@fabrika/app 0.8.2 → 0.9.0-cloudflare.2

package/src/testing/endpoint-access.ts

@@ -20,6 +20,9 @@ import type { Tables } from '@fabrika/db'
 import { tablePolicies } from '@fabrika/db/tables'
 import { type IsolationWorlds, type SampleValue, SEEDED_OBJECT_VERSION, type TestDatabase, type WorldRow } from '@fabrika/db/testing'
 import { MemoryFileObjects } from '@fabrika/platform/testing'
+import { readFile } from 'node:fs/promises'
+import { basename } from 'node:path'
+import { fileURLToPath } from 'node:url'
 import { z } from 'zod/v4'
 import type { RpcFetch } from '../client/transport'
 import { compileContract } from '../contract/compile'
@@ -33,6 +36,7 @@ import {
 } from '../contract/defaults'
 import type { AnyContract } from '../contract/define'
 import type { FileScanner, ScanVerdict } from '../files/scan'
+import { bytesAreOfType, SNIFF_BYTES } from '../files/sniff'
 import type { ApplicationEnvironment, ContractImplementation } from '../implement/implement'
 import type { TestCaller, TestGrant } from './caller'
 import { standInIamKit } from './kit'
@@ -58,6 +62,13 @@ export type ReachOutcome = { readonly answered: true } | { readonly answered: fa
 /** Column → value of the row of the table that owns the endpoint's dimension, in both scopes: the author's seed. */
 export type Seed = Readonly<Record<string, SampleValue>>
 
+/**
+ * Table → column → value: one row of each application table the handler reads for the caller's own scope, seeded
+ * before a leak or an own case asks and removed once it is over, with every row that refers to it, so no other case
+ * finds it. Both scopes may see it, so its values are never counted as the other scope's.
+ */
+export type AppRows = Readonly<Record<string, Seed>>
+
 export interface EndpointAccessKit {
 	/**
 	 * A caller holding the endpoint's action in one scope names an object (`on`) or a scope value (`in`) of another;
@@ -66,16 +77,18 @@ export interface EndpointAccessKit {
 	denied(endpoint: string, input: Readonly<Record<string, unknown>>, seed?: Seed): Promise<DeniedOutcome>
 	/**
 	 * A caller of the other scope asks first, then a caller of one scope asks for its own object (`on`), its list
-	 * (`over`) or, for every table that lies in the dimension, its scope value (`in`).
+	 * (`over`) or, for every table that lies in the dimension, its scope value (`in`). `appRows` are seeded first, as
+	 * for `own`.
 	 */
-	leaked(endpoint: string, input: Readonly<Record<string, unknown>>, seed?: Seed): Promise<LeakOutcome>
+	leaked(endpoint: string, input: Readonly<Record<string, unknown>>, seed?: Seed, appRows?: AppRows): Promise<LeakOutcome>
 	/**
 	 * A caller that holds only the endpoint's action asks for its own object: a person or a script in its scope, or, on
 	 * a link mount, the holder of a link bound to the object. A write action reads its own target. Where IAM requires more
 	 * of the caller, it holds that too: a member manager an assigning role and the assigned role's actions, a link's
-	 * issuer the actions the link grants.
+	 * issuer the actions the link grants. `appRows` are the rows of application tables its handler reads (the guide a link
+	 * holder downloads), each seeded first.
 	 */
-	own(endpoint: string, input: Readonly<Record<string, unknown>>, seed?: Seed): Promise<DeniedOutcome>
+	own(endpoint: string, input: Readonly<Record<string, unknown>>, seed?: Seed, appRows?: AppRows): Promise<DeniedOutcome>
 	/**
 	 * An `app` or a `creates` endpoint asked by a caller who holds its action in one value of a dimension only, never
 	 * globally: refused (403), by the proxy for `app` and by IAM for `creates`, since both need a global grant.
@@ -101,6 +114,54 @@ export interface EndpointAccessKit {
 	anyone(endpoint: string, input: Readonly<Record<string, unknown>>): Promise<ReachOutcome>
 }
 
+export interface EndpointAccessOptions {
+	/**
+	 * The file every case of an endpoint sends in a file field instead of the kit's sample, by endpoint id and input
+	 * field: a file of the application's repository that a handler inspecting the content accepts (a valid package). Its
+	 * type is the first of the field's kind that its bytes are; a file of none of them throws. `files` of the fixtures.
