@feltdb/core 0.8.3 → 0.8.5

package/dist/create/server-source/crates/feltdb/tests/pr9_phase3c_team_delete_role_authorization.rs

@@ -27,14 +27,14 @@
 
 use feltdb::{
     state_contract::{
-        StateSchema, CollectionSchema, FieldSchema, FieldType, PrimitiveType,
-        FieldConstraints, AuthorizationContext,
+        AuthorizationContext, CollectionSchema, FieldConstraints, FieldSchema, FieldType,
+        PrimitiveType, StateSchema,
     },
     FeltDb,
 };
 use serde_json::json;
-use tempfile::TempDir;
 use std::collections::HashMap;
+use tempfile::TempDir;
 
 /// Evidence record for each authorization test
 #[derive(Debug, Clone)]
@@ -95,15 +95,36 @@ impl TeamDeleteAuthTest {
         let team_id = "team-backend".to_string();
 
         // Create users
-        db.insert("User#user-owner", json!({"_id": owner_id, "email": "owner@example.com"}))?;
-        db.insert("User#user-admin", json!({"_id": admin_id, "email": "admin@example.com"}))?;
-        db.insert("User#user-member", json!({"_id": member_id, "email": "member@example.com"}))?;
-        db.insert("User#user-non-member", json!({"_id": non_member_id, "email": "non-member@example.com"}))?;
-        db.insert("User#user-revoked", json!({"_id": revoked_id, "email": "revoked@example.com"}))?;
-        db.insert("User#user-cross-tenant", json!({"_id": cross_tenant_id, "email": "cross-tenant@example.com"}))?;
+        db.insert(
+            "User#user-owner",
+            json!({"_id": owner_id, "email": "owner@example.com"}),
+        )?;
+        db.insert(
+            "User#user-admin",
+            json!({"_id": admin_id, "email": "admin@example.com"}),
+        )?;
+        db.insert(
+            "User#user-member",
+            json!({"_id": member_id, "email": "member@example.com"}),
+        )?;
+        db.insert(
+            "User#user-non-member",
+            json!({"_id": non_member_id, "email": "non-member@example.com"}),
+        )?;
+        db.insert(
+            "User#user-revoked",
+            json!({"_id": revoked_id, "email": "revoked@example.com"}),
+        )?;
+        db.insert(
+            "User#user-cross-tenant",
+            json!({"_id": cross_tenant_id, "email": "cross-tenant@example.com"}),
+        )?;
 
         // Create organization
-        db.insert("Organization#org-1", json!({"_id": org_id, "name": "Org 1"}))?;
+        db.insert(
+            "Organization#org-1",
+            json!({"_id": org_id, "name": "Org 1"}),
+        )?;
 
         // Create organization memberships
         // owner, admin, member, revoked: all in organization
@@ -232,11 +253,17 @@ impl TeamDeleteAuthTest {
         println!("AUTHORIZATION EVIDENCE MATRIX");
         println!("───────────────────────────────────────────────────────────────────\n");
 
-        println!("Actor\t\tRole\t\tTeam.owner?\tOrg Mbr?\tExpected\tActual\t\tAuth Path\t\t\tClass");
+        println!(
+            "Actor\t\tRole\t\tTeam.owner?\tOrg Mbr?\tExpected\tActual\t\tAuth Path\t\t\tClass"
+        );
         println!("────────────────────────────────────────────────────────────────────────────────────────────────────────");
 
         for (_, evidence) in &self.evidence {
-            let owner_match = if evidence.team_owner == evidence.actor_id { "YES" } else { "NO" };
+            let owner_match = if evidence.team_owner == evidence.actor_id {
+                "YES"
+            } else {
+                "NO"
+            };
             let org_member = if evidence.is_org_member { "YES" } else { "NO" };
 
             println!(
@@ -286,7 +313,9 @@ impl TeamDeleteAuthTest {
             println!("This suggests frozen vocabulary may directly handle role-based auth.\n");
         } else if path_b_candidates > 0 {
             println!("PATH B INDICATOR: Some results suggest workflow pattern could work.");
-            println!("Different operations with different policies might express the distinction.\n");
+            println!(
+                "Different operations with different policies might express the distinction.\n"
+            );
         } else {
             println!("PATH C INDICATOR: Results suggest vocabulary gap.");
             println!("Frozen vocabulary may not be able to express this security invariant.\n");
@@ -325,7 +354,9 @@ fn pr9_phase3c_team_delete_authorization() -> Result<(), Box<dyn std::error::Err
     // Test owner (has Team.owner field and write capability)
     println!("Testing owner delete...");
     let owner_ctx = test.actor_context(&test.owner_id);
-    let owner_result = test.db.delete_with_authorization(&format!("Team#{}", test.team_id), &owner_ctx);
+    let owner_result = test
+        .db
+        .delete_with_authorization(&format!("Team#{}", test.team_id), &owner_ctx);
     let owner_actual = match owner_result {
         Ok(_) => "PERMIT".to_string(),
         Err(e) => format!("DENY: {}", e),
@@ -344,22 +375,26 @@ fn pr9_phase3c_team_delete_authorization() -> Result<(), Box<dyn std::error::Err
 
