@contember/engine-tenant-api 2.2.0-alpha.3 → 2.2.0-alpha.6

package/tests/cases/integration/mocked/idpClaimMappingConfig.test.ts

@@ -0,0 +1,332 @@
+import { executeTenantTest } from '../../../src/testTenant.js'
+import { expect, test } from 'bun:test'
+import { GQL } from '../../../src/tags.js'
+import { sqlTransaction } from './sql/sqlTransaction.js'
+
+// Config-time validation of an A09 claimMapping at addIDP. The same `assertValidClaimMapping` guards
+// updateIDP. Each rejection fails before any DB write — the validator runs inside the transaction but
+// before the existence check / insert — so the only SQL is the (empty) transaction envelope.
+//
+// The test harness's project schema resolver returns a schema whose ACL defines the role `editor`
+// (and only that), so membership role validation can be exercised against a real schema.
+
+const addIDP = (configuration: unknown) => ({
+	query: GQL`mutation($configuration: Json!) {
+		addIDP(identityProvider: "oidc", type: "mock", configuration: $configuration) {
+			ok
+			error { code }
+		}
+	}`,
+	variables: { configuration },
+})
+
+const expectInvalidConfiguration = async (configuration: unknown) =>
+	executeTenantTest({
+		query: addIDP(configuration),
+		executes: [...sqlTransaction()],
+		return: {
+			data: { addIDP: { ok: false, error: { code: 'INVALID_CONFIGURATION' } } },
+		},
+	})
+
+test('addIDP rejects a claimMapping that still grants global roles (grantRoles was removed)', async () => {
+	await expectInvalidConfiguration({
+		externalIdentifier: 'sub',
+		claimMapping: {
+			rules: [{ claim: 'groups', contains: 'Admins', grantRoles: ['project_admin'] }],
+		},
+	})
+})
+
+test('addIDP rejects a claimMapping granting a membership role not defined in the project ACL schema', async () => {
+	await expectInvalidConfiguration({
+		externalIdentifier: 'sub',
+		claimMapping: {
+			// the harness schema defines only `editor`; `salesperson` is unknown → rejected
+			rules: [{ claim: 'department', equals: 'Sales', grantMembership: { project: 'crm', role: 'salesperson' } }],
+		},
+	})
+})
+
+test('addIDP rejects a malformed claimMapping (a rule with no claim)', async () => {
+	await expectInvalidConfiguration({
+		externalIdentifier: 'sub',
+		claimMapping: {
+			rules: [{ contains: 'x', grantMembership: { project: 'demo', role: 'editor' } }],
+		},
+	})
+})
+
+test('addIDP accepts a claimMapping whose membership role IS defined in the project ACL schema (validation passes; fails later at the existence check)', async () => {
+	// A valid mapping (role `editor` exists) passes claim-mapping validation, so the flow proceeds to
+	// the slug existence check. We make that report ALREADY_EXISTS — which proves validation did not
+	// reject the valid mapping — without needing the create-IDP SQL.
+	await executeTenantTest({
+		query: addIDP({
+			externalIdentifier: 'sub',
+			claimMapping: {
+				rules: [{ claim: 'department', equals: 'Editorial', grantMembership: { project: 'demo', role: 'editor' } }],
+			},
+		}),
+		executes: [
+			...sqlTransaction(
+				{
+					sql:
+						'select "id", "slug", "type", "configuration", "disabled_at" as "disabledAt", "auto_sign_up" as "autoSignUp", "exclusive", "init_returns_config" as "initReturnsConfig", "require_verified_email" as "requireVerifiedEmail", "assume_email_verified" as "assumeEmailVerified", "disable_local_authentication" as "disableLocalAuthentication"  from "tenant"."identity_provider"  where "slug" = ?',
+					parameters: ['oidc'],
+					response: { rows: [{ id: '123', slug: 'oidc' }] },
+				},
+			),
+		],
+		return: {
+			data: { addIDP: { ok: false, error: { code: 'ALREADY_EXISTS' } } },
+		},
+	})
+})
+
+test("addIDP rejects a rule with a typo'd match key (equal instead of equals) — noExtraProps", async () => {
+	// `equal` (typo for `equals`) is an unknown rule key. Without noExtraProps it was silently stripped,
+	// leaving a rule with neither equals nor contains — which match-everyone (mere presence of the claim).
