@fabrika/app 0.3.2 → 0.4.0

package/src/testing/policy-isolation.ts

@@ -0,0 +1,827 @@
+// The policy isolation kit: it proves that the data layer enforces the declared table policies, not that the
+// application uses them. It serves one table through a probe contract over the application's vocabulary, booted by
+// `testKit` on a data layer of its own: every request takes the production path (the proxy decision, the token, the
+// access form, the request-bound capability, the scope predicate) and only the handler is the kit's, so the
+// application's handlers and stores never run. Each attempt seeds two fresh rows that share no scope value and asks as
+// a caller holding every action of the table in the scope of one of them.
+
+import { scoped, type Tables } from '@fabrika/db'
+import { tablePolicies } from '@fabrika/db/tables'
+import { type IsolationWorlds, type SampleValue, tableProbe, type TestDatabase, withoutInboxes } from '@fabrika/db/testing'
+import { z } from 'zod/v4'
+import { createClient } from '../client/contract'
+import { type AnyContract, defineContract, type Vocabulary } from '../contract/define'
+import { implement } from '../implement/implement'
+import type { TestGrant } from './caller'
+import { testKit } from './kit'
+import { refusalStatus, statusOf } from './status'
+
+/** Which of the two seeded rows a request names: the caller's own, or the one in the scope it holds nothing in. */
+export type IsolationRow = 'own' | 'other'
+
+/** A child row addressed through the caller's own parent with the other row's key: a key from another scope. */
+export type ChildIsolationRow = IsolationRow | 'crossed'
+
+export interface IsolationOutcome {
+	/** 200 when the operation ran, otherwise the status the caller got. */
+	readonly status: number
+}
+
+export interface ReadOutcome extends IsolationOutcome {
+	/** The columns the row came back with. */
+	readonly columns: readonly string[]
+}
+
+export interface ListOutcome extends IsolationOutcome {
+	/** Which seeded rows the list reached. */
+	readonly rows: readonly IsolationRow[]
+}
+
+export interface CountOutcome extends IsolationOutcome {
+	readonly count: string
+}
+
+export interface AppCountOutcome extends IsolationOutcome {
+	/** How many more rows the count answered after the seed than before it. */
+	readonly counted: number
+}
+
+export interface MisuseOutcome extends IsolationOutcome {
+	/** Whether the data layer refused the read capability (`CapabilityError`). */
+	readonly refused: boolean
+}
+
+export interface PolicyIsolationKit {
+	readonly table: string
+	/** The dimension the caller's grants are scoped by. */
+	readonly dimension: string
+	get(row: ChildIsolationRow): Promise<ReadOutcome>
+	/** Lists through a `Within` of the caller's scope. */
+	list(): Promise<ListOutcome>
+	/** A child table listed through the parent's `Ref`; the dimension table has no parent. */
+	listByParent(row: IsolationRow): Promise<ListOutcome>
+	count(): Promise<CountOutcome>
+	insert(into: IsolationRow): Promise<IsolationOutcome>
+	update(row: ChildIsolationRow): Promise<IsolationOutcome>
+	remove(row: ChildIsolationRow): Promise<IsolationOutcome>
+	/** A `Ref` for the read action handed to update: the data layer must refuse it. */
+	updateWithRead(): Promise<MisuseOutcome>
+	/** A `Ref` for the read action handed to remove. */
+	removeWithRead(): Promise<MisuseOutcome>
+	/** Lists from an `app` endpoint of `action`, one of the table's `appRead`, for a global holder: every row. */
+	appList(action: string): Promise<ListOutcome>
+	/**
+	 * Counts from an `app` endpoint of `action`, one of the table's `appCount`, for a global holder, before and after
+	 * two rows of two scopes are seeded: `counted` is 2 when the count reaches every row.
+	 */
+	appCount(action: string): Promise<AppCountOutcome>
+	/** Lists from an `app` endpoint of `action`, one of the table's `appCount`: the data layer must refuse it. */
+	appListWithCount(action: string): Promise<MisuseOutcome>
+	/**
+	 * Lists from an `app` endpoint of `action`, one of the table's `appRead`: `leaked` names each answered column that
+	 * declares another read action, `missing` each column that declares exactly `action` and was not answered.
+	 */
+	appColumns(action: string): Promise<AppColumnsOutcome>
+	/**
+	 * Groups by the key and every column from an `app` endpoint of `action`, one of the table's `appCount`: a group is a
+	 * row's values, so the data layer must refuse it.
+	 */
+	appGroupWithCount(action: string): Promise<MisuseOutcome>
+}
+
+export interface AppColumnsOutcome extends IsolationOutcome {
+	readonly leaked: readonly string[]
+	readonly missing: readonly string[]
+}
+
+/**
+ * An application table's isolation kit: the rows belong to no scope, so the boundary is the grant. `global` holds the
+ * table's actions as global grants; `scoped` holds the same actions in one value of a dimension only, which the proxy
+ * refuses on an `app` endpoint. Each attempt seeds one fresh row.
