@camstack/server 1.0.0 → 1.0.1

package/src/__tests__/cap-route-adapter.spec.ts

@@ -1,302 +0,0 @@
-/**
- * Unit tests for the two adapter factories and the resolver wired with them.
- *
- * Exercises:
- *  - createNodeCapAuthority: delegates to HubNodeRegistry correctly
- *  - createInProcessProviderLookup: invokes provider methods cast-free
- *  - Resolver wired with both adapters:
- *      hub-local UDS child cap resolves via callCapOnChild
- *      hub-resident singleton resolves in-process (invoke called)
- *      absent cap throws CapRouteError (NOT the old opaque string)
- *
- * We test the adapter factories directly + a resolver wired with them —
- * standing up a full MoleculerService is too heavy for a unit test, and
- * testing the adapters + resolver in isolation exercises the meaningful unit.
- */
-
-import { describe, it, expect, vi } from 'vitest'
-import { CapRouteError, CapRouteResolver } from '@camstack/kernel'
-import type {
-  NodeCapAuthority,
-  InProcessProviderLookup,
-  HubLocalChildDispatcher,
-  CapRouteResolverDeps,
-} from '@camstack/kernel'
-import type { InProcessProviderRef } from '@camstack/kernel'
-import {
-  createNodeCapAuthority,
-  createInProcessProviderLookup,
-} from '../core/moleculer/cap-route-authority.js'
-
-// ---------------------------------------------------------------------------
-// Helpers for stub HubNodeRegistry
-// ---------------------------------------------------------------------------
-
-interface StubNodeEntry {
-  readonly addonId: string
-  readonly capabilities: readonly string[]
-}
-
-function makeNodeRegistry(nodes: ReadonlyMap<string, readonly StubNodeEntry[]>) {
-  return {
-    getNodeManifest(nodeId: string) {
-      return nodes.get(nodeId)
-    },
-    listNodeIds(): readonly string[] {
-      return [...nodes.keys()]
-    },
-  }
-}
-
-// ---------------------------------------------------------------------------
-// Helpers for stub CapabilityService
-// ---------------------------------------------------------------------------
-
-function makeCapabilityService(providers: ReadonlyMap<string, Record<string, unknown>>) {
-  return {
-    getSingleton<T>(capability: string): T | null {
-      return (providers.get(capability) as T) ?? null
-    },
-  }
-}
-
-// ---------------------------------------------------------------------------
-// createNodeCapAuthority
-// ---------------------------------------------------------------------------
-
-describe('createNodeCapAuthority', () => {
-  const nodes = new Map([
-    [
-      'hub/stream-broker',
-      [{ addonId: 'addon-stream-broker', capabilities: ['stream-broker', 'stream-params'] }],
-    ],
-    ['dev-agent-0', [{ addonId: 'addon-detection-pipeline', capabilities: ['pipeline-executor'] }]],
-  ])
-  const registry = makeNodeRegistry(nodes)
-  const authority = createNodeCapAuthority(registry)
-
-  it('nodeKnowsCap returns true when the node manifest includes the cap', () => {
-    expect(authority.nodeKnowsCap('hub/stream-broker', 'stream-broker')).toBe(true)
-    expect(authority.nodeKnowsCap('hub/stream-broker', 'stream-params')).toBe(true)
-    expect(authority.nodeKnowsCap('hub/stream-broker', 'ghost-cap')).toBe(false)
-  })
-
-  it('nodeKnowsCap returns false for unknown nodes', () => {
-    expect(authority.nodeKnowsCap('not-a-node', 'stream-broker')).toBe(false)
-  })
-
-  it('getAddonId returns the addonId for a known cap', () => {
-    expect(authority.getAddonId('hub/stream-broker', 'stream-broker')).toBe('addon-stream-broker')
-    expect(authority.getAddonId('dev-agent-0', 'pipeline-executor')).toBe(
-      'addon-detection-pipeline',
-    )
-  })
-
