@feltdb/core 0.15.0 → 0.16.0

package/dist/create/server-source/crates/feltdb/tests/pr9_phase3c_authorized_mutations.rs

@@ -1,361 +0,0 @@
-//! PR #9 Phase 3C: Authorized Mutation API Test
-//!
-//! Test that the new authorized mutation API properly enforces authorization.
-//! Authorization evaluation happens INSIDE the FeltDB boundary, before mutations are applied.
-
-use feltdb::{state_contract::AuthorizationContext, FeltDb};
-use serde_json::json;
-use tempfile::TempDir;
-
-#[test]
-fn authorized_insert_requires_state_write_capability() -> Result<(), Box<dyn std::error::Error>> {
-    let temp_dir = TempDir::new()?;
-    let db = FeltDb::open(temp_dir.path().join("test.db"))?;
-
-    let authorized_context = AuthorizationContext {
-        subject: ":user-1".to_string(),
-        tenant_id: "tenant-1".to_string(),
-        application_id: "app".to_string(),
-        revision_id: "rev-1".to_string(),
-        capabilities: vec!["state:write".to_string()].into_iter().collect(),
-        readable_collections: Default::default(),
-        writable_collections: Default::default(),
-        field_projections: Default::default(),
-    };
-
-    let unauthorized_context = AuthorizationContext {
-        subject: ":user-2".to_string(),
-        tenant_id: "tenant-1".to_string(),
-        application_id: "app".to_string(),
-        revision_id: "rev-1".to_string(),
-        capabilities: vec!["state:read".to_string()].into_iter().collect(),
-        readable_collections: Default::default(),
-        writable_collections: Default::default(),
-        field_projections: Default::default(),
-    };
-
-    // Authorized insert should succeed
-    let result = db.insert_with_authorization(
-        "User#user-1",
-        json!({"_id": "user-1", "name": "Alice"}),
-        &authorized_context,
-    );
-    assert!(
-        result.is_ok(),
-        "Authorized insert should succeed: {:?}",
-        result
-    );
-
-    // Verify record was inserted
-    let value = db.get::<serde_json::Value>("User#user-1")?;
-    assert!(value.is_some(), "Record should exist after insert");
-
-    // Unauthorized insert should fail
-    let result = db.insert_with_authorization(
-        "User#user-2",
-        json!({"_id": "user-2", "name": "Bob"}),
-        &unauthorized_context,
-    );
-    assert!(
-        result.is_err(),
-        "Unauthorized insert should fail: {:?}",
-        result
-    );
-
-    // Verify unauthorized insert did not create record
-    let value = db.get::<serde_json::Value>("User#user-2")?;
-    assert!(
-        value.is_none(),
-        "Unauthorized insert should not create record"
-    );
-
-    Ok(())
-}
-
-#[test]
-fn authorized_delete_requires_state_write_capability() -> Result<(), Box<dyn std::error::Error>> {
-    let temp_dir = TempDir::new()?;
-    let db = FeltDb::open(temp_dir.path().join("test.db"))?;
-
-    let authorized_context = AuthorizationContext {
-        subject: ":user-1".to_string(),
-        tenant_id: "tenant-1".to_string(),
-        application_id: "app".to_string(),
-        revision_id: "rev-1".to_string(),
-        capabilities: vec!["state:write".to_string()].into_iter().collect(),
-        readable_collections: Default::default(),
-        writable_collections: Default::default(),
-        field_projections: Default::default(),
-    };
-
-    let unauthorized_context = AuthorizationContext {
-        subject: ":user-2".to_string(),
-        tenant_id: "tenant-1".to_string(),
-        application_id: "app".to_string(),
-        revision_id: "rev-1".to_string(),
-        capabilities: vec!["state:read".to_string()].into_iter().collect(),
-        readable_collections: Default::default(),
-        writable_collections: Default::default(),
-        field_projections: Default::default(),
-    };
-
-    // Create a record first
-    db.insert_with_authorization(
-        "Team#team-1",
-        json!({"_id": "team-1", "name": "Engineering"}),
-        &authorized_context,
-    )?;
-
-    // Verify record exists
-    let value = db.get::<serde_json::Value>("Team#team-1")?;
-    assert!(value.is_some(), "Record should exist before delete");
-
-    // Unauthorized delete should fail
-    let result = db.delete_with_authorization("Team#team-1", &unauthorized_context);
-    assert!(
-        result.is_err(),
