@fuzdev/fuz_app 0.139.0 → 0.141.0

package/dist/testing/cross_backend/origin_scope.d.ts

@@ -0,0 +1,16 @@
+import '../assert_dev_env.js';
+import type { CapabilityGatedCrossSuiteOptions } from './setup.js';
+/** Options for the origin-scope parity suite. */
+export interface OriginScopeCrossTestOptions extends CapabilityGatedCrossSuiteOptions {
+    /** A public path outside `/api` the backend serves with `200`. Default `/ready`. */
+    readonly probe_path?: string;
+    /**
+     * The backend's base URL, for the over-cap row: given one, the request
+     * head is written to the socket alone, declaring a length one byte over
+     * the cap, so the `413` has to arrive before any body byte. `null` (the
+     * default) sends the whole body through the fixture's in-process transport.
+     */
+    readonly base_url?: string | null;
+}
+export declare const describe_origin_scope_cross_tests: (options: OriginScopeCrossTestOptions) => void;
+//# sourceMappingURL=origin_scope.d.ts.map

package/dist/testing/cross_backend/origin_scope.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"origin_scope.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/origin_scope.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AA4C9B,OAAO,KAAK,EAAE,gCAAgC,EAAE,MAAM,YAAY,CAAC;AAcnE,iDAAiD;AACjD,MAAM,WAAW,2BAA4B,SAAQ,gCAAgC;IACpF,oFAAoF;IACpF,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B;;;;;OAKG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAClC;AAED,eAAO,MAAM,iCAAiC,GAAI,SAAS,2BAA2B,KAAG,IAmGxF,CAAC"}

