@cardstack/boxel-cli 0.9.0 → 0.10.0-unstable.0

package/bundled-test-harness/assets/realm-policy-test-DhKabhlk.js

@@ -1,1141 +0,0 @@
-import { s as __toESM } from "./chunk-Rp0pCe6z.js";
-import { Ar as testRealmURL, di as DEFAULT_ANONYMOUS_RATE_LIMIT, ua as IndexWriter } from "./runtime-common-ClpqhbwG.js";
-import { y as rri } from "./paths-BYHDgqsT.js";
-import { b as PermissionsContextName } from "./constants-CqKWhRfY.js";
-import { M as waitUntil, T as settled, d as click, o as waitFor, s as fillIn } from "./dist-BOAdzfkP.js";
-import { t as require_qunit } from "./qunit-C-Foo4Nd.js";
-import { D as realmConfigCardJSON, F as setupLocalIndexing, M as setupCardLogs, P as setupIntegrationTestRealm, b as getDbAdapter, lt as setupRenderingTest, nt as provide, t as setupMockMatrix } from "./mock-matrix-DPQ0j2MD.js";
-import { r as getService } from "./dist-CPfIHBla.js";
-import { Y as serializeCard } from "./field-support-DdQ7XgyM.js";
-import "./card-api-u1pOrwS6.js";
-import { t as renderCard } from "./render-component-B15Z0e2v.js";
-import { t as setupCatalogTestSubset } from "./catalog-test-subset-Dvz5g8wa.js";
-//#region tests/integration/realm-policy-test.gts
-var import_qunit = /* @__PURE__ */ __toESM(require_qunit());
-var policyRef = {
-	module: rri("@cardstack/catalog/realm-policy/realm-policy"),
-	name: "RealmPolicy"
-};
-var teacherPredicate = "  actor() in .teacherIds  ";
-var rosterPredicate = ".roster.providerIds contains actor()";
-var providerPredicate = ".providerId == actor()";
-function policyDocument(rules) {
-	return { data: {
-		type: "card",
-		attributes: {
-			cardInfo: { name: "Education" },
-			rules
-		},
-		meta: { adoptsFrom: policyRef }
-	} };
-}
-var educationPolicy = policyDocument([{
-	targetType: {
-		module: "../classroom",
-		name: "Classroom"
-	},
-	grants: [{ operation: "read" }, {
-		operation: "appendActivity",
-		where: teacherPredicate
-	}]
-}, {
-	targetType: {
-		module: "../schedule",
-		name: "Schedule"
-	},
-	grants: [{
-		operation: "read",
-		where: {
-			bxl: rosterPredicate,
-			snapshot: true
-		}
-	}, {
-		operation: "listMySchedules",
-		where: providerPredicate
-	}]
-}]);
-var BACKTICK = "`";
-var ANONYMOUS = "actor() == \"anonymous\"";
-var PLATFORM_LIMIT = {
-	requests: 17,
-	windowSeconds: 45
-};
-var PLATFORM_LIMIT_LINE = `${PLATFORM_LIMIT.requests}/${PLATFORM_LIMIT.windowSeconds} (platform default where unset)`;
-var TEACHER = "@teacher:localhost";
-var COLLEAGUE = "@colleague:localhost";
-var leadsPredicate = ".leadTeacherIds | any(. == actor())";
-var teachesPredicate = ".teacherIds | any(. == actor())";
-var classroomModule = `
-  import { contains, containsMany, field, CardDef } from "@cardstack/base/card-api";
-  import StringField from "@cardstack/base/string";
-
-  export class Classroom extends CardDef {
-    @field title = contains(StringField);
-    @field teacherIds = containsMany(StringField);
-    @field leadTeacherIds = containsMany(StringField);
-  }
-`;
-var rosterModule = `
-  import { contains, containsMany, field, linksToMany, CardDef } from "@cardstack/base/card-api";
-  import StringField from "@cardstack/base/string";
-
-  export class Student extends CardDef {
-    @field name = contains(StringField);
-  }
-
-  export class Roster extends CardDef {
-    @field teacherIds = containsMany(StringField);
-    @field students = linksToMany(() => Student);
-  }
-`;
-function classroom(teacherIds) {
-	return { data: {
-		type: "card",
-		attributes: {
-			teacherIds,
-			leadTeacherIds: []
-		},
-		meta: { adoptsFrom: {
-			module: "../classroom",
-			name: "Classroom"
-		} }
-	} };
-}
-var classroomPolicy = policyDocument([{
-	targetType: {
-		module: "../classroom",
-		name: "Classroom"
-	},
-	grants: [
-		{
-			operation: "delete",
-			where: leadsPredicate
-		},
-		{
-			operation: "delete",
-			where: teachesPredicate
-		},
-		{ operation: "update" }
-	]
-}]);
-(0, import_qunit.module)("Integration | realm policy", function(hooks) {
-	setupRenderingTest(hooks);
-	setupCatalogTestSubset(hooks);
-	setupLocalIndexing(hooks);
-	let loader;
-	let mockMatrixUtils = setupMockMatrix(hooks, {
-		loggedInAs: "@testuser:localhost",
-		activeRealms: [testRealmURL],
-		autostart: true
-	});
-	hooks.beforeEach(function() {
-		loader = getService("loader-service").loader;
-	});
-	setupCardLogs(hooks, async () => await loader.import("@cardstack/base/card-api"));
-	async function setupPolicyRealm(contents) {
-		let { realm } = await setupIntegrationTestRealm({
-			mockMatrixUtils,
-			contents,
-			anonymousRateLimit: PLATFORM_LIMIT
-		});
-		return realm;
-	}
-	async function loadPolicy(path) {
-		return await getService("store").get(`${testRealmURL}${path}`);
-	}
-	(0, import_qunit.test)("an authored policy indexes and reads back with its predicates as written", async function(assert) {
-		let doc = await (await setupPolicyRealm({ "policies/education.json": educationPolicy })).realmIndexQueryEngine.cardDocument(new URL(`${testRealmURL}policies/education`));
-		assert.strictEqual(doc?.type, "doc", `the policy indexes cleanly: ${JSON.stringify(doc?.type === "error" ? doc.error : void 0)}`);
-		let rules = doc?.type === "doc" ? doc.doc.data.attributes?.rules : [];
-		assert.deepEqual(rules.map((rule) => rule.grants.map((grant) => grant.operation)), [["read", "appendActivity"], ["read", "listMySchedules"]], "both rules and all four grants survive indexing, in order");
-		assert.strictEqual(rules[0].grants[1].where, teacherPredicate, "a bare-string predicate reads back as the same bare string");
-		assert.deepEqual(rules[1].grants[0].where, {
-			bxl: rosterPredicate,
-			snapshot: true
-		}, "the annotated snapshot form reads back as the annotated form");
-		assert.strictEqual(rules[1].grants[1].where, providerPredicate, "a second bare-string predicate is unaffected by its annotated sibling");
-		assert.strictEqual(rules[0].grants[0].where, null, "a grant authored with no predicate reads back with none, not an empty string");
-	});
-	(0, import_qunit.test)("a loaded policy resolves each target type relative to the policy card", async function(assert) {
-		await setupPolicyRealm({ "policies/education.json": educationPolicy });
-		let policy = await loadPolicy("policies/education");
-		assert.deepEqual(policy.rules.map((rule) => rule.targetType), [{
-			module: `${testRealmURL}classroom`,
-			name: "Classroom"
-		}, {
-			module: `${testRealmURL}schedule`,
-			name: "Schedule"
-		}], "targetType is a code ref resolved against the policy card");
-		assert.deepEqual(policy.rules.flatMap((rule) => rule.grants.map((grant) => grant.where)), [
-			null,
-			{
-				source: teacherPredicate,
-				snapshot: false
-			},
-			{
-				source: rosterPredicate,
-				snapshot: true
-			},
-			{
-				source: providerPredicate,
-				snapshot: false
-			}
-		], "both stored shapes read as one representation, told apart only by snapshot");
