@fuzdev/fuz_app 0.141.0 → 0.142.0

package/dist/testing/cross_backend/account_lifecycle.js

@@ -2,7 +2,9 @@ import '../assert_dev_env.js';
 /**
  * Cross-backend parity suite for the account-lifecycle admin verbs:
  * `account_delete` (soft), `account_undelete` (reactivation), and
- * `account_purge` (keeper hard-delete), plus the keeper guard.
+ * `account_purge` (keeper hard-delete), plus the keeper guard and the
+ * session-only self-delete (an API token can't end its own account; an admin
+ * token still deletes another).
  *
  * Like the cell suites, these verbs can't ride the generic
  * `describe_rpc_round_trip_tests`: they're stateful and destructive (a
@@ -16,7 +18,8 @@ import '../assert_dev_env.js';
  */
 import { describe, assert } from 'vitest';
 import { AccountDeleteOutput, AccountUndeleteOutput, AccountPurgeOutput, AdminAccountListOutput, AuditLogListOutput, ERROR_CANNOT_DELETE_KEEPER } from '../../auth/admin_action_specs.js';
-import { ERROR_ACCOUNT_NOT_FOUND, ERROR_AUTHENTICATION_REQUIRED } from '../../http/error_schemas.js';
+import { ERROR_ACCOUNT_NOT_FOUND, ERROR_AUTHENTICATION_REQUIRED, ERROR_CREDENTIAL_TYPE_REQUIRED } from '../../http/error_schemas.js';
+import { JSONRPC_ERROR_CODES } from '../../http/jsonrpc_errors.js';
 import { test_if } from './capabilities.js';
 import { cross_rpc_call, error_reason, expect_output } from './cell_cross_helpers.js';
 import { assert_iso8601_seconds } from './wire_shapes.js';
@@ -55,6 +58,38 @@ export const describe_account_lifecycle_cross_tests = (options) => {
             assert.strictEqual(purge.ok, false, 'purge of keeper account must be refused');
             assert.strictEqual(error_reason(purge), ERROR_CANNOT_DELETE_KEEPER);
         });
+        test_if(capabilities.account_lifecycle, 'self-delete is session-only; an admin bearer still deletes another account', async () => {
+            const fixture = await setup_test();
+            const member = await fixture.create_account({ username: 'lifecycle_self_bearer' });
+            // The member's own bearer may not end its account (handler-enforced,
+            // the dispatcher's credential-type refusal).
+            const refused = await cross_rpc_call(fixture.fresh_transport({ origin: null }), rpc_path, 'account_delete', {}, member.create_bearer_headers());
+            assert.strictEqual(refused.ok, false, 'a bearer self-delete must be refused');
+            assert.strictEqual(refused.error?.code, JSONRPC_ERROR_CODES.forbidden);
+            assert.strictEqual(error_reason(refused), ERROR_CREDENTIAL_TYPE_REQUIRED);
+            assert.deepStrictEqual(refused.error?.data
+                ?.required_credential_types, ['session']);
+            // An explicit own id is self in either case (`Uuid` admits both) — the
+            // keeper's too, whose refusal is the credential one, not the keeper guard.
+            for (const [label, account_id, headers] of [
+                ['member', member.account.id, member.create_bearer_headers()],
+                ['keeper', fixture.account.id, fixture.create_bearer_headers()]
+            ]) {
+                const upper = await cross_rpc_call(fixture.fresh_transport({ origin: null }), rpc_path, 'account_delete', { account_id: account_id.toUpperCase() }, headers);
+                assert.strictEqual(upper.ok, false, `${label}: an uppercased own id is self`);
+                assert.deepStrictEqual(upper.error, refused.error, label);
+            }
+            // Nothing was tombstoned: the member's session still verifies.
+            const still = await cross_rpc_call(fixture.fresh_transport(), rpc_path, 'account_verify', undefined, member.create_session_headers());
+            assert.ok(still.ok, 'the refused self-delete leaves the account live');
+            // The keeper's bearer (admin-capable) deletes another account.
+            const deleted = expect_output(await cross_rpc_call(fixture.fresh_transport({ origin: null }), rpc_path, 'account_delete', { account_id: member.account.id }, fixture.create_bearer_headers()), AccountDeleteOutput);
+            assert.strictEqual(deleted.deleted, true);
+            // A self-delete over a session goes through.