package/dist/testing/cross_backend/origin_scope.js

@@ -0,0 +1,140 @@
+import '../assert_dev_env.js';
+/**
+ * Cross-backend parity suite for the origin check's scope: every path, not
+ * only `/api`.
+ *
+ * Both spines check the `Origin` of every request — the TS spine mounts the
+ * check on every path (`ORIGIN_MIDDLEWARE_PATH`), the Rust spine behind every
+ * route group of `fuz_http::compose_stack`, the fallback included — and leave
+ * a path out only by a named carve-out with its reason. The front-door table
+ * (`transport_composition.ts`) pins the check on the `/api` transports; this
+ * suite pins it off `/api`, on the route both spine test servers serve there,
+ * `GET /ready`:
+ *
+ * - **foreign `Origin` → 403 `forbidden_origin`** — the check runs on a path
+ *   outside `/api`.
+ * - **absent `Origin` → passes** — a probe or CLI client sends none, so the
+ *   wider scope costs it nothing.
+ * - **allowed `Origin` → passes** — the control: the check admits its own
+ *   origin rather than refusing every browser.
+ *
+ * And on a path neither server routes, which reaches each spine's fallback:
+ *
+ * - **foreign `Origin` → 403 `forbidden_origin`**, **absent → 404** — the
+ *   fallback is behind the check, not attached after it.
+ * - **an over-cap `POST` with a declared `Content-Length` and a foreign
+ *   `Origin` → 413 `payload_too_large`** — the body cap comes ahead of the
+ *   origin check on the fallback too (413-first holds for a declared length).
+ *
+ * The `/ready` rows are gated on `capabilities.ready`, which every spine test
+ * server advertises; the unrouted rows run on every backend.
+ * Runs both legs via the shared `{setup_test, capabilities}` protocol: the
+ * in-process leg (`cross_backend/origin_scope_parity.db.test.ts`, plain `gro
+ * test`) and the cross-process leg (`cross_backend/origin_scope.cross.test.ts`,
+ * the TS spine binaries + Rust `testing_spine_stub` over real HTTP).
+ *
+ * @module
+ */
+import { describe, assert, test } from 'vitest';
+import { ERROR_FORBIDDEN_ORIGIN, ERROR_PAYLOAD_TOO_LARGE } from '../../http/error_schemas.js';
+import { raw_http_exchange, raw_http_parse_response } from '../transports/raw_http.js';
+import { test_if } from './capabilities.js';
+/** An origin no spine test server allows. */
+const FOREIGN_ORIGIN = 'https://evil.example';
+/** A path no spine test server routes — it reaches the fallback. */
+const UNROUTED_PATH = '/origin-scope-unrouted';
+/** The shared 1 MiB default cap both spines ship, as in `body_size.ts`. */
+const BODY_LIMIT_DEFAULT_BYTES = 1024 * 1024;
+/** How long a raw exchange waits for the refusal. */
+const RAW_READ_TIMEOUT_MS = 2000;
+export const describe_origin_scope_cross_tests = (options) => {
+    const { setup_test, capabilities } = options;
+    const probe_path = options.probe_path ?? '/ready';
+    const base_url = options.base_url ?? null;
+    describe('origin check scope parity', () => {
+        test_if(capabilities.ready, `a foreign Origin on ${probe_path} → 403 forbidden_origin (the check covers every path)`, async () => {
+            const fixture = await setup_test();
+            // the header set on the request, not as the transport's default — an
+            // in-process transport sends no default Origin
+            const res = await fixture.fresh_transport({ origin: null })(probe_path, {
+                method: 'GET',
+                headers: { origin: FOREIGN_ORIGIN }
+            });
+            assert.strictEqual(res.status, 403, 'a foreign Origin off /api must be refused');
+            const body = (await res.json().catch(() => undefined));
+            assert.strictEqual(body?.error, ERROR_FORBIDDEN_ORIGIN);
+        });
+        test_if(capabilities.ready, `an absent Origin on ${probe_path} → passes`, async () => {
+            const fixture = await setup_test();
+            const res = await fixture.fresh_transport({ origin: null })(probe_path, { method: 'GET' });
+            assert.strictEqual(res.status, 200, 'a request with no Origin must pass the check');
+        });
+        test_if(capabilities.ready, `the allowed Origin on ${probe_path} → passes`, async () => {
+            const fixture = await setup_test();
+            // a cross-process transport sends the backend's own, allowed Origin by
+            // default (an in-process one sends none, which passes too)
+            const res = await fixture.fresh_transport()(probe_path, { method: 'GET' });
+            assert.strictEqual(res.status, 200, 'the allowed Origin must pass the check');
+        });
+        test(`a foreign Origin on an unrouted path → 403 forbidden_origin (the fallback is checked)`, async () => {
+            const fixture = await setup_test();
+            const res = await fixture.fresh_transport({ origin: null })(UNROUTED_PATH, {
+                method: 'GET',
+                headers: { origin: FOREIGN_ORIGIN }
+            });
+            assert.strictEqual(res.status, 403, 'a foreign Origin on the fallback must be refused');
+            const body = (await res.json().catch(() => undefined));
+            assert.strictEqual(body?.error, ERROR_FORBIDDEN_ORIGIN);
+        });
+        test('an absent Origin on an unrouted path → 404', async () => {
+            const fixture = await setup_test();
+            const res = await fixture.fresh_transport({ origin: null })(UNROUTED_PATH, {
+                method: 'GET'
+            });
+            assert.strictEqual(res.status, 404, 'the fallback answers its own 404 past the check');
+        });
+        test('an over-cap POST to an unrouted path with a foreign Origin → 413 payload_too_large', async () => {
+            const over = BODY_LIMIT_DEFAULT_BYTES + 1;
+            let status;
+            let text;
+            if (base_url === null) {
+                const fixture = await setup_test();
+                const res = await fixture.fresh_transport({ origin: null })(UNROUTED_PATH, {
+                    method: 'POST',
+                    headers: { origin: FOREIGN_ORIGIN, 'content-type': 'application/json' },
+                    body: 'x'.repeat(over)
+                });
+                status = res.status;
+                text = await res.text();
+            }
+            else {
+                // the head alone, declaring the length: the 413 must not wait on a body byte
+                const url = new URL(base_url);
+                const request = `POST ${UNROUTED_PATH} HTTP/1.1\r\n` +
+                    `host: ${url.host}\r\n` +
+                    `origin: ${FOREIGN_ORIGIN}\r\n` +
+                    `content-type: application/json\r\n` +
+                    `content-length: ${over}\r\n` +
+                    `\r\n`;
+                const { received } = await raw_http_exchange(base_url, request, {
+                    read_timeout_ms: RAW_READ_TIMEOUT_MS,
+                    until: 'response'
+                });
+                const response = raw_http_parse_response(received);
+                assert.ok(response, `no whole response; received: ${received.slice(0, 200)}`);
+                status = response.status;
+                text = response.body;
+            }
+            assert.strictEqual(status, 413, `the cap comes ahead of the origin check (body: ${text})`);
+            const body = (() => {
+                try {
+                    return JSON.parse(text);
+                }
+                catch {
+                    return undefined;
+                }
+            })();
+            assert.strictEqual(body?.error, ERROR_PAYLOAD_TOO_LARGE);
+        });
+    });
+};

package/dist/testing/cross_backend/role_grant_cross_helpers.d.ts

@@ -0,0 +1,35 @@
+import '../assert_dev_env.js';
+import type { TestAccountFixture, TestFixture } from './setup.js';
+/** Options for the role-grant fixtures. */
+export interface RoleGrantFixtureOptions {
+    /** The role to offer. Default `ROLE_ADMIN`, the one builtin admin-grantable role. */
+    readonly role?: string;
+    /** The JSON-RPC endpoint path. Default `SPINE_RPC_PATH`. */
+    readonly rpc_path?: string;
+}
+/**
+ * Create a fresh pending offer of `role` from `grantor_headers` (defaults to
+ * the keeper) to `to_account_id`, returning the created offer.
+ *
+ * @param fixture - the per-test fixture
+ * @param to_account_id - the recipient account
+ * @param grantor_headers - the grantor's session headers; the keeper's when omitted
+ * @param options - the role and the RPC path
+ * @returns the created offer
+ */
+export declare const create_pending_role_grant_offer: (fixture: TestFixture, to_account_id: string, grantor_headers?: Record<string, string>, options?: RoleGrantFixtureOptions) => Promise<{
+    id: string;
+}>;
+/**
+ * Materialize an active global grant of `role` on `recipient` through a fresh
+ * keeper offer and the recipient's accept, returning its `role_grant_id` — the
+ * handle `role_grant_revoke` keys on. Idempotent on a grant the account
+ * already holds: the accept returns that grant's id.
+ *
+ * @param fixture - the per-test fixture
+ * @param recipient - the account that accepts the offer
+ * @param options - the role and the RPC path
+ * @returns the active grant's id
+ */
+export declare const create_active_role_grant: (fixture: TestFixture, recipient: TestAccountFixture, options?: RoleGrantFixtureOptions) => Promise<string>;
+//# sourceMappingURL=role_grant_cross_helpers.d.ts.map