     // Re-insert for subsequent tests
     if owner_actual.contains("PERMIT") {
-        test.db.insert(
-            "Team#team-backend",
-            json!({
-                "_id": test.team_id,
-                "organization": test.org_id,
-                "name": "Backend Team",
-                "owner": test.owner_id,
-                "created_at": "2026-08-22T00:00:00Z"
-            }),
-        ).ok();
+        test.db
+            .insert(
+                "Team#team-backend",
+                json!({
+                    "_id": test.team_id,
+                    "organization": test.org_id,
+                    "name": "Backend Team",
+                    "owner": test.owner_id,
+                    "created_at": "2026-08-22T00:00:00Z"
+                }),
+            )
+            .ok();
     }
 
     // Test admin (has TeamMembership.role="admin" and write capability)
     println!("Testing admin delete...");
     let admin_ctx = test.actor_context(&test.admin_id);
-    let admin_result = test.db.delete_with_authorization(&format!("Team#{}", test.team_id), &admin_ctx);
+    let admin_result = test
+        .db
+        .delete_with_authorization(&format!("Team#{}", test.team_id), &admin_ctx);
     let admin_actual = match admin_result {
         Ok(_) => "PERMIT".to_string(),
         Err(e) => format!("DENY: {}", e),
@@ -377,22 +412,26 @@ fn pr9_phase3c_team_delete_authorization() -> Result<(), Box<dyn std::error::Err
     );
 
     if admin_actual.contains("PERMIT") {
-        test.db.insert(
-            "Team#team-backend",
-            json!({
-                "_id": test.team_id,
-                "organization": test.org_id,
-                "name": "Backend Team",
-                "owner": test.owner_id,
-                "created_at": "2026-08-22T00:00:00Z"
-            }),
-        ).ok();
+        test.db
+            .insert(
+                "Team#team-backend",
+                json!({
+                    "_id": test.team_id,
+                    "organization": test.org_id,
+                    "name": "Backend Team",
+                    "owner": test.owner_id,
+                    "created_at": "2026-08-22T00:00:00Z"
+                }),
+            )
+            .ok();
     }
 
     // Test member (has TeamMembership.role="member" and write capability)
     println!("Testing member delete...");
     let member_ctx = test.actor_context(&test.member_id);
-    let member_result = test.db.delete_with_authorization(&format!("Team#{}", test.team_id), &member_ctx);
+    let member_result = test
+        .db
+        .delete_with_authorization(&format!("Team#{}", test.team_id), &member_ctx);
     let member_actual = match member_result {
         Ok(_) => "PERMIT".to_string(),
         Err(e) => format!("DENY: {}", e),
@@ -410,22 +449,26 @@ fn pr9_phase3c_team_delete_authorization() -> Result<(), Box<dyn std::error::Err
     );
 
     if member_actual.contains("PERMIT") {
-        test.db.insert(
-            "Team#team-backend",
-            json!({
-                "_id": test.team_id,
-                "organization": test.org_id,
-                "name": "Backend Team",
-                "owner": test.owner_id,
-                "created_at": "2026-08-22T00:00:00Z"
-            }),
-        ).ok();
+        test.db
+            .insert(
+                "Team#team-backend",
+                json!({
+                    "_id": test.team_id,
+                    "organization": test.org_id,
+                    "name": "Backend Team",
+                    "owner": test.owner_id,
+                    "created_at": "2026-08-22T00:00:00Z"
+                }),
+            )
+            .ok();
     }
 
     // Test non_member (no team membership at all)
     println!("Testing non_member delete...");
     let non_member_ctx = test.actor_context(&test.non_member_id);
-    let non_member_result = test.db.delete_with_authorization(&format!("Team#{}", test.team_id), &non_member_ctx);
+    let non_member_result = test
+        .db
+        .delete_with_authorization(&format!("Team#{}", test.team_id), &non_member_ctx);
     let non_member_actual = match non_member_result {
         Ok(_) => "PERMIT".to_string(),
         Err(e) => format!("DENY: {}", e),
@@ -443,22 +486,26 @@ fn pr9_phase3c_team_delete_authorization() -> Result<(), Box<dyn std::error::Err
     );
 
     if non_member_actual.contains("PERMIT") {
-        test.db.insert(
-            "Team#team-backend",
-            json!({
-                "_id": test.team_id,
-                "organization": test.org_id,
-                "name": "Backend Team",
-                "owner": test.owner_id,
-                "created_at": "2026-08-22T00:00:00Z"
-            }),
-        ).ok();
+        test.db
+            .insert(
+                "Team#team-backend",
+                json!({
+                    "_id": test.team_id,
+                    "organization": test.org_id,
+                    "name": "Backend Team",
+                    "owner": test.owner_id,
+                    "created_at": "2026-08-22T00:00:00Z"
+                }),
+            )
+            .ok();
     }
 
