@fuzdev/fuz_app 0.101.1 → 0.103.0

package/dist/testing/cross_backend/role_grant_participation.js

@@ -0,0 +1,73 @@
+import '../assert_dev_env.js';
+/**
+ * Cross-backend parity suite for **role-gated participation conferral — the
+ * success paths**. The imperative escape hatch beneath the declarative
+ * `conformance_participation_cases.ts`: the multi-step flows that need a real
+ * recipient account (so a static conformance row can't express them) — an
+ * admin assigns the `participant` app-role, and an admin offers it through the
+ * consent flow and the recipient accepts.
+ *
+ * Proves the two conferral *write* paths agree on both spines (TS spine binary
+ * + Rust `testing_spine_stub`):
+ *
+ * - **immediate assign** — `role_grant_assign` of the admin-grantable
+ *   `participant` role lands a grant and returns `{ok, role_grant_id}`;
+ *   re-assigning the active grant is idempotent (same id).
+ * - **consent flow** — `role_grant_offer_create` of `participant` (admin-only)
+ *   → the recipient `role_grant_offer_accept`s → a role_grant lands.
+ *
+ * The single-request gate/denial matrix (grantability refusal, admin-only
+ * conferral, dispatcher admin gate, auth) lives in the declarative table
+ * (`conformance_participation_cases.ts`) — keep new single-request assertions
+ * there; this suite is only for flows the table cannot carry.
+ *
+ * The `participant` role is registered admin-grantable on both spines
+ * (`spine_roles` / the Rust stub's `RoleRegistry`), so the suite is ungated;
+ * every spine mounts the standard RPC surface it drives.
+ *
+ * `$lib`-free by contract (relative specifiers only), like the sibling
+ * cross-backend suites.
+ *
+ * @module
+ */
+import { describe, test, assert } from 'vitest';
+import { rpc_call } from '../rpc_helpers.js';
+import { SPINE_PARTICIPANT_ROLE, SPINE_RPC_PATH } from './spine_surface_constants.js';
+export const describe_role_grant_participation_cross_tests = (options) => {
+    const { setup_test } = options;
+    const rpc_path = options.rpc_path ?? SPINE_RPC_PATH;
+    const rpc = (transport, method, params, headers) => rpc_call({ app: transport, path: rpc_path, method, params, headers });
+    describe('role-gated participation conferral (success paths)', () => {
+        test('admin assigns the participant app-role to a fresh account (idempotent)', async () => {
+            const fixture = await setup_test();
+            const recipient = await fixture.create_account({ username: 'participation_assignee' });
+            // The keeper holds ROLE_ADMIN (seeded via extra_keeper_roles), so it
+            // clears the dispatcher admin gate; `participant` is admin-grantable, so
+            // it clears the grant-path gate; the recipient is single-actor, so the
+            // target actor resolves without `to_actor_id`.
+            const first = await rpc(fixture.transport, 'role_grant_assign', { to_account_id: recipient.account.id, role: SPINE_PARTICIPANT_ROLE }, fixture.create_session_headers());
+            assert.ok(first.ok, `assign must succeed: ${JSON.stringify(first)}`);
+            const assigned = first.result;
+            assert.strictEqual(assigned.ok, true);
+            assert.ok(typeof assigned.role_grant_id === 'string' && assigned.role_grant_id.length > 0, 'assign returns the new role_grant id');
+            // Idempotent — re-assigning the active grant returns the existing id.
+            const second = await rpc(fixture.transport, 'role_grant_assign', { to_account_id: recipient.account.id, role: SPINE_PARTICIPANT_ROLE }, fixture.create_session_headers());
+            assert.ok(second.ok, `re-assign must succeed: ${JSON.stringify(second)}`);
+            assert.strictEqual(second.result.role_grant_id, assigned.role_grant_id, 're-assigning an active grant returns the existing role_grant id');
+        });
+        test('admin offers the participant app-role and the recipient accepts', async () => {
+            const fixture = await setup_test();
+            const recipient = await fixture.create_account({ username: 'participation_offeree' });
+            // Admin-only conferral via the consent flow: the keeper (admin) offers
+            // the app-role, proving the widened grant-path gate admits it through
+            // the offer path too.
+            const created = await rpc(fixture.transport, 'role_grant_offer_create', { to_account_id: recipient.account.id, role: SPINE_PARTICIPANT_ROLE }, fixture.create_session_headers());
+            assert.ok(created.ok, `offer create must succeed: ${JSON.stringify(created)}`);
+            const offer_id = created.result.offer.id;
+            // The recipient accepts → a role_grant lands.
+            const accepted = await rpc(fixture.fresh_transport(), 'role_grant_offer_accept', { offer_id }, recipient.create_session_headers());
+            assert.ok(accepted.ok, `accept must succeed: ${JSON.stringify(accepted)}`);
+            assert.ok(typeof accepted.result.role_grant_id === 'string', 'accept lands a role_grant for the app-role');
+        });
+    });
+};