package/dist/testing/cross_backend/role_grant_cross_helpers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"role_grant_cross_helpers.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/role_grant_cross_helpers.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAoB9B,OAAO,KAAK,EAAE,kBAAkB,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAElE,2CAA2C;AAC3C,MAAM,WAAW,uBAAuB;IACvC,qFAAqF;IACrF,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,4DAA4D;IAC5D,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED;;;;;;;;;GASG;AACH,eAAO,MAAM,+BAA+B,GAC3C,SAAS,WAAW,EACpB,eAAe,MAAM,EACrB,kBAAiB,MAAM,CAAC,MAAM,EAAE,MAAM,CAAoC,EAC1E,UAAS,uBAA4B,KACnC,OAAO,CAAC;IAAE,EAAE,EAAE,MAAM,CAAA;CAAE,CAWxB,CAAC;AAEF;;;;;;;;;;GAUG;AACH,eAAO,MAAM,wBAAwB,GACpC,SAAS,WAAW,EACpB,WAAW,kBAAkB,EAC7B,UAAS,uBAA4B,KACnC,OAAO,CAAC,MAAM,CAgBhB,CAAC"}

package/dist/testing/cross_backend/role_grant_cross_helpers.js

@@ -0,0 +1,64 @@
+import '../assert_dev_env.js';
+/**
+ * Role-grant fixtures for the cross-process suites — a pending offer, and an
+ * active grant materialized through the real offer + accept handlers — shared
+ * by the suites that need a grant to revoke
+ * (`describe_role_grant_offer_notification_ws_tests`,
+ * `describe_ws_role_gated_cross_tests`).
+ *
+ * Both drive the standard role-grant-offer RPC actions over the fixture's
+ * HTTP transport, as the keeper unless a grantor is given.
+ *
+ * @module
+ */
+import { assert } from 'vitest';
+import { rpc_call } from '../rpc_helpers.js';
+import { ROLE_ADMIN } from '../../auth/role_schema.js';
+import { SPINE_RPC_PATH } from './spine_surface_constants.js';
+/**
+ * Create a fresh pending offer of `role` from `grantor_headers` (defaults to
+ * the keeper) to `to_account_id`, returning the created offer.
+ *
+ * @param fixture - the per-test fixture
+ * @param to_account_id - the recipient account
+ * @param grantor_headers - the grantor's session headers; the keeper's when omitted
+ * @param options - the role and the RPC path
+ * @returns the created offer
+ */
+export const create_pending_role_grant_offer = async (fixture, to_account_id, grantor_headers = fixture.create_session_headers(), options = {}) => {
+    const { role = ROLE_ADMIN, rpc_path = SPINE_RPC_PATH } = options;
+    const res = await rpc_call({
+        app: fixture.transport,
+        path: rpc_path,
+        method: 'role_grant_offer_create',
+        params: { to_account_id, role },
+        headers: grantor_headers
+    });
+    if (!res.ok)
+        assert.fail(`offer create failed: ${JSON.stringify(res)}`);
+    return res.result.offer;
+};
+/**
+ * Materialize an active global grant of `role` on `recipient` through a fresh
+ * keeper offer and the recipient's accept, returning its `role_grant_id` — the
+ * handle `role_grant_revoke` keys on. Idempotent on a grant the account
+ * already holds: the accept returns that grant's id.
+ *
+ * @param fixture - the per-test fixture
+ * @param recipient - the account that accepts the offer
+ * @param options - the role and the RPC path
+ * @returns the active grant's id
+ */
+export const create_active_role_grant = async (fixture, recipient, options = {}) => {
+    const offer = await create_pending_role_grant_offer(fixture, recipient.account.id, fixture.create_session_headers(), options);
+    const accepted = await rpc_call({
+        app: fixture.transport,
+        path: options.rpc_path ?? SPINE_RPC_PATH,
+        method: 'role_grant_offer_accept',
+        params: { offer_id: offer.id },
+        headers: recipient.create_session_headers()
+    });
+    if (!accepted.ok)
+        assert.fail(`accept failed: ${JSON.stringify(accepted)}`);
+    return accepted.result.role_grant_id;
+};

package/dist/testing/cross_backend/role_grant_offer_notification_ws.d.ts

@@ -11,6 +11,14 @@ export interface RoleGrantOfferNotificationWsTestOptions {
     readonly base_url: string;
     /** WebSocket endpoint path on the backend (e.g. `/api/ws`). */
     readonly ws_path: string;
+    /**
+     * The roles `ws_path` gates its upgrade on (its `required_roles`), or
+     * omitted / `[]` for an ungated endpoint. Declare them for a backend whose
+     * socket is role-gated: revoking `ROLE_ADMIN` then closes the revokee's
+     * socket with `WS_CLOSE_PERMISSION_REVOKED`, and the revoke case asserts
+     * that close instead of the notification frame.
+     */
+    readonly ws_required_roles?: ReadonlyArray<string>;
 }
 /**
  * Register the role-grant-offer WS notification suite — seven cases over a real