-	});
-	(0, import_qunit.test)("a predicate that is present but malformed fails the policy instead of reading as unconditional", async function(assert) {
-		let realm = await setupPolicyRealm({
-			"policies/typo.json": policyDocument([{
-				targetType: {
-					module: "../classroom",
-					name: "Classroom"
-				},
-				grants: [{
-					operation: "update",
-					where: {
-						bxl: rosterPredicate,
-						snapshop: true
-					}
-				}]
-			}]),
-			"policies/number.json": policyDocument([{
-				targetType: {
-					module: "../classroom",
-					name: "Classroom"
-				},
-				grants: [{
-					operation: "update",
-					where: 42
-				}]
-			}])
-		});
-		for (let [path, reason] of [["policies/typo", "accepts only 'bxl' and 'snapshot'"], ["policies/number", "must be a string of BXL source"]]) {
-			let entry = await realm.realmIndexQueryEngine.instance(new URL(`${testRealmURL}${path}`));
-			assert.strictEqual(entry?.type, "instance-error", `${path} is an index error rather than a policy with an unconditional grant`);
-			let error = entry?.type === "instance-error" ? entry.error : void 0;
-			assert.true(JSON.stringify(error ?? null).includes(reason), `${path} fails because its predicate is malformed: ${JSON.stringify(error?.message)}`);
-		}
-	});
-	(0, import_qunit.test)("the policy lists its rules and grants in isolated format", async function(assert) {
-		await setupPolicyRealm({ "policies/education.json": educationPolicy });
-		let policy = await loadPolicy("policies/education");
-		await renderCard(loader, policy, "isolated");
-		assert.dom("[data-test-realm-policy-isolated]").exists();
-		assert.dom("[data-test-policy-rule]").exists({ count: 2 });
-		assert.dom("[data-test-policy-rule-type-name]").exists({ count: 2 }).hasText("Classroom", "rules are listed by the type they govern");
-		assert.dom("[data-test-operation-grant]").exists({ count: 4 }, "every grant is listed");
-		assert.dom("[data-test-policy-rule-type-module]").hasText(`${testRealmURL}classroom`, "with the module that defines it");
-		assert.dom("[data-test-operation-grant-unconditional]").exists({ count: 1 }, "the grant with no predicate reads as always");
-		assert.dom("[data-test-policy-predicate-source]").exists({ count: 3 }, "each predicate is shown");
-		assert.deepEqual([...document.querySelectorAll("[data-test-policy-predicate-source]")].map((el) => el.textContent), [
-			teacherPredicate,
-			rosterPredicate,
-			providerPredicate
-		], "each predicate is shown exactly as written, with no added whitespace");
-		assert.dom("[data-test-policy-predicate-snapshot]").exists({ count: 1 }, "only the annotated predicate is marked snapshot");
-	});
-	(0, import_qunit.test)("the policy lists its rules and grants in embedded format", async function(assert) {
-		await setupPolicyRealm({ "policies/education.json": educationPolicy });
-		let policy = await loadPolicy("policies/education");
-		await renderCard(loader, policy, "embedded");
-		assert.dom("[data-test-realm-policy-embedded]").exists();
-		assert.dom("[data-test-policy-rule]").exists({ count: 2 });
-		assert.dom("[data-test-operation-grant]").exists({ count: 4 });
-		assert.dom("[data-test-operation-grant-operation]").hasText("read", "grants are listed by operation name");
-		assert.dom("[data-test-policy-predicate-snapshot]").exists({ count: 1 });
-	});
-	(0, import_qunit.test)("a grant opened to callers who are not signed in says so, and a write names the setting it acts as", async function(assert) {
-		await setupPolicyRealm({ "policies/public.json": policyDocument([{
-			targetType: {
-				module: "../classroom",
-				name: "Classroom"
-			},
-			grants: [
-				{
-					operation: "read",
-					where: ANONYMOUS
-				},
-				{
-					operation: "update",
-					where: ANONYMOUS,
-					actingUser: "realmConfig(\"feedbackWriter\")"
-				},
-				{ operation: "delete" }
-			]
-		}]) });
-		let policy = await loadPolicy("policies/public");
-		await renderCard(loader, policy, "embedded");
-		assert.dom("[data-test-operation-grant]").exists({ count: 3 });
-		assert.dom("[data-test-operation-grant-anonymous]").exists({ count: 2 }, "only the grants that opt in are marked").hasText("anyone");
-		assert.dom("[data-test-operation-grant-acting-user]").exists({ count: 1 }, "only the write names who it acts as").hasText("realmConfig(\"feedbackWriter\")");
-		assert.dom("[data-test-operation-grant-rate-limit]").exists({ count: 2 }, "and each grant opened to them says what it limits them to");
-	});
-	(0, import_qunit.test)("an anonymous write without an acting user carries a warning", async function(assert) {
-		await renderPolicyNamed("policies/public", [{
-			targetType: {
-				module: "../classroom",
-				name: "Classroom"
-			},
-			grants: [{
-				operation: "update",
-				where: ANONYMOUS
-			}]
-		}]);
-		assert.dom("[data-test-policy-grant-warning-message=\"anonymous-write-without-acting-user\"]").exists().includesText("needs an");
-	});
-	(0, import_qunit.test)("an anonymous write editor shows Realm Config-backed rate limits", async function(assert) {
-		await setupPolicyRealm({ "policies/public.json": policyDocument([{
-			targetType: {
-				module: "../classroom",
-				name: "Classroom"
-			},
-			grants: [{
-				operation: "update",
-				where: ANONYMOUS,
-				rateLimitRequests: "realmConfig(\"publicRequests\")",
-				rateLimitWindowSeconds: "realmConfig(\"publicWindow\")"
-			}]
-		}]) });
-		let policy = await loadPolicy("policies/public");
-		provide(PermissionsContextName, {
-			canWrite: true,
-			canRead: true
-		});
-		await renderCard(loader, policy, "edit");
-		assert.dom("[data-test-field=\"rateLimitRequests\"] input").hasValue("realmConfig(\"publicRequests\")");
-		assert.dom("[data-test-field=\"rateLimitWindowSeconds\"] input").hasValue("realmConfig(\"publicWindow\")");
-	});
-	(0, import_qunit.test)("a policy with no rules says it grants nothing", async function(assert) {
-		await setupPolicyRealm({ "policies/empty.json": policyDocument([]) });
-		let policy = await loadPolicy("policies/empty");
-		await renderCard(loader, policy, "isolated");
-		assert.dom("[data-test-realm-policy-no-rules]").exists();
-		assert.dom("[data-test-policy-rule]").doesNotExist();
-	});
-	(0, import_qunit.test)("an empty predicate and an unannotated object are kept as present predicates", async function(assert) {
-		let doc = await (await setupPolicyRealm({ "policies/edge.json": policyDocument([{
-			targetType: {
-				module: "../classroom",
-				name: "Classroom"
-			},
-			grants: [
-				{
-					operation: "read",
-					where: ""
-				},
-				{
-					operation: "update",
-					where: {
-						bxl: providerPredicate,
-						snapshot: false
-					}
-				},
-				{
-					operation: "delete",
-					where: { bxl: providerPredicate }
-				}
-			]
-		}]) })).realmIndexQueryEngine.cardDocument(new URL(`${testRealmURL}policies/edge`));
