = await serve(service);
+    const res = await client.post(
+      '/api/embed/token',
+      { accountId: 'acc-1', email: 'a@x.io', reference: 'Data/Thing.md' },
+      { 'x-embed-secret': 'shh' },
+    );
+    expect(res.status).toBe(200);
+    expect(await res.json()).toMatchObject({ token: TOKEN });
+    expect(service.mintToken).toHaveBeenCalledWith({
+      accountId: 'acc-1',
+      email: 'a@x.io',
+      reference: 'Data/Thing.md',
+    });
+  });
+
+  it('refuses a wrong secret and a missing one', async () => {
+    const client = await serve(stubService());
+    expect((await client.post('/api/embed/token', { accountId: 'a', reference: 'b' }, { 'x-embed-secret': 'no' })).status).toBe(401);
+    expect((await client.post('/api/embed/token', { accountId: 'a', reference: 'b' })).status).toBe(401);
+  });
+
+  it('refuses an incomplete body', async () => {
+    const client = await serve(stubService());
+    const res = await client.post('/api/embed/token', { accountId: 'acc-1' }, { 'x-embed-secret': 'shh' });
+    expect(res.status).toBe(400);
+  });
+
+  /** A deployment with no connector pointed at it has no such route at all. */
+  it('is absent when no shared secret is configured', async () => {
+    const service = stubService({ sharedSecretConfigured: vi.fn(() => false) });
+    const client = await serve(service);
+    const res = await client.post('/api/embed/token', { accountId: 'a', reference: 'b' }, { 'x-embed-secret': 'shh' });
+    expect(res.status).toBe(404);
+    expect(service.verifySharedSecret).not.toHaveBeenCalled();
+  });
+});
+
+describe('the data routes', () => {
+  it('serves the page to render', async () => {
+    const client = await serve(stubService());
+    const res = await client.get(`/api/embed/load?token=${TOKEN}`);
+    expect(await res.json()).toMatchObject({ nodeName: 'Thing' });
+  });
+
+  it('serves bytes inline, never as a download, and never from a shared cache', async () => {
+    const client = await serve(stubService());
+    const res = await client.get(`/api/embed/raw?token=${TOKEN}&path=assets/x.png`);
+    expect(res.status).toBe(200);
+    expect(res.headers.get('content-disposition')).toBe('inline');
+    expect(res.headers.get('cache-control')).toContain('no-store');
+    expect(res.headers.get('x-content-type-options')).toBe('nosniff');
+    expect([...new Uint8Array(await res.arrayBuffer())]).toEqual([1, 2, 3]);
+  });
+
+  it('saves, and proposes, through the service', async () => {
+    const service = stubService();
+    const client = await serve(service);
+    expect((await client.post('/api/embed/save', { token: TOKEN, content: 'new' })).status).toBe(204);
+    expect(service.save).toHaveBeenCalledWith(TOKEN, 'new');
+    const proposed = await client.post('/api/embed/propose', { token: TOKEN, content: 'draft' });
+    expect(await proposed.json()).toMatchObject({ number: 7 });
+  });
+
+  it('says who holds the lock when a save is refused for it', async () => {
+    const service = stubService({
+      save: vi.fn(async () => {
+        throw new EmbedLockedError('Bob');
+      }),
+    });
+    const client = await serve(service);
+    const res = await client.post('/api/embed/save', { token: TOKEN, content: 'x' });
+    expect(res.status).toBe(409);
+    expect((await res.json()).error).toContain('Bob');
+  });
+
+  /** Protected text and a token-bearing link: nothing may keep the answer. */
+  it('forbids caching the loaded page, as it does the raw bytes', async () => {
+    const client = await serve(stubService());
+    const load = await client.get(`/api/embed/load?token=${TOKEN}`);
+    expect(load.headers.get('cache-control')).toBe('no-store, private');
+    const refused = await client.get('/api/embed/load?token=wrong');
+    expect(refused.headers.get('cache-control')).toBe('no-store, private');
+  });
+
+  it('refuses a save with no content', async () => {
+    const client = await serve(stubService());
+    expect((await client.post('/api/embed/save', { token: TOKEN })).status).toBe(400);
+  });
+
+  it.each([
+    [new EmbedTokenError(), 401],
+    [new EmbedAccessError(), 403],
+    [new EmbedNodeNotFoundError('gone'), 404],
+    [new EmbedLockedError('Bob'), 409],
+  ])('maps %s to its status', async (error, status) => {
+    const service = stubService({
+      loadFile: vi.fn(async () => {
+        throw error;
+      }),
+    });
+    const client = await serve(service);
+    expect((await client.get(`/api/embed/load?token=${TOKEN}`)).status).toBe(status);
+  });
+
+  it('does not leak an unexpected failure message', async () => {
+    const service = stubService({
+      loadFile: vi.fn(async () => {
+        throw new Error('postgres://user:pw@host down');