+	 */
+	readonly files?: Readonly<Record<string, Readonly<Record<string, URL>>>>
+	/**
+	 * The error types of the refusals (400) an endpoint's handler answers its own object with when the case's input meets
+	 * no domain rule the kit can satisfy, by endpoint id: such a 400 is the handler's own answer, so the request passed
+	 * the access form, and the endpoint's own case gets it as `{ status: 400 }` instead of failing; so does the other
+	 * scope's request a leak case makes first. The own scope's answer of a leak case, and a global or capability case,
+	 * still throw on it (an answer that holds nothing proves no isolation), so does any other 400, and an input the schema
+	 * refuses (`validation`) always does. `refusals` of the fixtures.
+	 */
+	readonly refusals?: Readonly<Record<string, readonly string[]>>
+	/**
+	 * Known values for text columns of the row the endpoint addresses (the row of the table that owns its dimension), by
+	 * endpoint id: the value in the own scope's row, and `<value>-other` in the other scope's, which counts among the
+	 * other scope's values a leak shows. For a handler whose rule ties a column to the input or a file fixture (a package
+	 * that names the skill's slug). `pins` of the fixtures.
+	 */
+	readonly pins?: Readonly<Record<string, Readonly<Record<string, string>>>>
+}
+
+/**
+ * Whether a request takes a refusal the fixtures declare for its endpoint as the handler's answer: an own case's, and the
+ * other scope's request a leak case makes first, whose answer is not the one checked.
+ */
+type Refusals = 'declared' | 'none'
+
+/**
+ * The pins of a case's endpoint (column → the own scope's value of a text column), and the removals of the case: rows
+ * seeded with pins are removed once the case is over, so the next case can pin the same values under a unique index.
+ */
+interface Pinning {
+	readonly pins: Readonly<Record<string, string>>
+	readonly removals: (() => Promise<void>)[]
+}
+
+const NO_PINNING: Pinning = { pins: {}, removals: [] }
+
+/** Seeded worlds, their removal taken by the case when they hold pinned values. */
+const pinned = <W extends { readonly remove: () => Promise<void> }>(worlds: W, pinning: Pinning): W => {
+	if (Object.keys(pinning.pins).length > 0) pinning.removals.push(worlds.remove)
+	return worlds
+}
+
 interface ActionEndpoint {
 	readonly id: string
 	/** The link mount of a link procedure; `null` for every other endpoint. */
@@ -276,7 +337,12 @@ export const managerGrants = (
  * The endpoint access kit of `app`, whose data layer is `scoped(tables)`, over `postgres`. It boots `app` once, so the
  * application's layer is bound here and nowhere else in the process.
  */
-export function endpointAccessKit<DB, P>(app: ContractImplementation<AnyContract>, tables: Tables<DB, P>, postgres: TestDatabase): EndpointAccessKit {
+export function endpointAccessKit<DB, P>(
+	app: ContractImplementation<AnyContract>,
+	tables: Tables<DB, P>,
+	postgres: TestDatabase,
+	options: EndpointAccessOptions = {},
+): EndpointAccessKit {
 	// The objects of the files the cases seed live in memory; their rows are the application's own tables.
 	const objects = new MemoryFileObjects()
 	const { kit, standIn } = standInIamKit(app, {
@@ -395,16 +461,20 @@ export function endpointAccessKit<DB, P>(app: ContractImplementation<AnyContract
 		throw new Error(`${row.id} admits neither a human nor a machine caller`)
 	}
 
-	/** A case's request by a new caller holding `grants`, its generated fields filled for `chain` and that caller. */
+	/**
+	 * A case's request by a new caller holding `grants`, its generated fields filled for `chain` and that caller. Only an
+	 * own case passes `refusals: 'declared'`.
+	 */
 	const ask = async (
 		row: ActionEndpoint,
 		grants: readonly Grant[],
 		input: Readonly<Record<string, unknown>>,
 		chain: Chain,
+		refusals: Refusals = 'none',
 	): Promise<{ readonly status: number; readonly text: string; readonly marks: readonly string[] }> => {
 		const asker = callerFor(row, grants)
 		const asked = withGenerated(row, input, chain, asker.caller)
-		return { ...(await askAs(row, asker.fetch, asked.input)), marks: asked.marks }
+		return { ...(await askAs(row, asker.fetch, asked.input, refusals)), marks: asked.marks }
 	}
 
 	// A seeded file column references an empty object, which a handler that serves or opens the file reads here.