-		let rules = doc?.type === "doc" ? doc.doc.data.attributes?.rules : [];
-		assert.deepEqual(rules[0]?.grants.map((grant) => grant.where), [
-			"",
-			providerPredicate,
-			providerPredicate
-		], "an empty source stays an empty string, and an object without snapshot: true is stored as the bare string");
-		let policy = await loadPolicy("policies/edge");
-		assert.deepEqual(policy.rules[0].grants.map((grant) => grant.where), [
-			{
-				source: "",
-				snapshot: false
-			},
-			{
-				source: providerPredicate,
-				snapshot: false
-			},
-			{
-				source: providerPredicate,
-				snapshot: false
-			}
-		], "none of them reads as an unconditional grant");
-	});
-	(0, import_qunit.test)("emptying a predicate while editing keeps it, and removing it is explicit", async function(assert) {
-		await setupPolicyRealm({ "policies/one.json": policyDocument([{
-			targetType: {
-				module: "../schedule",
-				name: "Schedule"
-			},
-			grants: [{
-				operation: "read",
-				where: {
-					bxl: rosterPredicate,
-					snapshot: true
-				}
-			}]
-		}]) });
-		let grant = (await loadPolicy("policies/one")).rules[0].grants[0];
-		provide(PermissionsContextName, {
-			canWrite: true,
-			canRead: true
-		});
-		await renderCard(loader, grant, "edit");
-		await fillIn("[data-test-policy-predicate-input]", "");
-		assert.deepEqual(grant.where, {
-			source: "",
-			snapshot: true
-		}, "an emptied predicate is still a predicate, and keeps its snapshot flag");
-		assert.dom("[data-test-policy-predicate-input]").hasAttribute("placeholder", "Empty condition", "an emptied predicate does not read as always allowed");
-		await fillIn("[data-test-policy-predicate-input]", providerPredicate);
-		assert.deepEqual(grant.where, {
-			source: providerPredicate,
-			snapshot: true
-		}, "retyping the source keeps the snapshot flag");
-		await click("[data-test-policy-predicate-remove]");
-		assert.strictEqual(grant.where, null, "removing the condition makes the grant unconditional");
-		assert.dom("[data-test-policy-predicate-remove]").doesNotExist("an unconditional grant has no condition to remove");
-		assert.dom("[data-test-policy-predicate-input]").hasAttribute("placeholder", "Always allowed", "an unconditional grant reads as always allowed");
-	});
-	function grantLinesInEditor() {
-		return [...document.querySelectorAll("[data-test-policy-rule-grant] [data-test-operation-grant]")].map((el) => el.textContent?.replace(/\s+/g, " ").trim());
-	}
-	function ruleEditor(index) {
-		return `[data-test-contains-many="rules"] [data-test-item="${index}"]`;
-	}
-	(0, import_qunit.test)("editing a policy shows each grant as its view does, and adds, changes and removes grants", async function(assert) {
-		await setupPolicyRealm({ "policies/education.json": educationPolicy });
-		let policy = await loadPolicy("policies/education");
-		provide(PermissionsContextName, {
-			canWrite: true,
-			canRead: true
-		});
-		await renderCard(loader, policy, "edit");
-		assert.dom("[data-test-policy-rule-edit]").exists({ count: 2 });
-		assert.deepEqual(grantLinesInEditor(), [
-			"read always",
-			`appendActivity where ${teacherPredicate.trim()}`,
-			`read where ${rosterPredicate} snapshot`,
-			`listMySchedules where ${providerPredicate}`
-		], "each grant is shown by its operation and condition, in order");
-		assert.dom("[data-test-contains-many=\"rules\"]").doesNotIncludeText("Untitled", "no grant is shown as an untitled field");
-		assert.dom("[data-test-policy-rule-target-type] input").exists({ count: 2 }, "every rule's target type can be edited");
-		assert.dom("[data-test-policy-rule-grant] [data-test-policy-predicate-input]").exists({ count: 4 }, "every grant's condition can be edited");
-		assert.dom("[data-test-policy-rule-grant] [data-test-field=\"actingUser\"]").exists({ count: 4 }, "every grant says who a write by a caller who is not signed in is made as");
-		assert.dom("[data-test-policy-rule-grant] [data-test-field=\"blocklist\"]").exists({ count: 4 }, "and which addresses it refuses them from");
-		assert.dom(`${ruleEditor(0)} [data-test-rate-limit-requests-default]`).includesText(`${PLATFORM_LIMIT.requests}`, "the rate-limit fields say what applies when they are left empty");
-		assert.dom(`${ruleEditor(0)} [data-test-rate-limit-window-default]`).includesText(`${PLATFORM_LIMIT.windowSeconds}`);
-		assert.dom(`${ruleEditor(1)} [data-test-policy-rule-remove-grant="0"]`).hasAttribute("aria-label", "Remove grant 1 (read)", "each remove button names the grant it removes");
-		let studentPredicate = ".studentIds | any(. == actor())";
-		await fillIn(`${ruleEditor(0)} [data-test-policy-rule-grant="1"] [data-test-policy-predicate-input]`, studentPredicate);
-		await click(`${ruleEditor(0)} [data-test-policy-rule-add-grant]`);
-		await fillIn(`${ruleEditor(0)} [data-test-policy-rule-grant="2"] [data-test-field="operation"] input`, "update");
-		await click(`${ruleEditor(1)} [data-test-policy-rule-remove-grant="0"]`);
-		await fillIn(`${ruleEditor(0)} [data-test-policy-rule-grant="2"] [data-test-policy-predicate-input]`, ANONYMOUS);
-		await fillIn(`${ruleEditor(0)} [data-test-policy-rule-grant="2"] [data-test-field="actingUser"] input`, "realmConfig(\"feedbackWriter\")");
-		assert.deepEqual(grantLinesInEditor(), [
-			"read always",
-			`appendActivity where ${studentPredicate}`,
-			`update where ${ANONYMOUS} anyone as realmConfig("feedbackWriter") limit ${PLATFORM_LIMIT_LINE}`,
-			`listMySchedules where ${providerPredicate}`
-		], "each grant reads as it now stands");
-		let rules = serializeCard(policy, {}).data.attributes?.rules;
-		assert.deepEqual(rules.map((rule) => rule.grants.map(({ operation, where, actingUser }) => ({
-			operation,
-			where,
-			actingUser: actingUser ?? null
-		}))), [[
-			{
-				operation: "read",
-				where: null,
-				actingUser: null
-			},
-			{
-				operation: "appendActivity",
-				where: studentPredicate,
-				actingUser: null
-			},
-			{
-				operation: "update",
-				where: ANONYMOUS,
-				actingUser: "realmConfig(\"feedbackWriter\")"
-			}
-		], [{
-			operation: "listMySchedules",
-			where: providerPredicate,
-			actingUser: null
-		}]], "the saved policy holds the added, changed and remaining grants");
-	});
-	(0, import_qunit.test)("a policy edited without write permission shows its grants but cannot add or remove them", async function(assert) {
-		await setupPolicyRealm({ "policies/education.json": educationPolicy });
-		let policy = await loadPolicy("policies/education");
-		provide(PermissionsContextName, {
-			canWrite: false,
-			canRead: true
-		});
-		await renderCard(loader, policy, "edit");
-		assert.strictEqual(grantLinesInEditor().length, 4, "every grant is still shown");
-		assert.dom("[data-test-policy-rule-add-grant]").doesNotExist();
-		assert.dom("[data-test-policy-rule-remove-grant]").doesNotExist();