package/dist/testing/cross_backend/rust_spine_stub_backend_config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"rust_spine_stub_backend_config.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/rust_spine_stub_backend_config.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAuC9B,OAAO,KAAK,EAAC,aAAa,EAAC,MAAM,qBAAqB,CAAC;AASvD,uGAAuG;AACvG,eAAO,MAAM,uBAAuB,oCAAoC,CAAC;AAEzE;;;;;GAKG;AACH,eAAO,MAAM,wCAAwC,6CAA6C,CAAC;AAenG,kGAAkG;AAClG,eAAO,MAAM,4BAA4B,OAAO,CAAC;AAEjD,0FAA0F;AAC1F,eAAO,MAAM,oCAAoC,sDACG,CAAC;AAErD,MAAM,WAAW,6BAA6B;IAC7C,8DAA8D;IAC9D,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,+EAA+E;IAC/E,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B;;;OAGG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B;;;;;;;OAOG;IACH,QAAQ,CAAC,uBAAuB,CAAC,EAAE,OAAO,CAAC;IAC3C;;;;;;OAMG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;CAClC;AAED;;;;;;;;;;GAUG;AACH,eAAO,MAAM,8BAA8B,GAC1C,UAAS,6BAAkC,KACzC,aAiDF,CAAC"}
+{"version":3,"file":"rust_spine_stub_backend_config.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/rust_spine_stub_backend_config.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAuC9B,OAAO,KAAK,EAAC,aAAa,EAAC,MAAM,qBAAqB,CAAC;AASvD,uGAAuG;AACvG,eAAO,MAAM,uBAAuB,oCAAoC,CAAC;AAEzE;;;;;GAKG;AACH,eAAO,MAAM,wCAAwC,6CAA6C,CAAC;AAkBnG,kGAAkG;AAClG,eAAO,MAAM,4BAA4B,OAAO,CAAC;AAEjD,0FAA0F;AAC1F,eAAO,MAAM,oCAAoC,sDACG,CAAC;AAErD,MAAM,WAAW,6BAA6B;IAC7C,8DAA8D;IAC9D,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,+EAA+E;IAC/E,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B;;;OAGG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B;;;;;;;OAOG;IACH,QAAQ,CAAC,uBAAuB,CAAC,EAAE,OAAO,CAAC;IAC3C;;;;;;OAMG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;CAClC;AAED;;;;;;;;;;GAUG;AACH,eAAO,MAAM,8BAA8B,GAC1C,UAAS,6BAAkC,KACzC,aAiDF,CAAC"}

package/dist/testing/cross_backend/rust_spine_stub_backend_config.js

@@ -49,14 +49,17 @@ export const RUST_SPINE_STUB_EXPECTED_SCHEMA_PATH_ENV = 'FUZ_RUST_SPINE_STUB_EXP
 /**
  * Capabilities for the Rust `testing_spine_stub` — `rust_default_capabilities`
  * plus `sse` (the stub serves `GET /api/admin/audit/stream` over the spine
- * `fuz_realtime::SseRegistry` + audit listener) and `ready` (it live-mounts
- * `/ready` over the env-supplied fixture path). Named (not inline) so every
- * spine preset is greppable, mirroring `ts_spine_capabilities`.
+ * `fuz_realtime::SseRegistry` + audit listener), `ready` (it live-mounts
+ * `/ready` over the env-supplied fixture path), and `cell_gated_create` (it
+ * mounts the `TestCellGatedCreateAuthorize` policy on its cell layer). Named
+ * (not inline) so every spine preset is greppable, mirroring
+ * `ts_spine_capabilities`.
  */
 const rust_spine_stub_capabilities = Object.freeze({
     ...rust_default_capabilities,
     sse: true,
     ready: true,
+    cell_gated_create: true,
 });
 /** Default listening port — slots beside zzz's 1175/1176; matches the binary's `DEFAULT_PORT`. */
 export const RUST_SPINE_STUB_DEFAULT_PORT = 1177;

