@fuzdev/fuz_app 0.140.0 → 0.142.0

package/dist/testing/cross_backend/body_size.js

@@ -9,8 +9,8 @@ import '../assert_dev_env.js';
  * `Content-Length` over the cap is refused on the header, *before* auth,
  * origin, or dispatch run (middleware step 4). Each impl unit-tests this in
  * isolation; this suite pins the cross-impl agreement on the status + body
- * shape, on the exact `>` cap boundary (not an off-by-one divergence), and on
- * the cap answering ahead of the origin check and of auth. The cases:
+ * shape, and on the exact `>` cap boundary (not an off-by-one divergence). The
+ * cases:
  *
  * - **over-limit POST (cap + 1 byte) → 413** `payload_too_large`, refused
  *   before any handler runs (the limit fires ahead of origin verification + the
@@ -25,11 +25,10 @@ import '../assert_dev_env.js';
  * - **under-limit POST (small) → 200** — a small, well-formed authenticated
  *   `account_verify` envelope sails through to a successful handler response,
  *   the positive control that the route works for normal traffic.
- * - **over-limit POST with a disallowed `Origin` → 413**, not the origin
- *   check's 403, and **over-limit POST with no credentials → 413**, not 401:
- *   the cap answers a declared length ahead of both. The control — the same
- *   disallowed `Origin` on an under-limit body → 403 `forbidden_origin` —
- *   shows the origin check still runs.
+ * - The cap answering a declared length ahead of the origin check and auth —
+ *   over-cap with a disallowed `Origin` and no credential → 413 — is pinned per
+ *   transport by the front-door table (`transport_composition.ts`), beside the
+ *   under-cap 403 that shows the origin check still runs.
  * - **over-limit chunked POST (no `Content-Length`), authenticated → 413** —
  *   a body with no declared length is refused by the bytes that arrive.
  *
@@ -83,7 +82,7 @@ import '../assert_dev_env.js';
  */
 import { describe, test, assert } from 'vitest';
 import { account_verify_action_spec } from '../../auth/account_action_specs.js';
-import { ERROR_FORBIDDEN_ORIGIN, ERROR_PAYLOAD_TOO_LARGE } from '../../http/error_schemas.js';
+import { ERROR_PAYLOAD_TOO_LARGE } from '../../http/error_schemas.js';
 import { raw_http_exchange, raw_http_parse_response } from '../transports/raw_http.js';
 import { SPINE_RPC_PATH } from './spine_surface_constants.js';
 /**
@@ -111,8 +110,6 @@ const sized_envelope = (id, target_bytes) => {
 };
 /** A small, well-formed nullary `account_verify` body — well under the cap. */
 const small_envelope = (id) => JSON.stringify({ jsonrpc: '2.0', method: account_verify_action_spec.method, id });
-/** An `Origin` no backend's allowlist admits. */
-const DISALLOWED_ORIGIN = 'http://evil.com';
 /** Chunk size of the streamed over-cap body. */
 const STREAM_CHUNK_BYTES = 64 * 1024;
 /**
@@ -191,19 +188,15 @@ export const describe_body_size_cross_tests = (options) => {
         body
     });
     /**
-     * POST with a declared `Content-Length` one byte over the cap. Over a
-     * socket only the head is sent; in-process, the whole body.
-     *
-     * `headers` carries the credential and any `Origin`, which defaults to the
-     * backend's own. `anonymous` picks the cookie-jar-free transport in-process;
-     * a raw head carries only what `headers` names either way.
+     * POST as the keeper, with the backend's own `Origin` and a declared
+     * `Content-Length` one byte over the cap. Over a socket only the head is
+     * sent; in-process, the whole body.
      */
-    const post_over_limit_declared = async (fixture, request) => {
-        const { id, headers, anonymous } = request;
+    const post_over_limit_declared = async (fixture, id) => {
+        const headers = fixture.create_session_headers();
         const content_length = BODY_LIMIT_DEFAULT_BYTES + 1;
         if (base_url === null) {
-            const transport = anonymous ? fixture.fresh_transport() : fixture.transport;