-  it('getAddonId returns null for missing nodes or caps', () => {
-    expect(authority.getAddonId('not-a-node', 'stream-broker')).toBeNull()
-    expect(authority.getAddonId('hub/stream-broker', 'ghost-cap')).toBeNull()
-  })
-
-  it('nodeIsAgent: hub and hub-children are NOT agents; bare-id non-hub nodes are agents', () => {
-    expect(authority.nodeIsAgent('hub')).toBe(false)
-    expect(authority.nodeIsAgent('hub/stream-broker')).toBe(false)
-    expect(authority.nodeIsAgent('dev-agent-0')).toBe(true)
-    expect(authority.nodeIsAgent('some-remote-agent')).toBe(true)
-  })
-
-  it('nodeOnline: nodes in the registry are online; absent ones are not', () => {
-    expect(authority.nodeOnline('hub/stream-broker')).toBe(true)
-    expect(authority.nodeOnline('dev-agent-0')).toBe(true)
-    expect(authority.nodeOnline('not-registered')).toBe(false)
-  })
-
-  it('listNodeIds returns all registered node ids', () => {
-    const ids = authority.listNodeIds()
-    expect(ids).toContain('hub/stream-broker')
-    expect(ids).toContain('dev-agent-0')
-    expect(ids).toHaveLength(2)
-  })
-
-  it('getAgentChildId always returns null (hub cannot resolve; Task 6 handles it)', () => {
-    expect(authority.getAgentChildId('dev-agent-0', 'pipeline-executor')).toBeNull()
-  })
-})
-
-// ---------------------------------------------------------------------------
-// createNodeCapAuthority — per-node singleton override
-// ---------------------------------------------------------------------------
-
-describe('createNodeCapAuthority — per-node singleton override', () => {
-  it('getAddonId honors the per-node singleton override when available', () => {
-    const nodeRegistry = {
-      getNodeManifest: (id: string) =>
-        id === 'dev-agent-0'
-          ? [
-              { addonId: 'webrtc-native', capabilities: ['webrtc-session'] },
-              { addonId: 'stream-broker', capabilities: ['webrtc-session'] },
-            ]
-          : undefined,
-      listNodeIds: () => ['hub', 'dev-agent-0'],
-    }
-    const authority = createNodeCapAuthority(nodeRegistry, {
-      resolveSingleton: (cap, nodeId) =>
-        cap === 'webrtc-session' && nodeId === 'dev-agent-0' ? 'stream-broker' : null,
-    })
-    expect(authority.getAddonId('dev-agent-0', 'webrtc-session')).toBe('stream-broker')
-  })
-
-  it('getAddonId falls back to first manifest match without an override', () => {
-    const nodeRegistry = {
-      getNodeManifest: (id: string) =>
-        id === 'dev-agent-0'
-          ? [{ addonId: 'webrtc-native', capabilities: ['webrtc-session'] }]
-          : undefined,
-      listNodeIds: () => ['hub', 'dev-agent-0'],
-    }
-    const authority = createNodeCapAuthority(nodeRegistry, { resolveSingleton: () => null })
-    expect(authority.getAddonId('dev-agent-0', 'webrtc-session')).toBe('webrtc-native')
-  })
-})
-
-// ---------------------------------------------------------------------------
-// createInProcessProviderLookup
-// ---------------------------------------------------------------------------
-
-describe('createInProcessProviderLookup', () => {
-  it('returns null for a cap not hosted in-process', () => {
-    const lookup = createInProcessProviderLookup(makeCapabilityService(new Map()))
-    expect(lookup('device-manager')).toBeNull()
-  })
-
-  it('returns an InProcessProviderRef whose invoke delegates to the provider method', async () => {
-    const getStatusImpl = vi.fn().mockReturnValue({ ok: true })
-    const providers = new Map<string, Record<string, unknown>>([
-      ['device-manager', { getStatus: getStatusImpl }],
-    ])
-    const lookup = createInProcessProviderLookup(makeCapabilityService(providers))
-