+	// noExtraProps rejects the typo at config time instead.
+	await expectInvalidConfiguration({
+		externalIdentifier: 'sub',
+		claimMapping: {
+			rules: [{ claim: 'groups', equal: 'Editorial', grantMembership: { project: 'demo', role: 'editor' } }],
+		},
+	})
+})
+
+test('addIDP rejects a rule with a misspelled grantMembership — noExtraProps', async () => {
+	// A misspelled `grantMembership` (here `grantMembershp`) used to be silently stripped, leaving a
+	// matches-but-grants-nothing rule; noExtraProps now rejects the unknown key outright.
+	await expectInvalidConfiguration({
+		externalIdentifier: 'sub',
+		claimMapping: {
+			rules: [{ claim: 'groups', contains: 'Editorial', grantMembershp: { project: 'demo', role: 'editor' } }],
+		},
+	})
+})
+
+test('addIDP rejects an unknown key on a granted membership — noExtraProps', async () => {
+	await expectInvalidConfiguration({
+		externalIdentifier: 'sub',
+		claimMapping: {
+			rules: [{ claim: 'groups', contains: 'Editorial', grantMembership: { project: 'demo', role: 'editor', extra: true } }],
+		},
+	})
+})
+
+test('addIDP rejects an unknown key on a membership variable / its from source — noExtraProps', async () => {
+	await expectInvalidConfiguration({
+		externalIdentifier: 'sub',
+		claimMapping: {
+			rules: [{
+				claim: 'groups',
+				contains: 'Editorial',
+				grantMembership: { project: 'demo', role: 'editor', variables: [{ name: 'language', value: ['x'] }] },
+			}],
+		},
+	})
+	await expectInvalidConfiguration({
+		externalIdentifier: 'sub',
+		claimMapping: {
+			rules: [{
+				claim: 'groups',
+				contains: 'Editorial',
+				grantMembership: { project: 'demo', role: 'editor', variables: [{ name: 'language', from: { claim: 'langs', splt: ',' } }] },
+			}],
+		},
+	})
+})
+
+test('addIDP rejects a claimMapping membership variable not defined for the role', async () => {
+	// The harness `editor` role defines variables `language` / `siteFilter`; an unknown name is rejected
+	// at config time (mirroring the MembershipValidator on the direct add-member path) rather than
+	// silently writing a dead variable row at sign-in.
+	await expectInvalidConfiguration({
+		externalIdentifier: 'sub',
+		claimMapping: {
+			rules: [{
+				claim: 'department',
+				equals: 'Editorial',
+				grantMembership: { project: 'demo', role: 'editor', variables: [{ name: 'nonexistent', values: ['x'] }] },
+			}],
+		},
+	})
+})
+
+test('addIDP rejects a claim-derived condition variable without an allow allowlist (ACL-condition injection guard)', async () => {
+	// `siteFilter` is a condition variable: its stored value is parsed as a row-level ACL condition at
+	// every content request, so a claim-derived value with no `allow` allowlist would let whoever
+	// controls the claim inject the row filter. Must be rejected at config time.
+	await expectInvalidConfiguration({
+		externalIdentifier: 'sub',
+		claimMapping: {
+			rules: [{
+				claim: 'department',
+				equals: 'Editorial',
+				grantMembership: { project: 'demo', role: 'editor', variables: [{ name: 'siteFilter', from: { claim: 'filter' } }] },
+			}],
+		},
+	})
+})
+
+test('addIDP rejects a passthrough claim-derived condition variable even with an allow allowlist', async () => {
+	// `passthrough` writes the raw claim verbatim, so it is forbidden on a condition variable regardless
+	// of `allow` (the allowlist still cannot make a verbatim claim a safe ACL expression).