-            return to_sized_response(await transport(rpc_path, {
+            return to_sized_response(await fixture.transport(rpc_path, {
                 method: 'POST',
                 headers: { ...headers, 'content-type': 'application/json' },
                 body: sized_envelope(id, content_length)
@@ -258,11 +251,7 @@ export const describe_body_size_cross_tests = (options) => {
             // Keeper session cookie + the default allowed Origin, so neither auth
             // nor origin is the cause — only the size. One byte over the cap: both
             // impls reject on a strict `>`.
-            const res = await post_over_limit_declared(fixture, {
-                id: 'over-limit',
-                headers: fixture.create_session_headers(),
-                anonymous: false
-            });
+            const res = await post_over_limit_declared(fixture, 'over-limit');
             assert_payload_too_large(res, 'a body one byte over the cap must be rejected with 413');
         });
         test('at-limit POST (exactly the cap) → not size-rejected', async () => {
@@ -281,46 +270,6 @@ export const describe_body_size_cross_tests = (options) => {
             const res = await post(fixture, small_envelope('under-limit'));
             assert.strictEqual(res.status, 200, 'an under-limit authenticated request must pass');
         });
-        test('over-limit POST with a disallowed Origin → 413, not 403', async () => {
-            const fixture = await setup_test();
-            // Keeper session + a rogue Origin: the origin check would answer 403,
-            // and the cap, which reads only the declared length, answers first.
-            const res = await post_over_limit_declared(fixture, {
-                id: 'over-limit-evil-origin',
-                headers: { ...fixture.create_session_headers(), origin: DISALLOWED_ORIGIN },
-                anonymous: false
-            });
-            assert_payload_too_large(res, 'a declared length over the cap must answer 413 ahead of the origin check');
-        });
-        test('under-limit POST with a disallowed Origin → 403 forbidden_origin', async () => {
-            const fixture = await setup_test();
-            // The control for the case above: the same request minus the size is
-            // refused by the origin check, so the 413 there is the cap answering
-            // first, not the origin check being absent.
-            const res = await fixture.transport(rpc_path, {
-                method: 'POST',
-                headers: {
-                    ...fixture.create_session_headers(),
-                    origin: DISALLOWED_ORIGIN,
-                    'content-type': 'application/json'
-                },
-                body: small_envelope('under-limit-evil-origin')
-            });
-            assert.strictEqual(res.status, 403, 'a disallowed Origin on an under-limit body is refused');
-            const body = (await res.json().catch(() => undefined));
-            assert.strictEqual(body?.error, ERROR_FORBIDDEN_ORIGIN);
-        });
-        test('over-limit POST with no credentials → 413, not 401', async () => {
-            const fixture = await setup_test();
-            // No cookie, no token: the dispatcher would answer 401, and the cap
-            // answers first.
-            const res = await post_over_limit_declared(fixture, {
-                id: 'over-limit-anonymous',
-                headers: {},
-                anonymous: true
-            });
-            assert_payload_too_large(res, 'a declared length over the cap must answer 413 ahead of auth');
-        });
         test('over-limit chunked POST (no Content-Length), authenticated → 413', async () => {
             const fixture = await setup_test();
             // Keeper session + the default allowed Origin, so nothing but the size