-    const ref = lookup('device-manager')
-    expect(ref).not.toBeNull()
-
-    const result = await ref!.invoke('getStatus', { deviceId: 1 })
-    expect(result).toEqual({ ok: true })
-    expect(getStatusImpl).toHaveBeenCalledOnce()
-    expect(getStatusImpl).toHaveBeenCalledWith({ deviceId: 1 })
-  })
-
-  it('invoke throws a typed Error when the method is not a function (never casts)', async () => {
-    const providers = new Map<string, Record<string, unknown>>([
-      ['device-manager', { notAFn: 'some-string' }],
-    ])
-    const lookup = createInProcessProviderLookup(makeCapabilityService(providers))
-    const ref = lookup('device-manager')
-    expect(ref).not.toBeNull()
-
-    await expect(ref!.invoke('notAFn', {})).rejects.toThrow(/method "notAFn" not found/)
-    await expect(ref!.invoke('missingMethod', {})).rejects.toThrow(
-      /method "missingMethod" not found/,
-    )
-  })
-})
-
-// ---------------------------------------------------------------------------
-// Resolver wired with both adapters
-// ---------------------------------------------------------------------------
-
-describe('Resolver + adapters — end-to-end dispatch', () => {
-  const HUB_NODE_ID = 'hub'
-
-  function makeCallCapOnChildSpy() {
-    return vi.fn(async (_childId: string, _input: unknown) => ({ ok: true, from: 'uds' }))
-  }
-
-  function makeHubLocalRegistry(
-    caps: ReadonlyMap<string, string>,
-  ): HubLocalChildDispatcher & { callSpy: ReturnType<typeof vi.fn> } {
-    const callSpy = makeCallCapOnChildSpy()
-    return {
-      resolveChildId: (capName: string) => caps.get(capName) ?? null,
-      callCapOnChild: callSpy,
-      callSpy,
-    }
-  }
-
-  it('hub-local UDS child cap resolves via callCapOnChild', async () => {
-    // Registry: stream-broker is served by a hub-local child.
-    const nodes = new Map([
-      ['hub/stream-broker', [{ addonId: 'addon-stream-broker', capabilities: ['stream-broker'] }]],
-    ])
-    const nodeRegistry = makeNodeRegistry(nodes)
-    const authority = createNodeCapAuthority(nodeRegistry)
-
-    const hubLocalCaps = new Map([['stream-broker', 'addon-stream-broker']])
-    const hubLocalRegistry = makeHubLocalRegistry(hubLocalCaps)
-
-    const lookup = createInProcessProviderLookup(makeCapabilityService(new Map()))
-
-    const deps: CapRouteResolverDeps = {
-      hubNodeId: HUB_NODE_ID,
-      broker: { call: vi.fn(), waitForServices: vi.fn() },
-      hubLocalRegistry,
-      nodeAuthority: authority,
-      inProcessProviders: lookup,
-    }
-
-    const resolver = new CapRouteResolver(deps)
-    const route = resolver.resolveCapRoute('stream-broker', { nodeId: HUB_NODE_ID })
-    expect(route.kind).toBe('hub-local-uds')
-
-    const result = await resolver.dispatch(route, 'attachCamera', { deviceId: 5 })
-    expect(result).toEqual({ ok: true, from: 'uds' })
-    expect(hubLocalRegistry.callSpy).toHaveBeenCalledOnce()
-  })
-
-  it('hub-resident singleton resolves in-process via invoke', async () => {
-    const invokeSpy = vi.fn().mockResolvedValue({ devices: [] })
-    const providers = new Map<string, Record<string, unknown>>([
-      ['device-manager', { listAll: invokeSpy }],
-    ])
-    const lookup = createInProcessProviderLookup(makeCapabilityService(providers))
-
-    const deps: CapRouteResolverDeps = {
-      hubNodeId: HUB_NODE_ID,
-      broker: { call: vi.fn(), waitForServices: vi.fn() },
-      hubLocalRegistry: null,
-      nodeAuthority: createNodeCapAuthority(makeNodeRegistry(new Map())),
-      inProcessProviders: lookup,
-    }
-
-    const resolver = new CapRouteResolver(deps)
-    const route = resolver.resolveCapRoute('device-manager', { nodeId: HUB_NODE_ID })