+      }),
+    });
+    const client = await serve(service);
+    const res = await client.get(`/api/embed/load?token=${TOKEN}`);
+    expect(res.status).toBe(500);
+    expect((await res.json()).error).toBe('Something went wrong.');
+  });
+});
+
+describe('the account-link routes', () => {
+  it('link, list and unlink need a session', async () => {
+    const client = await serve(stubService(), { session: false });
+    expect((await client.post('/api/embed/link', { token: TOKEN })).status).toBe(401);
+    expect((await client.get('/api/embed/links')).status).toBe(401);
+    expect((await client.del('/api/embed/links/acc-1')).status).toBe(401);
+  });
+
+  it('links the token account to the signed-in user', async () => {
+    const service = stubService();
+    const client = await serve(service, { session: true });
+    expect((await client.post('/api/embed/link', { token: TOKEN })).status).toBe(204);
+    expect(service.linkAccount).toHaveBeenCalledWith(TOKEN, 'u-1');
+  });
+
+  it('answers 404 for a link that is not this user own, so it cannot probe others', async () => {
+    const service = stubService({ unlinkAccount: vi.fn(async () => false) });
+    const client = await serve(service, { session: true });
+    expect((await client.del('/api/embed/links/someone-elses')).status).toBe(404);
+  });
+});
+
+/**
+ * The MCP App view runs the embed inside a chat host's SANDBOX — another
+ * origin, and one no deployment can know in advance — and calls the token
+ * routes from there. The server's app-wide CORS is what lets it: mounted
+ * here as `create-core-server` mounts it, so what is pinned is the behaviour
+ * a sandbox actually meets, not a header these routes set themselves. Safe
+ * on the token routes for the reason the token-only rule exists: CORS guards
+ * a browser's ambient credentials, these routes take none, and the token in
+ * the request is the whole credential.
+ */
+describe('a cross-origin caller reaches the token routes through the app-wide CORS', () => {
+  const SANDBOX = 'https://sandbox.example';
+  const FOREIGN = { origin: SANDBOX };
+
+  it.each(DATA_ROUTES)('%s %s answers the sandbox origin', async (method, path) => {
+    const client = await serve(stubService(), { appWideCors: true });
+    const res =
+      method === 'GET'
+        ? await client.get(`${path}?token=${TOKEN}`, FOREIGN)
+        : await client.post(path, { token: TOKEN, content: 'x' }, FOREIGN);
+    expect(res.status).toBeLessThan(400);
+    expect(res.headers.get('access-control-allow-origin')).toBe(SANDBOX);
+  });
+
+  it('answers the preflight a JSON POST from the sandbox triggers', async () => {
+    const client = await serve(stubService(), { appWideCors: true });
+    const res = await fetch(`${client.base}/api/embed/save`, {
+      method: 'OPTIONS',
+      headers: { ...FOREIGN, 'access-control-request-method': 'POST', 'access-control-request-headers': 'content-type' },
+    });
+    expect(res.status).toBe(204);
+    expect(res.headers.get('access-control-allow-origin')).toBe(SANDBOX);
+    expect(res.headers.get('access-control-allow-methods')).toContain('POST');
+    expect(res.headers.get('access-control-allow-headers')?.toLowerCase()).toContain('content-type');
+  });
+
+  it('still refuses a sandbox caller that brings no token', async () => {
+    // Being reachable from another origin changes nothing about who may
+    // read: the token is the credential, and a request without it is 401
+    // from the sandbox exactly as from a tab.
+    const client = await serve(stubService(), { appWideCors: true });
+    const res = await client.get('/api/embed/load', FOREIGN);
+    expect(res.status).toBe(401);
+    expect((await res.json()).error).toBe(TOKEN_REQUIRED);
+  });
+});

package/src/modules/embed/__tests__/embed.service.lock.test.ts

@@ -0,0 +1,193 @@
+import { beforeEach, describe, expect, it, vi } from 'vitest';
+import type { AuthUser } from '@bevel-software/platform-shared';
+import { FileLockService } from '../../workflow/file-lock.service.js';
+import { makeFakeLockDb, type FakeLockDb } from '../../workflow/__tests__/fake-file-lock-db.js';
+import { createFileReaderRegistry } from '../../workspace/file-readers/file-reader.registry.js';
+import type { DocExtractOutcome, DocExtractService } from '../../workspace/file-readers/doc-extract.service.js';
+import { makeRolesYamlWriteValidator } from '../../access-model/roles-yaml-guard.js';
+import { testKbContext, TEST_BRANCH_MODEL } from '../../../__tests__/kb-context.js';
+import { EmbedService } from '../embed.service.js';
+import { EmbedLockedError } from '../embed.errors.js';
+
+/**
+ * Edit and Save against the REAL lock.