-        "Unauthorized delete should be denied: {:?}",
-        result
-    );
-
-    // Verify record still exists after denied delete
-    let value = db.get::<serde_json::Value>("Team#team-1")?;
-    assert!(
-        value.is_some(),
-        "Record should still exist after unauthorized delete attempt"
-    );
-
-    // Authorized delete should succeed
-    let result = db.delete_with_authorization("Team#team-1", &authorized_context);
-    assert!(
-        result.is_ok(),
-        "Authorized delete should succeed: {:?}",
-        result
-    );
-
-    // Verify record is deleted
-    let value = db.get::<serde_json::Value>("Team#team-1")?;
-    assert!(
-        value.is_none(),
-        "Record should be deleted after authorized delete"
-    );
-
-    Ok(())
-}
-
-#[test]
-fn authorized_update_requires_state_write_capability() -> Result<(), Box<dyn std::error::Error>> {
-    let temp_dir = TempDir::new()?;
-    let db = FeltDb::open(temp_dir.path().join("test.db"))?;
-
-    let authorized_context = AuthorizationContext {
-        subject: ":user-1".to_string(),
-        tenant_id: "tenant-1".to_string(),
-        application_id: "app".to_string(),
-        revision_id: "rev-1".to_string(),
-        capabilities: vec!["state:write".to_string()].into_iter().collect(),
-        readable_collections: Default::default(),
-        writable_collections: Default::default(),
-        field_projections: Default::default(),
-    };
-
-    let unauthorized_context = AuthorizationContext {
-        subject: ":user-2".to_string(),
-        tenant_id: "tenant-1".to_string(),
-        application_id: "app".to_string(),
-        revision_id: "rev-1".to_string(),
-        capabilities: vec!["state:read".to_string()].into_iter().collect(),
-        readable_collections: Default::default(),
-        writable_collections: Default::default(),
-        field_projections: Default::default(),
-    };
-
-    // Create a record
-    db.insert_with_authorization(
-        "Organization#org-1",
-        json!({"_id": "org-1", "name": "Acme Corp"}),
-        &authorized_context,
-    )?;
-
-    let original = db.get::<serde_json::Value>("Organization#org-1")?;
-    assert_eq!(
-        original
-            .as_ref()
-            .and_then(|v| v.get("name"))
-            .and_then(|v| v.as_str()),
-        Some("Acme Corp")
-    );
-
-    // Unauthorized update should fail
-    let result = db.update_with_authorization(
-        "Organization#org-1",
-        json!({"_id": "org-1", "name": "Acme Inc"}),
-        &unauthorized_context,
-    );
-    assert!(
-        result.is_err(),
-        "Unauthorized update should fail: {:?}",
-        result
-    );
-
-    // Verify record was not changed
-    let value = db.get::<serde_json::Value>("Organization#org-1")?;
-    assert_eq!(
-        value
-            .as_ref()
-            .and_then(|v| v.get("name"))
-            .and_then(|v| v.as_str()),
-        Some("Acme Corp"),
-        "Unauthorized update should not change record"
-    );
-
-    // Authorized update should succeed
-    let result = db.update_with_authorization(
-        "Organization#org-1",
-        json!({"_id": "org-1", "name": "Acme Inc"}),
-        &authorized_context,
-    );
-    assert!(
-        result.is_ok(),
-        "Authorized update should succeed: {:?}",
-        result
-    );
-
-    // Verify record was updated
-    let value = db.get::<serde_json::Value>("Organization#org-1")?;
-    assert_eq!(
-        value
-            .as_ref()
-            .and_then(|v| v.get("name"))
-            .and_then(|v| v.as_str()),
-        Some("Acme Inc"),
-        "Authorized update should change record"
-    );
-
-    Ok(())
-}
-
-#[test]
-fn authorization_context_flows_through_mutations() -> Result<(), Box<dyn std::error::Error>> {
-    // This test verifies that AuthorizationContext is properly threaded through all mutation paths
-    let temp_dir = TempDir::new()?;
-    let db = FeltDb::open(temp_dir.path().join("test.db"))?;
-
-    let context = AuthorizationContext {
-        subject: ":user-1".to_string(),
-        tenant_id: "tenant-1".to_string(),
-        application_id: "app".to_string(),
-        revision_id: "rev-1".to_string(),
-        capabilities: vec!["state:write".to_string()].into_iter().collect(),
-        readable_collections: Default::default(),