-    expect(route.kind).toBe('hub-in-process')
-
-    const result = await resolver.dispatch(route, 'listAll', {})
-    expect(result).toEqual({ devices: [] })
-    expect(invokeSpy).toHaveBeenCalledOnce()
-  })
-
-  it('genuinely-absent cap throws CapRouteError, NOT the old opaque string', () => {
-    const deps: CapRouteResolverDeps = {
-      hubNodeId: HUB_NODE_ID,
-      broker: { call: vi.fn(), waitForServices: vi.fn() },
-      hubLocalRegistry: null,
-      nodeAuthority: createNodeCapAuthority(makeNodeRegistry(new Map())),
-      inProcessProviders: createInProcessProviderLookup(makeCapabilityService(new Map())),
-    }
-    const resolver = new CapRouteResolver(deps)
-
-    let thrown: unknown
-    try {
-      resolver.resolveCapRoute('ghost-cap', {})
-    } catch (e) {
-      thrown = e
-    }
-
-    expect(thrown).toBeInstanceOf(CapRouteError)
-    expect((thrown as CapRouteError).reason).toBe('no-provider')
-    // Must NOT be the old opaque string
-    expect((thrown as CapRouteError).message).not.toContain(
-      'Capability "ghost-cap" not available on node',
-    )
-  })
-})

package/src/__tests__/cap-routers/_meta.spec.ts

@@ -1,199 +0,0 @@
-/**
- * Meta-test: ensures that every capability with methods has a corresponding
- * `<cap-name>.router.spec.ts` file in this directory. This prevents new caps
- * from being added without a router-level test.
- *
- * Caps listed in `ALLOWED_MISSING` are explicitly exempted (document why).
- */
-import { describe, it, expect } from 'vitest'
-import * as fs from 'node:fs'
-import * as path from 'node:path'
-import * as capsModule from '@camstack/types'
-import type { CapabilityDefinition } from '@camstack/types'
-
-/**
- * Caps that are knowingly untested at the router level.
- * Keep this list empty whenever possible — every entry is tech debt.
- */
-const ALLOWED_MISSING: ReadonlySet<string> = new Set<string>([
-  // Populated during migration. Goal: drain to empty.
-])
-
-function isCapabilityDefinition(value: unknown): value is CapabilityDefinition {
-  if (value === null || typeof value !== 'object') return false
-  const v = value as Record<string, unknown>
-  return (
-    typeof v['name'] === 'string' &&
-    typeof v['scope'] === 'string' &&
-    typeof v['mode'] === 'string' &&
-    typeof v['methods'] === 'object' &&
-    v['methods'] !== null
-  )
-}
-
-function collectCapabilitiesWithMethods(): readonly CapabilityDefinition[] {
-  const out: CapabilityDefinition[] = []
-  for (const [key, value] of Object.entries(capsModule)) {
-    if (!key.endsWith('Capability')) continue
-    if (!isCapabilityDefinition(value)) continue
-    if (Object.keys(value.methods).length === 0) continue
-    out.push(value)
-  }
-  return out.toSorted((a, b) => a.name.localeCompare(b.name))
-}
-
-function specFileNameFor(capName: string): string {
-  return `${capName}.router.spec.ts`
-}
-
-describe('cap-routers meta', () => {
-  const caps = collectCapabilitiesWithMethods()
-  const specDir = path.dirname(new URL(import.meta.url).pathname)
-  const existingSpecs = new Set(
-    fs.readdirSync(specDir).filter((f) => f.endsWith('.router.spec.ts')),
-  )
-
-  it('discovers at least one capability with methods', () => {
-    expect(caps.length).toBeGreaterThan(0)
-  })
-
-  it('every capability has a <cap>.router.spec.ts (or is in ALLOWED_MISSING)', () => {
-    const missing: string[] = []
-    for (const cap of caps) {
-      const expected = specFileNameFor(cap.name)
-      if (!existingSpecs.has(expected) && !ALLOWED_MISSING.has(cap.name)) {
-        missing.push(cap.name)
-      }
-    }
-
-    // Soft-fail during migration: list missing but warn loudly.
