@bevel-software/platform-core-backend 0.33.0 → 0.35.0

package/src/modules/access/__tests__/groups-admin.service.test.ts

@@ -11,6 +11,9 @@ import { DEFAULT_BRANCH } from '@bevel-software/platform-shared';
 import { AccessControlService } from '../access-control.service.js';
 import { GroupsAdminService, GroupsAdminError } from '../groups-admin.service.js';
 import { createGroup, addGroupMember, GroupsEditError } from '../groups-edit.js';
+import { workspaceIdForBranch } from '../../../shared/workspace-id.js';
+import { AccessDeniedError } from '../../access-model/index.js';
+import { UNSHOWN_REFERENCE_REFUSAL } from '../reference-scan.js';
 
 const KB = 'knowledge-base';
 const ADMIN: AuthUser = { id: 'u-admin', email: 'admin@x.io', name: 'Admin' } as AuthUser;
@@ -108,6 +111,7 @@ describe('GroupsAdminService', () => {
       workspace,
       workflow.svc,
       new AccessControlService(workspace as never, KB, new NodeFs()),
+      new NodeFs(),
       KB,
       () => DEFAULT_BRANCH,
     );
@@ -126,7 +130,7 @@ describe('GroupsAdminService', () => {
       'roles.yaml',
       'roles:\n  Admin:\n    - admin@x.io\n  Reviewer:\n    - rev@x.io\n    - group:gtm team\n',
     );
-    const roster = await service.getRoster();
+    const roster = await service.getRoster('admin@x.io');
     expect(roster.mode).toBe('manual');
     expect(roster.groupsHealth).toEqual({ ok: true });
     expect(roster.groups.map((g) => g.displayName).sort()).toEqual(['GTM Team', 'Product']);
@@ -141,7 +145,7 @@ describe('GroupsAdminService', () => {
 
   it('a broken MANUAL groups.yaml answers the roster with 422 + the parse message', async () => {
     await write(repo, 'groups.yaml', 'groups:\n  - not\n  - a\n  - mapping\n');
-    const err = await service.getRoster().catch((e: unknown) => e);
+    const err = await service.getRoster('admin@x.io').catch((e: unknown) => e);
     expect(err).toBeInstanceOf(GroupsAdminError);
     expect((err as GroupsAdminError).status).toBe(422);
     expect((err as GroupsAdminError).message).toMatch(/groups.yaml/);
@@ -152,7 +156,7 @@ describe('GroupsAdminService', () => {
 
   it('a broken SYNCED file keeps IdP mode: empty roster + groupsHealth marker (no manual fallback)', async () => {
     await write(repo, 'synced-groups.yaml', 'groups:\n  - not\n  - a\n  - mapping\n');
-    const roster = await service.getRoster();
+    const roster = await service.getRoster('admin@x.io');
     expect(roster.mode).toBe('idp');
     // Falling back to groups.yaml would resurrect retired manual groups.
     expect(roster.groups).toEqual([]);
@@ -218,7 +222,7 @@ describe('GroupsAdminService', () => {
 
   it('IdP mode: mutations refuse with the typed 409; reads still work', async () => {
     await write(repo, 'synced-groups.yaml', 'groups:\n  Engineering:\n    - ada@x.io\n');
-    const roster = await service.getRoster();
+    const roster = await service.getRoster('admin@x.io');
     expect(roster.mode).toBe('idp');
     // The roster IS the synced file now — not the retired manual list.
     expect(roster.groups.map((g) => g.canonical)).toEqual(['engineering']);
@@ -241,18 +245,106 @@ describe('GroupsAdminService', () => {
   });
 
   it('canonical-changing rename rewrites grant references in ONE commit', async () => {
-    await write(repo, 'Knowledge/Sales/access.md', '---\nread:\n  - GTM Team\nwrite:\n  - deny GTM Team\n---\n');
+    await write(
+      repo,
+      'Knowledge/Sales/access.md',
+      '---\nread:\n  - GTM Team\n  - group/GTM Team\nwrite:\n  - deny GTM Team\n---\n',
+    );
     await service.renameGroup(ADMIN, 'gtm team', 'Go To Market');
 
     expect(await groupsYaml()).toContain('Go To Market:');
     const rewritten = await fs.readFile(path.join(repo, 'Knowledge/Sales/access.md'), 'utf-8');
-    expect(rewritten).toContain('- Go To Market');
-    expect(rewritten).toContain('- deny Go To Market');
+    // Rewritten as the explicit group token, whatever the old spelling.
+    expect(rewritten).toContain('- group/Go To Market');
+    expect(rewritten).toContain('- deny group/Go To Market');
     expect(rewritten).not.toContain('GTM Team');
     expect(commits).toHaveLength(1);
     expect(commits[0].summary).toContain('gtm team → Go To Market');
   });
 