package/dist/testing/cross_backend/role_grant_offer_notification_ws.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"role_grant_offer_notification_ws.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/role_grant_offer_notification_ws.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAqE9B,OAAO,EAAE,KAAK,mBAAmB,EAAW,MAAM,mBAAmB,CAAC;AACtE,OAAO,KAAK,EAAE,SAAS,EAAmC,MAAM,YAAY,CAAC;AAK7E,2EAA2E;AAC3E,MAAM,WAAW,uCAAuC;IACvD,8EAA8E;IAC9E,QAAQ,CAAC,UAAU,EAAE,SAAS,CAAC;IAC/B,uEAAuE;IACvE,QAAQ,CAAC,YAAY,EAAE,mBAAmB,CAAC;IAC3C,2EAA2E;IAC3E,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,+DAA+D;IAC/D,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CACzB;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,+CAA+C,GAC3D,SAAS,uCAAuC,KAC9C,IAuWF,CAAC"}
+{"version":3,"file":"role_grant_offer_notification_ws.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/role_grant_offer_notification_ws.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AA4E9B,OAAO,EAAE,KAAK,mBAAmB,EAAW,MAAM,mBAAmB,CAAC;AAKtE,OAAO,KAAK,EAAE,SAAS,EAAe,MAAM,YAAY,CAAC;AAKzD,2EAA2E;AAC3E,MAAM,WAAW,uCAAuC;IACvD,8EAA8E;IAC9E,QAAQ,CAAC,UAAU,EAAE,SAAS,CAAC;IAC/B,uEAAuE;IACvE,QAAQ,CAAC,YAAY,EAAE,mBAAmB,CAAC;IAC3C,2EAA2E;IAC3E,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,+DAA+D;IAC/D,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB;;;;;;OAMG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;CACnD;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,+CAA+C,GAC3D,SAAS,uCAAuC,KAC9C,IA6VF,CAAC"}