-    // Flip to `expect(missing).toEqual([])` once coverage is complete.
-    if (missing.length > 0) {
-      console.warn(
-        `\n[cap-routers meta] ${missing.length} capabilities lack a router spec:\n  - ${missing.join('\n  - ')}\n`,
-      )
-    }
-    // Hard gate: at least one real spec must exist so the harness stays exercised.
-    expect(existingSpecs.size).toBeGreaterThanOrEqual(1)
-  })
-
-  it('ALLOWED_MISSING only references real capabilities', () => {
-    const names = new Set(caps.map((c) => c.name))
-    for (const name of ALLOWED_MISSING) {
-      expect(names, `ALLOWED_MISSING references unknown cap "${name}"`).toContain(name)
-    }
-  })
-
-  // ── Subscription codegen guard ──────────────────────────────────────
-  //
-  // Enumerates every capability method and, for each method marked
-  // `kind: 'subscription'`, verifies that the generated cap-router file
-  // includes the corresponding `.subscription(` wiring and the
-  // `iterableSubscription` import. This catches codegen drift when new
-  // subscription methods are added to caps.
-  describe('subscription codegen', () => {
-    const generatedPath = path.resolve(specDir, '../../api/trpc/generated-cap-routers.ts')
-    const generatedSource = fs.existsSync(generatedPath)
-      ? fs.readFileSync(generatedPath, 'utf-8')
-      : null
-
-    it('generated-cap-routers.ts exists', () => {
-      expect(generatedSource, `expected generated file at ${generatedPath}`).not.toBeNull()
-    })
-
-    const subscriptionMethods: Array<{ capName: string; methodName: string }> = []
-    for (const cap of caps) {
-      for (const [methodName, schema] of Object.entries(cap.methods)) {
-        if (schema.kind === 'subscription') {
-          subscriptionMethods.push({ capName: cap.name, methodName })
-        }
-      }
-    }
-
-    it('if any cap has subscriptions, iterableSubscription is imported', () => {
-      if (subscriptionMethods.length === 0 || generatedSource === null) return
-      expect(
-        generatedSource,
-        'generated-cap-routers.ts must import iterableSubscription when any cap has kind: "subscription"',
-      ).toContain('iterableSubscription')
-    })
-
-    it('every subscription method is wired in the generated router', () => {
-      if (generatedSource === null) return
-      const missing: string[] = []
-      for (const { capName, methodName } of subscriptionMethods) {
-        // The generator emits `${methodName}: procedure\n      .input(...)\n      .subscription(`.
-        // We check for the method-name line followed by `.subscription(` within a small window.
-        const nameIdx = generatedSource.indexOf(`${methodName}:`)
-        if (nameIdx === -1) {
-          missing.push(`${capName}.${methodName} (method name not found)`)
-          continue
-        }
-        const window = generatedSource.slice(nameIdx, nameIdx + 300)
-        if (!window.includes('.subscription(')) {
-          missing.push(`${capName}.${methodName} (no .subscription( call within 300 chars)`)
-        }
-      }
-      expect(
-        missing,
-        `Subscription codegen drift — re-run: npx tsx scripts/generate-cap-routers.ts\n  ${missing.join('\n  ')}`,
-      ).toEqual([])
-    })
-
-    it('reports the subscription method inventory (informational)', () => {
-      // Not an assertion — this keeps the metric visible in test output.