+ */
+export interface AppIsolationKit {
+	readonly table: string
+	get(caller: AppCaller): Promise<ReadOutcome>
+	/** Lists through the `app` capability; `rows` is `['own']` when the list holds the seeded row. */
+	list(caller: AppCaller): Promise<ListOutcome>
+	insert(caller: AppCaller): Promise<IsolationOutcome>
+	update(caller: AppCaller): Promise<IsolationOutcome>
+	remove(caller: AppCaller): Promise<IsolationOutcome>
+	/** The capability of the read action handed to update: the data layer must refuse it. */
+	updateWithRead(): Promise<MisuseOutcome>
+	/** The capability of the read action handed to remove. */
+	removeWithRead(): Promise<MisuseOutcome>
+	/**
+	 * Lists from an `over` endpoint of the table's read action, for a caller who holds it in one scope only: a scoped
+	 * site reads every row of an application table by its read action.
+	 */
+	scopedList(): Promise<ListOutcome>
+	/** The same list from an `over` endpoint of another action the table names: the data layer must refuse it. */
+	scopedListWithOther(): Promise<MisuseOutcome>
+}
+
+export type AppCaller = 'global' | 'scoped'
+
+const ById = z.strictObject({ id: z.string() })
+const Tagged = z.strictObject({ tag: z.string() })
+const Edit = z.strictObject({ id: z.string(), tag: z.string() })
+const InScope = z.strictObject({ scope: z.string(), tag: z.string() })
+const ChildByKey = z.strictObject({ parent: z.string(), key: z.string() })
+const ChildEdit = z.strictObject({ parent: z.string(), key: z.string(), tag: z.string() })
+const ChildInsert = z.strictObject({ parent: z.string(), tag: z.string() })
+const ByParent = z.strictObject({ parent: z.string() })
+const Columns = z.strictObject({ columns: z.array(z.string()) })
+const Keys = z.strictObject({ keys: z.array(z.string()) })
+const Count = z.strictObject({ count: z.string() })
+const Done = z.strictObject({ done: z.boolean() })
+const Refused = z.strictObject({ refused: z.boolean() })
+
+interface ProbeActions {
+	readonly read: string
+	readonly insert: string | null
+	readonly update: string | null
+	readonly delete: string | null
+}
+
+function isCapabilityError(error: unknown): boolean {
+	return error instanceof Error && error.name === 'CapabilityError'
+}
+
+async function attempt<T extends object>(run: () => Promise<T>, failed: (status: number) => T): Promise<T> {
+	try {
+		return await run()
+	} catch (error) {
+		return failed(refusalStatus(error))
+	}
+}
+
+/** A write's outcome: 200 when it ran, the status otherwise. */
+async function wrote(run: () => Promise<unknown>): Promise<IsolationOutcome> {
+	return { status: await statusOf(run()) }
+}
+
+function dimensionProbe(vocabulary: Vocabulary<string, string, string>, dimension: string, list: string, actions: ProbeActions) {
+	const { read } = actions
+	return defineContract(vocabulary, (c) => ({
+		probe: c.rpc('/probe', { callers: ['human'] }, {
+			get: c.query({ input: ById, output: Columns, access: { action: read, on: dimension, from: 'id' } }),
+			list: c.query({ output: Keys, access: { action: read, over: list } }),
+			count: c.query({ output: Count, access: { action: read, over: list } }),
+			insert: c.mutation({ input: InScope, output: Done, access: { action: actions.insert ?? read, in: list, from: 'scope' } }),
+			update: c.mutation({ input: Edit, output: Done, access: { action: actions.update ?? read, on: dimension, from: 'id' } }),
+			remove: c.mutation({ input: ById, output: Done, access: { action: actions.delete ?? read, on: dimension, from: 'id' } }),
+			updateWithRead: c.mutation({ input: Edit, output: Refused, access: { action: read, on: dimension, from: 'id' } }),
+			removeWithRead: c.mutation({ input: ById, output: Refused, access: { action: read, on: dimension, from: 'id' } }),
+		}),
+	}))
+}
+
+function childProbe(vocabulary: Vocabulary<string, string, string>, parent: string, list: string, actions: ProbeActions) {
+	const { read } = actions
+	return defineContract(vocabulary, (c) => ({
+		probe: c.rpc('/probe', { callers: ['human'] }, {
+			get: c.query({ input: ChildByKey, output: Columns, access: { action: read, on: parent, from: 'parent' } }),
+			list: c.query({ output: Keys, access: { action: read, over: list } }),
+			listByParent: c.query({ input: ByParent, output: Keys, access: { action: read, on: parent, from: 'parent' } }),
+			count: c.query({ output: Count, access: { action: read, over: list } }),
+			insert: c.mutation({ input: ChildInsert, output: Done, access: { action: actions.insert ?? read, in: parent, from: 'parent' } }),
+			update: c.mutation({ input: ChildEdit, output: Done, access: { action: actions.update ?? read, on: parent, from: 'parent' } }),
+			remove: c.mutation({ input: ChildByKey, output: Done, access: { action: actions.delete ?? read, on: parent, from: 'parent' } }),