@@ -418,7 +488,7 @@ export function endpointAccessKit<DB, P>(app: ContractImplementation<AnyContract
 	}
 
 	/** The request of a case: a GET's input in its URL, a file field's marker as a file of its kind in a multipart body. */
-	const requestOf = (row: ActionEndpoint, body: Readonly<Record<string, unknown>>): readonly [string, RequestInit] => {
+	const requestOf = async (row: ActionEndpoint, body: Readonly<Record<string, unknown>>): Promise<readonly [string, RequestInit]> => {
 		if (row.method === 'GET') {
 			const params = new URLSearchParams(Object.entries(body).map(([name, value]) => [name, value === null ? 'null' : String(value)]))
 			return [params.size === 0 ? row.path : `${row.path}?${params}`, { method: 'GET' }]
@@ -437,7 +507,7 @@ export function endpointAccessKit<DB, P>(app: ContractImplementation<AnyContract
 			for (const item of Array.isArray(value) ? value : [value]) {
 				const kind = fileKindOf(item)
 				if (kind === undefined) throw new Error(`${row.id}: the file field ${name} holds ${JSON.stringify(item)}, not a generated file`)
-				files.push([name, generatedFile(kind)])
+				files.push([name, await generatedFile(row.id, name, kind)])
 			}
 		}
 		const form = new FormData()
@@ -446,30 +516,69 @@ export function endpointAccessKit<DB, P>(app: ContractImplementation<AnyContract
 		return [row.path, { method: 'POST', body: form }]
 	}
 
-	const generatedFile = (kind: string): File => {
-		const sample = sampleFile(kind, kit.artifact.fileKinds?.[kind]?.types ?? [])
-		return new File([sample.bytes], `generated-${kind}`, { type: sample.type })
+	/** The file a case sends in `field`: the author's file fixture of the endpoint's field, else a sample of `kind`. */
+	const generatedFile = async (endpoint: string, field: string, kind: string): Promise<File> => {
+		const types = kit.artifact.fileKinds?.[kind]?.types ?? []
+		const fixture = options.files?.[endpoint]?.[field]
+		if (fixture === undefined) {
+			const sample = sampleFile(kind, types)
+			return new File([sample.bytes], `generated-${kind}`, { type: sample.type })
+		}
+		const path = fileURLToPath(fixture)
+		const bytes = await fixtureBytes(endpoint, field, path)
+		const type = types.find((candidate) => bytesAreOfType(candidate, bytes.subarray(0, SNIFF_BYTES)))
+		if (type === undefined) {
+			throw new Error(`${endpoint}: the file of ${field}, ${path}, is none of the types of files.${kind} (${types.join(', ')})`)
+		}
+		return new File([bytes], basename(path), { type })
+	}
+
+	// A file fixture is read once; every case sends the same bytes.
+	const fixtureFiles = new Map<string, Uint8Array<ArrayBuffer>>()
+	const fixtureBytes = async (endpoint: string, field: string, path: string): Promise<Uint8Array<ArrayBuffer>> => {
+		const known = fixtureFiles.get(path)
+		if (known !== undefined) return known
+		let bytes: Uint8Array<ArrayBuffer>
+		try {
+			bytes = new Uint8Array(await readFile(path))
+		} catch {
+			throw new Error(`${endpoint}: the file of ${field} in the fixtures, ${path}, cannot be read; add it to the repository or correct its path`)
+		}
+		fixtureFiles.set(path, bytes)
+		return bytes
 	}
 
 	const askAs = async (
 		row: ActionEndpoint,
 		fetch: RpcFetch,
 		body: Readonly<Record<string, unknown>>,
+		refusals: Refusals = 'none',
 	): Promise<{ readonly status: number; readonly text: string }> => {
 		stockSeededObjects()
-		const [url, init] = requestOf(row, body)
+		const [url, init] = await requestOf(row, body)
 		const response = await fetch(url, init)
 		const text = await response.text()
 		// A 400 hides what the case is about: input is parsed before the access form runs, and a handler's refusal of
 		// the input it was given is no answer to another scope. Either is what the generator could not build.
 		if (response.status === 400) {
 			const type = errorType(text)
+			const declared = type !== undefined && type !== 'validation' && options.refusals?.[row.id]?.includes(type) === true
+			// The own case may take it: it shows the access form let the caller through. The answer a leak case checks, or a
+			// global case's, would pass holding nothing, which proves nothing.