+ *
+ * The rest of the service suite stubs `acquireLock`, and a stub answers
+ * whatever it was told to. That is how a Save that re-acquired the writer's
+ * own lock shipped: the stub said yes, while `FileLockService.acquire` is
+ * strict on purpose and refuses a live lock even to its own holder (an agent
+ * shares the human's user id, and must not steal their edit). On a real boot
+ * every Save from the embed answered 409 against the writer's own Edit lock.
+ *
+ * So the lock half of the workflow service here is the real `FileLockService`
+ * over the in-memory `file_locks` table the workflow suites use — the
+ * contention rules come from the code that enforces them.
+ */
+
+const KB = 'knowledge-base';
+const BRANCH = TEST_BRANCH_MODEL.defaultBranch;
+const WS_ID = encodeURIComponent(BRANCH);
+const REPO = 'Data/Thing.md';
+const WS = `${KB}/${REPO}`;
+
+const ALICE: AuthUser = { id: '11111111-1111-4111-8111-111111111111', email: 'alice@example.com', name: 'Alice' };
+const BOB: AuthUser = { id: '22222222-2222-4222-8222-222222222222', email: 'bob@example.com', name: 'Bob' };
+
+let fake: FakeLockDb;
+let locks: FileLockService;
+
+/** The extraction service the reader registry takes, typed against its contract; no document is read here. */
+function noDocExtract(): DocExtractService {
+  const extract = async (): Promise<DocExtractOutcome> => ({
+    ok: false,
+    message: 'this suite reads no document-format file',
+  });
+  return { extract } satisfies Pick<DocExtractService, 'extract'> as DocExtractService;
+}
+
+function build() {
+  const workspaceService = {
+    getOrCreateForBranch: vi.fn(async (branch: string) => ({ id: encodeURIComponent(branch), kbDirName: KB })),
+    readFileBinary: vi.fn(async () => Buffer.from('# Thing\n', 'utf8')),
+    isFile: vi.fn(async () => true),
+    writeFile: vi.fn(async () => undefined),
+    withPathTurn: vi.fn(async (_id: string, _wsPath: string, op: () => Promise<unknown>) => op()),
+  };
+  // The lock verbs go straight to the real service; release drops the row as
+  // the real `releaseLock` does once it has enqueued the commit.
+  const workflowService = {
+    getLock: vi.fn((id: string, branch: string, path: string) => locks.get(id, branch, path)),
+    acquireLock: vi.fn((id: string, branch: string, path: string, user: AuthUser) =>
+      locks.acquire(id, branch, path, user),
+    ),
+    heartbeatLock: vi.fn((id: string, branch: string, path: string, user: AuthUser) =>
+      locks.heartbeat(id, branch, path, user),
+    ),
+    releaseLock: vi.fn((id: string, branch: string, path: string, user: AuthUser) =>
+      locks.release(id, branch, path, user),
+    ),
+    releaseLockNoCommit: vi.fn((id: string, branch: string, path: string, user: AuthUser) =>
+      locks.release(id, branch, path, user),
+    ),
+  };
+  const service = new EmbedService(
+    { jwtSecret: 's', embedSharedSecret: '', publicFrontendUrl: 'https://hexis.example', kbDirName: KB },
+    testKbContext({ kbDirName: KB }),
+    workspaceService as never,
+    { canRead: async () => true, canWrite: async () => true } as never,
+    {
+      getUserById: async (id: string) => (id === ALICE.id ? ALICE : BOB),
+      isEmailDomainAllowed: () => true,
+      isActive: async () => true,
+    } as never,
+    workflowService as never,
+    { remoteBranchExists: async () => false } as never,
+    { getUserId: async () => null } as never,
+    createFileReaderRegistry(noDocExtract()),
+    makeRolesYamlWriteValidator(KB),
+  );
+  return { service, workspaceService, workflowService };
+}
+
+beforeEach(() => {
+  fake = makeFakeLockDb();
+  locks = new FileLockService(fake.db);
+});
+
+describe('the real lock is strict', () => {
+  /** The premise the regression broke on — pinned, so nobody "relies" on the opposite again. */
+  it('refuses a live lock even to its own holder', async () => {
+    expect((await locks.acquire(WS_ID, BRANCH, WS, ALICE)).acquired).toBe(true);
+    expect((await locks.acquire(WS_ID, BRANCH, WS, ALICE)).acquired).toBe(false);
+  });
+});
+
+describe('Edit then Save, as the writer does it', () => {
+  it('saves under the lock Edit took, then releases it', async () => {
+    const { service, workspaceService } = build();
+    const { token } = await service.mintForUser({ userId: ALICE.id, reference: REPO });
+
+    expect(await service.acquireLock(token)).toEqual({ acquired: true });
+    await service.heartbeat(token);
+    await expect(service.save(token, 'new text')).resolves.toBeUndefined();
+
+    expect(workspaceService.writeFile).toHaveBeenCalledWith(WS_ID, WS, 'new text');
+    // Released, so the file is free for the next editor.