+			updateWithRead: c.mutation({ input: ChildEdit, output: Refused, access: { action: read, on: parent, from: 'parent' } }),
+			removeWithRead: c.mutation({ input: ChildByKey, output: Refused, access: { action: read, on: parent, from: 'parent' } }),
+		}),
+	}))
+}
+
+/** An action the table names besides its read action, or `null` when it names none. */
+function otherAction(actions: ProbeActions): string | null {
+	return [actions.insert, actions.update, actions.delete].find((action) => action !== null && action !== actions.read) ?? null
+}
+
+function appProbe(vocabulary: Vocabulary<string, string, string>, actions: ProbeActions) {
+	const { read } = actions
+	return defineContract(vocabulary, (c) => ({
+		probe: c.rpc('/probe', { callers: ['human'] }, {
+			get: c.query({ input: ById, output: Columns, access: { action: read, app: true } }),
+			list: c.query({ output: Keys, access: { action: read, app: true } }),
+			insert: c.mutation({ input: Tagged, output: Done, access: { action: actions.insert ?? read, app: true } }),
+			update: c.mutation({ input: Edit, output: Done, access: { action: actions.update ?? read, app: true } }),
+			remove: c.mutation({ input: ById, output: Done, access: { action: actions.delete ?? read, app: true } }),
+			updateWithRead: c.mutation({ input: Edit, output: Refused, access: { action: read, app: true } }),
+			removeWithRead: c.mutation({ input: ById, output: Refused, access: { action: read, app: true } }),
+		}),
+	}))
+}
+
+/** Scoped sites over an application table: `over` the vocabulary's first dimension, of its read action and of another. */
+function scopedAppProbe(vocabulary: Vocabulary<string, string, string>, actions: ProbeActions, dimension: string) {
+	return defineContract(vocabulary, (c) => ({
+		probe: c.rpc('/probe', { callers: ['human'] }, {
+			list: c.query({ output: Keys, access: { action: actions.read, over: dimension } }),
+			listWithOther: c.query({ output: Refused, access: { action: otherAction(actions) ?? actions.read, over: dimension } }),
+		}),
+	}))
+}
+
+/**
+ * The isolation kit of `table`, an application table of `tables`, over `postgres`, through a probe contract of `app`
+ * endpoints. `contract` gives only the vocabulary. The kit binds a data layer of its own.
+ */
+export function appPolicyIsolationKit<C extends AnyContract, DB, P>(
+	contract: C,
+	tables: Tables<DB, P>,
+	table: string,
+	postgres: TestDatabase,
+): AppIsolationKit {
+	const policy = tablePolicies(tables)[table]
+	if (policy === undefined) {
+		throw new Error(`${table} is not a table of src/db/tables.ts`)
+	}
+	const scope = policy.scope
+	if (scope.mode !== 'app') {
+		throw new Error(`${table} is a ${scope.mode} table; policyIsolationKit probes a dimension or child table`)
+	}
+	const actions: ProbeActions = policy.actions
+	const layer = scoped(withoutInboxes(tables))
+	const probe = tableProbe(layer, table)
+	const expectVersion = policy.version === null ? undefined : 1
+	const staged = new Map<string, Readonly<Record<string, SampleValue>>>()
+	const tagged = (values: Readonly<Record<string, SampleValue>>): string => {
+		const tag = crypto.randomUUID()
+		staged.set(tag, values)
+		return tag
+	}
+	const valuesOf = (tag: string): Readonly<Record<string, SampleValue>> => {
+		const values = staged.get(tag)
+		staged.delete(tag)
+		if (values === undefined) {
+			throw new Error(`no values were staged for ${tag}`)
+		}
+		return values
+	}
+	const required = (operation: 'insert' | 'update' | 'delete'): void => {
+		if (actions[operation] === null) {
+			throw new Error(`the policy of ${table} declares no ${operation} action`)
+		}
+	}
+	const misuse = async (run: () => Promise<unknown>): Promise<{ readonly refused: boolean }> => {
+		try {
+			await run()
+			return { refused: false }
+		} catch (error) {
+			if (isCapabilityError(error)) {
+				return { refused: true }
+			}
+			throw error
+		}
+	}
+	const probeContract = appProbe(contract.vocabulary, actions)
+	const kit = testKit(
+		implement(probeContract, {
+			database: layer,
+			deps: () => ({}),
+			handlers: () => ({
+				probe: {
+					get: async ({ input, ctx }) => ({ columns: Object.keys(await probe.get(ctx.app, input.id)) }),
+					list: async ({ ctx }) => ({ keys: (await probe.select(ctx.app)).map((row) => String(row[scope.key])) }),
+					insert: async ({ input, ctx }) => {
+						await probe.insert(ctx.app, valuesOf(input.tag))
+						return { done: true }
+					},
+					update: async ({ input, ctx }) => {
+						await probe.update(ctx.app, input.id, valuesOf(input.tag), expectVersion)
+						return { done: true }
+					},
+					remove: async ({ input, ctx }) => {