+            const self = await fixture.create_account({ username: 'lifecycle_self_session' });
+            const self_deleted = expect_output(await cross_rpc_call(fixture.fresh_transport(), rpc_path, 'account_delete', {}, self.create_session_headers()), AccountDeleteOutput);
+            assert.strictEqual(self_deleted.deleted, true);
+        });
         test_if(capabilities.account_lifecycle, 'fail-closed: a soft-deleted account’s session + bearer credentials no longer authenticate', async () => {
             const fixture = await setup_test();
             const victim = await fixture.create_account({ username: 'lifecycle_failclosed' });

package/dist/testing/cross_backend/cell_gated_create.d.ts

@@ -19,6 +19,44 @@ export declare const describe_cell_gated_create_cross_tests: (options: RpcPathCa
  *   contribution gets `cell_not_found`, never learns it exists.
  * - **reject** → `moderation: 'rejected'`, visibility stays private.
  *
+ * And that moderation gates reads — a cell's effective audience is its
+ * visibility or grants **and** its moderation admission (unmoderated or
+ * `approved`), so a pending or rejected contribution reaches no one past its
+ * author and admins:
+ *
+ * - **an author's self-flip to public admits nobody** — a pending post its
+ *   author makes public stays 404 to anon and a fresh non-admin on `cell_get`,
+ *   and out of their `cell_list`; the author and admin still read it.
+ * - **rejection holds a public post back** — pending → rejected → public, and
+ *   approved → rejected (approval made it public, rejection leaves visibility
+ *   alone), both 404 past the author; a grant made while the post was approved
+ *   stops admitting once it is rejected, on `cell_get` and `shared_with: 'me'`.
+ * - **an approved post is live** — the control.
+ * - **relation reads follow** — a pending post in a public collection is
+ *   omitted from anon `cell_item_list`, beside a live sibling that isn't; at
+ *   the far end of all four relation lists, a pending post is hidden from
+ *   anon even flipped public, and a rejected one from its grant holder.
+ * - **fact serving follows** — a pending post's fact is 404 to anon, even
+ *   with the post flipped public (also gated on `capabilities.fact_serving`).
+ *
+ * And the steward arm — the owner of a **non-admin** root (a parentless
+ * non-`space` kind carrying the same policy, which the test authorizer leaves
+ * open) reads the pending posts under it and moderates them:
+ *
+ * - **the queue** — `cell_list({root_id, moderation: 'pending'})` and
+ *   `cell_get` (with `can_edit` / `can_grant` false) → 200; a stranger 404s.
+ * - **moderation** — the root owner approves → 200; the author 403, a
+ *   stranger 404.
+ * - **the arm stops there** — the root owner's `cell_clone` of the pending
+ *   post and a contribution under it are both 404.
+ * - **fact serving** — the root owner fetches a pending post's fact → 200,
+ *   anon 404 (also gated on `capabilities.fact_serving`).
+ *
+ * And that `cell_grant_create` refuses a pending contribution — **403**
+ * `cell_grant_unapproved` for its author and an admin, actor- and role-shaped,
+ * while a non-manager keeps the **404** mask; the same grant lands once the
+ * post is approved.
+ *
  * Gated on `capabilities.cell_gated_create` — a `pending` contribution only
  * exists when the directory authorizer is mounted (reference spine binaries).
  */

package/dist/testing/cross_backend/cell_gated_create.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cell_gated_create.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/cell_gated_create.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAuD9B,OAAO,KAAK,EAAE,uCAAuC,EAAE,MAAM,YAAY,CAAC;AAkB1E,eAAO,MAAM,sCAAsC,GAClD,SAAS,uCAAuC,KAC9C,IAwPF,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,eAAO,MAAM,kCAAkC,GAC9C,SAAS,uCAAuC,KAC9C,IAyKF,CAAC"}
+{"version":3,"file":"cell_gated_create.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/cell_gated_create.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAoE9B,OAAO,KAAK,EAAE,uCAAuC,EAAE,MAAM,YAAY,CAAC;AAqB1E,eAAO,MAAM,sCAAsC,GAClD,SAAS,uCAAuC,KAC9C,IAuTF,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0DG;AACH,eAAO,MAAM,kCAAkC,GAC9C,SAAS,uCAAuC,KAC9C,IA25BF,CAAC"}

package/dist/testing/cross_backend/cell_gated_create.js

@@ -30,6 +30,10 @@ import '../assert_dev_env.js';
  *   **private** space the caller can't view → **404** `cell_not_found` (the
  *   parent is masked); under a **public** space → **403** (you see it, you
  *   can't contribute).