+  // Another person's private plugin is closed to the Admin: the rewrite still
+  // covers it (no reference left behind). Whether the Admin may WRITE it is
+  // the commit gate's call — see the gated cases below; this stub allows it.
+  it('rename rewrites a file the Admin cannot read when the commit allows it', async () => {
+    await write(
+      repo,
+      'Plugins/Sara/access.md',
+      '---\nread:\n  - deny everyone\n  - Sara <sara@x.io>\nwrite:\n  - Sara <sara@x.io>\n---\n',
+    );
+    await write(repo, 'Plugins/Sara/Notes.md', "---\nread: ['group/GTM Team']\n---\n# Notes\n");
+    const access = new AccessControlService(stubWorkspace(root) as never, KB, new NodeFs());
+    expect(await access.canRead(workspaceIdForBranch(DEFAULT_BRANCH), ADMIN.email, 'Plugins/Sara/Notes.md')).toBe(false);
+
+    await service.renameGroup(ADMIN, 'gtm team', 'Go To Market');
+
+    expect(await fs.readFile(path.join(repo, 'Plugins/Sara/Notes.md'), 'utf-8')).toBe(
+      "---\nread: ['group/Go To Market']\n---\n# Notes\n",
+    );
+    expect(commits).toHaveLength(1);
+  });
+
+  describe('rename against the commit write gate', () => {
+    // The real commit gates every touched path on the actor's write rules and
+    // refuses the first one they may not write (git.service
+    // `assertCanWriteAtRef`); this stub does the same through the live model.
+    function gatedService(): { gated: GroupsAdminService; gatedCommits: { summary: string }[] } {
+      const workspace = stubWorkspace(root);
+      const access = new AccessControlService(workspace as never, KB, new NodeFs());
+      const workflow = stubWorkflow();
+      const svc = workflow.svc as unknown as Record<string, unknown>;
+      svc.commitChanges = async (ws: string, user: AuthUser, summary: string, onlyPaths: string[] = []) => {
+        const rel = onlyPaths.map((p) => p.slice(KB.length + 1));
+        const verdicts = await access.canWriteBatch(ws, user.email, rel);
+        const denied = rel.find((p) => verdicts.get(p) !== true);
+        if (denied) throw new AccessDeniedError({ path: denied, eligibleRoles: [], eligibleUsers: [] });
+        workflow.commits.push({ summary });
+        return {} as unknown;
+      };
+      const gated = new GroupsAdminService(workspace, workflow.svc, access, new NodeFs(), KB, () => DEFAULT_BRANCH);
+      return { gated, gatedCommits: workflow.commits };
+    }
+
+    const SARA_ACCESS = '---\nread:\n  - deny everyone\n  - Sara <sara@x.io>\nwrite:\n  - Sara <sara@x.io>\n---\n';
+
+    it('a file the Admin cannot read refuses generically, never naming it, and writes nothing', async () => {
+      await write(repo, 'Plugins/Sara/access.md', SARA_ACCESS);
+      const notes = "---\nread: ['group/GTM Team']\n---\n# Notes\n";
+      await write(repo, 'Plugins/Sara/Notes.md', notes);
+      const { gated, gatedCommits } = gatedService();
+
+      const err = await gated.renameGroup(ADMIN, 'gtm team', 'Go To Market').catch((e: unknown) => e);
+      expect(err).toBeInstanceOf(GroupsAdminError);
+      expect((err as GroupsAdminError).status).toBe(422);
+      expect((err as Error).message).toBe(UNSHOWN_REFERENCE_REFUSAL);
+      expect((err as Error).message).not.toContain('Sara');
+      // Restored: the hidden file, and the roster, as they were.
+      expect(await fs.readFile(path.join(repo, 'Plugins/Sara/Notes.md'), 'utf-8')).toBe(notes);
+      expect(await groupsYaml()).toBe(GROUPS);
+      expect(gatedCommits).toHaveLength(0);
+    });
+
+    it('a file the Admin can read but not write keeps the refusal that names it', async () => {
+      await write(repo, 'Knowledge/Locked/access.md', '---\nread:\n  - everyone\nwrite:\n  - deny Admin\n---\n');
+      await write(repo, 'Knowledge/Locked/Plan.md', '---\nread:\n  - group/GTM Team\n---\n# Plan\n');
+      const { gated } = gatedService();
+
+      const err = await gated.renameGroup(ADMIN, 'gtm team', 'Go To Market').catch((e: unknown) => e);
+      expect(err).toBeInstanceOf(AccessDeniedError);
+      expect((err as AccessDeniedError).access.path).toMatch(/^Knowledge\/Locked\//);
+    });
+
+    it('a hidden file that names something else does not block the rename', async () => {
+      await write(repo, 'Plugins/Sara/access.md', SARA_ACCESS);
+      await write(repo, 'Plugins/Sara/Notes.md', "---\nread: ['group/Product']\n---\n# Notes\n");
+      await write(repo, 'Knowledge/Sales/access.md', '---\nread:\n  - group/GTM Team\n---\n');
+      const { gated, gatedCommits } = gatedService();
+
+      await gated.renameGroup(ADMIN, 'gtm team', 'Go To Market');
+      expect(await fs.readFile(path.join(repo, 'Knowledge/Sales/access.md'), 'utf-8')).toContain('group/Go To Market');
+      expect(gatedCommits).toHaveLength(1);
+    });
+  });
+
   it('rename rewrites a BODY-GOVERNED access.md (rules live below the frontmatter)', async () => {
     // New-format file: frontmatter governs access.md itself, the body is the
     // folder's rules — exactly what the resolver enforces.
@@ -262,14 +354,15 @@ describe('GroupsAdminService', () => {
       '---\nwrite:\n  - Admin\n---\nread:\n  - GTM Team\nwrite:\n  - deny GTM Team\n',
     );
     // The scan must see the body rule too (delete warnings / referencedBy).
-    const roster = await service.getRoster();
+    const roster = await service.getRoster('admin@x.io');
     const gtm = roster.groups.find((g) => g.canonical === 'gtm team');
     expect(gtm?.referencedBy).toContainEqual({ path: 'Knowledge/Sales/access.md', verb: 'read' });
 