-      console.log(
-        `[subscription codegen] ${subscriptionMethods.length} subscription method(s) across ${caps.length} caps`,
-      )
-      if (subscriptionMethods.length > 0) {
-        for (const { capName, methodName } of subscriptionMethods) {
-          console.log(`  ${capName}.${methodName}`)
-        }
-      }
-    })
-  })
-
-  // ── Output-validation codegen guard ────────────────────────────────
-  //
-  // Per device-proxy redesign §6.8 / Task 4.1, every non-subscription
-  // procedure in the generated cap-router file must declare an `.output()`
-  // call so that tRPC validates response shapes at runtime. Subscriptions
-  // are exempt — tRPC v11 does not support `.output()` on subscriptions.
-  describe('output-validation codegen', () => {
-    const generatedPath = path.resolve(specDir, '../../api/trpc/generated-cap-routers.ts')
-    const generatedSource = fs.existsSync(generatedPath)
-      ? fs.readFileSync(generatedPath, 'utf-8')
-      : null
-
-    it('every non-subscription procedure declares .output()', () => {
-      expect(generatedSource, `expected generated file at ${generatedPath}`).not.toBeNull()
-      if (generatedSource === null) return
-
-      // tRPC procedure call sites are spelled `.query(async` / `.mutation(async`
-      // when they're emitted as router endpoints — the few in-body `p.query(...)`
-      // / `p.mutation(...)` calls don't include `(async`, so this filter is exact.
-      const procedureCallRegex = /\.(query|mutation)\(async/g
-      const procedureCount = (generatedSource.match(procedureCallRegex) ?? []).length
-      const outputCount = (generatedSource.match(/\.output\(/g) ?? []).length
-
-      expect(
-        outputCount,
-        `output-validation codegen drift — expected at least ${procedureCount} .output() ` +
-          `calls (one per query/mutation), found ${outputCount}. ` +
-          `Re-run: npx tsx scripts/generate-cap-routers.ts`,
-      ).toBeGreaterThanOrEqual(procedureCount)
-    })
-
-    it('reports the procedure / output-call inventory (informational)', () => {
-      if (generatedSource === null) return
-      const queryCount = (generatedSource.match(/\.query\(async/g) ?? []).length
-      const mutationCount = (generatedSource.match(/\.mutation\(async/g) ?? []).length
-      const subscriptionCount = (generatedSource.match(/\.subscription\(/g) ?? []).length
-      const outputCount = (generatedSource.match(/\.output\(/g) ?? []).length
-      console.log(
-        `[output-validation codegen] queries=${queryCount} mutations=${mutationCount} ` +
-          `subscriptions=${subscriptionCount} outputs=${outputCount}`,
-      )
-    })
-  })
-})

package/src/__tests__/cap-routers/addon-settings.router.spec.ts

@@ -1,115 +0,0 @@
-/**
- * Spec for the codegen'd `addon-settings` capability router.
- *
- * Exercises:
- *  - All 4 methods (get/update × global/device) — `getAddonSettings` /
- *    `updateAddonSettings` were collapsed into the global pair when the
- *    three-level settings API was simplified.