+						await probe.remove(ctx.app, input.id)
+						return { done: true }
+					},
+					updateWithRead: ({ input, ctx }) => misuse(() => probe.update(ctx.app, input.id, valuesOf(input.tag), expectVersion)),
+					removeWithRead: ({ input, ctx }) => misuse(() => probe.remove(ctx.app, input.id)),
+				},
+			}),
+		}),
+		{ database: postgres.database },
+	)
+	const held = [...new Set([actions.read, actions.insert, actions.update, actions.delete].filter((action) => action !== null))]
+	const dimension = scopeTypeOf(contract.vocabulary.dimensions)
+	let scopedSites: ReturnType<typeof scopedAppKit> | undefined
+	const inOneScope = (action: string) => {
+		if (!Object.hasOwn(contract.vocabulary.dimensions, dimension)) {
+			throw new Error(`the vocabulary declares no dimension, so no scoped site reads ${table}`)
+		}
+		scopedSites ??= scopedAppKit(scopedAppProbe(contract.vocabulary, actions, dimension), tables, table, scope.key, postgres)
+		return scopedSites.as(action, dimension)
+	}
+	const grantsOf = (caller: AppCaller): TestGrant<AnyContract>[] =>
+		caller === 'global'
+			? held.map((action) => ({ action }))
+			: held.map((action) => ({ action, scope: { type: dimension, value: `${dimension}-scoped-${crypto.randomUUID()}` } }))
+	const session = (caller: AppCaller) => createClient(probeContract, 'probe', { fetch: kit.browser(kit.testCaller(grantsOf(caller))) })
+	const seed = () => postgres.seedRow(tables, table)
+	const appKit: AppIsolationKit = {
+		table,
+		async get(caller) {
+			const row = await seed()
+			const api = session(caller)
+			return attempt(async () => ({ status: 200, ...(await api.get({ id: row.key })) }), (status) => ({ status, columns: [] }))
+		},
+		async list(caller) {
+			const row = await seed()
+			const api = session(caller)
+			return attempt(async () => {
+				const { keys } = await api.list()
+				const rows: IsolationRow[] = keys.includes(row.key) ? ['own'] : []
+				return { status: 200, rows }
+			}, (status) => ({ status, rows: [] }))
+		},
+		async insert(caller) {
+			required('insert')
+			const api = session(caller)
+			const tag = tagged(await postgres.sampleInsert(tables, table))
+			return wrote(() => api.insert({ tag }))
+		},
+		async update(caller) {
+			required('update')
+			const row = await seed()
+			const api = session(caller)
+			return wrote(() => api.update({ id: row.key, tag: tagged(row.updates) }))
+		},
+		async remove(caller) {
+			required('delete')
+			const row = await seed()
+			const api = session(caller)
+			return wrote(() => api.remove({ id: row.key }))
+		},
+		async updateWithRead() {
+			const row = await seed()
+			const api = session('global')
+			return attempt(
+				async () => ({ status: 200, ...(await api.updateWithRead({ id: row.key, tag: tagged(row.updates) })) }),
+				(status) => ({ status, refused: false }),
+			)
+		},
+		async removeWithRead() {
+			const row = await seed()
+			const api = session('global')
+			return attempt(async () => ({ status: 200, ...(await api.removeWithRead({ id: row.key })) }), (status) => ({ status, refused: false }))
+		},
+		async scopedList() {
+			const row = await seed()
+			const api = inOneScope(actions.read)
+			return attempt(async () => {
+				const { keys } = await api.list()
+				const rows: IsolationRow[] = keys.includes(row.key) ? ['own'] : []
+				return { status: 200, rows }
+			}, (status) => ({ status, rows: [] }))
+		},
+		async scopedListWithOther() {
+			const other = otherAction(actions)
+			if (other === null) {
+				throw new Error(`the policy of ${table} names no action besides its read action`)
+			}
+			await seed()
+			const api = inOneScope(other)
+			return attempt(async () => ({ status: 200, ...(await api.listWithOther()) }), (status) => ({ status, refused: false }))
+		},
+	}
+	return Object.freeze(appKit)
+}
+
+/** `app` endpoints of one action over a dimension or child table: what its `appRead` and `appCount` reach. */
+function appReachProbe(vocabulary: Vocabulary<string, string, string>, action: string) {
+	return defineContract(vocabulary, (c) => ({
+		probe: c.rpc('/probe', { callers: ['human'] }, {
+			list: c.query({ output: Keys, access: { action, app: true } }),
+			count: c.query({ output: Count, access: { action, app: true } }),
+			listRefused: c.query({ output: Refused, access: { action, app: true } }),
+			columns: c.query({ output: Columns, access: { action, app: true } }),
+			groupRefused: c.query({ output: Refused, access: { action, app: true } }),
+		}),
+	}))
+}
+
+/**
+ * The `app` reach of a dimension or child table, one kit per action on a data layer of its own (a layer binds once),
+ * each asked by a global holder of the action. `seed` writes the two rows of two scopes the lists must both reach.