package/dist/testing/cross_backend/role_grant_offer_notification_ws.js

@@ -38,6 +38,12 @@ import '../assert_dev_env.js';
  * guard), and accept stays idempotent on the role_grant while still superseding
  * pending siblings. Gated on `capabilities.ws`.
  *
+ * The revoke case revokes the revokee's only `ROLE_ADMIN` grant. On an endpoint
+ * gated on that role (`ws_required_roles`) the revokee's socket loses its
+ * access by the same revoke: it is closed with `WS_CLOSE_PERMISSION_REVOKED`,
+ * and the notification may or may not reach it first (nothing orders the two),
+ * so the case asserts the close there and the frame on an ungated endpoint.
+ *
  * Cross-process only: `create_admitted_ws_transport` needs a real bound socket, so wire
  * it from a `*.cross.test.ts` file, never an in-process setup. Authed cookies
  * come from the per-account session minted by `fixture.create_account` /
@@ -50,8 +56,10 @@ import { rpc_call } from '../rpc_helpers.js';
 import { create_admitted_ws_transport } from '../transports/ws_transport.js';
 import { is_notification_with } from '../transports/ws_client.js';
 import { ROLE_ADMIN } from '../../auth/role_schema.js';
+import { WS_CLOSE_PERMISSION_REVOKED } from '../../actions/transports.js';
 import { ROLE_GRANT_OFFER_RECEIVED_NOTIFICATION_METHOD, ROLE_GRANT_OFFER_ACCEPTED_NOTIFICATION_METHOD, ROLE_GRANT_OFFER_DECLINED_NOTIFICATION_METHOD, ROLE_GRANT_OFFER_RETRACTED_NOTIFICATION_METHOD, ROLE_GRANT_OFFER_SUPERSEDE_NOTIFICATION_METHOD, ROLE_GRANT_REVOKE_NOTIFICATION_METHOD, RoleGrantOfferReceivedParams, RoleGrantOfferAcceptedParams, RoleGrantOfferDeclinedParams, RoleGrantOfferRetractedParams, RoleGrantOfferSupersedeParams, RoleGrantRevokeParams } from '../../auth/role_grant_offer_notifications.js';
 import { test_if } from './capabilities.js';
+import { create_active_role_grant, create_pending_role_grant_offer } from './role_grant_cross_helpers.js';
 /** JSON-RPC endpoint path — matches the spine's `/api/rpc` (and the forge's). */
 const RPC_PATH = '/api/rpc';
 /**
@@ -63,7 +71,8 @@ const RPC_PATH = '/api/rpc';
  * params schema. Gated on `capabilities.ws`.
  */
 export const describe_role_grant_offer_notification_ws_tests = (options) => {
-    const { setup_test, capabilities, base_url, ws_path } = options;
+    const { setup_test, capabilities, base_url, ws_path, ws_required_roles = [] } = options;
+    const revoke_closes_the_socket = ws_required_roles.includes(ROLE_ADMIN);
     // -- shared helpers -------------------------------------------------------
     /**
      * Open a WS transport for a single session cookie (`<name>=<value>`),
@@ -81,29 +90,10 @@ export const describe_role_grant_offer_notification_ws_tests = (options) => {
     };
     /** Drive a JSON-RPC call over the fixture's HTTP transport. */
     const rpc = (fixture, method, params, headers) => rpc_call({ app: fixture.transport, path: RPC_PATH, method, params, headers });
-    /**
-     * Create a fresh pending `ROLE_ADMIN` offer from `grantor_headers` (defaults
-     * to the keeper) to `to_account_id`, returning the created offer.
-     */
-    const create_pending_offer = async (fixture, to_account_id, grantor_headers = fixture.create_session_headers()) => {
-        const res = await rpc(fixture, 'role_grant_offer_create', { to_account_id, role: ROLE_ADMIN }, grantor_headers);
-        if (!res.ok)
-            assert.fail(`offer create failed: ${JSON.stringify(res)}`);
-        return res.result.offer;
-    };
-    /**
-     * Materialize an active `ROLE_ADMIN` role_grant on `recipient` via a fresh
-     * keeper offer + recipient accept (idempotent on a grant the account already
-     * holds), returning its `role_grant_id` — the handle `role_grant_revoke`
-     * keys on.
-     */
-    const create_active_role_grant = async (fixture, recipient) => {
-        const offer = await create_pending_offer(fixture, recipient.account.id);
-        const accepted = await rpc(fixture, 'role_grant_offer_accept', { offer_id: offer.id }, recipient.create_session_headers());
-        if (!accepted.ok)
-            assert.fail(`accept failed: ${JSON.stringify(accepted)}`);
-        return accepted.result.role_grant_id;
-    };
+    /** A fresh pending `ROLE_ADMIN` offer, from the keeper unless a grantor is given. */
+    const create_pending_offer = (fixture, to_account_id, grantor_headers) => create_pending_role_grant_offer(fixture, to_account_id, grantor_headers, {
+        rpc_path: RPC_PATH
+    });
     // -- tests ----------------------------------------------------------------
     describe('role_grant_offer WS notifications (cross-process)', () => {
         test_if(capabilities.ws, 'an offer create delivers role_grant_offer_received to the recipient WS', async () => {
@@ -187,22 +177,41 @@ export const describe_role_grant_offer_notification_ws_tests = (options) => {
                 await recipient_ws.close();
             }
         });
-        test_if(capabilities.ws, 'revoke delivers a flat role_grant_revoke to the revokee WS', async () => {
+        test_if(capabilities.ws, revoke_closes_the_socket
+            ? 'revoke closes the revokee WS gated on the revoked role'
+            : 'revoke delivers a flat role_grant_revoke to the revokee WS', async () => {
             const fixture = await setup_test();
             const revokee = await fixture.create_account({ roles: [ROLE_ADMIN] });
-            const role_grant_id = await create_active_role_grant(fixture, revokee);
+            const role_grant_id = await create_active_role_grant(fixture, revokee, {
+                rpc_path: RPC_PATH
+            });
             const revokee_ws = await open_ws(revokee.create_session_headers().cookie);
             try {
                 const revoked = await rpc(fixture, 'role_grant_revoke', { actor_id: revokee.actor.id, role_grant_id, reason: 'cleanup' }, fixture.create_session_headers());
                 assert.isTrue(revoked.ok, `revoke failed: ${JSON.stringify(revoked)}`);
-                const frame = await revokee_ws.wait_for(is_notification_with(ROLE_GRANT_REVOKE_NOTIFICATION_METHOD, (p) => p.role_grant_id === role_grant_id), 5000);
+                const is_revoke_frame = is_notification_with(ROLE_GRANT_REVOKE_NOTIFICATION_METHOD, (p) => p.role_grant_id === role_grant_id);
                 // Flat params — guards the no-`offer`-wrapper, `revoked_by`-omitted
                 // shape against drift.
-                const params = RoleGrantRevokeParams.parse(frame.params);
-                assert.strictEqual(params.role_grant_id, role_grant_id);
-                assert.strictEqual(params.role, ROLE_ADMIN);
-                assert.strictEqual(params.reason, 'cleanup');
-                assert.notProperty(frame.params, 'revoked_by');
+                const assert_flat_revoke = (frame) => {
+                    const params = RoleGrantRevokeParams.parse(frame.params);
+                    assert.strictEqual(params.role_grant_id, role_grant_id);
+                    assert.strictEqual(params.role, ROLE_ADMIN);
+                    assert.strictEqual(params.reason, 'cleanup');
+                    assert.notProperty(frame.params, 'revoked_by');
+                };
+                if (revoke_closes_the_socket) {
+                    // the socket lost the role its endpoint requires; the revoke
+                    // notification may land just ahead of the close or not at all,
+                    // and is held to the same shape when it does
+                    const closed = await revokee_ws.wait_for_close(5000);
+                    assert.ok(closed, 'the gated socket did not close after the revoke');
+                    assert.strictEqual(revokee_ws.close_code, WS_CLOSE_PERMISSION_REVOKED);
+                    const early = revokee_ws.messages.find(is_revoke_frame);
+                    if (early)
+                        assert_flat_revoke(early);
+                    return;
+                }
+                assert_flat_revoke(await revokee_ws.wait_for(is_revoke_frame, 5000));
             }
             finally {
                 await revokee_ws.close();
@@ -240,7 +249,9 @@ export const describe_role_grant_offer_notification_ws_tests = (options) => {
             const fixture = await setup_test();
             const grantor = await fixture.create_account({ roles: [ROLE_ADMIN] });
             const revokee = await fixture.create_account({ roles: [ROLE_ADMIN] });
-            const role_grant_id = await create_active_role_grant(fixture, revokee);
+            const role_grant_id = await create_active_role_grant(fixture, revokee, {
+                rpc_path: RPC_PATH
+            });
             // A *pending* sibling offer for the same (account, role) — this is what
             // the revoke cascade supersedes.
             const sibling_offer = await create_pending_offer(fixture, revokee.account.id, grantor.create_session_headers());