+ * - **a soft-deleted root refuses contributions** — soft delete doesn't
+ *   cascade, so a live post can sit under a deleted space; a comment under it
+ *   → **404** `cell_not_found`, the same shape as a missing parent (the
+ *   authorizer never sees a root id without its data).
  * - **clone is no side door** — `cell_clone` runs the authorizer for every cell
  *   it writes as a parentless create, so a non-admin clone of a viewable
  *   `space` root → **403** `cell_create_forbidden`; admin → succeeds.
@@ -42,7 +46,13 @@ import '../assert_dev_env.js';
  * @module
  */
 import { describe, assert } from 'vitest';
-import { CellCloneOutput, CellCreateOutput, CellModerateOutput } from '../../auth/cell_action_specs.js';
+import { fractional_index_between } from '@fuzdev/fuz_util/fractional_index.ts';
+import { CellCloneOutput, CellCreateOutput, CellGetOutput, CellListOutput, CellModerateOutput, CellUpdateOutput } from '../../auth/cell_action_specs.js';
+import { CellItemInsertOutput, CellItemListOutput } from '../../auth/cell_item_action_specs.js';
+import { CellGrantCreateOutput } from '../../auth/cell_grant_action_specs.js';
+import { CellFieldListOutput, CellFieldSetOutput } from '../../auth/cell_field_action_specs.js';
+import { z } from 'zod';
+import { FactHashSchema } from '../../primitive_schemas.js';
 import { JSONRPC_ERROR_CODES } from '../../http/jsonrpc_errors.js';
 import { test_if } from './capabilities.js';
 import { cross_rpc_call, error_reason, expect_output } from './cell_cross_helpers.js';
@@ -61,6 +71,8 @@ const SPACE_POLICY = {
         comment: { min_role: PARTICIPATION_ROLE, moderation_required: false }
     }
 };
+/** `_testing_put_fact`'s output envelope. */
+const TestingPutFactOutput = z.strictObject({ hash: FactHashSchema });
 export const describe_cell_gated_create_cross_tests = (options) => {
     const { setup_test, capabilities } = options;
     const rpc_path = options.rpc_path ?? SPINE_RPC_PATH;
@@ -144,6 +156,27 @@ export const describe_cell_gated_create_cross_tests = (options) => {
             assert.strictEqual(comment.cell.root_id, space.cell.id, 'the governing root resolves to the space (deep read through the post), not the post');
             assert.strictEqual(comment.cell.moderation, 'approved', 'the comment policy (moderation_required: false) resolved from the space, not the post');
         });
+        test_if(capabilities.cell_gated_create, 'a contribution under a soft-deleted root is 404 cell_not_found (the missing-parent shape)', async () => {
+            const fixture = await setup_test();
+            const admin_headers = fixture.create_session_headers();
+            const space = expect_output(await cross_rpc_call(fixture.transport, rpc_path, 'cell_create', { kind: SPACE_CELL_KIND, data: SPACE_POLICY, visibility: 'public' }, admin_headers), CellCreateOutput);
+            const participant = await fixture.create_account({
+                username: 'tombstone_participant',
+                roles: [PARTICIPATION_ROLE]
+            });
+            const participant_headers = participant.create_session_headers();
+            const post = expect_output(await cross_rpc_call(fixture.transport, rpc_path, 'cell_create', { kind: 'post', data: {}, parent_id: space.cell.id }, participant_headers), CellCreateOutput);
+            // Soft delete doesn't cascade: the post stays live (and viewable by
+            // its author) under the tombstoned space.
+            const deleted = await cross_rpc_call(fixture.transport, rpc_path, 'cell_delete', { cell_id: space.cell.id }, admin_headers);
+            assert.ok(deleted.ok, `cell_delete failed: ${JSON.stringify(deleted.error)}`);
+            const refused = await cross_rpc_call(fixture.transport, rpc_path, 'cell_create', { kind: 'comment', data: {}, parent_id: post.cell.id }, participant_headers);
+            assert.ok(!refused.ok, 'a contribution under a deleted root must be refused');
+            assert.strictEqual(error_reason(refused), 'cell_not_found');
+            // Byte-identical to the missing-parent refusal.