     await service.renameGroup(ADMIN, 'gtm team', 'Go To Market');
     const rewritten = await fs.readFile(path.join(repo, 'Knowledge/Sales/access.md'), 'utf-8');
-    expect(rewritten).toContain('- Go To Market');
-    expect(rewritten).toContain('- deny Go To Market');
+    // Rewritten as the explicit group token, whatever the old spelling.
+    expect(rewritten).toContain('- group/Go To Market');
+    expect(rewritten).toContain('- deny group/Go To Market');
     expect(rewritten).not.toContain('GTM Team');
     // The frontmatter self-rule is a rule source too, and Admin is untouched.
     expect(rewritten).toContain('- Admin');
@@ -303,6 +396,7 @@ describe('GroupsAdminService', () => {
       workspace,
       workflow.svc,
       new AccessControlService(workspace as never, KB, new NodeFs()),
+      new NodeFs(),
       KB,
       () => DEFAULT_BRANCH,
     );
@@ -349,6 +443,7 @@ describe('GroupsAdminService', () => {
       workspace,
       workflow.svc,
       new AccessControlService(workspace as never, KB, new NodeFs()),
+      new NodeFs(),
       KB,
       () => DEFAULT_BRANCH,
     );
@@ -388,6 +483,7 @@ describe('GroupsAdminService', () => {
       workspace,
       workflow.svc,
       new AccessControlService(workspace as never, KB, new NodeFs()),
+      new NodeFs(),
       KB,
       () => DEFAULT_BRANCH,
     );
@@ -421,27 +517,124 @@ describe('groups-edit guardrails', () => {
 });
 