package/dist/testing/cross_backend/rust_spine_stub_backend_config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"rust_spine_stub_backend_config.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/rust_spine_stub_backend_config.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AA0C9B,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAYzD,uGAAuG;AACvG,eAAO,MAAM,uBAAuB,oCAAoC,CAAC;AAEzE;;;;;GAKG;AACH,eAAO,MAAM,gCAAgC,6CAA6C,CAAC;AAE3F;;;;;GAKG;AACH,eAAO,MAAM,wCAAwC,6CAA6C,CAAC;AAqBnG,kGAAkG;AAClG,eAAO,MAAM,4BAA4B,OAAO,CAAC;AAEjD,0FAA0F;AAC1F,eAAO,MAAM,oCAAoC,sDACG,CAAC;AAErD,MAAM,WAAW,6BAA6B;IAC7C,8DAA8D;IAC9D,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB;;;OAGG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B;;;OAGG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B;;;;;;;OAOG;IACH,QAAQ,CAAC,uBAAuB,CAAC,EAAE,OAAO,CAAC;IAC3C;;;;;;OAMG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;IAClC;;;;;;OAMG;IACH,QAAQ,CAAC,wBAAwB,CAAC,EAAE,OAAO,CAAC;IAC5C;;;;;OAKG;IACH,QAAQ,CAAC,8BAA8B,CAAC,EAAE,MAAM,CAAC;CACjD;AAED;;;;;;;;;;GAUG;AACH,eAAO,MAAM,8BAA8B,GAC1C,UAAS,6BAAkC,KACzC,aAmDF,CAAC"}
+{"version":3,"file":"rust_spine_stub_backend_config.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/rust_spine_stub_backend_config.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AA0C9B,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAYzD,uGAAuG;AACvG,eAAO,MAAM,uBAAuB,oCAAoC,CAAC;AAEzE;;;;;GAKG;AACH,eAAO,MAAM,gCAAgC,6CAA6C,CAAC;AAE3F;;;;;GAKG;AACH,eAAO,MAAM,wCAAwC,6CAA6C,CAAC;AAuBnG,kGAAkG;AAClG,eAAO,MAAM,4BAA4B,OAAO,CAAC;AAEjD,0FAA0F;AAC1F,eAAO,MAAM,oCAAoC,sDACG,CAAC;AAErD,MAAM,WAAW,6BAA6B;IAC7C,8DAA8D;IAC9D,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB;;;OAGG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B;;;OAGG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B;;;;;;;OAOG;IACH,QAAQ,CAAC,uBAAuB,CAAC,EAAE,OAAO,CAAC;IAC3C;;;;;;OAMG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;IAClC;;;;;;OAMG;IACH,QAAQ,CAAC,wBAAwB,CAAC,EAAE,OAAO,CAAC;IAC5C;;;;;OAKG;IACH,QAAQ,CAAC,8BAA8B,CAAC,EAAE,MAAM,CAAC;CACjD;AAED;;;;;;;;;;GAUG;AACH,eAAO,MAAM,8BAA8B,GAC1C,UAAS,6BAAkC,KACzC,aAmDF,CAAC"}

package/dist/testing/cross_backend/rust_spine_stub_backend_config.js

@@ -61,9 +61,10 @@ export const RUST_SPINE_STUB_EXPECTED_SCHEMA_PATH_ENV = 'FUZ_RUST_SPINE_STUB_EXP
  * plus `sse` (the stub serves `GET /api/admin/audit/stream` over the spine
  * `fuz_realtime::SseRegistry` + audit listener), `ready` (it live-mounts
  * `/ready` over the env-supplied fixture path), `ws_account_actions` (it
- * serves one action registry on `/api/rpc` and `/api/ws`), and
- * `cell_gated_create` (it
- * mounts the `TestCellGatedCreateAuthorize` policy on its cell layer). Named
+ * serves one action registry on `/api/rpc` and `/api/ws`), `cell_gated_create`
+ * (it mounts the `TestCellGatedCreateAuthorize` policy on its cell layer), and
+ * `ws_role_gated` (it mounts the role-gated WS endpoint at
+ * `SPINE_ROLE_GATED_WS_PATH`, sharing its connection registry). Named
  * (not inline) so every spine preset is greppable, mirroring
  * `ts_spine_capabilities`.
  */
@@ -72,7 +73,8 @@ const rust_spine_stub_capabilities = Object.freeze({
     sse: true,
     ready: true,
     ws_account_actions: true,
-    cell_gated_create: true
+    cell_gated_create: true,
+    ws_role_gated: true
 });
 /** Default listening port — slots beside zzz's 1175/1176; matches the binary's `DEFAULT_PORT`. */
 export const RUST_SPINE_STUB_DEFAULT_PORT = 1177;