package/dist/testing/cross_backend/spine_surface_constants.d.ts

@@ -32,6 +32,18 @@ export declare const SPINE_SSE_PATH = "/api/admin/audit/stream";
  * Rust `testing_spine_stub`'s `known_roles` (cross-language test contract).
  */
 export declare const SPINE_CELL_EDITOR_ROLE = "cell_editor";
+/**
+ * Admin-grantable app role the role-gated-participation cross suite exercises.
+ * Registered with `grant_paths: ['admin']` so it enters the admin grant flow —
+ * the cross-backend proof that an app-defined role is conferrable (offer /
+ * `role_grant_assign`) admin-only on **both** spines. Must match the
+ * `participant` entry in the Rust `testing_spine_stub`'s `RoleRegistry`
+ * **and** its `known_roles` (the registry feeds the cell vocabulary too) — a
+ * cross-language test contract. Distinct from `SPINE_CELL_EDITOR_ROLE`
+ * (no grant path): this one is the *grantable* role, that one is the
+ * bootstrap-seed-only cell role.
+ */
+export declare const SPINE_PARTICIPANT_ROLE = "participant";
 /**
  * Committed expected-schema fixture for the spine `/ready` deploy gate — the
  * column map a fresh full spine bootstrap (auth + cell + cell_history + fact)

package/dist/testing/cross_backend/spine_surface_constants.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"spine_surface_constants.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/spine_surface_constants.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAE9B;;;;;;;;;;;;;;GAcG;AAEH,iEAAiE;AACjE,eAAO,MAAM,cAAc,aAAa,CAAC;AAEzC;;;;;;GAMG;AACH,eAAO,MAAM,cAAc,4BAA4B,CAAC;AAExD;;;;;;GAMG;AACH,eAAO,MAAM,sBAAsB,gBAAgB,CAAC;AAEpD;;;;;;;;;;GAUG;AACH,eAAO,MAAM,yBAAyB,EAAE,GAAwD,CAAC"}
+{"version":3,"file":"spine_surface_constants.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/spine_surface_constants.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAE9B;;;;;;;;;;;;;;GAcG;AAEH,iEAAiE;AACjE,eAAO,MAAM,cAAc,aAAa,CAAC;AAEzC;;;;;;GAMG;AACH,eAAO,MAAM,cAAc,4BAA4B,CAAC;AAExD;;;;;;GAMG;AACH,eAAO,MAAM,sBAAsB,gBAAgB,CAAC;AAEpD;;;;;;;;;;GAUG;AACH,eAAO,MAAM,sBAAsB,gBAAgB,CAAC;AAEpD;;;;;;;;;;GAUG;AACH,eAAO,MAAM,yBAAyB,EAAE,GAAwD,CAAC"}

package/dist/testing/cross_backend/spine_surface_constants.js

@@ -32,6 +32,18 @@ export const SPINE_SSE_PATH = '/api/admin/audit/stream';
  * Rust `testing_spine_stub`'s `known_roles` (cross-language test contract).
  */
 export const SPINE_CELL_EDITOR_ROLE = 'cell_editor';
+/**
+ * Admin-grantable app role the role-gated-participation cross suite exercises.
+ * Registered with `grant_paths: ['admin']` so it enters the admin grant flow —
+ * the cross-backend proof that an app-defined role is conferrable (offer /
+ * `role_grant_assign`) admin-only on **both** spines. Must match the
+ * `participant` entry in the Rust `testing_spine_stub`'s `RoleRegistry`
+ * **and** its `known_roles` (the registry feeds the cell vocabulary too) — a
+ * cross-language test contract. Distinct from `SPINE_CELL_EDITOR_ROLE`
+ * (no grant path): this one is the *grantable* role, that one is the
+ * bootstrap-seed-only cell role.
+ */
+export const SPINE_PARTICIPANT_ROLE = 'participant';
 /**
  * Committed expected-schema fixture for the spine `/ready` deploy gate — the
  * column map a fresh full spine bootstrap (auth + cell + cell_history + fact)