+			if (declared && refusals === 'declared') {
+				return { status: response.status, text }
+			}
+			if (declared) {
+				throw new Error(
+					`${row.id}: the handler answered its declared refusal (400 ${type}), which only the own case takes; this case proves nothing on it until the fixtures give what the handler needs (pins, files, fixtures) (${text})`,
+				)
+			}
 			throw new Error(
 				type === 'validation'
 					? `${row.id}: the case's input does not match the endpoint's input schema; correct its fixture (${text})`
 					: `${row.id}: the handler refused the case's input (400 ${
 						type ?? 'without a type'
-					}); the case cannot reach what it tests until its fixtures give what the handler needs: a picked person in members, a row of its object in rows, the state in seeds or the whole input in fixtures (${text})`,
+					}); the case cannot reach what it tests until its fixtures give what the handler needs: a picked person in members, a row of its object in rows, the state in seeds, a file it accepts in files, the whole input in fixtures, or the refusal it answers in refusals (${text})`,
 			)
 		}
 		return { status: response.status, text }
@@ -485,6 +594,7 @@ export function endpointAccessKit<DB, P>(app: ContractImplementation<AnyContract
 		field: SchemaShape | undefined,
 		seed: Seed,
 		input: Readonly<Record<string, unknown>>,
+		pinning: Pinning = NO_PINNING,
 	): Promise<Scopes> => {
 		const named = rowFields(input)
 		const owner = ownerOf(dimension)
@@ -505,7 +615,7 @@ export function endpointAccessKit<DB, P>(app: ContractImplementation<AnyContract
 				},
 			}
 		}
-		const worlds = await postgres.seedWorlds(tables, owner, seed)
+		const worlds = pinned(await postgres.seedWorlds(tables, owner, seed, pinning.pins), pinning)
 		const own = await rowsIn(worlds.own, named)
 		const other = await rowsIn(worlds.other, named)
 		return {
@@ -560,14 +670,17 @@ export function endpointAccessKit<DB, P>(app: ContractImplementation<AnyContract
 	 * For a report `in` `dimension`: one row in each scope of every table that lies in it, the table that owns it with
 	 * `seed`. Each side's targets are its rows' values of `dimension`, and each caller holds all of them.
 	 */
-	const inScopesOf = async (action: string, dimension: string, field: SchemaShape | undefined, seed: Seed) => {
+	const inScopesOf = async (action: string, dimension: string, field: SchemaShape | undefined, seed: Seed, pinning: Pinning = NO_PINNING) => {
 		const own: InTarget[] = []
 		const other: InTarget[] = []
 		const values: string[] = []
 		for (const name of tableNames) {
 			const mode = policies[name]?.scope.mode
 			if (mode !== 'dimension' && mode !== 'child') continue
-			const worlds = await postgres.seedWorlds(tables, name, name === ownerOf(dimension) ? seed : {})
+			const owned = name === ownerOf(dimension)
+			const worlds = owned
+				? pinned(await postgres.seedWorlds(tables, name, seed, pinning.pins), pinning)
+				: await postgres.seedWorlds(tables, name)
 			const ownAt = worlds.own.chain.findIndex((link) => link.type === dimension)
 			const otherAt = worlds.other.chain.findIndex((link) => link.type === dimension)
 			const ownValue = worlds.own.chain[ownAt]?.value
@@ -579,7 +692,7 @@ export function endpointAccessKit<DB, P>(app: ContractImplementation<AnyContract
 			}
 		}
 		if (own.length === 0) {
-			const scopes = await scopesOf(action, dimension, field, seed, {})
+			const scopes = await scopesOf(action, dimension, field, seed, {}, pinning)
 			return { own: [scopes.own], other: [scopes.other], values: scopes.other.values }
 		}
 		return { own, other, values }
@@ -702,6 +815,7 @@ export function endpointAccessKit<DB, P>(app: ContractImplementation<AnyContract
 		mount: string,
 		seed: Seed,
 		input: Readonly<Record<string, unknown>>,
+		pinning: Pinning,
 	): Promise<{ readonly fetch: RpcFetch; readonly rows: Readonly<Record<string, string>> }> => {
 		const access = row.access
 		if (access.form !== 'on') {
@@ -711,7 +825,7 @@ export function endpointAccessKit<DB, P>(app: ContractImplementation<AnyContract
 		if (owner === undefined) {
 			throw new Error(`${row.id}: no table owns ${access.dimension}, so no link can be bound to one`)
 		}
-		const { own } = await postgres.seedWorlds(tables, owner, seed)
+		const { own } = pinned(await postgres.seedWorlds(tables, owner, seed, pinning.pins), pinning)
 		const holder = kit.testCaller([{ action: row.action, scope: { type: access.dimension, value: own.key } }], {
 			kind: 'link',
 			link: { mount, chain: own.chain },