-        writable_collections: Default::default(),
-        field_projections: Default::default(),
-    };
-
-    // Insert, update, delete should all accept and use AuthorizationContext
-    db.insert_with_authorization(
-        "Organization#org-1",
-        json!({"_id": "org-1", "name": "Acme"}),
-        &context,
-    )?;
-
-    db.update_with_authorization(
-        "Organization#org-1",
-        json!({"_id": "org-1", "name": "Acme Inc"}),
-        &context,
-    )?;
-
-    db.delete_with_authorization("Organization#org-1", &context)?;
-
-    // Verify record is gone
-    let value = db.get::<serde_json::Value>("Organization#org-1")?;
-    assert!(value.is_none(), "Record should be deleted");
-
-    Ok(())
-}
-
-#[test]
-fn atomic_transaction_with_authorization_denies_on_any_mutation_failure(
-) -> Result<(), Box<dyn std::error::Error>> {
-    let temp_dir = TempDir::new()?;
-    let db = FeltDb::open(temp_dir.path().join("test.db"))?;
-
-    let authorized_context = AuthorizationContext {
-        subject: ":user-1".to_string(),
-        tenant_id: "tenant-1".to_string(),
-        application_id: "app".to_string(),
-        revision_id: "rev-1".to_string(),
-        capabilities: vec!["state:write".to_string()].into_iter().collect(),
-        readable_collections: Default::default(),
-        writable_collections: Default::default(),
-        field_projections: Default::default(),
-    };
-
-    let unauthorized_context = AuthorizationContext {
-        subject: ":user-2".to_string(),
-        tenant_id: "tenant-1".to_string(),
-        application_id: "app".to_string(),
-        revision_id: "rev-1".to_string(),
-        capabilities: vec!["state:read".to_string()].into_iter().collect(),
-        readable_collections: Default::default(),
-        writable_collections: Default::default(),
-        field_projections: Default::default(),
-    };
-
-    // Create initial records
-    db.insert_with_authorization("User#user-1", json!({"_id": "user-1"}), &authorized_context)?;
-    db.insert_with_authorization("Team#team-1", json!({"_id": "team-1"}), &authorized_context)?;
-
-    // Attempt atomic transaction with unauthorized context
-    // Should be rejected without applying ANY mutations
-    let result = db.apply_atomic_transaction_with_authorization(
-        "txn-1",
-        None,
-        &[],
-        &[], // Empty mutations for this test
-        None,
-        &unauthorized_context,
-    );
-    assert!(
-        result.is_err(),
-        "Transaction with unauthorized context should be rejected"
-    );
-
-    Ok(())
-}
-
-#[test]
-fn authorization_error_messages_are_clear() -> Result<(), Box<dyn std::error::Error>> {
-    let temp_dir = TempDir::new()?;
-    let db = FeltDb::open(temp_dir.path().join("test.db"))?;
-
-    let unauthorized_context = AuthorizationContext {
-        subject: ":user-1".to_string(),
-        tenant_id: "tenant-1".to_string(),
-        application_id: "app".to_string(),
-        revision_id: "rev-1".to_string(),
-        capabilities: vec!["state:read".to_string()].into_iter().collect(),
-        readable_collections: Default::default(),
-        writable_collections: Default::default(),
-        field_projections: Default::default(),
-    };
-
-    let result = db.insert_with_authorization(
-        "User#user-1",
-        json!({"_id": "user-1"}),
-        &unauthorized_context,
-    );
-
-    if let Err(err) = result {
-        let error_message = format!("{}", err);
-        assert!(
-            error_message.contains("AUTHORIZATION_DENIED"),
-            "Error should contain AUTHORIZATION_DENIED: {}",
-            error_message
-        );
-    } else {
-        panic!("Should have returned authorization error");
-    }
-
-    Ok(())
-}

package/dist/create/server-source/crates/feltdb/tests/pr9_phase3c_role_based_authorization.rs

@@ -1,330 +0,0 @@
-//! PR #9 Phase 3C: Role-Based Authorization Testing
-//!
-//! CRITICAL DISCIPLINE:
-//! - Same privileged operation invoked by all actors
-//! - No application gatekeeping or role checking before FeltDB call
-//! - Authorization decision made entirely by FeltDB runtime
-//! - Document the authorization path (why PERMIT/DENY, not just the boolean)
-//! - Test whether frozen vocabulary can express role-based security invariant
-//!