+ */
+function appReachKit<DB, P>(
+	contract: AnyContract,
+	tables: Tables<DB, P>,
+	table: string,
+	key: string,
+	postgres: TestDatabase,
+	seed: () => Promise<IsolationWorlds>,
+) {
+	const policy = tablePolicies(tables)[table]
+	const columnReads: Readonly<Record<string, string>> = Object.fromEntries(
+		Object.entries(policy?.columns ?? {}).flatMap(([column, declared]) => (declared.read === undefined ? [] : [[column, declared.read]])),
+	)
+	const refusedBy = async (run: () => Promise<unknown>): Promise<{ readonly refused: boolean }> => {
+		try {
+			await run()
+			return { refused: false }
+		} catch (error) {
+			if (isCapabilityError(error)) {
+				return { refused: true }
+			}
+			throw error
+		}
+	}
+	const kits = new Map<string, ReturnType<typeof appReachClient>>()
+	const appReachClient = (action: string) => {
+		const probeContract = appReachProbe(contract.vocabulary, action)
+		const layer = scoped(withoutInboxes(tables))
+		const probe = tableProbe(layer, table)
+		const kit = testKit(
+			implement(probeContract, {
+				database: layer,
+				deps: () => ({}),
+				handlers: () => ({
+					probe: {
+						list: async ({ ctx }) => ({ keys: (await probe.select(ctx.app)).map((row) => String(row[key])) }),
+						count: async ({ ctx }) => ({ count: await probe.count(ctx.app) }),
+						listRefused: ({ ctx }) => refusedBy(() => probe.select(ctx.app)),
+						columns: async ({ ctx }) => ({ columns: [...new Set((await probe.select(ctx.app)).flatMap((row) => Object.keys(row)))] }),
+						groupRefused: ({ ctx }) => refusedBy(() => probe.group(ctx.app, [...new Set([key, ...(policy?.insert ?? [])])])),
+					},
+				}),
+			}),
+			{ database: postgres.database },
+		)
+		return createClient(probeContract, 'probe', { fetch: kit.browser(kit.testCaller([{ action }])) })
+	}
+	const client = (action: string) => {
+		const known = kits.get(action)
+		if (known !== undefined) return known
+		const made = appReachClient(action)
+		kits.set(action, made)
+		return made
+	}
+	return {
+		async appList(action: string): Promise<ListOutcome> {
+			const worlds = await seed()
+			return attempt(async () => ({ status: 200, rows: reached(worlds, (await client(action).list()).keys) }), (status) => ({ status, rows: [] }))
+		},
+		async appCount(action: string): Promise<AppCountOutcome> {
+			const api = client(action)
+			return attempt(async () => {
+				const before = Number((await api.count()).count)
+				await seed()
+				return { status: 200, counted: Number((await api.count()).count) - before }
+			}, (status) => ({ status, counted: 0 }))
+		},
+		async appListWithCount(action: string): Promise<MisuseOutcome> {
+			await seed()
+			return attempt(async () => ({ status: 200, ...(await client(action).listRefused()) }), (status) => ({ status, refused: false }))
+		},
+		async appColumns(action: string): Promise<AppColumnsOutcome> {
+			await seed()
+			return attempt(async () => {
+				const answered = new Set((await client(action).columns()).columns)
+				const declared = Object.entries(columnReads)
+				return {
+					status: 200,
+					leaked: declared.filter(([column, read]) => read !== action && answered.has(column)).map(([column]) => column),
+					missing: declared.filter(([column, read]) => read === action && !answered.has(column)).map(([column]) => column),
+				}
+			}, (status) => ({ status, leaked: [], missing: [] }))
+		},
+		async appGroupWithCount(action: string): Promise<MisuseOutcome> {
+			await seed()
+			return attempt(async () => ({ status: 200, ...(await client(action).groupRefused()) }), (status) => ({ status, refused: false }))
+		},
+	}
+}
+
+/**
+ * The kit of `scopedAppProbe`, on a data layer of its own (a layer binds once): its handlers read `table` through the
+ * `Within` of each `over` site.