+	await expectInvalidConfiguration({
+		externalIdentifier: 'sub',
+		claimMapping: {
+			rules: [{
+				claim: 'department',
+				equals: 'Editorial',
+				grantMembership: {
+					project: 'demo',
+					role: 'editor',
+					variables: [{ name: 'siteFilter', from: { claim: 'filter' }, passthrough: true, allow: ['{"always":true}'] }],
+				},
+			}],
+		},
+	})
+})
+
+test('addIDP rejects a membership role that names a prototype member (own-property role check)', async () => {
+	// A role name like `toString` / `constructor` must not resolve to an inherited Object.prototype
+	// member and pass the existence check.
+	for (const role of ['toString', 'constructor', 'hasOwnProperty']) {
+		await expectInvalidConfiguration({
+			externalIdentifier: 'sub',
+			claimMapping: { rules: [{ claim: 'x', equals: 'y', grantMembership: { project: 'demo', role } }] },
+		})
+	}
+})
+
+test('addIDP accepts a condition variable bounded by an allow allowlist plus a valid entity variable', async () => {
+	// Proves the condition-variable guard does NOT over-reject: a claim-derived condition value bounded
+	// by `allow` (no passthrough) and a constant entity variable are both valid, so the flow proceeds to
+	// the existence check (reported ALREADY_EXISTS).
+	await executeTenantTest({
+		query: addIDP({
+			externalIdentifier: 'sub',
+			claimMapping: {
+				rules: [{
+					claim: 'department',
+					equals: 'Editorial',
+					grantMembership: {
+						project: 'demo',
+						role: 'editor',
+						variables: [
+							{ name: 'siteFilter', from: { claim: 'filter' }, allow: ['{"eq":"site-1"}'] },
+							{ name: 'language', values: ['uuid-en'] },
+						],
+					},
+				}],
+			},
+		}),
+		executes: [
+			...sqlTransaction(
+				{
+					sql:
+						'select "id", "slug", "type", "configuration", "disabled_at" as "disabledAt", "auto_sign_up" as "autoSignUp", "exclusive", "init_returns_config" as "initReturnsConfig", "require_verified_email" as "requireVerifiedEmail", "assume_email_verified" as "assumeEmailVerified", "disable_local_authentication" as "disableLocalAuthentication"  from "tenant"."identity_provider"  where "slug" = ?',
+					parameters: ['oidc'],
+					response: { rows: [{ id: '123', slug: 'oidc' }] },
+				},
+			),
+		],
+		return: {
+			data: { addIDP: { ok: false, error: { code: 'ALREADY_EXISTS' } } },
+		},
+	})
+})
+
+test('addIDP rejects a condition variable whose constant value is not a valid condition', async () => {
+	// `siteFilter` is a condition variable: its stored value is parsed as a row-level ACL condition at
+	// every content request (MembershipResolver does `conditionSchema()(JSON.parse(value))`). A constant
+	// value that is not a parseable condition must be rejected at config time rather than silently denying
+	// (`{ never: true }`) on every content request once granted.
+	await expectInvalidConfiguration({
+		externalIdentifier: 'sub',
+		claimMapping: {
+			rules: [{
+				claim: 'department',
+				equals: 'Editorial',
+				grantMembership: { project: 'demo', role: 'editor', variables: [{ name: 'siteFilter', values: ['not-a-condition'] }] },
+			}],
+		},
+	})
+})
+
+test('addIDP accepts a condition variable whose constant value IS a valid condition', async () => {
+	// A constant condition value that parses as a real condition is allowed (proves the new JSON check does
+	// not over-reject) — the flow proceeds to the existence check (reported ALREADY_EXISTS).