package/dist/testing/cross_backend/test_cell_gated_create_authorize.d.ts

@@ -0,0 +1,17 @@
+import '../assert_dev_env.js';
+import type { CellCreateAuthorize } from '../../auth/cell_actions.js';
+/** The single kind the test policy gates (shared with the driving suite). */
+export declare const GATED_CELL_KIND = "gated";
+/**
+ * The app-role that unlocks creating the gated kind (besides admin) — the
+ * `participant` role both reference spines register. Mirrors the Rust policy's
+ * `"participant"` literal.
+ */
+export declare const GATED_CELL_ROLE = "participant";
+/**
+ * Allow unless the cell's `kind` is `'gated'`, in which case the actor must
+ * hold the `participant` role or be a (scope-agnostic) admin. Mirrors the Rust
+ * `TestCellGatedCreateAuthorize` exactly.
+ */
+export declare const test_cell_gated_create_authorize: CellCreateAuthorize;
+//# sourceMappingURL=test_cell_gated_create_authorize.d.ts.map

package/dist/testing/cross_backend/test_cell_gated_create_authorize.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"test_cell_gated_create_authorize.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/test_cell_gated_create_authorize.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAuB9B,OAAO,KAAK,EAAC,mBAAmB,EAA2B,MAAM,4BAA4B,CAAC;AAG9F,6EAA6E;AAC7E,eAAO,MAAM,eAAe,UAAU,CAAC;AAEvC;;;;GAIG;AACH,eAAO,MAAM,eAAe,gBAAyB,CAAC;AAEtD;;;;GAIG;AACH,eAAO,MAAM,gCAAgC,EAAE,mBAIiD,CAAC"}

package/dist/testing/cross_backend/test_cell_gated_create_authorize.js

@@ -0,0 +1,36 @@
+import '../assert_dev_env.js';
+/**
+ * Test `CellCreateAuthorize` policy mounted on **both** reference spines — the
+ * TS spine binary's full mount (`full_spine_mount.ts`) and the Rust
+ * `testing_spine_stub` — so the cross-backend `cell_gated_create` suite proves
+ * the cell-creation authorizer agrees TS↔Rust. The twin of the Rust
+ * `TestCellGatedCreateAuthorize`.
+ *
+ * The policy gates exactly one kind: creating a `kind: 'gated'` cell requires
+ * the `participant` app-role (registered on both spines, `grant_paths:
+ * ['admin']`) or admin. Every other kind — and a typeless cell — is open, so
+ * the existing cell suites (which use `note` / `collection` kinds) are
+ * unaffected, exactly as on the Rust stub.
+ *
+ * **`$lib`-free by contract** — reached by the spawned TS spine binary under
+ * Gro's loader (no `$lib` alias). Keep every import relative.
+ *
+ * @module
+ */
+import { has_role } from '../../auth/request_context.js';
+import { ROLE_ADMIN } from '../../auth/role_schema.js';
+import { SPINE_PARTICIPANT_ROLE } from './spine_surface_constants.js';
+/** The single kind the test policy gates (shared with the driving suite). */
+export const GATED_CELL_KIND = 'gated';
+/**
+ * The app-role that unlocks creating the gated kind (besides admin) — the
+ * `participant` role both reference spines register. Mirrors the Rust policy's
+ * `"participant"` literal.
+ */
+export const GATED_CELL_ROLE = SPINE_PARTICIPANT_ROLE;
+/**
+ * Allow unless the cell's `kind` is `'gated'`, in which case the actor must
+ * hold the `participant` role or be a (scope-agnostic) admin. Mirrors the Rust
+ * `TestCellGatedCreateAuthorize` exactly.
+ */
+export const test_cell_gated_create_authorize = (auth, input) => input.kind !== GATED_CELL_KIND || has_role(auth, GATED_CELL_ROLE) || has_role(auth, ROLE_ADMIN);