-//! PRODUCT DECISION (Locked In):
-//! Admin is an authorization boundary.
-//! A team admin is authorized to perform privileged team operations
-//! that ordinary members are not.
-//!
-//! QUESTION:
-//! Can existing frozen vocabulary (authenticated, self, owner, member)
-//! express this authorization using TeamMembership.role as domain fact?
-//!
-//! TEST STRATEGY:
-//! 1. Create identical privileged operation
-//! 2. Invoke it with owner, admin, member, non_member actors
-//! 3. Document what FeltDB permits/denies and why
-//! 4. Analyze: Does frozen vocabulary handle role-based auth?
-
-use feltdb::{
-    state_contract::{
-        AuthorizationContext, CollectionSchema, FieldConstraints, FieldSchema, FieldType,
-        PrimitiveType, StateSchema,
-    },
-    FeltDb,
-};
-use serde_json::json;
-use tempfile::TempDir;
-
-/// Test fixture for Phase 3C role-based authorization investigation
-struct RoleAuthTestFixture {
-    db: FeltDb,
-    // Actors
-    owner_id: String,
-    admin_id: String,
-    member_id: String,
-    non_member_id: String,
-    // Resources
-    team_id: String,
-    org_id: String,
-}
-
-impl RoleAuthTestFixture {
-    fn actor_context(&self, actor_id: &str) -> AuthorizationContext {
-        AuthorizationContext {
-            subject: format!(":{}", actor_id),
-            tenant_id: "tenant".to_string(),
-            application_id: "saas-portal".to_string(),
-            revision_id: "rev-1".to_string(),
-            capabilities: ["state:read".to_string()].into(),
-            readable_collections: Default::default(),
-            writable_collections: Default::default(),
-            field_projections: Default::default(),
-        }
-    }
-
-    fn setup() -> Result<Self, Box<dyn std::error::Error>> {
-        let temp_dir = TempDir::new()?;
-        let db_path = temp_dir.path().join("role_auth_tests.db");
-        let db = FeltDb::open(&db_path)?;
-
-        let owner_id = "user-owner".to_string();
-        let admin_id = "user-admin".to_string();
-        let member_id = "user-member".to_string();
-        let non_member_id = "user-non-member".to_string();
-        let org_id = "org-1".to_string();
-        let team_id = "team-backend".to_string();
-
-        // Create users
-        db.insert(
-            "User#user-owner",
-            json!({"_id": owner_id, "email": "owner@example.com"}),
-        )?;
-        db.insert(
-            "User#user-admin",
-            json!({"_id": admin_id, "email": "admin@example.com"}),
-        )?;
-        db.insert(
-            "User#user-member",
-            json!({"_id": member_id, "email": "member@example.com"}),
-        )?;
-        db.insert(
-            "User#user-non-member",
-            json!({"_id": non_member_id, "email": "non-member@example.com"}),
-        )?;
-
-        // Create organization
-        db.insert(
-            "Organization#org-1",
-            json!({"_id": org_id, "name": "Org 1"}),
-        )?;
-
-        // Create organization memberships (all users are org members except non_member)
-        db.insert(
-            "Membership#mem-owner",
-            json!({"_id": "mem-owner", "user": owner_id, "organization": org_id}),
-        )?;
-        db.insert(
-            "Membership#mem-admin",
-            json!({"_id": "mem-admin", "user": admin_id, "organization": org_id}),
-        )?;
-        db.insert(
-            "Membership#mem-member",
-            json!({"_id": "mem-member", "user": member_id, "organization": org_id}),
-        )?;
-
-        // Create team with owner field
-        db.insert(
-            "Team#team-backend",
-            json!({
-                "_id": team_id,
-                "organization": org_id,
-                "name": "Backend Team",
-                "owner": owner_id,
-                "created_at": "2026-08-22T00:00:00Z"
-            }),
-        )?;
-
-        // Create team memberships with roles
-        // CRITICAL: Role is domain state, not yet an authorization fact
-        // Question: Can frozen vocabulary make it an authorization fact?