-	});
-	(0, import_qunit.test)("a document shape assigned in code is refused rather than read as a predicate", async function(assert) {
-		await setupPolicyRealm({ "policies/education.json": educationPolicy });
-		let policy = await loadPolicy("policies/education");
-		let grant = policy.rules[0].grants[1];
-		grant.where = providerPredicate;
-		assert.throws(() => serializeCard(policy, {}), /a policy predicate in memory must be \{ source, snapshot \}/, "a bare string on the instance fails the save instead of being written");
-		grant.where = {
-			bxl: providerPredicate,
-			snapshot: true
-		};
-		assert.throws(() => serializeCard(policy, {}), /a policy predicate in memory must be \{ source, snapshot \}/, "so does the annotated document shape");
-		grant.where = {
-			source: providerPredicate,
-			snapshot: true
-		};
-		let serialized = serializeCard(policy, {});
-		assert.deepEqual((serialized.data.attributes?.rules)[0].grants[1].where, {
-			bxl: providerPredicate,
-			snapshot: true
-		}, "an in-memory predicate serializes to its document shape");
-	});
-	async function renderClassroomPolicy() {
-		await setupIntegrationTestRealm({
-			mockMatrixUtils,
-			permissions: {
-				"*": ["read"],
-				"@testuser:localhost": [
-					"read",
-					"write",
-					"realm-owner"
-				]
-			},
-			contents: {
-				"realm.json": realmConfigCardJSON({ policy: `${testRealmURL}policies/classrooms` }),
-				"classroom.gts": classroomModule,
-				"classrooms/room-204.json": classroom([TEACHER]),
-				"classrooms/room-205.json": classroom([COLLEAGUE]),
-				"policies/classrooms.json": classroomPolicy
-			}
-		});
-		await getService("realm").login(testRealmURL);
-		getService("operations");
-		let policy = await loadPolicy("policies/classrooms");
-		await renderCard(loader, policy, "isolated");
-	}
-	async function ask(actor, target, operation) {
-		await fillIn("[data-test-explain-actor]", actor);
-		await fillIn("[data-test-explain-target]", target);
-		await fillIn("[data-test-explain-operation]", operation);
-		await click("[data-test-explain-submit]");
-		await waitFor("[data-test-explanation], [data-test-explain-refusal]", { timeout: 1e4 });
-	}
-	function grantsShown() {
-		return [...document.querySelectorAll("[data-test-explanation-grant]")].map((el) => [el.querySelector("[data-test-explanation-grant-where]")?.textContent, el.getAttribute("data-test-explanation-grant")]);
-	}
-	(0, import_qunit.test)("an explanation for someone who is not signed in shows what each grant opened to them limits, blocks and writes as", async function(assert) {
-		await setupIntegrationTestRealm({
-			mockMatrixUtils,
-			permissions: {
-				"*": ["read"],
-				"@testuser:localhost": [
-					"read",
-					"write",
-					"realm-owner"
-				]
-			},
-			contents: {
-				"realm.json": realmConfigCardJSON({
-					policy: `${testRealmURL}policies/classrooms`,
-					config: {
-						submitter: "@testuser:localhost",
-						blockedIps: "not an address"
-					}
-				}),
-				"classroom.gts": classroomModule,
-				"classrooms/room-204.json": classroom([TEACHER]),
-				"policies/classrooms.json": policyDocument([{
-					targetType: {
-						module: "../classroom",
-						name: "Classroom"
-					},
-					grants: [
-						{
-							operation: "update",
-							where: ANONYMOUS,
-							actingUser: "realmConfig(\"submitter\")",
-							blocklist: "realmConfig(\"blockedIps\")",
-							rateLimitRequests: "7",
-							rateLimitWindowSeconds: "30"
-						},
-						{
-							operation: "update",
-							where: ANONYMOUS,
-							actingUser: "realmConfig(\"missing\")"
-						},
-						{
-							operation: "update",
-							where: teachesPredicate,
-							actingUser: "realmConfig(\"submitter\")"
-						}
-					]
-				}])
-			}
-		});
-		await getService("realm").login(testRealmURL);
-		getService("operations");
-		let policy = await loadPolicy("policies/classrooms");
-		await renderCard(loader, policy, "isolated");
-		await ask("", `${testRealmURL}classrooms/room-204`, "update");
-		assert.dom("[data-test-explanation-actor]").hasText("not signed in");
-		assert.dom("[data-test-explanation-anonymous-limit]").hasText(`${DEFAULT_ANONYMOUS_RATE_LIMIT.requests} requests per ${DEFAULT_ANONYMOUS_RATE_LIMIT.windowSeconds} seconds from one address, the platform default, for a grant that sets none`);
-		assert.deepEqual([...document.querySelectorAll("[data-test-explanation-grant-anonymous]")].map((el) => el.textContent?.trim()), [
-			"Open to people who aren't signed in.",
-			"Their writes are made as @testuser:localhost.",
-			"Limit: 7 requests (set by this grant) per 30 seconds (set by this grant) from one address.",
-			"Its blocklist has entries that aren't an address or a range (\"not an address\"), so it turns away everyone who isn't signed in until it's fixed.",
-			"Open to people who aren't signed in.",
-			"Their writes: its \"Write as\" expression produced nothing, so this grant admits none of their writes.",
-			`Limit: ${DEFAULT_ANONYMOUS_RATE_LIMIT.requests} requests (the platform default) per ${DEFAULT_ANONYMOUS_RATE_LIMIT.windowSeconds} seconds (the platform default) from one address.`
-		], "only the grants opened to them carry these lines");
-		assert.deepEqual([...document.querySelectorAll("[data-test-explanation-grant-issue]")].map((el) => el.getAttribute("data-test-explanation-grant-issue")), ["acting-user-never-used"], "the grant that names an acting user it can never use carries its warning");
-	});
-	(0, import_qunit.test)("the policy explains what it decides for one caller, one card and one operation", async function(assert) {
-		await renderClassroomPolicy();
-		assert.dom("[data-test-realm-policy-explain]").exists();
-		assert.dom("[data-test-explain-actor-hint]").hasText("Leave this empty to check what someone who isn't signed in can do.", "the person field says how to ask about someone who is not signed in");
-		assert.dom("[data-test-explain-submit]").isDisabled("nothing to ask yet");
-		await ask(TEACHER, `${testRealmURL}classrooms/room-204`, "delete");
-		assert.strictEqual(document.querySelector("[data-test-explain-refusal]")?.textContent?.trim(), void 0, "the realm answers the question rather than refusing it");
-		assert.dom("[data-test-explanation-decision]").hasText("allowed");
-		assert.dom("[data-test-explanation-reason]").hasText("A grant in this policy allows it.");
-		assert.dom("[data-test-explanation-actor]").hasText(TEACHER);
-		assert.dom("[data-test-explanation-acl]").hasText("read", "the realm's own permissions let the teacher only read");
-		assert.dom("[data-test-explanation-refusal]").doesNotExist("an allowed invocation has no refusal to report");
-		assert.dom("[data-test-explanation-rule]").exists({ count: 1 }, "the one rule governing a classroom");