 describe('groups roster referencedBy — the mirror of the roles roster attribution', () => {
-  it('a group shadowed BY a role name still owns its bare-token hits; role/<name> hits are never the group’s', async () => {
+  it('a group sharing a role name owns only its group/ hits; bare and role/ hits are the role’s', async () => {
     const root2 = await fs.mkdtemp(path.join(os.tmpdir(), 'bevel-groups-shadow-'));
     try {
       const repo2 = path.join(root2, KB);
-      // A group named Reviewer shares the Reviewer role's name. Group-first
-      // precedence gives the GROUP the bare key, so the bare hit is its
-      // reference; the explicit role/ hit belongs to the ROLE roster only.
+      // A group named Reviewer shares the Reviewer role's name. Role-first
+      // precedence gives the ROLE the bare key, so the bare and role/ hits
+      // belong to the ROLE roster; the group's reference is its group/ hit.
+      // The bare hit is reported so an Admin can rewrite it if the group
+      // was meant.
       await write(repo2, 'roles.yaml', ROLES); // declares role Reviewer
-      await write(repo2, 'groups.yaml', 'groups:\n  Reviewer:\n    - pat@x.io\n');
-      await write(repo2, 'team/access.md', '---\nread:\n  - Reviewer\nwrite:\n  - role/Reviewer\n---\n');
+      await write(repo2, 'groups.yaml', 'groups:\n  Reviewer:\n    - pat@x.io\n  Ops:\n    - ops@x.io\n');
+      await write(repo2, 'ops/access.md', '---\nread:\n  - Ops\nwrite:\n  - group/Ops\n---\n');
+      await write(
+        repo2,
+        'team/access.md',
+        '---\nread:\n  - Reviewer\nwrite:\n  - role/Reviewer\nowner:\n  - group/Reviewer\ndownload:\n  - deny Reviewer\n---\n',
+      );
       const workspace = stubWorkspace(root2);
       const svc = new GroupsAdminService(
         workspace,
         stubWorkflow().svc,
         new AccessControlService(workspace as never, KB, new NodeFs()),
+        new NodeFs(),
         KB,
         () => DEFAULT_BRANCH,
       );
-      const roster = await svc.getRoster();
+      // rev@x.io holds the Reviewer role, so it can read team/access.md.
+      const roster = await svc.getRoster('rev@x.io');
       const reviewer = roster.groups.find((g) => g.canonical === 'reviewer')!;
-      expect(reviewer.referencedBy).toEqual([{ path: 'team/access.md', verb: 'read' }]);
+      expect(reviewer.referencedBy).toEqual([{ path: 'team/access.md', verb: 'owner' }]);
+      // A bare DENIAL changed meaning too (it now denies the role, not the
+      // group), so it is reported alongside the bare grant.
+      expect(reviewer.bareNameResolvesToRole).toEqual([
+        { path: 'team/access.md', verb: 'read' },
+        { path: 'team/access.md', verb: 'download' },
+      ]);
+      // A group no role shares a name with keeps its bare hits, and has nothing
+      // to report. ops@x.io is in Ops, so it can read ops/access.md.
+      const ops = (await svc.getRoster('ops@x.io')).groups.find((g) => g.canonical === 'ops')!;
+      expect(ops.referencedBy).toEqual(
+        expect.arrayContaining([
+          { path: 'ops/access.md', verb: 'read' },
+          { path: 'ops/access.md', verb: 'write' },
+        ]),
+      );
+      expect(ops.referencedBy).toHaveLength(2);
+      expect(ops.bareNameResolvesToRole).toEqual([]);
+    } finally {
+      await fs.rm(root2, { recursive: true, force: true });
+    }
+  });
+
+  it('bareNameResolvesToRole names only the files the viewer can read', async () => {
+    const root2 = await fs.mkdtemp(path.join(os.tmpdir(), 'bevel-groups-disclose-'));
+    try {
+      const repo2 = path.join(root2, KB);