@@ -724,147 +838,188 @@ export function endpointAccessKit<DB, P>(app: ContractImplementation<AnyContract
 		return { fetch, rows: (await rowsIn(own, rowFields(input))).rows }
 	}
 
-	const accessKit: EndpointAccessKit = {
-		async denied(endpoint, input, seed = {}) {
-			const row = endpointOf(endpoint)
-			const { action, access } = row
-			if (access.form !== 'on' && access.form !== 'in') {
-				throw new Error(`${endpoint} has the access form ${access.form}; only on and in name an object or a scope value`)
-			}
-			const scopes = await scopesOf(action, access.dimension, fieldOf(row.input, access.from), seed, input)
-			const asked = addressing(input, access.from, scopes.other)
-			const { status } = await ask(row, holding(row, input, scopes.own.grants, scopes.own.chain), asked, scopes.own.chain)
-			return { status }
-		},
-		async leaked(endpoint, input, seed = {}) {
-			const row = endpointOf(endpoint)
-			const { action, access } = row
-			if (access.form === 'in') {
-				const scopes = await inScopesOf(action, access.dimension, fieldOf(row.input, access.from), seed)
-				const grants = (targets: readonly InTarget[]): Grant[] =>
-					targets.flatMap(({ target, chain }) => holding(row, input, [{ action, scope: { type: access.dimension, value: target } }], chain))
-				const marks: string[] = []
-				for (const side of scopes.other) {
-					const answer = await ask(row, grants(scopes.other), addressing(input, access.from, side), side.chain)
-					marks.push(...answer.marks)
+	// The cases of one call: `removals` takes the removal of the application rows it seeds, which `drained` runs once
+	// the call and the runs it kicked are over. A list per call, so a concurrent case never removes the rows another
+	// was given; the generated cases run one after another, since a row a required foreign key needed is shared.
+	const accessKitOf = (removals: (() => Promise<void>)[]): EndpointAccessKit => {
+		/** The pins of `endpoint`, whose seeded rows this call removes once it is over. */
+		const pinningOf = (endpoint: string): Pinning => ({ pins: options.pins?.[endpoint] ?? {}, removals })
+
+		/** One row of each application table `appRows` names, for this call only. */
+		const seedAppRows = async (appRows: AppRows): Promise<void> => {
+			if (Object.keys(appRows).length === 0) return
+			removals.push((await postgres.seedApplicationRows(tables, appRows)).remove)
+		}
+
+		return {
+			async denied(endpoint, input, seed = {}) {
+				const row = endpointOf(endpoint)
+				const { action, access } = row
+				if (access.form !== 'on' && access.form !== 'in') {
+					throw new Error(`${endpoint} has the access form ${access.form}; only on and in name an object or a scope value`)
 				}
-				const answers = []
-				for (const side of scopes.own) {
-					answers.push(await ask(row, grants(scopes.own), addressing(input, access.from, side), side.chain))
+				const scopes = await scopesOf(action, access.dimension, fieldOf(row.input, access.from), seed, input, pinningOf(endpoint))
+				const asked = addressing(input, access.from, scopes.other)
+				const { status } = await ask(row, holding(row, input, scopes.own.grants, scopes.own.chain), asked, scopes.own.chain)
+				return { status }
+			},
+			async leaked(endpoint, input, seed = {}, appRows = {}) {
+				const row = endpointOf(endpoint)
+				const { action, access } = row
+				if (access.form === 'in') {
+					await seedAppRows(appRows)
+					const scopes = await inScopesOf(action, access.dimension, fieldOf(row.input, access.from), seed, pinningOf(endpoint))
+					const grants = (targets: readonly InTarget[]): Grant[] =>
+						targets.flatMap(({ target, chain }) => holding(row, input, [{ action, scope: { type: access.dimension, value: target } }], chain))
+					const marks: string[] = []
+					for (const side of scopes.other) {
+						const answer = await ask(row, grants(scopes.other), addressing(input, access.from, side), side.chain, 'declared')
+						marks.push(...answer.marks)
+					}
+					const answers = []
+					for (const side of scopes.own) {
+						answers.push(await ask(row, grants(scopes.own), addressing(input, access.from, side), side.chain))
+					}
+					return leakOutcome(answers, [...scopes.values, ...marks])
 				}
-				return leakOutcome(answers, [...scopes.values, ...marks])
-			}
-			if (access.form !== 'on' && access.form !== 'over') {
-				throw new Error(`${endpoint} has the access form ${access.form}; only on, in and over answer with rows of a scope`)
-			}
-			const scopes = access.form === 'on'