-		assert.deepEqual(grantsShown(), [[leadsPredicate, "did-not-hold"], [teachesPredicate, "held"]], "each delete grant is listed with its predicate and what it said, and the update grant is not");
-		assert.dom("[data-test-explanation-grant=\"held\"] [data-test-explanation-admitting]").exists("the grant that admitted the delete is marked");
-		assert.dom("[data-test-explanation-admitting]").exists({ count: 1 }, "and no other grant is");
-	});
-	(0, import_qunit.test)("the policy explains a refusal, and says when a question is refused", async function(assert) {
-		await renderClassroomPolicy();
-		await ask(TEACHER, `${testRealmURL}classrooms/room-205`, "delete");
-		assert.dom("[data-test-explanation-decision]").hasText("denied");
-		assert.dom("[data-test-explanation-reason]").hasText("This policy has grants for this operation on this card, but none of their conditions is met.");
-		assert.dom("[data-test-explanation-refusal]").hasText("403 operation-not-permitted", "the teacher may read the realm, so they would be told the gate refused them");
-		assert.deepEqual(grantsShown(), [[leadsPredicate, "did-not-hold"], [teachesPredicate, "did-not-hold"]], "neither delete grant holds for a classroom the teacher does not teach");
-		assert.dom("[data-test-explanation-admitting]").doesNotExist("no grant admitted the delete");
-		await ask(TEACHER, `${testRealmURL}classrooms/room-999`, "delete");
-		assert.dom("[data-test-explain-refusal]").hasText("no such target", "a card that is not there is refused the way the realm refuses one");
-		assert.dom("[data-test-explanation]").doesNotExist("and the earlier answer is not left on the page");
-	});
-	const MISTYPED = `${teachesPredicate} and .title ==`;
-	const UNFILTERABLE = "(.title | tonumber) > 0";
-	async function renderPolicyNamed(path, rules, modules = {}) {
-		let { realm } = await setupIntegrationTestRealm({
-			mockMatrixUtils,
-			contents: {
-				"classroom.gts": classroomModule,
-				...modules,
-				[`${path}.json`]: policyDocument(rules)
-			}
-		});
-		getService("operations");
-		let policy = await loadPolicy(path);
-		await renderCard(loader, policy, "isolated");
-		return realm;
-	}
-	async function grantStatuses() {
-		await waitFor("[data-test-policy-grant-status]", { timeout: 1e4 });
-		return [...document.querySelectorAll("[data-test-policy-grant-status]")].map((el) => el.getAttribute("data-test-policy-grant-status"));
-	}
-	(0, import_qunit.test)("a grant that does not compile is marked inactive among the live ones, and its issue names its rule and grant", async function(assert) {
-		await renderPolicyNamed("policies/mistyped", [{
-			targetType: {
-				module: "../classroom",
-				name: "Classroom"
-			},
-			grants: [
-				{ operation: "read" },
-				{
-					operation: "delete",
-					where: MISTYPED
-				},
-				{ operation: "update" }
-			]
-		}]);
-		assert.deepEqual(await grantStatuses(), [
-			"live",
-			"inactive",
-			"live"
-		], "the grant that does not compile is inactive, and the others are live");
-		assert.dom("[data-test-policy-grant-inactive]").exists({ count: 1 }, "and it is marked where it is listed");
-		assert.dom("[data-test-policy-grant-status=\"inactive\"] [data-test-operation-grant-operation]").hasText("delete", "the marked grant is the delete");
-		assert.dom("[data-test-realm-policy-uncompilable]").doesNotExist();
-		assert.dom("[data-test-realm-policy-issues]").exists();
-		assert.dom("[data-test-policy-issue]").exists({ count: 1 }).hasAttribute("data-test-policy-issue", "invalid-predicate");
-		assert.dom("[data-test-policy-issue-rule]").hasText("Classroom", "the issue names its rule's type");
-		assert.dom("[data-test-policy-issue-operation]").hasText("delete", "and its grant's operation");
-		assert.dom("[data-test-policy-issue-message]").includesText("has a syntax error", "and says what is wrong");
-	});
-	(0, import_qunit.test)("a query grant whose predicate compiles no search filter is inactive, and its issue says why", async function(assert) {
-		await renderPolicyNamed("policies/unfilterable", [{
-			targetType: {
-				module: "../classroom",
-				name: "Classroom"
-			},
-			grants: [{ operation: "read" }, {
-				operation: "query",
-				where: UNFILTERABLE
-			}]
-		}]);
-		assert.deepEqual(await grantStatuses(), ["live", "inactive"], "a query is authorized only through a filter, so the grant admits nothing");
-		assert.dom("[data-test-policy-grant-status=\"inactive\"] [data-test-operation-grant-operation]").hasText("query", "the marked grant is the query");
-		assert.dom("[data-test-policy-grant-inactive]").exists({ count: 1 }, "and it is marked where it is listed");
-		assert.dom("[data-test-policy-issue]").exists({ count: 1 }).hasAttribute("data-test-policy-issue", "policy-not-filterable");
-		assert.dom("[data-test-policy-issue-operation]").hasText("query");
-	});
-	(0, import_qunit.test)("a grant whose condition is annotated as reading a snapshot is live", async function(assert) {
-		await renderPolicyNamed("policies/snapshot", [{
-			targetType: {
-				module: "../classroom",
-				name: "Classroom"
-			},
-			grants: [{
-				operation: "read",
-				where: {
-					bxl: teachesPredicate,
-					snapshot: true
-				}
-			}, {
-				operation: "update",
-				where: teachesPredicate
-			}]
-		}]);
-		assert.deepEqual(await grantStatuses(), ["live", "live"], "the gate evaluates an annotated condition, so the annotation leaves the read in force");
-		assert.dom("[data-test-realm-policy-issues]").doesNotExist("compiling recorded no issue");
-	});
-	(0, import_qunit.test)("a rule whose type does not resolve is marked inactive with its grants", async function(assert) {
-		await renderPolicyNamed("policies/unresolved", [{
-			targetType: {
-				module: "../no-such-module",
-				name: "Nope"
-			},
-			grants: [{ operation: "read" }]
-		}, {
-			targetType: {
-				module: "../classroom",
-				name: "Classroom"
-			},
-			grants: [{ operation: "read" }]
-		}]);
-		assert.deepEqual(await grantStatuses(), ["inactive", "live"]);
-		assert.dom("[data-test-policy-rule-inactive]").exists({ count: 1 }, "the rule is marked, once");
-		assert.dom("[data-test-policy-grant-inactive]").doesNotExist("rather than each grant in it");
-		assert.dom("[data-test-policy-issue]").hasAttribute("data-test-policy-issue", "unresolved-type");
-		assert.dom("[data-test-policy-issue-rule]").hasText("Nope");
-		assert.dom("[data-test-policy-issue-operation]").doesNotExist("a rule-level issue names no grant");
-	});
-	(0, import_qunit.test)("a policy that does not compile at all says so apart from any one grant", async function(assert) {
-		await setupIntegrationTestRealm({
-			mockMatrixUtils,
-			contents: {
-				"classroom.gts": classroomModule,
-				"policies/broken.json": classroomPolicy
-			}
-		});
-		getService("operations");
-		let policy = await loadPolicy("policies/broken");
-		let batch = await new IndexWriter(await getDbAdapter()).createBatch(new URL(testRealmURL), getService("network").virtualNetwork);