+            const missing_parent = await cross_rpc_call(fixture.transport, rpc_path, 'cell_create', { kind: 'comment', data: {}, parent_id: '00000000-0000-4000-8000-000000000000' }, participant_headers);
+            assert.deepStrictEqual(refused.error, missing_parent.error);
+        });
     });
 };
 /**
@@ -164,6 +197,44 @@ export const describe_cell_gated_create_cross_tests = (options) => {
  *   contribution gets `cell_not_found`, never learns it exists.
  * - **reject** → `moderation: 'rejected'`, visibility stays private.
  *
+ * And that moderation gates reads — a cell's effective audience is its
+ * visibility or grants **and** its moderation admission (unmoderated or
+ * `approved`), so a pending or rejected contribution reaches no one past its
+ * author and admins:
+ *
+ * - **an author's self-flip to public admits nobody** — a pending post its
+ *   author makes public stays 404 to anon and a fresh non-admin on `cell_get`,
+ *   and out of their `cell_list`; the author and admin still read it.
+ * - **rejection holds a public post back** — pending → rejected → public, and
+ *   approved → rejected (approval made it public, rejection leaves visibility
+ *   alone), both 404 past the author; a grant made while the post was approved
+ *   stops admitting once it is rejected, on `cell_get` and `shared_with: 'me'`.
+ * - **an approved post is live** — the control.
+ * - **relation reads follow** — a pending post in a public collection is
+ *   omitted from anon `cell_item_list`, beside a live sibling that isn't; at
+ *   the far end of all four relation lists, a pending post is hidden from
+ *   anon even flipped public, and a rejected one from its grant holder.
+ * - **fact serving follows** — a pending post's fact is 404 to anon, even
+ *   with the post flipped public (also gated on `capabilities.fact_serving`).
+ *
+ * And the steward arm — the owner of a **non-admin** root (a parentless
+ * non-`space` kind carrying the same policy, which the test authorizer leaves
+ * open) reads the pending posts under it and moderates them:
+ *
+ * - **the queue** — `cell_list({root_id, moderation: 'pending'})` and
+ *   `cell_get` (with `can_edit` / `can_grant` false) → 200; a stranger 404s.
+ * - **moderation** — the root owner approves → 200; the author 403, a
+ *   stranger 404.
+ * - **the arm stops there** — the root owner's `cell_clone` of the pending
+ *   post and a contribution under it are both 404.
+ * - **fact serving** — the root owner fetches a pending post's fact → 200,
+ *   anon 404 (also gated on `capabilities.fact_serving`).
+ *
+ * And that `cell_grant_create` refuses a pending contribution — **403**
+ * `cell_grant_unapproved` for its author and an admin, actor- and role-shaped,
+ * while a non-manager keeps the **404** mask; the same grant lands once the
+ * post is approved.
+ *
  * Gated on `capabilities.cell_gated_create` — a `pending` contribution only
  * exists when the directory authorizer is mounted (reference spine binaries).
  */
@@ -172,16 +243,58 @@ export const describe_cell_moderate_cross_tests = (options) => {
     const rpc_path = options.rpc_path ?? SPINE_RPC_PATH;
     // Build an admin-owned public space (moderated `post` policy) + a
     // participant's pending post under it.
-    const setup_pending_post = async () => {
-        const fixture = await setup_test();
+    const setup_pending_post_on = async (fixture, post_data = {}) => {
         const space = expect_output(await cross_rpc_call(fixture.transport, rpc_path, 'cell_create', { kind: SPACE_CELL_KIND, data: SPACE_POLICY, visibility: 'public' }, fixture.create_session_headers()), CellCreateOutput);
         const author = await fixture.create_account({
             username: 'moderate_author',
             roles: [PARTICIPATION_ROLE]
         });
-        const post = expect_output(await cross_rpc_call(fixture.transport, rpc_path, 'cell_create', { kind: 'post', data: {}, parent_id: space.cell.id }, author.create_session_headers()), CellCreateOutput);
-        return { fixture, author, post };
+        const post = expect_output(await cross_rpc_call(fixture.transport, rpc_path, 'cell_create', { kind: 'post', data: post_data, parent_id: space.cell.id }, author.create_session_headers()), CellCreateOutput);
+        return { fixture, space, author, post };
+    };
+    const setup_pending_post = async () => setup_pending_post_on(await setup_test());
+    // A non-admin's policy root (a parentless non-`space` kind stays open under
+    // the test authorizer, and contributions read the policy off any root) + a
+    // participant's pending post under it.