+	await executeTenantTest({
+		query: addIDP({
+			externalIdentifier: 'sub',
+			claimMapping: {
+				rules: [{
+					claim: 'department',
+					equals: 'Editorial',
+					grantMembership: { project: 'demo', role: 'editor', variables: [{ name: 'siteFilter', values: ['{"eq":"published"}'] }] },
+				}],
+			},
+		}),
+		executes: [
+			...sqlTransaction(
+				{
+					sql:
+						'select "id", "slug", "type", "configuration", "disabled_at" as "disabledAt", "auto_sign_up" as "autoSignUp", "exclusive", "init_returns_config" as "initReturnsConfig", "require_verified_email" as "requireVerifiedEmail", "assume_email_verified" as "assumeEmailVerified", "disable_local_authentication" as "disableLocalAuthentication"  from "tenant"."identity_provider"  where "slug" = ?',
+					parameters: ['oidc'],
+					response: { rows: [{ id: '123', slug: 'oidc' }] },
+				},
+			),
+		],
+		return: {
+			data: { addIDP: { ok: false, error: { code: 'ALREADY_EXISTS' } } },
+		},
+	})
+})
+
+test('updateIDP runs the same claimMapping validation (rejects a merged-in grantRoles)', async () => {
+	// updateIDP is the more dangerous path — it mutates an already-trusted provider — and validates the
+	// MERGED configuration. A merge that introduces a removed `grantRoles` must be rejected before any
+	// UpdateIdpCommand SQL. The provider is fetched once outside the transaction (the audit `before`
+	// snapshot) and once inside it; validation then fails, so only the two selects run.
+	const idpRow = {
+		id: '123',
+		slug: 'mock',
+		type: 'mock',
+		configuration: { externalIdentifier: 'sub' },
+		disabledAt: null,
+		autoSignUp: false,
+		exclusive: false,
+		initReturnsConfig: false,
+		requireVerifiedEmail: false,
+		assumeEmailVerified: false,
+	}
+	const selectIdp = {
+		sql:
+			'select "id", "slug", "type", "configuration", "disabled_at" as "disabledAt", "auto_sign_up" as "autoSignUp", "exclusive", "init_returns_config" as "initReturnsConfig", "require_verified_email" as "requireVerifiedEmail", "assume_email_verified" as "assumeEmailVerified", "disable_local_authentication" as "disableLocalAuthentication"  from "tenant"."identity_provider"  where "slug" = ?',
+		parameters: ['mock'],
+		response: { rows: [idpRow] },
+	}
+	await executeTenantTest({
+		query: {
+			query: GQL`mutation($configuration: Json!) {
+				updateIDP(identityProvider: "mock", configuration: $configuration, mergeConfiguration: true) {
+					ok
+					error { code }
+				}
+			}`,
+			variables: {
+				configuration: { claimMapping: { rules: [{ claim: 'groups', contains: 'Admins', grantRoles: ['project_admin'] }] } },
+			},
+		},
+		executes: [
+			selectIdp,
+			...sqlTransaction(selectIdp),
+		],
+		return: {
+			data: { updateIDP: { ok: false, error: { code: 'INVALID_CONFIGURATION' } } },
+		},
+	})
+})

package/tests/cases/integration/mocked/listProjectMembersQuery.test.ts

@@ -4,14 +4,18 @@ import { testUuid } from '../../../src/testUuid.js'
 import { test } from 'bun:test'
 import { sqlTransaction } from './sql/sqlTransaction.js'
 
-test('list project members by email query', async () => {
+test('list project members by email query with stable pagination order', async () => {
 	await executeTenantTest({
 		query: {
 			query: GQL`
 query {	
 	projectBySlug(slug: "sandbox") {
 		members(
-			input: { filter: { email: ["foo@localhost", "bar@localhost"], memberType: PERSON } }
+			input: {
+				filter: { email: ["foo@localhost", "bar@localhost"], memberType: PERSON }
+				limit: 10
+				offset: 20
+			}
 		) {
 			identity {
 				id
@@ -41,7 +45,8 @@ query {
 					sql: `select "id", "description"  from "tenant"."identity"  
                             where exists (select ?::int  from "tenant"."project_membership"  
                                                          where "project_membership"."identity_id" = "identity"."id" and "project_id" = ?) 