-		await batch.updateEntry(new URL(`${testRealmURL}policies/broken.json`), {
-			type: "instance-error",
-			error: {
-				message: "Bad Gateway",
-				status: 502,
-				additionalErrors: null
-			},
-			diagnostics: { gatewayFailure: ["instance"] }
-		});
-		await batch.done();
-		await renderCard(loader, policy, "isolated");
-		await waitFor("[data-test-realm-policy-uncompilable]", { timeout: 1e4 });
-		assert.dom("[data-test-realm-policy-uncompilable]").includesText("Not in force", "the whole policy is out of force").includesText("This card couldn't be indexed this time", "and says why of the card itself");
-		assert.dom("[data-test-policy-rule-inactive]").doesNotExist("which is said once, not on each rule");
-		assert.dom("[data-test-policy-issue]").hasAttribute("data-test-policy-issue", "policy-card-unloadable");
-		assert.dom("[data-test-policy-issue-rule]").doesNotExist("a card-level issue names no rule");
-	});
-	(0, import_qunit.test)("fixing a grant clears its issue", async function(assert) {
-		let realm = await renderPolicyNamed("policies/fixable", [{
-			targetType: {
-				module: "../classroom",
-				name: "Classroom"
-			},
-			grants: [{
-				operation: "delete",
-				where: MISTYPED
-			}]
-		}]);
-		assert.deepEqual(await grantStatuses(), ["inactive"]);
-		await realm.write("policies/fixable.json", JSON.stringify(policyDocument([{
-			targetType: {
-				module: "../classroom",
-				name: "Classroom"
-			},
-			grants: [{
-				operation: "delete",
-				where: teachesPredicate
-			}]
-		}])));
-		await waitUntil(() => document.querySelector("[data-test-policy-grant-status]")?.getAttribute("data-test-policy-grant-status") === "live", { timeout: 1e4 });
-		await settled();
-		assert.deepEqual(await grantStatuses(), ["live"], "the grant is live");
-		assert.dom("[data-test-realm-policy-issues]").doesNotExist("and the issue is gone");
-	});
-	(0, import_qunit.test)("a policy with no issues shows no issue affordance", async function(assert) {
-		await renderPolicyNamed("policies/clean", [{
-			targetType: {
-				module: "../classroom",
-				name: "Classroom"
-			},
-			grants: [{
-				operation: "read",
-				where: teachesPredicate
-			}, { operation: "update" }]
-		}]);
-		assert.deepEqual(await grantStatuses(), ["live", "live"], "the realm has answered");
-		assert.dom("[data-test-realm-policy-issues]").doesNotExist();
-		assert.dom("[data-test-realm-policy-uncompilable]").doesNotExist();
-		assert.dom("[data-test-policy-grant-inactive]").doesNotExist();
-		assert.dom("[data-test-policy-rule-inactive]").doesNotExist();
-		assert.dom("[data-test-realm-policy-validate-failure]").doesNotExist();
-	});
-	function grantMarkedWithWarning() {
-		return document.querySelector("[data-test-policy-grant-warning]")?.closest("[data-test-policy-grant-status]");
-	}
-	(0, import_qunit.test)("a live grant that hands over cards of a type no rule grants is marked live with its warning beside it", async function(assert) {
-		await renderPolicyNamed("policies/reaching", [{
-			targetType: {
-				module: "../roster",
-				name: "Roster"
-			},
-			grants: [{
-				operation: "read",
-				where: teachesPredicate
-			}, {
-				operation: "update",
-				where: teachesPredicate
-			}]
-		}], { "roster.gts": rosterModule });
-		assert.deepEqual(await grantStatuses(), ["live", "live"], "a warning leaves its grant live");
-		assert.dom("[data-test-policy-grant-inactive]").doesNotExist("and marks nothing inactive");
-		assert.dom("[data-test-policy-grant-warning]").exists({ count: 1 }, "one grant is marked with a warning");
-		let marked = grantMarkedWithWarning();
-		assert.strictEqual(marked?.getAttribute("data-test-policy-grant-status"), "live", "the marked grant is live");
-		assert.dom("[data-test-operation-grant-operation]", marked ?? void 0).hasText("read", "it is the read, whose document carries the students");
-		await click("[data-test-policy-grant-warning] summary");
-		assert.dom("[data-test-policy-grant-warning-message=\"grant-reaches-ungranted-type\"]").exists({ count: 1 }).isVisible("opening the mark shows the warning").includesText("no rule lets anyone read Student cards", "which says what the grant hands over");
-		assert.dom("[data-test-policy-issue]").exists({ count: 1 }).hasAttribute("data-test-policy-issue", "grant-reaches-ungranted-type");
-		assert.dom("[data-test-policy-issue-rule]").hasText("Roster", "the warning is listed with its rule");
-		assert.dom("[data-test-policy-issue-operation]").hasText("read", "and its grant");
-		assert.dom("[data-test-policy-issue] [data-test-policy-issue-warning]").exists("and is marked there as a warning");
-		assert.dom("[data-test-policy-issue-message]").includesText("no rule lets anyone read Student cards");
-		assert.dom("[data-test-policy-issue-message] code").exists("the identifiers in the message render as code").hasText("read", "the first is the grant’s operation");
-		assert.dom("[data-test-policy-issue-message] .message-paragraph").exists({ count: 4 }, "the message is laid out one idea per paragraph, as the compiler writes it");
-		assert.dom("[data-test-policy-issue-message]").doesNotIncludeText(BACKTICK, "and no backtick shows").includesText("read on Roster sends", "and the text reads on across a span, spaces kept");
-		assert.dom("[data-test-policy-grant-warning-message=\"grant-reaches-ungranted-type\"] code").exists("the grant’s warning renders them as code too");
-		assert.dom("[data-test-policy-grant-warning-message=\"grant-reaches-ungranted-type\"]").doesNotIncludeText(BACKTICK);
-	});
-	(0, import_qunit.test)("a policy whose issues only leave grants inactive marks no warning", async function(assert) {
-		await renderPolicyNamed("policies/inactive-only", [{
-			targetType: {
-				module: "../classroom",
-				name: "Classroom"
-			},
-			grants: [
-				{ operation: "read" },
-				{
-					operation: "delete",
-					where: MISTYPED
-				},
-				{
-					operation: "query",
-					where: UNFILTERABLE
-				}
-			]
-		}]);
-		assert.deepEqual(await grantStatuses(), [
-			"live",
-			"inactive",
-			"inactive"
-		]);
-		assert.dom("[data-test-policy-grant-inactive]").exists({ count: 2 }, "each grant an issue leaves out is marked inactive");
-		assert.dom("[data-test-policy-issue]").exists({ count: 2 }, "and each issue is listed");
-		assert.dom("[data-test-policy-grant-warning]").doesNotExist("no grant is marked with a warning");
-		assert.dom("[data-test-policy-issue-warning]").doesNotExist("and no listed issue is marked as one");
-	});
-	(0, import_qunit.test)("a view created in an index render never asks what the policy compiles to", async function(assert) {
-		await setupIntegrationTestRealm({
-			mockMatrixUtils,
-			contents: {
-				"classroom.gts": classroomModule,
-				"policies/mistyped.json": policyDocument([{
-					targetType: {