+    const setup_stewarded_post_on = async (fixture, post_data = {}) => {
+        const root_owner = await fixture.create_account({ username: 'steward_root_owner' });
+        const root = expect_output(await cross_rpc_call(fixture.transport, rpc_path, 'cell_create', { kind: 'forum', data: SPACE_POLICY, visibility: 'public' }, root_owner.create_session_headers()), CellCreateOutput);
+        const author = await fixture.create_account({
+            username: 'steward_author',
+            roles: [PARTICIPATION_ROLE]
+        });
+        const post = expect_output(await cross_rpc_call(fixture.transport, rpc_path, 'cell_create', { kind: 'post', data: post_data, parent_id: root.cell.id }, author.create_session_headers()), CellCreateOutput);
+        assert.strictEqual(post.cell.moderation, 'pending', "the root's policy gates the post");
+        return { fixture, root, root_owner, author, post };
+    };
+    const setup_stewarded_post = async () => setup_stewarded_post_on(await setup_test());
+    /** Seed an embedded fact over the daemon channel; returns its `blake3:` hash. */
+    const put_fact = async (fixture, content) => expect_output(await cross_rpc_call(
+    // origin-free — the daemon-token middleware discards the credential beside an `Origin`
+    fixture.fresh_transport({ origin: null }), rpc_path, '_testing_put_fact', { content }, fixture.create_daemon_token_headers()), TestingPutFactOutput).hash;
+    /** The status of a fact GET — `null` headers = anon. */
+    const fact_status = async (fixture, path, headers) => {
+        const transport = headers === null ? fixture.fresh_transport({ origin: null }) : fixture.transport;
+        const res = await transport(path, { method: 'GET', headers: headers ?? {} });
+        await res.text();
+        return res.status;
+    };
+    /** `'ok'`, or the refusal reason, for one caller's RPC — `null` headers = anon. */
+    const outcome = async (fixture, method, params, headers) => {
+        const r = headers === null
+            ? await cross_rpc_call(fixture.fresh_transport({ origin: null }), rpc_path, method, params, {})
+            : await cross_rpc_call(fixture.transport, rpc_path, method, params, headers);
+        return r.ok ? 'ok' : error_reason(r);
     };
+    /** The ids a caller's `cell_list` returns — `null` headers = anon. */
+    const listed_ids = async (fixture, params, headers) => {
+        const r = headers === null
+            ? await cross_rpc_call(fixture.fresh_transport({ origin: null }), rpc_path, 'cell_list', params, {})
+            : await cross_rpc_call(fixture.transport, rpc_path, 'cell_list', params, headers);
+        return expect_output(r, CellListOutput).cells.map((c) => c.id);
+    };
+    const moderate = async (fixture, cell_id, moderation, headers = fixture.create_session_headers()) => expect_output(await cross_rpc_call(fixture.transport, rpc_path, 'cell_moderate', { cell_id, moderation }, headers), CellModerateOutput).cell;
+    const set_visibility = async (fixture, headers, cell_id, visibility) => expect_output(await cross_rpc_call(fixture.transport, rpc_path, 'cell_update', { cell_id, visibility }, headers), CellUpdateOutput).cell;
     describe('cell_moderate verb parity (root-authority-gated)', () => {
         test_if(capabilities.cell_gated_create, 'a root manager (admin) approves a pending post → approved + public', async () => {
             const { fixture, post } = await setup_pending_post();
@@ -211,6 +324,289 @@ export const describe_cell_moderate_cross_tests = (options) => {
             assert.strictEqual(moderated.cell.visibility, 'private', 'rejection leaves the post private');
         });
     });
+    describe('moderation gates reads (parity)', () => {
+        test_if(capabilities.cell_gated_create, 'a pending post its author flips public stays hidden past the author and admins', async () => {
+            const { fixture, space, author, post } = await setup_pending_post();
+            const author_h = author.create_session_headers();
+            const flipped = await set_visibility(fixture, author_h, post.cell.id, 'public');
+            assert.strictEqual(flipped.visibility, 'public', 'the author manages their own post');