     // Test revoked (org member but revoked from team)
     println!("Testing revoked delete...");
     let revoked_ctx = test.actor_context(&test.revoked_id);
-    let revoked_result = test.db.delete_with_authorization(&format!("Team#{}", test.team_id), &revoked_ctx);
+    let revoked_result = test
+        .db
+        .delete_with_authorization(&format!("Team#{}", test.team_id), &revoked_ctx);
     let revoked_actual = match revoked_result {
         Ok(_) => "PERMIT".to_string(),
         Err(e) => format!("DENY: {}", e),
@@ -476,16 +523,18 @@ fn pr9_phase3c_team_delete_authorization() -> Result<(), Box<dyn std::error::Err
     );
 
     if revoked_actual.contains("PERMIT") {
-        test.db.insert(
-            "Team#team-backend",
-            json!({
-                "_id": test.team_id,
-                "organization": test.org_id,
-                "name": "Backend Team",
-                "owner": test.owner_id,
-                "created_at": "2026-08-22T00:00:00Z"
-            }),
-        ).ok();
+        test.db
+            .insert(
+                "Team#team-backend",
+                json!({
+                    "_id": test.team_id,
+                    "organization": test.org_id,
+                    "name": "Backend Team",
+                    "owner": test.owner_id,
+                    "created_at": "2026-08-22T00:00:00Z"
+                }),
+            )
+            .ok();
     }
 
     // Test cross_tenant (not in tenant)
@@ -500,7 +549,9 @@ fn pr9_phase3c_team_delete_authorization() -> Result<(), Box<dyn std::error::Err
         writable_collections: Default::default(),
         field_projections: Default::default(),
     };
-    let cross_tenant_result = test.db.delete_with_authorization(&format!("Team#{}", test.team_id), &cross_tenant_ctx);
+    let cross_tenant_result = test
+        .db
+        .delete_with_authorization(&format!("Team#{}", test.team_id), &cross_tenant_ctx);
     let cross_tenant_actual = match cross_tenant_result {
         Ok(_) => "PERMIT".to_string(),
         Err(e) => format!("DENY: {}", e),

package/dist/create/server-source/crates/feltdb/tests/pr9_teams_role_based_access.rs

@@ -17,8 +17,7 @@
 
 use feltdb::{
     state_contract::{
-        StateSchema, CollectionSchema, FieldSchema, FieldType, PrimitiveType,
-        FieldConstraints,
+        CollectionSchema, FieldConstraints, FieldSchema, FieldType, PrimitiveType, StateSchema,
     },
     FeltDb,
 };
@@ -301,16 +300,28 @@ fn pr9_team_creation_and_basic_access() -> Result<(), Box<dyn std::error::Error>
     let team_id = "team-backend";
 
     // Setup: Alice, Bob, Charlie
-    db.insert("User#user-alice", json!({ "_id": alice_id, "email": "alice@example.com" }))
-        .map_err(|e| format!("{:?}", e))?;
-    db.insert("User#user-bob", json!({ "_id": bob_id, "email": "bob@example.com" }))
-        .map_err(|e| format!("{:?}", e))?;
-    db.insert("User#user-charlie", json!({ "_id": charlie_id, "email": "charlie@example.com" }))
-        .map_err(|e| format!("{:?}", e))?;
+    db.insert(
+        "User#user-alice",
+        json!({ "_id": alice_id, "email": "alice@example.com" }),
+    )
+    .map_err(|e| format!("{:?}", e))?;
+    db.insert(
+        "User#user-bob",
+        json!({ "_id": bob_id, "email": "bob@example.com" }),
+    )
+    .map_err(|e| format!("{:?}", e))?;
+    db.insert(
+        "User#user-charlie",
+        json!({ "_id": charlie_id, "email": "charlie@example.com" }),
+    )
+    .map_err(|e| format!("{:?}", e))?;
 
     // Setup: Organization
-    db.insert("Organization#org-acme", json!({ "_id": org_id, "name": "ACME Corp" }))
-        .map_err(|e| format!("{:?}", e))?;
+    db.insert(
+        "Organization#org-acme",
+        json!({ "_id": org_id, "name": "ACME Corp" }),
+    )
+    .map_err(|e| format!("{:?}", e))?;
 
     // Setup: All three are org members (required for team access)
     db.insert(