+      await write(repo2, 'roles.yaml', ROLES); // Admin: admin@x.io, Reviewer: rev@x.io
+      await write(repo2, 'groups.yaml', 'groups:\n  Reviewer:\n    - pat@x.io\n');
+      await write(repo2, 'access.md', '---\nread:\n  - everyone\nwrite:\n  - Admin\n---\n');
+      // Two bare Reviewer rules: one in an open folder, one in a node only
+      // the Reviewer role may read.
+      await write(repo2, 'team/access.md', '---\nwrite:\n  - Reviewer\n---\n');
+      await write(repo2, 'secret/Plan.md', '---\nread:\n  - deny everyone\n  - Reviewer\n---\n# Plan\n');
+      const workspace = stubWorkspace(root2);
+      const access = new AccessControlService(workspace as never, KB, new NodeFs());
+      const svc = new GroupsAdminService(workspace, stubWorkflow().svc, access, new NodeFs(), KB, () => DEFAULT_BRANCH);
+      const rowsFor = async (email: string) =>
+        (await svc.getRoster(email)).groups.find((g) => g.canonical === 'reviewer')!.bareNameResolvesToRole;
+
+      expect(await rowsFor('rev@x.io')).toEqual(
+        expect.arrayContaining([
+          { path: 'team/access.md', verb: 'write' },
+          { path: 'secret/Plan.md', verb: 'read' },
+        ]),
+      );
+      // pat@x.io is in the Reviewer GROUP, not the role: the bare grant is the
+      // role's, so the secret file is closed to pat, and so is its path.
+      expect(await access.canRead(workspaceIdForBranch(DEFAULT_BRANCH), 'pat@x.io', 'secret/Plan.md')).toBe(false);
+      expect(await rowsFor('pat@x.io')).toEqual([{ path: 'team/access.md', verb: 'write' }]);
+    } finally {
+      await fs.rm(root2, { recursive: true, force: true });
+    }
+  });
+
+  it('referencedBy names only the files the viewer can read and omits the rest entirely, uncounted', async () => {
+    const root2 = await fs.mkdtemp(path.join(os.tmpdir(), 'bevel-groups-disclose-refs-'));
+    try {
+      const repo2 = path.join(root2, KB);
+      await write(repo2, 'roles.yaml', ROLES); // Admin: admin@x.io, Reviewer: rev@x.io
+      await write(repo2, 'groups.yaml', 'groups:\n  Ops:\n    - ops@x.io\n');
+      await write(repo2, 'access.md', '---\nread:\n  - everyone\nwrite:\n  - Admin\n---\n');
+      // Two group/Ops rules: one in an open folder, one in a node only the
+      // Reviewer role may read.
+      await write(repo2, 'team/access.md', '---\nwrite:\n  - group/Ops\n---\n');
+      await write(
+        repo2,
+        'secret/Plan.md',
+        '---\nread:\n  - deny everyone\n  - Reviewer\nowner:\n  - deny group/Ops\n---\n# Plan\n',
+      );
+      const workspace = stubWorkspace(root2);
+      const svc = new GroupsAdminService(
+        workspace,
+        stubWorkflow().svc,
+        new AccessControlService(workspace as never, KB, new NodeFs()),
+        new NodeFs(),
+        KB,
+        () => DEFAULT_BRANCH,
+      );
+      const opsFor = async (email: string) =>
+        (await svc.getRoster(email)).groups.find((g) => g.canonical === 'ops')!;
+
+      const asReviewer = await opsFor('rev@x.io');
+      expect(asReviewer.referencedBy.map((r) => r.path).sort()).toEqual(['secret/Plan.md', 'team/access.md']);
+      // The Admin cannot read secret/Plan.md: its rule is left out entirely —
+      // not named, and not counted either (Admin status does not grant read).
+      const asAdmin = await opsFor('admin@x.io');
+      expect(asAdmin.referencedBy).toEqual([{ path: 'team/access.md', verb: 'write' }]);
+      expect(asAdmin).not.toHaveProperty('referencesHidden');
     } finally {
       await fs.rm(root2, { recursive: true, force: true });
     }