-        db.insert(
-            "TeamMembership#tm-owner",
-            json!({
-                "_id": "tm-owner",
-                "team": team_id,
-                "user": owner_id,
-                "role": "owner"
-            }),
-        )?;
-        db.insert(
-            "TeamMembership#tm-admin",
-            json!({
-                "_id": "tm-admin",
-                "team": team_id,
-                "user": admin_id,
-                "role": "admin"
-            }),
-        )?;
-        db.insert(
-            "TeamMembership#tm-member",
-            json!({
-                "_id": "tm-member",
-                "team": team_id,
-                "user": member_id,
-                "role": "member"
-            }),
-        )?;
-
-        Ok(RoleAuthTestFixture {
-            db,
-            owner_id,
-            admin_id,
-            member_id,
-            non_member_id,
-            team_id,
-            org_id,
-        })
-    }
-}
-
-#[test]
-fn pr9_phase3c_role_authorization_matrix() -> Result<(), Box<dyn std::error::Error>> {
-    let fixture = RoleAuthTestFixture::setup()?;
-
-    println!("\n═══════════════════════════════════════════════════════════════");
-    println!("PHASE 3C: Role-Based Authorization Investigation");
-    println!("═══════════════════════════════════════════════════════════════\n");
-
-    println!("PRODUCT DECISION (Locked In)\n");
-    println!("Admin is an authorization boundary.");
-    println!("A team admin is authorized to perform privileged team operations");
-    println!("that ordinary members are not.\n");
-
-    println!("HYPOTHESIS (Frozen Vocabulary)\n");
-    println!("Existing primitives suffice: authenticated, self, owner, member\n");
-
-    println!("QUESTION\n");
-    println!("Can frozen vocabulary express role-based authorization using");
-    println!("TeamMembership.role as the domain fact?\n");
-
-    println!("TEST MATRIX: Identical Privileged Operation\n");
-
-    println!("Actor\t\tRole\t\tTeam.owner?\tOrg Member?\tExpected\tActual\tAuth Path");
-    println!("─────────────────────────────────────────────────────────────────────────────");
-
-    // Owner: Has Team.owner field AND admin role
-    // Policy must PERMIT via owner field
-    let owner_ctx = fixture.actor_context(&fixture.owner_id);
-    println!("owner\t\towner\t\tYES\t\tYES\t\tPERMIT\t\t?\t\tTeam.owner");
-
-    // Admin: Does NOT have Team.owner field, but has role="admin"
-    // Policy must PERMIT via... what? This is the question.
-    let admin_ctx = fixture.actor_context(&fixture.admin_id);
-    println!("admin\t\tadmin\t\tNO\t\tYES\t\tPERMIT\t\t?\t\tTeamMembership.role?");
-
-    // Member: Does NOT have owner status, role="member"
-    // Policy must DENY
-    let member_ctx = fixture.actor_context(&fixture.member_id);
-    println!("member\t\tmember\t\tNO\t\tYES\t\tDENY\t\t?\t\tNo authorization");
-
-    // Non-member: Not in organization
-    // Policy must DENY at org level
-    let non_member_ctx = fixture.actor_context(&fixture.non_member_id);
-    println!("non-member\t—\t\tNO\t\tNO\t\tDENY\t\t?\t\tOrg member check");
-
-    println!("\n─────────────────────────────────────────────────────────────────────────────");
-    println!("INVESTIGATION\n");
-
-    println!("KEY OBSERVATION:");
-    println!("  Owner is authorized via Team.owner field (existing owner primitive)");
-    println!("  Admin must be authorized via TeamMembership.role field (new test)\n");
-
-    println!("CRITICAL DISCIPLINE:");
-    println!("  Same operation invoked by all actors");
-    println!("  No application gatekeeping (role checking before FeltDB call)");
-    println!("  Authorization decision made entirely by FeltDB runtime\n");
-
-    println!("EXPECTED RESULTS:\n");
-
-    println!("Path A Success:");
-    println!("  Frozen vocabulary directly handles role-based auth");
-    println!("  Admin: PERMIT via TeamMembership.role evaluation");
-    println!("  Member: DENY via policy evaluation");
-    println!("  Result: Vocabulary sufficient, no new primitives\n");
-
-    println!("Path B Success:");
-    println!("  Different operations have different policies");
-    println!("  E.g., mark_deleted (member) vs. hard_delete (owner|admin)");
-    println!("  Result: Workflow pattern sufficient, no new primitives\n");
-
-    println!("Path C (Honest Failure):");