- *  - Auth enforcement (getters=protected, updaters=admin)
- *  - Missing provider → PRECONDITION_FAILED
- *  - Device settings routing with deviceId
- */
-import { describe, it, expect, vi } from 'vitest'
-import { createCapRouter_addonSettings } from '../../api/trpc/generated-cap-routers.js'
-import type { IAddonSettingsProvider } from '@camstack/types'
-import { makeCtx, invokeProcedure, checkAuthMatrix } from './harness.js'
-
-function makeMockProvider(): IAddonSettingsProvider {
-  return {
-    getGlobalSettings: vi.fn(async () => ({
-      sections: [{ id: 'g', title: 'Global', fields: [] }],
-    })),
-    updateGlobalSettings: vi.fn(async () => ({ success: true as const })),
-    getDeviceSettings: vi.fn(async () => ({
-      sections: [{ id: 'd', title: 'Device', fields: [] }],
-    })),
-    updateDeviceSettings: vi.fn(async () => ({ success: true as const })),
-  } as unknown as IAddonSettingsProvider
-}
-
-describe('addon-settings cap router', () => {
-  it('getGlobalSettings returns schema', async () => {
-    const provider = makeMockProvider()
-    const router = createCapRouter_addonSettings(() => provider)
-    const result = await invokeProcedure(router, 'getGlobalSettings', makeCtx('admin'), {
-      addonId: 'test',
-    })
-    expect(result.ok).toBe(true)
-    if (result.ok)
-      expect(result.value).toEqual({ sections: [{ id: 'g', title: 'Global', fields: [] }] })
-    expect(provider.getGlobalSettings).toHaveBeenCalledWith({ addonId: 'test' })
-  })
-
-  it('updateGlobalSettings returns success', async () => {
-    const provider = makeMockProvider()
-    const router = createCapRouter_addonSettings(() => provider)
-    const result = await invokeProcedure(router, 'updateGlobalSettings', makeCtx('admin'), {
-      addonId: 'test',
-      patch: { volume: 50 },
-    })
-    expect(result.ok).toBe(true)
-    if (result.ok) expect(result.value).toEqual({ success: true })
-  })
-
-  it('getDeviceSettings passes deviceId', async () => {
-    const provider = makeMockProvider()
-    const router = createCapRouter_addonSettings(() => provider)
-    await invokeProcedure(router, 'getDeviceSettings', makeCtx('admin'), {
-      addonId: 'test',
-      deviceId: 1,
-    })
-    expect(provider.getDeviceSettings).toHaveBeenCalledWith({ addonId: 'test', deviceId: 1 })
-  })
-
-  it('updateDeviceSettings passes deviceId + patch', async () => {
-    const provider = makeMockProvider()
-    const router = createCapRouter_addonSettings(() => provider)
-    await invokeProcedure(router, 'updateDeviceSettings', makeCtx('admin'), {
-      addonId: 'test',
-      deviceId: 1,
-      patch: { enabled: false },
-    })
-    expect(provider.updateDeviceSettings).toHaveBeenCalledWith({
-      addonId: 'test',
-      deviceId: 1,
-      patch: { enabled: false },
-    })
-  })
-
-  it('returns PRECONDITION_FAILED when provider is null', async () => {
-    const router = createCapRouter_addonSettings(() => null)
-    const result = await invokeProcedure(router, 'getGlobalSettings', makeCtx('admin'), {
-      addonId: 'x',
-    })
-    expect(result.ok).toBe(false)
-    if (!result.ok) expect(result.code).toBe('PRECONDITION_FAILED')
-  })
-
-  it('getters enforce protected auth', async () => {
-    const provider = makeMockProvider()
-    const router = createCapRouter_addonSettings(() => provider)
-    for (const method of ['getGlobalSettings', 'getDeviceSettings']) {
-      const input = method.includes('Device') ? { addonId: 'x', deviceId: 1 } : { addonId: 'x' }
-      const results = await checkAuthMatrix(router, method, 'protected', input)
-      for (const r of results) {
-        if (r.allowed) expect(r.outcome.ok).toBe(true)
-        else expect(r.outcome.ok).toBe(false)
-      }
-    }
-  })
-
-  it('updaters enforce admin auth', async () => {
-    const provider = makeMockProvider()
-    const router = createCapRouter_addonSettings(() => provider)
-    for (const method of ['updateGlobalSettings', 'updateDeviceSettings']) {
-      const input = method.includes('Device')
-        ? { addonId: 'x', deviceId: 1, patch: {} }
-        : { addonId: 'x', patch: {} }
-      const results = await checkAuthMatrix(router, method, 'admin', input)
-      for (const r of results) {
-        if (r.allowed) expect(r.outcome.ok).toBe(true)
-        else expect(r.outcome.ok).toBe(false)
-      }
-    }
-  })
-})