+ */
+function scopedAppKit<DB, P>(
+	probeContract: ReturnType<typeof scopedAppProbe>,
+	tables: Tables<DB, P>,
+	table: string,
+	key: string,
+	postgres: TestDatabase,
+) {
+	const layer = scoped(withoutInboxes(tables))
+	const probe = tableProbe(layer, table)
+	const kit = testKit(
+		implement(probeContract, {
+			database: layer,
+			deps: () => ({}),
+			handlers: () => ({
+				probe: {
+					list: async ({ ctx }) => ({ keys: (await probe.select(ctx.within)).map((row) => String(row[key])) }),
+					listWithOther: async ({ ctx }) => {
+						try {
+							await probe.select(ctx.within)
+							return { refused: false }
+						} catch (error) {
+							if (isCapabilityError(error)) {
+								return { refused: true }
+							}
+							throw error
+						}
+					},
+				},
+			}),
+		}),
+		{ database: postgres.database },
+	)
+	return {
+		as: (action: string, dimension: string) =>
+			createClient(probeContract, 'probe', {
+				fetch: kit.browser(kit.testCaller([{ action, scope: { type: dimension, value: `${dimension}-scoped-${crypto.randomUUID()}` } }])),
+			}),
+	}
+}
+
+/**
+ * The policy isolation kit of `table`, a dimension or child table of `tables`, over `postgres`. `contract` gives only the
+ * vocabulary: its actions, dimensions and roles. The kit binds a data layer of its own, so it does not touch the
+ * application's.
+ */
+export function policyIsolationKit<C extends AnyContract, DB, P>(
+	contract: C,
+	tables: Tables<DB, P>,
+	table: string,
+	postgres: TestDatabase,
+): PolicyIsolationKit {
+	const policy = tablePolicies(tables)[table]
+	if (policy === undefined) {
+		throw new Error(`${table} is not a table of src/db/tables.ts`)
+	}
+	const scope = policy.scope
+	if (scope.mode !== 'dimension' && scope.mode !== 'child') {
+		throw new Error(`${table} is a ${scope.mode} table; no store reaches it, so it has no isolation tests`)
+	}
+	const actions: ProbeActions = policy.actions
+	// The probe serves no form, so it compiles against the policies without the forms' inboxes.
+	const layer = scoped(withoutInboxes(tables))
+	const probe = tableProbe(layer, table)
+	const expectVersion = policy.version === null ? undefined : 1
+	const pending = new Map<string, Readonly<Record<string, SampleValue>>>()
+	const valuesOf = (tag: string): Readonly<Record<string, SampleValue>> => {
+		const values = pending.get(tag)
+		pending.delete(tag)
+		if (values === undefined) {
+			throw new Error(`no values were staged for ${tag}`)
+		}
+		return values
+	}
+	const keysOf = (rows: readonly Readonly<Record<string, unknown>>[]): string[] => rows.map((row) => String(row[scope.key]))
+	const tagged = (values: Readonly<Record<string, SampleValue>>): string => {
+		const tag = crypto.randomUUID()
+		pending.set(tag, values)
+		return tag
+	}
+	const required = (operation: 'insert' | 'update' | 'delete'): void => {
+		if (actions[operation] === null) {
+			throw new Error(`the policy of ${table} declares no ${operation} action`)
+		}
+	}
+	const misuse = async (run: () => Promise<unknown>): Promise<{ readonly refused: boolean }> => {
+		try {
+			await run()
+			return { refused: false }
+		} catch (error) {
+			if (isCapabilityError(error)) {
+				return { refused: true }
+			}
+			throw error
+		}
+	}
+	const seed = (): Promise<IsolationWorlds> => postgres.seedWorlds(tables, table)
+	const appReach = appReachKit(contract, tables, table, scope.key, postgres, seed)
+	const grantsIn = (worlds: IsolationWorlds): TestGrant<AnyContract>[] => {
+		const held = new Set([actions.read, actions.insert, actions.update, actions.delete].filter((action) => action !== null))
+		return [...held].map((action) => ({ action, scope: { type: worlds.dimension, value: worlds.own.scope } }))
+	}
+
+	if (scope.mode === 'dimension') {
+		const dimension = scope.dimension
+		const list = scope.container?.dimension ?? dimension
+		const probeContract = dimensionProbe(contract.vocabulary, dimension, list, actions)
+		const kit = testKit(
+			implement(probeContract, {
+				database: layer,
+				deps: () => ({}),
+				handlers: () => ({
+					probe: {
+						get: async ({ ctx }) => ({ columns: Object.keys(await probe.get(ctx.target)) }),
+						list: async ({ ctx }) => ({ keys: keysOf(await probe.select(ctx.within)) }),
+						count: async ({ ctx }) => ({ count: await probe.count(ctx.within) }),