-				? await scopesOf(action, access.dimension, fieldOf(row.input, access.from), seed, input)
-				: await listScopesOf(action, access.dimension)
-			const from = access.form === 'on' ? access.from : null
-			const other = await ask(
-				row,
-				holding(row, input, scopes.other.grants, scopes.other.chain),
-				addressing(input, from, scopes.other),
-				scopes.other.chain,
-			)
-			const answer = await ask(
-				row,
-				holding(row, input, scopes.own.grants, scopes.own.chain),
-				addressing(input, from, scopes.own),
-				scopes.own.chain,
-			)
-			return leakOutcome([answer], [...scopes.other.values, ...other.marks])
-		},
-		async own(endpoint, input, seed = {}) {
-			const row = endpointOf(endpoint)
-			const { action, access } = row
-			if (access.form !== 'on') {
-				throw new Error(`${endpoint} has the access form ${access.form}; only on addresses an object of its own`)
-			}
-			if (row.link !== null) {
-				const holder = await linkHolder(row, row.link, seed, input)
-				const { status } = await askAs(row, holder.fetch, { ...input, ...holder.rows })
+				if (access.form !== 'on' && access.form !== 'over') {
+					throw new Error(`${endpoint} has the access form ${access.form}; only on, in and over answer with rows of a scope`)
+				}
+				await seedAppRows(appRows)
+				const scopes = access.form === 'on'
+					? await scopesOf(action, access.dimension, fieldOf(row.input, access.from), seed, input, pinningOf(endpoint))
+					: await listScopesOf(action, access.dimension)
+				const from = access.form === 'on' ? access.from : null
+				// The other scope asks first, to fill whatever a handler keeps between requests; its pins differ from the own
+				// scope's, so a refusal the fixtures declare is its answer too. The own scope's answer is the one checked.
+				const other = await ask(
+					row,
+					holding(row, input, scopes.other.grants, scopes.other.chain),
+					addressing(input, from, scopes.other),
+					scopes.other.chain,
+					'declared',
+				)
+				const answer = await ask(
+					row,
+					holding(row, input, scopes.own.grants, scopes.own.chain),
+					addressing(input, from, scopes.own),
+					scopes.own.chain,
+				)
+				return leakOutcome([answer], [...scopes.other.values, ...other.marks])
+			},
+			async own(endpoint, input, seed = {}, appRows = {}) {
+				const row = endpointOf(endpoint)
+				const { action, access } = row
+				if (access.form !== 'on') {
+					throw new Error(`${endpoint} has the access form ${access.form}; only on addresses an object of its own`)
+				}
+				await seedAppRows(appRows)
+				if (row.link !== null) {
+					const holder = await linkHolder(row, row.link, seed, input, pinningOf(endpoint))
+					const { status } = await askAs(row, holder.fetch, { ...input, ...holder.rows }, 'declared')
+					return { status }
+				}
+				const scopes = await scopesOf(action, access.dimension, fieldOf(row.input, access.from), seed, input, pinningOf(endpoint))
+				const { status } = await ask(
+					row,
+					holding(row, input, scopes.own.grants, scopes.own.chain),
+					addressing(input, access.from, scopes.own),
+					scopes.own.chain,
+					'declared',
+				)
 				return { status }
+			},
+			async scoped(endpoint, input) {
+				const row = globalEndpointOf(endpoint)
+				const dimension = row.access.form === 'creates' ? row.access.dimension : scopeTypeOf(kit.artifact.dimensions)
+				const { status } = await ask(row, [{ action: row.action, scope: { type: dimension, value: freshValue(dimension, 'own', undefined) } }], input, [])
+				return { status }
+			},
+			async anyone(endpoint, input) {
+				const row = kit.artifact.endpoints.find((candidate) => candidate.id === endpoint)
+				if (row?.kind !== 'public') {
+					throw new Error(`${endpoint} is not a public procedure of the contract`)
+				}
+				const response = await kit.fetch(row.path, {
+					method: row.method,
+					headers: { 'Content-Type': 'application/json', Origin: kit.origin, 'Sec-Fetch-Site': 'same-origin' },
+					body: JSON.stringify(input),
+				})
+				const status = response.status
+				const challenged = status === 400 && errorType(await response.text()) === 'challenge_failed'
+				return status >= 500 || status === 401 || status === 403 || challenged ? { answered: false, status } : { answered: true }
+			},
+			async global(endpoint, input) {
+				const row = globalEndpointOf(endpoint)
+				const { status } = await askAs(row, callerFor(row, [], [{ action: row.action }]).fetch, input)
+				// Neither form refuses with 404, so a 404 is the handler's own answer (a row the sampled input names is missing).