+    expect(await locks.get(WS_ID, BRANCH, WS)).toBeNull();
+  });
+
+  it('can Edit and Save again straight after', async () => {
+    const { service, workspaceService } = build();
+    const { token } = await service.mintForUser({ userId: ALICE.id, reference: REPO });
+    await service.acquireLock(token);
+    await service.save(token, 'first');
+    await service.acquireLock(token);
+    await service.save(token, 'second');
+    expect(workspaceService.writeFile).toHaveBeenLastCalledWith(WS_ID, WS, 'second');
+  });
+});
+
+describe('a Save whose lock is not the viewer own', () => {
+  it('is refused, names the holder, writes nothing and leaves their lock alone', async () => {
+    await locks.acquire(WS_ID, BRANCH, WS, BOB);
+    const { service, workspaceService } = build();
+    const { token } = await service.mintForUser({ userId: ALICE.id, reference: REPO });
+
+    const save = service.save(token, 'x');
+    await expect(save).rejects.toThrow(EmbedLockedError);
+    await expect(service.save(token, 'x')).rejects.toThrow('Bob');
+    expect(workspaceService.writeFile).not.toHaveBeenCalled();
+    expect((await locks.get(WS_ID, BRANCH, WS))?.holderUserId).toBe(BOB.id);
+  });
+
+  /** A frame hidden past the TTL comes back to a free file: it takes the lock again and saves. */
+  it('takes a lapsed lock back when nobody else took the file', async () => {
+    const { service, workspaceService } = build();
+    const { token } = await service.mintForUser({ userId: ALICE.id, reference: REPO });
+    const past = new Date(Date.now() - 60_000);
+    fake.seed({
+      workspaceId: WS_ID,
+      branch: BRANCH,
+      path: WS,
+      holderUserId: ALICE.id,
+      holderName: ALICE.name,
+      mode: 'edit',
+      acquiredAt: past,
+      lastHeartbeatAt: past,
+      expiresAt: past,
+    });
+    await expect(service.save(token, 'back')).resolves.toBeUndefined();
+    expect(workspaceService.writeFile).toHaveBeenCalledWith(WS_ID, WS, 'back');
+  });
+
+  it('is refused when the lapsed lock was taken by somebody else', async () => {
+    const { service, workspaceService } = build();
+    const { token } = await service.mintForUser({ userId: ALICE.id, reference: REPO });
+    await service.acquireLock(token);
+    // Alice's lock lapses, and Bob takes the file.
+    const past = new Date(Date.now() - 60_000);
+    fake.seed({
+      workspaceId: WS_ID,
+      branch: BRANCH,
+      path: WS,
+      holderUserId: ALICE.id,
+      holderName: ALICE.name,
+      mode: 'edit',
+      acquiredAt: past,
+      lastHeartbeatAt: past,
+      expiresAt: past,
+    });
+    expect((await locks.acquire(WS_ID, BRANCH, WS, BOB)).acquired).toBe(true);
+
+    await expect(service.save(token, 'stale')).rejects.toThrow(EmbedLockedError);
+    expect(workspaceService.writeFile).not.toHaveBeenCalled();
+  });
+
+  it('does not treat a coordination hold under the same id as write possession', async () => {
+    await locks.acquire(WS_ID, BRANCH, WS, ALICE, { coordination: true });
+    const { service, workspaceService } = build();
+    const { token } = await service.mintForUser({ userId: ALICE.id, reference: REPO });
+    await expect(service.save(token, 'x')).rejects.toThrow(EmbedLockedError);
+    expect(workspaceService.writeFile).not.toHaveBeenCalled();
+  });
+});