-						module: "../classroom",
-						name: "Classroom"
-					},
-					grants: [{ operation: "read" }, {
-						operation: "delete",
-						where: MISTYPED
-					}]
-				}])
-			}
-		});
-		let { operations } = await loader.import("@cardstack/base/operations");
-		getService("operations");
-		let policy = await loadPolicy("policies/mistyped");
-		let validates = 0;
-		let network = getService("network");
-		let spy = async (request) => {
-			if (new URL(request.url).pathname.endsWith("/_operations") && (await request.clone().text()).includes("\"validate\"")) validates++;
-			return null;
-		};
-		network.virtualNetwork.mount(spy, { prepend: true });
-		let context = globalThis;
-		try {
-			context.__boxelRenderContext = true;
-			try {
-				await renderCard(loader, policy, "isolated");
-			} finally {
-				context.__boxelRenderContext = void 0;
-			}
-			assert.dom("[data-test-policy-rule]").exists({ count: 1 }, "the index render lists the rules");
-			assert.dom("[data-test-policy-grant-status]").doesNotExist("with no grant marked");
-			assert.dom("[data-test-realm-policy-issues]").doesNotExist("and no issues");
-			let validation = await operations(policy).validate();
-			assert.deepEqual(validation.issues.map(({ code }) => code), ["invalid-predicate"], "the realm answers a validate of this card");
-			assert.strictEqual(validates, 1, "the only validate sent is the test's own");
-		} finally {
-			network.virtualNetwork.unmount(spy);
-		}
-	});
-});
-var DEFINITIONS = "http://test-realm/classroom-definitions/";
-var CLASSROOM = {
-	module: `${DEFINITIONS}classroom`,
-	name: "Classroom"
-};
-var OWNER = "@testuser:localhost";
-var MISTYPED_PREDICATE = `${teachesPredicate} and .title ==`;
-var UNFILTERABLE_PREDICATE = "(.title | tonumber) > 0";
-var classroomQueryModule = `
-  import { contains, containsMany, field, CardDef } from "@cardstack/base/card-api";
-  import StringField from "@cardstack/base/string";
-  import { operation } from "@cardstack/base/operations";
-
-  export class Classroom extends CardDef {
-    @field title = contains(StringField);
-    @field teacherIds = containsMany(StringField);
-
-    @operation static listMine = {
-      base: 'query',
-      query: { filter: { type: () => Classroom } },
-    };
-  }
-`;
-var askedPolicyRules = [{
-	targetType: CLASSROOM,
-	grants: [
-		{
-			operation: "read",
-			where: teachesPredicate
-		},
-		{
-			operation: "delete",
-			where: teachesPredicate
-		},
-		{
-			operation: "listMine",
-			where: teachesPredicate
-		},
-		{
-			operation: "query",
-			where: UNFILTERABLE_PREDICATE
-		}
-	]
-}];
-var ROOMS = Array.from({ length: 11 }, (_, i) => `room-${201 + i}`);
-function definedClassroom(teacherIds) {
-	return { data: {
-		type: "card",
-		attributes: { teacherIds },
-		meta: { adoptsFrom: CLASSROOM }
-	} };
-}
-(0, import_qunit.module)("Integration | realm policy explain forms", function(hooks) {
-	setupRenderingTest(hooks);
-	setupCatalogTestSubset(hooks);
-	setupLocalIndexing(hooks);
-	let loader;
-	let mockMatrixUtils = setupMockMatrix(hooks, {
-		loggedInAs: OWNER,
-		activeRealms: [DEFINITIONS, testRealmURL],
-		autostart: true
-	});
-	hooks.beforeEach(function() {
-		loader = getService("loader-service").loader;
-	});
-	setupCardLogs(hooks, async () => await loader.import("@cardstack/base/card-api"));
-	async function renderAskedPolicy() {
-		await setupIntegrationTestRealm({
-			mockMatrixUtils,
-			realmURL: DEFINITIONS,
-			permissions: { "*": ["read"] },
-			contents: {
-				"realm.json": realmConfigCardJSON({ name: "Classroom definitions" }),
-				"classroom.gts": classroomQueryModule
-			}
-		});
-		await setupIntegrationTestRealm({
-			mockMatrixUtils,
-			enforcePermissions: true,
-			permissions: { [OWNER]: [
-				"read",
-				"write",
-				"realm-owner"
-			] },
-			contents: {
-				"realm.json": realmConfigCardJSON({ policy: `${testRealmURL}policies/classrooms` }),
-				...Object.fromEntries(ROOMS.map((room, i) => [`classrooms/${room}.json`, definedClassroom(i < 3 ? [TEACHER] : [COLLEAGUE])])),
-				"policies/classrooms.json": policyDocument(askedPolicyRules)
-			}
-		});
-		getService("operations");
-		let policy = await getService("store").get(`${testRealmURL}policies/classrooms`);
-		await renderCard(loader, policy, "isolated");
-	}
-	async function chooseMode(mode) {
-		await click(`[data-test-explain-mode="${mode}"] input`);
-	}
-	async function submitAndWait(answer) {
-		await click("[data-test-explain-submit]");
-		await waitFor(`${answer}, [data-test-explain-refusal]`, { timeout: 1e4 });
-	}
-	function draftRules(grants) {
-		return JSON.stringify({ rules: [{
-			targetType: CLASSROOM,
-			grants
-		}] });
-	}
-	(0, import_qunit.test)("the policy answers a question against a draft, and the policy in force is unchanged", async function(assert) {
-		await renderAskedPolicy();
-		let room205 = `${testRealmURL}classrooms/room-205`;
-		await fillIn("[data-test-explain-actor]", TEACHER);
-		await fillIn("[data-test-explain-target]", room205);
-		await fillIn("[data-test-explain-operation]", "delete");
-		await submitAndWait("[data-test-explanation]");
-		assert.dom("[data-test-explanation-decision]").hasText("denied", "the policy in force lets a teacher delete only their own classrooms");
-		assert.dom("[data-test-explanation-draft]").doesNotExist();
-		await click("[data-test-explain-use-draft]");
-		let started = JSON.parse(document.querySelector("[data-test-explain-draft]").value);
-		assert.deepEqual(started.rules.map((rule) => rule.grants.map((g) => g.operation)), [[
-			"read",
-			"delete",
-			"listMine",
-			"query"
-		]], "the draft starts from this card's rules");
-		await fillIn("[data-test-explain-draft]", draftRules([{ operation: "delete" }]));
-		await submitAndWait("[data-test-explanation]");
-		assert.dom("[data-test-explanation-decision]").hasText("allowed", "the draft lets the teacher delete any classroom");
-		assert.dom("[data-test-explanation-reason]").hasText("A grant in this policy allows it.");
-		assert.dom("[data-test-explanation-draft]").exists("the answer says it was answered against the draft");
-		assert.dom("[data-test-explanation-draft-clean]").exists();
-		await fillIn("[data-test-explain-draft]", draftRules([{
-			operation: "delete",
-			where: MISTYPED_PREDICATE
-		}]));
-		await submitAndWait("[data-test-explanation]");
-		assert.dom("[data-test-explanation-decision]").hasText("denied");
-		assert.dom("[data-test-explanation-draft-issue]").exists({ count: 1 }).hasAttribute("data-test-explanation-draft-issue", "invalid-predicate").includesText("rules[0].grants[0].where", "the issue names where it is");
-		await fillIn("[data-test-explain-draft]", JSON.stringify({ attributes: { rules: [] } }));
-		await submitAndWait("[data-test-explain-refusal]");
-		assert.dom("[data-test-explain-refusal]").includesText("a policy document", "the realm's refusal of the draft is shown in place of an answer");