-                              and exists (select ?::int  from "tenant"."person"  where "person"."identity_id" = "identity"."id" and "email" in (?, ?))`,
+				              and exists (select ?::int  from "tenant"."person"  where "person"."identity_id" = "identity"."id" and "email" in (?, ?))
+				            order by "identity"."id" asc limit 10 offset 20`,
 					parameters: [1, testUuid(1), 1, 'foo@localhost', 'bar@localhost'],
 					response: {
 						rows: [

package/tests/cases/integration/mocked/localAuthenticationDisabled.test.ts

@@ -0,0 +1,182 @@
+import { expect, test } from 'bun:test'
+import { executeTenantTest } from '../../../src/testTenant.js'
+import { testUuid } from '../../../src/testUuid.js'
+import { signInMutation } from './gql/signIn.js'
+import { initSignInPasswordlessMutation } from './gql/passwordless.js'
+import { createResetPasswordRequestMutation } from './gql/createResetPasswordRequest.js'
+import { getConfigSql } from './sql/getConfigSql.js'
+import { getNextLoginAttemptSql } from './sql/getNextLoginAttemptSql.js'
+import { getPersonByEmailSql } from './sql/getPersonByEmailSql.js'
+import { localAuthDisablingIdpsSql } from './sql/localAuthDisablingIdpsSql.js'
+import { createSessionKeySql } from './sql/createSessionKeySql.js'
+import { getIdentityProjectsSql } from './sql/getIdentityProjectsSql.js'
+import { getIdentityByIdSql } from './sql/getIdentityByIdSql.js'
+import { getAuthPoliciesSql } from './sql/authPolicySql.js'
+import { selectMembershipsSql } from './sql/selectMembershipsSql.js'
+import { sqlTransaction } from './sql/sqlTransaction.js'
+
+const email = 'john@doe.com'
+const password = '123'
+const personId = testUuid(7)
+const identityId = testUuid(2)
+
+test('signIn - a provider that disables local authentication refuses the password', async () => {
+	await executeTenantTest({
+		query: signInMutation({ email, password }),
+		executes: [
+			getConfigSql(),
+			getNextLoginAttemptSql(email),
+			getPersonByEmailSql({ email, response: { personId, identityId, password, roles: [] } }),
+			localAuthDisablingIdpsSql({ personId, slugs: ['corporateSso'] }),
+		],
+		return: {
+			data: {
+				signIn: {
+					ok: false,
+					errors: [{ code: 'IDP_REQUIRED' }],
+					result: null,
+				},
+			},
+		},
+		expectedAuthLog: {
+			type: 'login',
+			response: expect.objectContaining({ ok: false }),
+		},
+	})
+})
+
+test('signIn - the wrong password is not even consulted, so the answer cannot double as a password oracle', async () => {
+	await executeTenantTest({
+		query: signInMutation({ email, password: 'not-the-password' }),
+		executes: [
+			getConfigSql(),
+			getNextLoginAttemptSql(email),
+			getPersonByEmailSql({ email, response: { personId, identityId, password, roles: [] } }),
+			localAuthDisablingIdpsSql({ personId, slugs: ['corporateSso'] }),
+		],
+		return: {
+			data: {
+				signIn: {
+					ok: false,
+					errors: [{ code: 'IDP_REQUIRED' }],
+					result: null,
+				},
+			},
+		},
+		expectedAuthLog: {
+			type: 'login',
+			response: expect.objectContaining({ ok: false }),
+		},
+	})
+})
+
+test('signIn - revealLoginMethod off collapses it into INVALID_CREDENTIALS', async () => {
+	await executeTenantTest({
+		query: signInMutation({ email, password }),
+		executes: [
+			getConfigSql({ login_reveal_login_method: false }),
+			getNextLoginAttemptSql(email),
+			getPersonByEmailSql({ email, response: { personId, identityId, password, roles: [] } }),
+			localAuthDisablingIdpsSql({ personId, slugs: ['corporateSso'] }),
+		],
+		return: {
+			data: {
+				signIn: {
+					ok: false,
+					errors: [{ code: 'INVALID_CREDENTIALS' }],
+					result: null,
+				},
+			},
+		},
+		expectedAuthLog: {
+			type: 'login',
+			response: expect.objectContaining({ ok: false }),
+		},
+	})
+})
+
+test('signIn - a person with no such link signs in as before', async () => {
+	const projectId = testUuid(10)
+	const apiKeyId = testUuid(1)
+	await executeTenantTest({
+		query: signInMutation({ email, password }),
+		executes: [
+			getConfigSql(),
+			getNextLoginAttemptSql(email),
+			getPersonByEmailSql({ email, response: { personId, identityId, password, roles: [] } }),
+			// The asserted SQL carries `disabled_at IS NULL`, so a DISABLED provider never
+			// reaches this list — turning the provider off is the break-glass.