package/dist/testing/cross_backend/capabilities.d.ts

@@ -208,6 +208,30 @@ export interface BackendCapabilities {
      * mount it.
      */
     readonly cell_gated_create: boolean;
+    /**
+     * The backend mounts a second, role-gated WebSocket endpoint at
+     * `SPINE_ROLE_GATED_WS_PATH`, gated on `SPINE_ROLE_GATED_WS_ROLES`, beside
+     * its ungated `ws_path`. Gates `describe_ws_role_gated_cross_tests`: a
+     * revoked global grant of a listed role closes the account's gated socket
+     * with `WS_CLOSE_PERMISSION_REVOKED`, its ungated socket stays open and
+     * still receives the account's pushes, a re-upgrade is refused at the gate,
+     * and a scoped revoke closes nothing. `true` only on the reference spine binaries that
+     * mount that endpoint (the TS spine binary + the Rust `testing_spine_stub`).
+     */
+    readonly ws_role_gated: boolean;
+    /**
+     * A refused WebSocket upgrade carries its refusal body — the flat
+     * `{error, ...}` the same refusal answers over plain HTTP. Not a gate: it
+     * forks how `describe_transport_composition_cross_tests` reads its WS rows.
+     * `true`, an empty refusal body fails the case; `false`, an empty body is
+     * allowed (the case pins the status alone) and a non-empty one is still
+     * asserted.
+     *
+     * `false` on Node: `@hono/node-ws` writes a refused upgrade to the raw
+     * socket with `Content-Length: 0`, dropping the response body. `true` on
+     * Deno, Bun, and the Rust spine, which send the response as built.
+     */
+    readonly ws_refusal_body: boolean;
 }
 /**
  * Capability declarations for the in-process Hono transport. Nearly every
@@ -218,8 +242,8 @@ export interface BackendCapabilities {
  * `create_ws_transport`, so the in-process driver never runs it — the
  * transport itself supports server-initiated requests),
  * `ws_handshake_pipelining` (raw bytes on a real socket),
- * `ws_account_actions` (a real socket's reply-then-close ordering), and
- * `cell_gated_create`. Cross-process consumers declare each flag explicitly
+ * `ws_account_actions` (a real socket's reply-then-close ordering),
+ * `cell_gated_create`, and `ws_role_gated`. Cross-process consumers declare each flag explicitly
  * per backend.
  */
 export declare const in_process_capabilities: BackendCapabilities;