+            assert.strictEqual(flipped.moderation, 'pending', 'a visibility write leaves moderation');
+            const stranger = await fixture.create_account({ username: 'flip_stranger' });
+            const stranger_h = stranger.create_session_headers();
+            const get = { id: post.cell.id };
+            assert.strictEqual(await outcome(fixture, 'cell_get', get, null), 'cell_not_found');
+            assert.strictEqual(await outcome(fixture, 'cell_get', get, stranger_h), 'cell_not_found');
+            assert.strictEqual(await outcome(fixture, 'cell_get', get, author_h), 'ok');
+            assert.strictEqual(await outcome(fixture, 'cell_get', get, fixture.create_session_headers()), 'ok');
+            const feed = { root_id: space.cell.id };
+            assert.notInclude(await listed_ids(fixture, feed, null), post.cell.id, 'anon list');
+            assert.notInclude(await listed_ids(fixture, feed, stranger_h), post.cell.id, 'stranger');
+            assert.include(await listed_ids(fixture, feed, author_h), post.cell.id, 'author list');
+            assert.include(await listed_ids(fixture, feed, fixture.create_session_headers()), post.cell.id, 'admin list');
+        });
+        test_if(capabilities.cell_gated_create, 'pending → rejected → public stays hidden past the author', async () => {
+            const { fixture, author, post } = await setup_pending_post();
+            const author_h = author.create_session_headers();
+            assert.strictEqual((await moderate(fixture, post.cell.id, 'rejected')).moderation, 'rejected');
+            await set_visibility(fixture, author_h, post.cell.id, 'public');
+            const stranger = await fixture.create_account({ username: 'rejected_stranger' });
+            const get = { id: post.cell.id };
+            assert.strictEqual(await outcome(fixture, 'cell_get', get, null), 'cell_not_found');
+            assert.strictEqual(await outcome(fixture, 'cell_get', get, stranger.create_session_headers()), 'cell_not_found');
+            assert.strictEqual(await outcome(fixture, 'cell_get', get, author_h), 'ok');
+        });
+        test_if(capabilities.cell_gated_create, 'approved → rejected stays hidden, and a grant made while approved stops admitting', async () => {
+            const { fixture, author, post } = await setup_pending_post();
+            const author_h = author.create_session_headers();
+            const friend = await fixture.create_account({ username: 'approved_friend' });
+            const friend_h = friend.create_session_headers();
+            const stranger = await fixture.create_account({ username: 'approved_stranger' });
+            const get = { id: post.cell.id };
+            const shared = { shared_with: 'me' };
+            // The control: approval publishes the post to everyone.
+            assert.strictEqual((await moderate(fixture, post.cell.id, 'approved')).visibility, 'public');
+            assert.strictEqual(await outcome(fixture, 'cell_get', get, null), 'ok', 'approved is live');
+            assert.strictEqual(await outcome(fixture, 'cell_get', get, stranger.create_session_headers()), 'ok');
+            // A grant made while approved admits on its own once the post is private.
+            expect_output(await cross_rpc_call(fixture.transport, rpc_path, 'cell_grant_create', {
+                cell_id: post.cell.id,
+                level: 'viewer',
+                principal: { kind: 'actor', actor_id: friend.actor.id }
+            }, author_h), CellGrantCreateOutput);
+            await set_visibility(fixture, author_h, post.cell.id, 'private');
+            assert.strictEqual(await outcome(fixture, 'cell_get', get, friend_h), 'ok', 'grant admits');
+            assert.include(await listed_ids(fixture, shared, friend_h), post.cell.id);
+            // Rejection holds it back from the grant holder ...
+            assert.strictEqual((await moderate(fixture, post.cell.id, 'rejected')).moderation, 'rejected');
+            assert.strictEqual(await outcome(fixture, 'cell_get', get, friend_h), 'cell_not_found');
+            assert.notInclude(await listed_ids(fixture, shared, friend_h), post.cell.id);
+            // ... and from everyone once public again; the author still reads it.