-    println!("  Frozen vocabulary cannot express this distinction");
-    println!("  TeamMembership.role cannot be authorization fact without new primitive");
-    println!("  Result: Evidence of vocabulary gap identified\n");
-
-    println!("CRITICAL CONSTRAINT FOR EVIDENCE:");
-    println!("For any PERMIT or DENY result, document WHY:");
-    println!("  - Which authorization relationship FeltDB evaluated");
-    println!("  - How TeamMembership.role was interpreted (or not)");
-    println!("  - Whether frozen vocabulary was sufficient\n");
-
-    println!("═══════════════════════════════════════════════════════════════\n");
-
-    Ok(())
-}
-
-#[test]
-fn pr9_phase3c_discipline_note() {
-    println!("\n═══════════════════════════════════════════════════════════════");
-    println!("PHASE 3C: Implementation Discipline");
-    println!("═══════════════════════════════════════════════════════════════\n");
-
-    println!("DO NOT encode role checking in test harness:");
-    println!("  ✗ WRONG: if (user.role == 'admin') {{ allow_operation() }}");
-    println!("  ✓ CORRECT: db.operation() // FeltDB decides\n");
-
-    println!("DO isolate authorization decision to FeltDB:");
-    println!("  ✗ Application gatekeeping before FeltDB call");
-    println!("  ✓ Same operation, all actors, FeltDB decides\n");
-
-    println!("DO document the authorization path:");
-    println!("  ✗ Result: PERMIT (boolean only)");
-    println!("  ✓ Result: PERMIT via owner field evaluation\n");
-
-    println!("DO test with identical mutations:");
-    println!("  ✗ Admin calls admin_delete(), member calls member_delete()");
-    println!("  ✓ Same delete() invoked by admin and member actors\n");
-
-    println!("RATIONALE:");
-    println!("If FeltDB permits admin and denies member for the SAME operation,");
-    println!("we can isolate which authorization relationship FeltDB evaluated.\n");
-
-    println!("If admin is PERMITTED only because application didn't invoke");
-    println!("the operation, that's not evidence of role-based authorization.");
-    println!("It's evidence of application gatekeeping.\n");
-
-    println!("Phase 3C proves whether frozen vocabulary can express");
-    println!("role-based security invariants at the database boundary.\n");
-
-    println!("═══════════════════════════════════════════════════════════════\n");
-}
-
-#[test]
-fn pr9_phase3c_evidence_template() {
-    println!("\n═══════════════════════════════════════════════════════════════");
-    println!("PHASE 3C: Evidence Template");
-    println!("═══════════════════════════════════════════════════════════════\n");
-
-    println!("For each actor, record:\n");
-
-    println!("Actor\t\tRole\t\tTeam.owner?\tOrg Member?\tExpected\tActual\tPolicy Evaluated\tPath");
-    println!(
-        "─────────────────────────────────────────────────────────────────────────────────────────"
-    );
-    println!("owner\t\towner\t\tYES\t\tYES\t\tPERMIT\t\t?\t\t?\t\t\t?\n");
-
-    println!("Analysis for each result:\n");
-
-    println!("1. PERMIT Evaluation:");
-    println!("   - Did FeltDB evaluate Team.owner field? (owner primitive)");
-    println!("   - Did FeltDB evaluate TeamMembership.role? (role-based auth)");
-    println!("   - Did FeltDB evaluate Membership in organization? (member primitive)");
-    println!("   - Which relationship granted authorization?\n");
-
-    println!("2. DENY Evaluation:");
-    println!("   - Which policy rule caused denial?");
-    println!("   - Did FeltDB check: org membership? owner? role?");
-    println!("   - Was denial at expected level (role, org, or tenant)?\n");
-
-    println!("3. Authorization Path:");
-    println!("   - Frozen vocabulary interpretation used");
-    println!("   - Domain state referenced (Team.owner, TeamMembership.role)");
-    println!("   - Whether role was readable by FeltDB");
-    println!("   - Whether field inspection occurred (regression indicator)\n");
-
-    println!("EVIDENCE SUCCESS:");
-    println!("For admin PERMIT: Documented that FeltDB evaluated");
-    println!("the existing authorization relationship from domain state.\n");
-
-    println!("NOT merely: 'Admin got PERMIT'");
-    println!("BUT: 'Admin got PERMIT because FeltDB evaluated...[specific mechanism]'\n");
-
-    println!("═══════════════════════════════════════════════════════════════\n");
-}