+						insert: async ({ input, ctx }) => {
+							await probe.insert(ctx.target, valuesOf(input.tag))
+							return { done: true }
+						},
+						update: async ({ input, ctx }) => {
+							await probe.update(ctx.target, undefined, valuesOf(input.tag), expectVersion)
+							return { done: true }
+						},
+						remove: async ({ ctx }) => {
+							await probe.remove(ctx.target)
+							return { done: true }
+						},
+						updateWithRead: ({ input, ctx }) => misuse(() => probe.update(ctx.target, undefined, valuesOf(input.tag), expectVersion)),
+						removeWithRead: ({ ctx }) => misuse(() => probe.remove(ctx.target)),
+					},
+				}),
+			}),
+			{ database: postgres.database },
+		)
+		const session = (worlds: IsolationWorlds) => createClient(probeContract, 'probe', { fetch: kit.browser(kit.testCaller(grantsIn(worlds))) })
+		const keyOf = (worlds: IsolationWorlds, row: ChildIsolationRow): string => {
+			if (row === 'crossed') {
+				throw new Error(`${table} is a dimension table; a crossed key addresses a child row`)
+			}
+			return worlds[row].key
+		}
+		const dimensionKit: PolicyIsolationKit = {
+			...appReach,
+			table,
+			dimension: list,
+			async get(row) {
+				const worlds = await seed()
+				const api = session(worlds)
+				return attempt(async () => ({ status: 200, ...(await api.get({ id: keyOf(worlds, row) })) }), (status) => ({ status, columns: [] }))
+			},
+			async list() {
+				const worlds = await seed()
+				const api = session(worlds)
+				return attempt(async () => ({ status: 200, rows: reached(worlds, (await api.list()).keys) }), (status) => ({ status, rows: [] }))
+			},
+			listByParent() {
+				return Promise.reject(new Error(`${table} is a dimension table; only a child table is listed by its parent`))
+			},
+			async count() {
+				const api = session(await seed())
+				return attempt(async () => ({ status: 200, ...(await api.count()) }), (status) => ({ status, count: '' }))
+			},
+			async insert(into) {
+				required('insert')
+				const worlds = await seed()
+				const api = session(worlds)
+				const tag = tagged(await postgres.sampleInsert(tables, table))
+				return wrote(() => api.insert({ scope: worlds[into].scope, tag }))
+			},
+			async update(row) {
+				required('update')
+				const worlds = await seed()
+				const api = session(worlds)
+				const id = keyOf(worlds, row)
+				const tag = tagged(worlds[row === 'other' ? 'other' : 'own'].updates)
+				return wrote(() => api.update({ id, tag }))
+			},
+			async remove(row) {
+				required('delete')
+				const worlds = await seed()
+				const api = session(worlds)
+				return wrote(() => api.remove({ id: keyOf(worlds, row) }))
+			},
+			async updateWithRead() {
+				const worlds = await seed()
+				const api = session(worlds)
+				const tag = tagged(worlds.own.updates)
+				return attempt(
+					async () => ({ status: 200, ...(await api.updateWithRead({ id: worlds.own.key, tag })) }),
+					(status) => ({ status, refused: false }),
+				)
+			},
+			async removeWithRead() {
+				const worlds = await seed()
+				const api = session(worlds)
+				return attempt(async () => ({ status: 200, ...(await api.removeWithRead({ id: worlds.own.key })) }), (status) => ({ status, refused: false }))
+			},
+		}
+		return Object.freeze(dimensionKit)
+	}
+
+	const parentPolicy = tablePolicies(tables)[scope.parent]
+	if (parentPolicy?.scope.mode !== 'dimension') {
+		throw new Error(`${table}: its parent ${scope.parent} is not a dimension table`)
+	}
+	const parent = parentPolicy.scope.dimension
+	const list = parentPolicy.scope.container?.dimension ?? parent
+	const probeContract = childProbe(contract.vocabulary, parent, list, actions)
+	const kit = testKit(
+		implement(probeContract, {
+			database: layer,
+			deps: () => ({}),
+			handlers: () => ({
+				probe: {
+					get: async ({ input, ctx }) => ({ columns: Object.keys(await probe.get(ctx.target, input.key)) }),
+					list: async ({ ctx }) => ({ keys: keysOf(await probe.select(ctx.within)) }),
+					listByParent: async ({ ctx }) => ({ keys: keysOf(await probe.select(ctx.target)) }),
+					count: async ({ ctx }) => ({ count: await probe.count(ctx.within) }),
+					insert: async ({ input, ctx }) => {
+						await probe.insert(ctx.target, valuesOf(input.tag))
+						return { done: true }