+				return status >= 500 || status === 401 || status === 403 ? { answered: false, status } : { answered: true }
+			},
+			async capability(endpoint, capability, input, seed = {}) {
+				const capabilities = capabilitiesEndpointOf(endpoint)
+				const named = capabilities.get(capability)
+				if (named === undefined) {
+					throw new Error(`${endpoint} has no capability '${capability}' (capabilities: ${[...capabilities.keys()].join(', ')})`)
+				}
+				const grants: Grant[] = []
+				const global: { readonly action: string }[] = []
+				let asked = input
+				for (const [name, other] of capabilities) {
+					if (name === capability) continue
+					if (other.access.form === 'over') {
+						global.push({ action: other.action })
+					} else if (other.access.form === 'on' || other.access.form === 'in') {
+						const { own } = await scopesOf(other.action, other.access.dimension, fieldOf(other.input, other.access.from), {}, input)
+						asked = addressing(asked, other.access.from, own)
+						grants.push(...own.grants)
+					}
+				}
+				const { access } = named
+				if (access.form === 'on' || access.form === 'in') {
+					const scopes = await scopesOf(named.action, access.dimension, fieldOf(named.input, access.from), seed, input, pinningOf(endpoint))
+					asked = addressing(asked, access.from, scopes.other)
+					grants.push(...scopes.own.grants)
+				}
+				const { status } = await askAs(named, callerFor(named, grants, global).fetch, asked)
+				return { status }
+			},
+		}
+	}
+	// Each case waits for the runs its requests kicked, so the suite's teardown never closes the database under one, and
+	// only then removes its application rows, which those runs may still read. Every step runs whatever failed before
+	// it, and the case's own error is thrown first.
+	const drained =
+		<A extends readonly unknown[], R>(method: (kit: EndpointAccessKit) => (...args: A) => Promise<R>) => async (...args: A): Promise<R> => {
+			const removals: (() => Promise<void>)[] = []
+			let outcome: { readonly ok: true; readonly value: R } | { readonly ok: false; readonly error: unknown }
+			try {
+				outcome = { ok: true, value: await method(accessKitOf(removals))(...args) }
+			} catch (error) {
+				outcome = { ok: false, error }
 			}
-			const scopes = await scopesOf(action, access.dimension, fieldOf(row.input, access.from), seed, input)
-			const { status } = await ask(
-				row,
-				holding(row, input, scopes.own.grants, scopes.own.chain),
-				addressing(input, access.from, scopes.own),
-				scopes.own.chain,
-			)
-			return { status }
-		},
-		async scoped(endpoint, input) {
-			const row = globalEndpointOf(endpoint)
-			const dimension = row.access.form === 'creates' ? row.access.dimension : scopeTypeOf(kit.artifact.dimensions)
-			const { status } = await ask(row, [{ action: row.action, scope: { type: dimension, value: freshValue(dimension, 'own', undefined) } }], input, [])
-			return { status }
-		},
-		async anyone(endpoint, input) {
-			const row = kit.artifact.endpoints.find((candidate) => candidate.id === endpoint)
-			if (row?.kind !== 'public') {
-				throw new Error(`${endpoint} is not a public procedure of the contract`)
-			}
-			const response = await kit.fetch(row.path, {
-				method: row.method,
-				headers: { 'Content-Type': 'application/json', Origin: kit.origin, 'Sec-Fetch-Site': 'same-origin' },
-				body: JSON.stringify(input),
-			})
-			const status = response.status
-			const challenged = status === 400 && errorType(await response.text()) === 'challenge_failed'
-			return status >= 500 || status === 401 || status === 403 || challenged ? { answered: false, status } : { answered: true }
-		},
-		async global(endpoint, input) {
-			const row = globalEndpointOf(endpoint)
-			const { status } = await askAs(row, callerFor(row, [], [{ action: row.action }]).fetch, input)
-			// Neither form refuses with 404, so a 404 is the handler's own answer (a row the sampled input names is missing).