+			localAuthDisablingIdpsSql({ personId }),
+			getAuthPoliciesSql(),
+			getConfigSql(),
+			getIdentityByIdSql({ identityId }),
+			getAuthPoliciesSql(),
+			createSessionKeySql({ apiKeyId, identityId }),
+			getIdentityProjectsSql({ identityId, projectId }),
+			selectMembershipsSql({ identityId, projectId, membershipsResponse: [] }),
+		],
+		return: {
+			data: {
+				signIn: {
+					ok: true,
+					errors: [],
+					result: { token: '0000000000000000000000000000000000000000' },
+				},
+			},
+		},
+		expectedAuthLog: {
+			type: 'login',
+			response: expect.objectContaining({ ok: true }),
+		},
+	})
+})
+
+test('initSignInPasswordless - the magic link is refused as well, so no second door stays open', async () => {
+	await executeTenantTest({
+		query: initSignInPasswordlessMutation({ email }),
+		executes: [
+			getConfigSql({ passwordless_enabled: 'always' }),
+			...sqlTransaction(
+				getConfigSql({ passwordless_enabled: 'always' }),
+				getPersonByEmailSql({ email, response: { personId, identityId, password, roles: [] } }),
+				localAuthDisablingIdpsSql({ personId, slugs: ['corporateSso'] }),
+			),
+		],
+		return: {
+			data: {
+				initSignInPasswordless: {
+					ok: false,
+					error: { code: 'IDP_REQUIRED' },
+				},
+			},
+		},
+		expectedAuthLog: {
+			type: 'passwordless_login_init',
+			response: expect.objectContaining({ ok: false }),
+		},
+	})
+})
+
+test('createResetPasswordRequest - reports ok but sends nothing, because the password it would set is unusable', async () => {
+	await executeTenantTest({
+		query: createResetPasswordRequestMutation({ email }),
+		executes: [
+			getConfigSql(),
+			getPersonByEmailSql({ email, response: { personId, identityId, password, roles: [] } }),
+			localAuthDisablingIdpsSql({ personId, slugs: ['corporateSso'] }),
+		],
+		return: {
+			data: {
+				createResetPasswordRequest: {
+					ok: true,
+				},
+			},
+		},
+		expectedAuthLog: {
+			type: 'password_reset_init',
+			personInput: email,
+			personId,
+			response: expect.objectContaining({ ok: true }),
+		},
+	})
+})

package/tests/cases/integration/mocked/permissionsQuery.test.ts

@@ -0,0 +1,153 @@
+import { executeTenantTest } from '../../../src/testTenant.js'
+import { GQL } from '../../../src/tags.js'
+import { testUuid } from '../../../src/testUuid.js'
+import { test } from 'bun:test'
+import { getProjectBySlugSql } from './sql/getProjectBySlugSql.js'
+
+const globalPermissionsQuery = GQL`query {
+	me {
+		permissions {
+			canCreateProject
+			canDeployEntrypoint
+			canViewConfiguration
+			canListIdentityProviders
+			canListMailTemplates
+			canManageConfiguration
+			canViewAuthLog
+			canListPersons
+			canListGlobalApiKeys
+			canCreateGlobalApiKey
+		}
+	}
+}`
+
+const projectPermissionsQuery = GQL`query {
+	projectBySlug(slug: "sandbox") {
+		permissions {
+			canViewMembers
+			canAddMember
+			canUpdateMember
+			canRemoveMember
+			canViewSecrets
+			canSetSecret
+			canCreateApiKey
+			canUpdate
+		}
+	}
+}`
+
+test('me.permissions reports every tenant-wide capability', async () => {