+					},
+					update: async ({ input, ctx }) => {
+						await probe.update(ctx.target, input.key, valuesOf(input.tag), expectVersion)
+						return { done: true }
+					},
+					remove: async ({ input, ctx }) => {
+						await probe.remove(ctx.target, input.key)
+						return { done: true }
+					},
+					updateWithRead: ({ input, ctx }) => misuse(() => probe.update(ctx.target, input.key, valuesOf(input.tag), expectVersion)),
+					removeWithRead: ({ input, ctx }) => misuse(() => probe.remove(ctx.target, input.key)),
+				},
+			}),
+		}),
+		{ database: postgres.database },
+	)
+	const session = (worlds: IsolationWorlds) => createClient(probeContract, 'probe', { fetch: kit.browser(kit.testCaller(grantsIn(worlds))) })
+	/** The parent and key a request names: a crossed row is the other key under the caller's own parent. */
+	const address = (worlds: IsolationWorlds, row: ChildIsolationRow): { readonly parent: string; readonly key: string } => {
+		const parentOf = worlds[row === 'other' ? 'other' : 'own'].parent
+		if (parentOf === null) {
+			throw new Error(`${table} is a child table, yet its seeded row has no parent`)
+		}
+		return { parent: parentOf, key: worlds[row === 'own' ? 'own' : 'other'].key }
+	}
+	const childKit: PolicyIsolationKit = {
+		...appReach,
+		table,
+		dimension: list,
+		async get(row) {
+			const worlds = await seed()
+			const api = session(worlds)
+			return attempt(async () => ({ status: 200, ...(await api.get(address(worlds, row))) }), (status) => ({ status, columns: [] }))
+		},
+		async list() {
+			const worlds = await seed()
+			const api = session(worlds)
+			return attempt(async () => ({ status: 200, rows: reached(worlds, (await api.list()).keys) }), (status) => ({ status, rows: [] }))
+		},
+		async listByParent(row) {
+			const worlds = await seed()
+			const api = session(worlds)
+			const { parent: parentKey } = address(worlds, row)
+			return attempt(async () => ({ status: 200, rows: reached(worlds, (await api.listByParent({ parent: parentKey })).keys) }), (status) => ({
+				status,
+				rows: [],
+			}))
+		},
+		async count() {
+			const api = session(await seed())
+			return attempt(async () => ({ status: 200, ...(await api.count()) }), (status) => ({ status, count: '' }))
+		},
+		async insert(into) {
+			required('insert')
+			const worlds = await seed()
+			const api = session(worlds)
+			const tag = tagged(await postgres.sampleInsert(tables, table))
+			const { parent: parentKey } = address(worlds, into)
+			return wrote(() => api.insert({ parent: parentKey, tag }))
+		},
+		async update(row) {
+			required('update')
+			const worlds = await seed()
+			const api = session(worlds)
+			const tag = tagged(worlds[row === 'own' ? 'own' : 'other'].updates)
+			return wrote(() => api.update({ ...address(worlds, row), tag }))
+		},
+		async remove(row) {
+			required('delete')
+			const worlds = await seed()
+			const api = session(worlds)
+			return wrote(() => api.remove(address(worlds, row)))
+		},
+		async updateWithRead() {
+			const worlds = await seed()
+			const api = session(worlds)
+			const tag = tagged(worlds.own.updates)
+			return attempt(async () => ({ status: 200, ...(await api.updateWithRead({ ...address(worlds, 'own'), tag })) }), (status) => ({
+				status,
+				refused: false,
+			}))
+		},
+		async removeWithRead() {
+			const worlds = await seed()
+			const api = session(worlds)
+			return attempt(async () => ({ status: 200, ...(await api.removeWithRead(address(worlds, 'own'))) }), (status) => ({ status, refused: false }))
+		},
+	}
+	return Object.freeze(childKit)
+}
+
+/**
+ * The scope type a `scoped` caller's grants name: the vocabulary's first dimension, or, in a vocabulary without one, a
+ * name IAM never grants in. Either way the grant is not global, which is all the app form looks at.
+ */
+export function scopeTypeOf(dimensions: object): string {
+	return Object.keys(dimensions).sort()[0] ?? 'scope'
+}
+
+/** Which of the two seeded rows `keys` holds; a key of neither (a row another test seeded) is not one of them. */
+function reached(worlds: IsolationWorlds, keys: readonly string[]): IsolationRow[] {
+	const rows: IsolationRow[] = []
+	if (keys.includes(worlds.own.key)) rows.push('own')
+	if (keys.includes(worlds.other.key)) rows.push('other')
+	return rows
+}