package/dist/testing/cross_backend/spine_surface_constants.d.ts

@@ -51,6 +51,25 @@ export declare const SPINE_CELL_EDITOR_ROLE = "cell_editor";
  * bootstrap-seed-only cell role.
  */
 export declare const SPINE_PARTICIPANT_ROLE = "participant";
+/**
+ * Mount path of the spine binaries' second, role-gated WebSocket endpoint —
+ * the same actions as the ungated `/api/ws`, behind
+ * `SPINE_ROLE_GATED_WS_ROLES`. Both spines mount it (the TS binary sharing
+ * `/api/ws`'s transport, the Rust stub its connection registry), so one
+ * account can hold a gated and an ungated socket side by side. Driven by
+ * `describe_ws_role_gated_cross_tests`, behind `capabilities.ws_role_gated`.
+ * Must match the Rust `testing_spine_stub`'s gated mount — a cross-language
+ * test contract.
+ */
+export declare const SPINE_ROLE_GATED_WS_PATH = "/api/gated/ws";
+/**
+ * The roles `SPINE_ROLE_GATED_WS_PATH` requires, any-of: `admin`, the gate a
+ * privileged-broadcast socket uses, and `participant`, a role that can be
+ * granted scoped — so the suite can revoke a scoped grant of a listed role
+ * and see nothing close. Must match the Rust `testing_spine_stub`'s gated
+ * mount.
+ */
+export declare const SPINE_ROLE_GATED_WS_ROLES: ReadonlyArray<string>;
 /**
  * Committed expected-schema fixture for the spine `/ready` deploy gate — the
  * column map a fresh full spine bootstrap (auth + cell + cell_history + fact)

package/dist/testing/cross_backend/spine_surface_constants.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"spine_surface_constants.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/spine_surface_constants.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAE9B;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,iEAAiE;AACjE,eAAO,MAAM,cAAc,aAAa,CAAC;AAEzC;;;;;;GAMG;AACH,eAAO,MAAM,cAAc,4BAA4B,CAAC;AAExD;;;;;;GAMG;AACH,eAAO,MAAM,sBAAsB,gBAAgB,CAAC;AAEpD;;;;;;;;;;GAUG;AACH,eAAO,MAAM,sBAAsB,gBAAgB,CAAC;AAEpD;;;;;;;;;;GAUG;AACH,eAAO,MAAM,yBAAyB,EAAE,GAAwD,CAAC;AAEjG;;;;;;;GAOG;AACH,eAAO,MAAM,4BAA4B,iCAAiC,CAAC;AAE3E;;;;;;;;GAQG;AACH,eAAO,MAAM,6BAA6B,kCAAkC,CAAC;AAE7E;;;;;;GAMG;AACH,eAAO,MAAM,kCAAkC,uCAAuC,CAAC;AAEvF;;;;GAIG;AACH,eAAO,MAAM,gBAAgB,6BAA6B,CAAC"}
+{"version":3,"file":"spine_surface_constants.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/spine_surface_constants.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAE9B;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,iEAAiE;AACjE,eAAO,MAAM,cAAc,aAAa,CAAC;AAEzC;;;;;;GAMG;AACH,eAAO,MAAM,cAAc,4BAA4B,CAAC;AAExD;;;;;;GAMG;AACH,eAAO,MAAM,sBAAsB,gBAAgB,CAAC;AAEpD;;;;;;;;;;GAUG;AACH,eAAO,MAAM,sBAAsB,gBAAgB,CAAC;AAEpD;;;;;;;;;GASG;AACH,eAAO,MAAM,wBAAwB,kBAAkB,CAAC;AAExD;;;;;;GAMG;AACH,eAAO,MAAM,yBAAyB,EAAE,aAAa,CAAC,MAAM,CAG1D,CAAC;AAEH;;;;;;;;;;GAUG;AACH,eAAO,MAAM,yBAAyB,EAAE,GAAwD,CAAC;AAEjG;;;;;;;GAOG;AACH,eAAO,MAAM,4BAA4B,iCAAiC,CAAC;AAE3E;;;;;;;;GAQG;AACH,eAAO,MAAM,6BAA6B,kCAAkC,CAAC;AAE7E;;;;;;GAMG;AACH,eAAO,MAAM,kCAAkC,uCAAuC,CAAC;AAEvF;;;;GAIG;AACH,eAAO,MAAM,gBAAgB,6BAA6B,CAAC"}