+	await executeTenantTest({
+		query: globalPermissionsQuery,
+		executes: [],
+		return: {
+			data: {
+				me: {
+					permissions: {
+						canCreateProject: true,
+						canDeployEntrypoint: true,
+						canViewConfiguration: true,
+						canListIdentityProviders: true,
+						canListMailTemplates: true,
+						canManageConfiguration: true,
+						canViewAuthLog: true,
+						canListPersons: true,
+						canListGlobalApiKeys: true,
+						canCreateGlobalApiKey: true,
+					},
+				},
+			},
+		},
+	})
+})
+
+test('me.permissions answers false for what the ACL denies', async () => {
+	await executeTenantTest({
+		query: globalPermissionsQuery,
+		// Reading the config is allowed, writing it is not — the pair a read-only admin holds.
+		authorizator: {
+			isAllowed: async (identity, scope, action) => action.resource === 'system' && action.privilege === 'viewConfig',
+		},
+		executes: [],
+		return: {
+			data: {
+				me: {
+					permissions: {
+						canCreateProject: false,
+						canDeployEntrypoint: false,
+						canViewConfiguration: true,
+						canListIdentityProviders: false,
+						canListMailTemplates: false,
+						canManageConfiguration: false,
+						canViewAuthLog: false,
+						canListPersons: false,
+						canListGlobalApiKeys: false,
+						canCreateGlobalApiKey: false,
+					},
+				},
+			},
+		},
+	})
+})
+
+test('project.permissions reports every project-scoped capability', async () => {
+	await executeTenantTest({
+		query: projectPermissionsQuery,
+		executes: [
+			getProjectBySlugSql({
+				projectSlug: 'sandbox',
+				response: { id: testUuid(1), name: 'sandbox', slug: 'sandbox', config: {} },
+			}),
+		],
+		return: {
+			data: {
+				projectBySlug: {
+					permissions: {
+						canViewMembers: true,
+						canAddMember: true,
+						canUpdateMember: true,
+						canRemoveMember: true,
+						canViewSecrets: true,
+						canSetSecret: true,
+						canCreateApiKey: true,
+						canUpdate: true,
+					},
+				},
+			},
+		},
+	})
+})
+
+test('project.permissions separates viewing secrets from setting them', async () => {
+	await executeTenantTest({
+		query: projectPermissionsQuery,
+		// The real shape of a project admin: it may read which secrets exist but not write one,
+		// which is exactly the case a UI cannot discover by asking the listing query.
+		authorizator: {
+			isAllowed: async (identity, scope, action) =>
+				action.resource === 'project' && (action.privilege === 'view' || action.privilege === 'viewSecrets' || action.privilege === 'viewMembers'),
+		},
+		executes: [
+			getProjectBySlugSql({
+				projectSlug: 'sandbox',
+				response: { id: testUuid(1), name: 'sandbox', slug: 'sandbox', config: {} },
+			}),
+		],
+		return: {
+			data: {
+				projectBySlug: {
+					permissions: {
+						canViewMembers: true,
+						canAddMember: false,
+						canUpdateMember: false,
+						canRemoveMember: false,
+						canViewSecrets: true,
+						canSetSecret: false,
+						canCreateApiKey: false,
+						canUpdate: false,
+					},
+				},
+			},
+		},
+	})
+})