package/dist/testing/cross_backend/ts_spine_backend_config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ts_spine_backend_config.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/ts_spine_backend_config.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAE9B;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,KAAK,EAAC,aAAa,EAAC,MAAM,qBAAqB,CAAC;AASvD,8GAA8G;AAC9G,eAAO,MAAM,gBAAgB,6BAA6B,CAAC;AA+B3D,6FAA6F;AAC7F,eAAO,MAAM,0BAA0B,OAAO,CAAC;AAE/C,iDAAiD;AACjD,eAAO,MAAM,0BAA0B,OAAO,CAAC;AAE/C,gDAAgD;AAChD,eAAO,MAAM,yBAAyB,OAAO,CAAC;AAE9C,yDAAyD;AACzD,eAAO,MAAM,mBAAmB,wDAAwD,CAAC;AAEzF,yDAAyD;AACzD,eAAO,MAAM,mBAAmB,wDAAwD,CAAC;AAEzF,wDAAwD;AACxD,eAAO,MAAM,kBAAkB,uDAAuD,CAAC;AAEvF,MAAM,WAAW,2BAA2B;IAC3C,mFAAmF;IACnF,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,8DAA8D;IAC9D,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B;;;;;;;;;OASG;IACH,QAAQ,CAAC,uBAAuB,CAAC,EAAE,OAAO,CAAC;CAC3C;AAWD;;;GAGG;AACH,eAAO,MAAM,4BAA4B,GACxC,UAAS,2BAAgC,KACvC,aAmBF,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,2BAA2B,GACvC,UAAS,2BAAgC,KACvC,aAmBF,CAAC;AAEF;;;;;;;;;;GAUG;AACH,eAAO,MAAM,4BAA4B,GACxC,UAAS,2BAAgC,KACvC,aAgCF,CAAC"}
+{"version":3,"file":"ts_spine_backend_config.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/ts_spine_backend_config.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAE9B;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,KAAK,EAAC,aAAa,EAAC,MAAM,qBAAqB,CAAC;AASvD,8GAA8G;AAC9G,eAAO,MAAM,gBAAgB,6BAA6B,CAAC;AAkC3D,6FAA6F;AAC7F,eAAO,MAAM,0BAA0B,OAAO,CAAC;AAE/C,iDAAiD;AACjD,eAAO,MAAM,0BAA0B,OAAO,CAAC;AAE/C,gDAAgD;AAChD,eAAO,MAAM,yBAAyB,OAAO,CAAC;AAE9C,yDAAyD;AACzD,eAAO,MAAM,mBAAmB,wDAAwD,CAAC;AAEzF,yDAAyD;AACzD,eAAO,MAAM,mBAAmB,wDAAwD,CAAC;AAEzF,wDAAwD;AACxD,eAAO,MAAM,kBAAkB,uDAAuD,CAAC;AAEvF,MAAM,WAAW,2BAA2B;IAC3C,mFAAmF;IACnF,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,8DAA8D;IAC9D,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B;;;;;;;;;OASG;IACH,QAAQ,CAAC,uBAAuB,CAAC,EAAE,OAAO,CAAC;CAC3C;AAWD;;;GAGG;AACH,eAAO,MAAM,4BAA4B,GACxC,UAAS,2BAAgC,KACvC,aAmBF,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,2BAA2B,GACvC,UAAS,2BAAgC,KACvC,aAmBF,CAAC;AAEF;;;;;;;;;;GAUG;AACH,eAAO,MAAM,4BAA4B,GACxC,UAAS,2BAAgC,KACvC,aAgCF,CAAC"}

package/dist/testing/cross_backend/ts_spine_backend_config.js

@@ -7,14 +7,17 @@ export const TS_SPINE_DIR_ENV = 'FUZ_TESTING_TS_SPINE_DIR';
 /**
  * Capabilities for the TS spine binary — `ts_default_capabilities` plus `sse`
  * (the binary wires `audit_log_sse`), `ready` (the binary live-mounts the
- * `/ready` deploy gate in `build_spine_app`), and `peer_request` (the backend
- * WS transport's `request_connection` path drives server→client `peer/ping`).
+ * `/ready` deploy gate in `build_spine_app`), `peer_request` (the backend
+ * WS transport's `request_connection` path drives server→client `peer/ping`),
+ * and `cell_gated_create` (the binary's `full_spine_mount` mounts the
+ * `test_cell_gated_create_authorize` policy).
  */
 const ts_spine_capabilities = Object.freeze({
     ...ts_default_capabilities,
     sse: true,
     ready: true,
     peer_request: true,
+    cell_gated_create: true,
 });
 /**
  * Capabilities for the **Bun** spine binary — `ts_spine_capabilities` with

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fuzdev/fuz_app",
-  "version": "0.101.1",
+  "version": "0.103.0",
   "description": "fullstack app library",
   "glyph": "🗝",
   "logo": "logo.svg",