-			return status >= 500 || status === 401 || status === 403 ? { answered: false, status } : { answered: true }
-		},
-		async capability(endpoint, capability, input, seed = {}) {
-			const capabilities = capabilitiesEndpointOf(endpoint)
-			const named = capabilities.get(capability)
-			if (named === undefined) {
-				throw new Error(`${endpoint} has no capability '${capability}' (capabilities: ${[...capabilities.keys()].join(', ')})`)
-			}
-			const grants: Grant[] = []
-			const global: { readonly action: string }[] = []
-			let asked = input
-			for (const [name, other] of capabilities) {
-				if (name === capability) continue
-				if (other.access.form === 'over') {
-					global.push({ action: other.action })
-				} else if (other.access.form === 'on' || other.access.form === 'in') {
-					const { own } = await scopesOf(other.action, other.access.dimension, fieldOf(other.input, other.access.from), {}, input)
-					asked = addressing(asked, other.access.from, own)
-					grants.push(...own.grants)
+			const failures: unknown[] = []
+			for (const step of [() => kit.drain(), ...removals]) {
+				try {
+					await step()
+				} catch (error) {
+					failures.push(error)
 				}
 			}
-			const { access } = named
-			if (access.form === 'on' || access.form === 'in') {
-				const scopes = await scopesOf(named.action, access.dimension, fieldOf(named.input, access.from), seed, input)
-				asked = addressing(asked, access.from, scopes.other)
-				grants.push(...scopes.own.grants)
+			if (!outcome.ok) {
+				if (failures.length === 0) throw outcome.error
+				throw new AggregateError([outcome.error, ...failures], 'the case failed, and so did its cleanup')
 			}
-			const { status } = await askAs(named, callerFor(named, grants, global).fetch, asked)
-			return { status }
-		},
-	}
-	// Each case waits for the runs its requests kicked, so the suite's teardown never closes the database under one.
-	const drained = <A extends readonly unknown[], R>(method: (...args: A) => Promise<R>) => async (...args: A): Promise<R> => {
-		try {
-			return await method(...args)
-		} finally {
-			await kit.drain()
+			if (failures.length === 1) throw failures[0]
+			if (failures.length > 1) throw new AggregateError(failures, 'the cleanup of the case failed')
+			return outcome.value
 		}
-	}
 	return Object.freeze({
-		denied: drained(accessKit.denied),
-		leaked: drained(accessKit.leaked),
-		own: drained(accessKit.own),
-		scoped: drained(accessKit.scoped),
-		global: drained(accessKit.global),
-		anyone: drained(accessKit.anyone),
-		capability: drained(accessKit.capability),
+		denied: drained((cases) => cases.denied),
+		leaked: drained((cases) => cases.leaked),
+		own: drained((cases) => cases.own),
+		scoped: drained((cases) => cases.scoped),
+		global: drained((cases) => cases.global),
+		anyone: drained((cases) => cases.anyone),
+		capability: drained((cases) => cases.capability),
 	})
 }

package/src/testing/isolation.ts

@@ -6,7 +6,14 @@ import { refuseInProduction } from '@fabrika/db/production'
 
 refuseInProduction('@fabrika/app/testing/isolation')
 
-export { type DeniedOutcome, type EndpointAccessKit, endpointAccessKit, type LeakOutcome, type ReachOutcome } from './endpoint-access'
+export {
+	type DeniedOutcome,
+	type EndpointAccessKit,
+	endpointAccessKit,
+	type EndpointAccessOptions,
+	type LeakOutcome,
+	type ReachOutcome,
+} from './endpoint-access'
 export {
 	type AppCaller,
 	type AppCountOutcome,