package/dist/testing/cross_backend/capabilities.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"capabilities.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/capabilities.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AA2C9B;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,iBAAiB;IACjC;;;;;OAKG;IACH,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAC;IAC9B;;;;;OAKG;IACH,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAC;IAChC;;;;OAIG;IACH,QAAQ,CAAC,gBAAgB,EAAE,OAAO,CAAC;CACnC;AAED;;;;;GAKG;AACH,MAAM,WAAW,mBAAmB;IACnC;;;;;;OAMG;IACH,QAAQ,CAAC,EAAE,EAAE,OAAO,CAAC;IACrB;;;;;OAKG;IACH,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC;IACtB;;;;;;;OAOG;IACH,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;IAC5B;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAC;IACjC;;;;;;;;;;;;;;OAcG;IACH,QAAQ,CAAC,iBAAiB,EAAE,OAAO,CAAC;IACpC;;;;;;;;OAQG;IACH,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC;IAC/B;;;;;;;;OAQG;IACH,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IACxB;;;;;;;;OAQG;IACH,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAC;IACjC;;;;;;;;;;;;;;;;;;OAkBG;IACH,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC;IAC/B;;;;;;;;;;;;;;;;OAgBG;IACH,QAAQ,CAAC,uBAAuB,EAAE,OAAO,CAAC;IAC1C;;;;;;;;;;;;;;OAcG;IACH,QAAQ,CAAC,kBAAkB,EAAE,OAAO,CAAC;IACrC;;;;;;;;;;;;;;;;OAgBG;IACH,QAAQ,CAAC,wBAAwB,EAAE,OAAO,CAAC;IAC3C;;;;;;;;;;;;OAYG;IACH,QAAQ,CAAC,iBAAiB,EAAE,OAAO,CAAC;CACpC;AAED;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,uBAAuB,EAAE,mBAqBpC,CAAC;AAEH;;;;GAIG;AACH,eAAO,MAAM,sBAAsB,EAAE,iBAInC,CAAC;AAEH;;;;;;;;GAQG;AACH,eAAO,MAAM,OAAO,GAAI,MAAM,OAAO,EAAE,MAAM,MAAM,EAAE,IAAI,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,KAAG,IAMrF,CAAC"}
+{"version":3,"file":"capabilities.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/capabilities.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AA2C9B;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,iBAAiB;IACjC;;;;;OAKG;IACH,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAC;IAC9B;;;;;OAKG;IACH,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAC;IAChC;;;;OAIG;IACH,QAAQ,CAAC,gBAAgB,EAAE,OAAO,CAAC;CACnC;AAED;;;;;GAKG;AACH,MAAM,WAAW,mBAAmB;IACnC;;;;;;OAMG;IACH,QAAQ,CAAC,EAAE,EAAE,OAAO,CAAC;IACrB;;;;;OAKG;IACH,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC;IACtB;;;;;;;OAOG;IACH,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;IAC5B;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAC;IACjC;;;;;;;;;;;;;;OAcG;IACH,QAAQ,CAAC,iBAAiB,EAAE,OAAO,CAAC;IACpC;;;;;;;;OAQG;IACH,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC;IAC/B;;;;;;;;OAQG;IACH,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IACxB;;;;;;;;OAQG;IACH,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAC;IACjC;;;;;;;;;;;;;;;;;;OAkBG;IACH,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC;IAC/B;;;;;;;;;;;;;;;;OAgBG;IACH,QAAQ,CAAC,uBAAuB,EAAE,OAAO,CAAC;IAC1C;;;;;;;;;;;;;;OAcG;IACH,QAAQ,CAAC,kBAAkB,EAAE,OAAO,CAAC;IACrC;;;;;;;;;;;;;;;;OAgBG;IACH,QAAQ,CAAC,wBAAwB,EAAE,OAAO,CAAC;IAC3C;;;;;;;;;;;;OAYG;IACH,QAAQ,CAAC,iBAAiB,EAAE,OAAO,CAAC;IACpC;;;;;;;;;OASG;IACH,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAC;IAChC;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,eAAe,EAAE,OAAO,CAAC;CAClC;AAED;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,uBAAuB,EAAE,mBA2BpC,CAAC;AAEH;;;;GAIG;AACH,eAAO,MAAM,sBAAsB,EAAE,iBAInC,CAAC;AAEH;;;;;;;;GAQG;AACH,eAAO,MAAM,OAAO,GAAI,MAAM,OAAO,EAAE,MAAM,MAAM,EAAE,IAAI,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,KAAG,IAMrF,CAAC"}

package/dist/testing/cross_backend/capabilities.js

@@ -47,8 +47,8 @@ import { test } from 'vitest';
  * `create_ws_transport`, so the in-process driver never runs it — the
  * transport itself supports server-initiated requests),
  * `ws_handshake_pipelining` (raw bytes on a real socket),
- * `ws_account_actions` (a real socket's reply-then-close ordering), and
- * `cell_gated_create`. Cross-process consumers declare each flag explicitly
+ * `ws_account_actions` (a real socket's reply-then-close ordering),
+ * `cell_gated_create`, and `ws_role_gated`. Cross-process consumers declare each flag explicitly
  * per backend.
  */
 export const in_process_capabilities = Object.freeze({
@@ -71,7 +71,13 @@ export const in_process_capabilities = Object.freeze({
     ws_self_revocation_reply: true,
     // Cross-process-only: the test `CellCreateAuthorize` policy is mounted on the
     // spine binaries' full mount + the Rust stub, not the in-process default app.
-    cell_gated_create: false
+    cell_gated_create: false,
+    // Cross-process-only: the gated endpoint is a spine-binary mount, and the
+    // case reads a real socket's close.
+    ws_role_gated: false,
+    // Read only by the front-door table's WS rows, which skip in-process (no
+    // socket to upgrade); Hono's own refusals carry their bodies.
+    ws_refusal_body: true
 });
 /**
  * Shape notes for the in-process Hono transport — every wiring fact present