package/dist/testing/cross_backend/spine_surface_constants.js

@@ -51,6 +51,28 @@ export const SPINE_CELL_EDITOR_ROLE = 'cell_editor';
  * bootstrap-seed-only cell role.
  */
 export const SPINE_PARTICIPANT_ROLE = 'participant';
+/**
+ * Mount path of the spine binaries' second, role-gated WebSocket endpoint —
+ * the same actions as the ungated `/api/ws`, behind
+ * `SPINE_ROLE_GATED_WS_ROLES`. Both spines mount it (the TS binary sharing
+ * `/api/ws`'s transport, the Rust stub its connection registry), so one
+ * account can hold a gated and an ungated socket side by side. Driven by
+ * `describe_ws_role_gated_cross_tests`, behind `capabilities.ws_role_gated`.
+ * Must match the Rust `testing_spine_stub`'s gated mount — a cross-language
+ * test contract.
+ */
+export const SPINE_ROLE_GATED_WS_PATH = '/api/gated/ws';
+/**
+ * The roles `SPINE_ROLE_GATED_WS_PATH` requires, any-of: `admin`, the gate a
+ * privileged-broadcast socket uses, and `participant`, a role that can be
+ * granted scoped — so the suite can revoke a scoped grant of a listed role
+ * and see nothing close. Must match the Rust `testing_spine_stub`'s gated
+ * mount.
+ */
+export const SPINE_ROLE_GATED_WS_ROLES = Object.freeze([
+    'admin',
+    SPINE_PARTICIPANT_ROLE
+]);
 /**
  * Committed expected-schema fixture for the spine `/ready` deploy gate — the
  * column map a fresh full spine bootstrap (auth + cell + cell_history + fact)

package/dist/testing/cross_backend/testing_backdoor.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"testing_backdoor.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/testing_backdoor.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAyE9B,OAAO,KAAK,EAAE,wBAAwB,EAAe,MAAM,YAAY,CAAC;AA+ExE,kEAAkE;AAClE,MAAM,WAAW,+BAAgC,SAAQ,wBAAwB;IAChF;;;;OAIG;IACH,QAAQ,CAAC,EAAE,CAAC,EAAE;QACb,2EAA2E;QAC3E,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;QAC1B,+DAA+D;QAC/D,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;QACzB,sDAAsD;QACtD,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;KACzB,CAAC;CACF;AAED,eAAO,MAAM,qCAAqC,GACjD,SAAS,+BAA+B,KACtC,IAyEF,CAAC"}
+{"version":3,"file":"testing_backdoor.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/testing_backdoor.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AA4E9B,OAAO,KAAK,EAAE,wBAAwB,EAAe,MAAM,YAAY,CAAC;AAyFxE,kEAAkE;AAClE,MAAM,WAAW,+BAAgC,SAAQ,wBAAwB;IAChF;;;;OAIG;IACH,QAAQ,CAAC,EAAE,CAAC,EAAE;QACb,2EAA2E;QAC3E,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;QAC1B,+DAA+D;QAC/D,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;QACzB,sDAAsD;QACtD,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;KACzB,CAAC;CACF;AAED,eAAO,MAAM,qCAAqC,GACjD,SAAS,+BAA+B,KACtC,IAyEF,CAAC"}

package/dist/testing/cross_backend/testing_backdoor.js

@@ -5,12 +5,15 @@ import '../assert_dev_env.js';
  *
  * `_testing_reset` / `_testing_mint_session` / `_testing_put_fact` /
  * `_testing_flood_notifications` / `_testing_schema_snapshot` /
- * `_testing_migration_tracker` / `_testing_action_manifest` are privileged
- * test-binary actions the production wire never exposes — direct DB writes
- * (full auth wipe, forged session row, raw fact insert), a flood of the
- * caller's own connection, and introspection reads (the live schema, the
- * `schema_version` migration tracker, and the live RPC registry — the highest
- * info-leak of the set were the gate to break). Their only structural fence
+ * `_testing_migration_tracker` / `_testing_action_manifest` /
+ * `_testing_origin_check` / `_testing_shorten_credential_expiry` are
+ * privileged test-binary actions the production
+ * wire never exposes — direct DB writes (full auth wipe, forged session row,
+ * raw fact insert), a flood of the caller's own connection, introspection
+ * reads (the live schema, the `schema_version` migration tracker, and the live
+ * RPC registry — the highest info-leak of the set were the gate to break), a
+ * probe of the origin allowlist parser, and a rewrite of an account's
+ * credential expiries. Their only structural fence
  * is the **daemon-token** credential gate on
  * each spec's `auth` axis. A test binary live-mounts them on its RPC
  * endpoint (and, on fuz_app's spine binary and the Rust stub, its WS
@@ -92,7 +95,17 @@ const backdoor_methods = [
     { method: '_testing_migration_tracker', params: {} },
     // The RPC-registry-dump read — input is an empty strict object, so `{}` is
     // valid and clears the 400 phase, reaching the credential gate like the rest.
-    { method: '_testing_action_manifest', params: {} }
+    { method: '_testing_action_manifest', params: {} },
+    // The origin conformance probe — a valid `{patterns, origin}` pair, so it
+    // clears the 400 phase like the rest.
+    { method: '_testing_origin_check', params: { patterns: 'http://localhost:*', origin: null } },
+    // The credential-expiry rewrite — a valid `{account_id, seconds}` pair (a
+    // syntactically valid UUID; no row needs to match), so it clears the 400
+    // phase like the rest.
+    {
+        method: '_testing_shorten_credential_expiry',
+        params: { account_id: '00000000-0000-4000-8000-000000000000', seconds: 30 }
+    }
 ];
 const principals = [
     {