package/src/modules/access/__tests__/holder-changes.test.ts

@@ -0,0 +1,127 @@
+import { describe, it, expect, beforeEach, afterEach } from 'vitest';
+import fs from 'node:fs/promises';
+import path from 'node:path';
+import os from 'node:os';
+
+import { realDisk } from '../../../__tests__/real-disk.js';
+import type { WorkspaceService } from '../../workspace/index.js';
+import { AccessControlService } from '../access-control.service.js';
+
+/**
+ * `prospectiveHolderChanges`: who loses and who gains opening or editing a
+ * file or folder in a move, over a real on-disk tree. The holder lists name
+ * grants, so these tests are about the cases a list comparison gets wrong: a
+ * group still covered by `everyone` where it lands, and someone a rule there
+ * denies by name, even when their only access before was `everyone`.
+ */
+
+const KB_DIR = 'knowledge-base';
+const rules = (body: string) => `---\n${body}---\n`;
+
+describe('AccessControlService.prospectiveHolderChanges', () => {
+  let root: string;
+  let repo: string;
+  const workspaceId = 'ws-holder-changes';
+
+  beforeEach(async () => {
+    root = await fs.mkdtemp(path.join(os.tmpdir(), 'bevel-holder-changes-'));
+    repo = path.join(root, workspaceId, KB_DIR);
+  });
+  afterEach(async () => {
+    if (root) await fs.rm(root, { recursive: true, force: true });
+  });
+
+  async function write(files: Record<string, string>): Promise<void> {
+    for (const [rel, contents] of Object.entries(files)) {
+      const abs = path.join(repo, rel);
+      await fs.mkdir(path.dirname(abs), { recursive: true });
+      await fs.writeFile(abs, contents);
+    }
+  }
+
+  const service = () =>
+    new AccessControlService(
+      {
+        getWorkspacePath: async () => path.join(root, workspaceId),
+        ensureRemotesFetched: async () => undefined,
+      } as unknown as WorkspaceService,
+      KB_DIR,
+      realDisk(),
+    );
+
+  /** Everyone reads; Support and Operations each edit their own folder. */
+  const BASE = {
+    'roles.yaml': 'roles:\n  Admin:\n    - admin@x.io\n',
+    'groups.yaml': 'groups:\n  Support:\n    - bea@x.io\n  Operations:\n    - jonas@x.io\n',
+    'access.md': rules('read:\n  - everyone\n'),
+    'Support/access.md': rules('write:\n  - Support\n'),
+    'Support/Runbooks/Warranty claim.md': '# Warranty claim\n',
+    'Operations/access.md': rules('write:\n  - Operations\n'),
+  };
+
+  it('a folder handed to another team: the old team loses editing, the new one gains it, and nobody loses opening it', async () => {
+    await write(BASE);
+    const changes = await service().prospectiveHolderChanges(workspaceId, 'Support/Runbooks', 'Operations/Runbooks');
+    expect(changes).toEqual({
+      lose: [{ kind: 'group', name: 'Support', verb: 'write' }],
+      gain: [{ kind: 'group', name: 'Operations', verb: 'write' }],
+    });
+  });
+
+  it('a person the destination denies by name loses access, though everyone may still read there', async () => {
+    await write({
+      ...BASE,
+      'Team/access.md': rules('write:\n  - Ana <ana@x.io>\n'),
+      'Team/plan.md': '# Plan\n',
+      'Closed/access.md': rules('read:\n  - everyone\n  - deny Ana <ana@x.io>\n'),
+    });
+    const changes = await service().prospectiveHolderChanges(workspaceId, 'Team/plan.md', 'Closed/plan.md');
+    expect(changes.lose).toEqual(
+      expect.arrayContaining([
+        { kind: 'person', name: 'ana@x.io', email: 'ana@x.io', verb: 'read' },
+        { kind: 'person', name: 'ana@x.io', email: 'ana@x.io', verb: 'write' },
+      ]),
+    );
+  });
+
+  it('a person whose only access was everyone, and whom the destination denies by name, loses it', async () => {
+    await write({
+      ...BASE,
+      'Closed/access.md': rules('read:\n  - everyone\n  - deny Leo <leo@x.io>\n'),
+    });
+    const changes = await service().prospectiveHolderChanges(workspaceId, 'Support/Runbooks', 'Closed/Runbooks');
+    expect(changes.lose).toContainEqual({ kind: 'person', name: 'leo@x.io', email: 'leo@x.io', verb: 'read' });
+  });
+
+  it('a group whose only read was everyone, and which the destination denies, loses it', async () => {
+    await write({
+      ...BASE,
+      'Closed/access.md': rules('read:\n  - everyone\n  - deny Operations\n'),
+    });
+    const changes = await service().prospectiveHolderChanges(workspaceId, 'Support/Runbooks', 'Closed/Runbooks');
+    expect(changes.lose).toContainEqual({ kind: 'group', name: 'Operations', verb: 'read' });
+  });
+
+  it('a group the destination denies loses opening it, though everyone may still read there', async () => {
+    await write({
+      ...BASE,
+      'Closed/access.md': rules('read:\n  - everyone\n  - deny Support\n'),
+    });
+    const changes = await service().prospectiveHolderChanges(workspaceId, 'Support/Runbooks', 'Closed/Runbooks');
+    expect(changes.lose).toEqual(
+      expect.arrayContaining([
+        { kind: 'group', name: 'Support', verb: 'read' },
+        { kind: 'group', name: 'Support', verb: 'write' },
+      ]),
+    );
+  });
+
+  it('a rename that carries its own rules changes nobody', async () => {
+    await write({
+      ...BASE,
+      'Sales/access.md': rules('read:\n  - Support\nwrite:\n  - Support\n'),
+      'Sales/deal.md': '# Deal\n',
+    });
+    expect(await service().prospectiveHolderChanges(workspaceId, 'Sales', 'Revenue')).toEqual({ lose: [], gain: [] });
+  });
+});