package/dist/testing/cross_backend/cell_gated_create.d.ts

@@ -19,6 +19,44 @@ export declare const describe_cell_gated_create_cross_tests: (options: RpcPathCa
  *   contribution gets `cell_not_found`, never learns it exists.
  * - **reject** → `moderation: 'rejected'`, visibility stays private.
  *
+ * And that moderation gates reads — a cell's effective audience is its
+ * visibility or grants **and** its moderation admission (unmoderated or
+ * `approved`), so a pending or rejected contribution reaches no one past its
+ * author and admins:
+ *
+ * - **an author's self-flip to public admits nobody** — a pending post its
+ *   author makes public stays 404 to anon and a fresh non-admin on `cell_get`,
+ *   and out of their `cell_list`; the author and admin still read it.
+ * - **rejection holds a public post back** — pending → rejected → public, and
+ *   approved → rejected (approval made it public, rejection leaves visibility
+ *   alone), both 404 past the author; a grant made while the post was approved
+ *   stops admitting once it is rejected, on `cell_get` and `shared_with: 'me'`.
+ * - **an approved post is live** — the control.
+ * - **relation reads follow** — a pending post in a public collection is
+ *   omitted from anon `cell_item_list`, beside a live sibling that isn't; at
+ *   the far end of all four relation lists, a pending post is hidden from
+ *   anon even flipped public, and a rejected one from its grant holder.
+ * - **fact serving follows** — a pending post's fact is 404 to anon, even
+ *   with the post flipped public (also gated on `capabilities.fact_serving`).
+ *
+ * And the steward arm — the owner of a **non-admin** root (a parentless
+ * non-`space` kind carrying the same policy, which the test authorizer leaves
+ * open) reads the pending posts under it and moderates them:
+ *
+ * - **the queue** — `cell_list({root_id, moderation: 'pending'})` and
+ *   `cell_get` (with `can_edit` / `can_grant` false) → 200; a stranger 404s.
+ * - **moderation** — the root owner approves → 200; the author 403, a
+ *   stranger 404.
+ * - **the arm stops there** — the root owner's `cell_clone` of the pending
+ *   post and a contribution under it are both 404.
+ * - **fact serving** — the root owner fetches a pending post's fact → 200,
+ *   anon 404 (also gated on `capabilities.fact_serving`).
+ *
+ * And that `cell_grant_create` refuses a pending contribution — **403**
+ * `cell_grant_unapproved` for its author and an admin, actor- and role-shaped,
+ * while a non-manager keeps the **404** mask; the same grant lands once the
+ * post is approved.
+ *
  * Gated on `capabilities.cell_gated_create` — a `pending` contribution only
  * exists when the directory authorizer is mounted (reference spine binaries).
  */

package/dist/testing/cross_backend/cell_gated_create.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cell_gated_create.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/cell_gated_create.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAuD9B,OAAO,KAAK,EAAE,uCAAuC,EAAE,MAAM,YAAY,CAAC;AAkB1E,eAAO,MAAM,sCAAsC,GAClD,SAAS,uCAAuC,KAC9C,IAwPF,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,eAAO,MAAM,kCAAkC,GAC9C,SAAS,uCAAuC,KAC9C,IAyKF,CAAC"}
+{"version":3,"file":"cell_gated_create.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/cell_gated_create.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAoE9B,OAAO,KAAK,EAAE,uCAAuC,EAAE,MAAM,YAAY,CAAC;AAqB1E,eAAO,MAAM,sCAAsC,GAClD,SAAS,uCAAuC,KAC9C,IAuTF,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0DG;AACH,eAAO,MAAM,kCAAkC,GAC9C,SAAS,uCAAuC,KAC9C,IA25BF,CAAC"}