-		assert.dom("[data-test-explanation]").doesNotExist();
-		await fillIn("[data-test-explain-draft]", "{ \"rules\": ");
-		await submitAndWait("[data-test-explain-refusal]");
-		assert.dom("[data-test-explain-refusal]").includesText("The draft isn't valid JSON", "a draft that does not parse is never sent");
-		await click("[data-test-explain-use-draft]");
-		await submitAndWait("[data-test-explanation]");
-		assert.dom("[data-test-explanation-decision]").hasText("denied", "and without the draft, the policy in force answers as before");
-		assert.dom("[data-test-explanation-draft]").doesNotExist();
-	});
-	(0, import_qunit.test)("the policy says what it composes into a search, and how far behind the index is", async function(assert) {
-		await renderAskedPolicy();
-		await chooseMode("search");
-		assert.dom("[data-test-explain-realm]").hasValue(testRealmURL, "a search runs in this card's realm unless another is named");
-		assert.dom("[data-test-explain-target]").doesNotExist();
-		await fillIn("[data-test-explain-actor]", TEACHER);
-		await fillIn("[data-test-explain-operation]", "listMine");
-		await fillIn("[data-test-explain-type-module]", CLASSROOM.module);
-		await fillIn("[data-test-explain-type-name]", CLASSROOM.name);
-		await submitAndWait("[data-test-explanation]");
-		assert.dom("[data-test-explanation-decision]").hasText("allowed");
-		assert.dom("[data-test-explanation-reason]").hasText("Grants in this policy let this search return the cards their conditions match, and no others.");
-		assert.dom("[data-test-explanation-search-operation]").hasText("listMine");
-		assert.dom("[data-test-explanation-search-types]").hasText("Classroom");
-		assert.dom("[data-test-explanation-search-fragment]").includesText(TEACHER, "what the policy composes names the teacher");
-		assert.dom("[data-test-explanation-search-index]").hasText("Up to date.", "the index has every write");
-		assert.dom("[data-test-explanation-grant]").exists({ count: 1 }, "the one grant on the named query").hasAttribute("data-test-explanation-grant-filterable", "true");
-		assert.dom("[data-test-explanation-grant-label]").hasText("narrows the search");
-		assert.dom("[data-test-explanation-grant] .tier").doesNotExist("a search runs the condition over the index, so no copy of one card is named");
-		await fillIn("[data-test-explain-operation]", "listTheirs");
-		await submitAndWait("[data-test-explanation]");
-		assert.dom("[data-test-explanation-reason]").includesText("This search couldn't be resolved", "a search the type does not declare is said to be one");
-		await fillIn("[data-test-explain-operation]", "query");
-		assert.dom("[data-test-explain-type-module]").doesNotExist("an ad-hoc search names its types in its filter");
-		await fillIn("[data-test-explain-search-filter]", JSON.stringify({ "item.on": CLASSROOM }));
-		await submitAndWait("[data-test-explanation]");
-		assert.dom("[data-test-explanation-decision]").hasText("denied");
-		assert.dom("[data-test-explanation-reason]").includesText("No grant in this policy can narrow this search");
-		assert.dom("[data-test-explanation-search-operation]").hasText("query");
-		assert.dom("[data-test-explanation-search-no-fragment]").exists("the policy composes nothing");
-		assert.dom("[data-test-explanation-grant]").hasAttribute("data-test-explanation-grant-filterable", "false");
-		assert.dom("[data-test-explanation-grant-label]").hasText("a search can't use its condition, so it adds nothing", "the grant whose condition a search cannot use is shown as adding nothing");
-		await click("[data-test-explain-use-draft]");
-		await fillIn("[data-test-explain-draft]", JSON.stringify({ grants: [] }));
-		await submitAndWait("[data-test-explain-refusal]");
-		assert.dom("[data-test-explain-refusal]").includesText("a policy document", "a search asked of a draft the realm refuses shows the refusal");
-		await fillIn("[data-test-explain-draft]", draftRules([{
-			operation: "query",
-			where: teachesPredicate
-		}]));
-		await submitAndWait("[data-test-explanation]");
-		assert.dom("[data-test-explanation-decision]").hasText("allowed", "a draft whose grant a search can use admits it");
-		assert.dom("[data-test-explanation-search-fragment]").includesText(TEACHER, "and composes a fragment naming the teacher");
-		assert.dom("[data-test-explanation-grant]").hasAttribute("data-test-explanation-grant-filterable", "true");
-		assert.dom("[data-test-explanation-draft-clean]").exists();
-	});
-	(0, import_qunit.test)("the policy explains a page of the cards in a realm at a time", async function(assert) {
-		await renderAskedPolicy();
-		await chooseMode("listing");
-		await fillIn("[data-test-explain-actor]", TEACHER);
-		await fillIn("[data-test-explain-operation]", "read");
-		await fillIn("[data-test-explain-type-module]", CLASSROOM.module);
-		await fillIn("[data-test-explain-type-name]", CLASSROOM.name);
-		await submitAndWait("[data-test-explanation-listing]");
-		let listed = () => [...document.querySelectorAll("[data-test-explanation-listed]")].map((el) => [el.getAttribute("data-test-explanation-listed"), el.querySelector("[data-test-explanation-listed-decision]")?.textContent?.trim()]);
-		assert.dom("[data-test-explanation-listing-page]").hasText("Cards 1 to 10 of 11");
-		assert.deepEqual(listed(), ROOMS.slice(0, 10).map((room, i) => [`${testRealmURL}classrooms/${room}`, i < 3 ? "allowed" : "denied"]), "each card on the page is explained for the teacher");
-		assert.dom("[data-test-explanation-listing-previous]").isDisabled();
-		assert.dom("[data-test-explanation-listing-next]").isEnabled();
-		await fillIn("[data-test-explain-actor]", COLLEAGUE);
-		await click("[data-test-explanation-listing-next]");
-		await waitUntil(() => document.querySelector("[data-test-explanation-listing-page]")?.textContent?.trim() === "Cards 11 to 11 of 11", { timeout: 1e4 });
-		assert.deepEqual(listed(), [[`${testRealmURL}classrooms/room-211`, "denied"]]);
-		assert.dom("[data-test-explanation-listed] [data-test-explanation-actor]").hasText(TEACHER, "the next page answers for the teacher it was asked for");
-		assert.dom("[data-test-explanation-listing-previous]").isEnabled();
-		assert.dom("[data-test-explanation-listing-next]").isDisabled();
-		await click("[data-test-explain-use-draft]");
-		await fillIn("[data-test-explain-draft]", draftRules([{ operation: "read" }]));
-		await submitAndWait("[data-test-explanation-listing]");
-		assert.dom("[data-test-explanation-listing-page]").hasText("Cards 1 to 10 of 11", "a new question starts at the first page");
-		assert.deepEqual(listed().map(([, decision]) => decision), Array(10).fill("allowed"), "the draft lets the teacher read every classroom");
-		assert.dom("[data-test-explanation-draft-clean]").exists();
-	});
-});
-//#endregion