+            await set_visibility(fixture, author_h, post.cell.id, 'public');
+            assert.strictEqual(await outcome(fixture, 'cell_get', get, null), 'cell_not_found');
+            assert.strictEqual(await outcome(fixture, 'cell_get', get, stranger.create_session_headers()), 'cell_not_found');
+            assert.strictEqual(await outcome(fixture, 'cell_get', get, friend_h), 'cell_not_found');
+            assert.strictEqual(await outcome(fixture, 'cell_get', get, author_h), 'ok');
+        });
+        test_if(capabilities.cell_gated_create, 'approval leaves visibility to rejection: an approved-then-rejected post is still public, and hidden', async () => {
+            const { fixture, post } = await setup_pending_post();
+            await moderate(fixture, post.cell.id, 'approved');
+            const rejected = await moderate(fixture, post.cell.id, 'rejected');
+            assert.strictEqual(rejected.visibility, 'public', 'rejection does not reset visibility');
+            assert.strictEqual(await outcome(fixture, 'cell_get', { id: post.cell.id }, null), 'cell_not_found');
+        });
+        test_if(capabilities.cell_gated_create, 'an editor grant made while approved admits no write once rejected; the author keeps the owner arm', async () => {
+            const { fixture, author, post } = await setup_pending_post();
+            const author_h = author.create_session_headers();
+            const editor = await fixture.create_account({ username: 'rejected_editor' });
+            const editor_h = editor.create_session_headers();
+            const other = expect_output(await cross_rpc_call(fixture.transport, rpc_path, 'cell_create', { kind: 'note', data: {}, visibility: 'public' }, editor_h), CellCreateOutput);
+            await moderate(fixture, post.cell.id, 'approved');
+            expect_output(await cross_rpc_call(fixture.transport, rpc_path, 'cell_grant_create', {
+                cell_id: post.cell.id,
+                level: 'editor',
+                principal: { kind: 'actor', actor_id: editor.actor.id }
+            }, author_h), CellGrantCreateOutput);
+            const update = { cell_id: post.cell.id };
+            assert.strictEqual(await outcome(fixture, 'cell_update', update, editor_h), 'ok', 'the grant admits a write while approved');
+            await moderate(fixture, post.cell.id, 'rejected');
+            const writes = [
+                ['cell_get', { id: post.cell.id }],
+                ['cell_update', update],
+                ['cell_field_set', { source_id: post.cell.id, name: 'link', target_id: other.cell.id }],
+                [
+                    'cell_item_insert',
+                    { parent_id: post.cell.id, child_id: other.cell.id, position: 'a0' }
+                ],
+                ['cell_delete', { cell_id: post.cell.id }]
+            ];
+            for (const [method, params] of writes) {
+                assert.strictEqual(await outcome(fixture, method, params, editor_h), 'cell_not_found', method);
+            }
+            assert.strictEqual(await outcome(fixture, 'cell_update', update, author_h), 'ok', 'author');
+        });
+        test_if(capabilities.cell_gated_create, 'a pending post in a public collection is omitted from anon cell_item_list', async () => {
+            const { fixture, space, author, post } = await setup_pending_post();
+            const author_h = author.create_session_headers();
+            // A live sibling under the same space: a `react` is born approved + public.
+            const react = expect_output(await cross_rpc_call(fixture.transport, rpc_path, 'cell_create', { kind: 'react', data: {}, parent_id: space.cell.id, visibility: 'public' }, author_h), CellCreateOutput);
+            await set_visibility(fixture, author_h, post.cell.id, 'public');
+            const collection = expect_output(await cross_rpc_call(fixture.transport, rpc_path, 'cell_create', { kind: 'collection', data: {}, visibility: 'public' }, author_h), CellCreateOutput);
+            const pos_a = fractional_index_between(null, null);
+            const pos_b = fractional_index_between(pos_a, null);
+            for (const [child_id, position] of [
+                [post.cell.id, pos_a],
+                [react.cell.id, pos_b]
+            ]) {
+                expect_output(await cross_rpc_call(fixture.transport, rpc_path, 'cell_item_insert', { parent_id: collection.cell.id, child_id, position }, author_h), CellItemInsertOutput);
+            }
+            const items = async (headers) => {
+                const params = { parent_id: collection.cell.id };
+                const r = headers === null
+                    ? await cross_rpc_call(fixture.fresh_transport({ origin: null }), rpc_path, 'cell_item_list', params, {})
+                    : await cross_rpc_call(fixture.transport, rpc_path, 'cell_item_list', params, headers);
+                return expect_output(r, CellItemListOutput).items.map((i) => i.child_id);
+            };
+            assert.deepStrictEqual(await items(null), [react.cell.id], 'anon sees the live sibling only');
+            assert.deepStrictEqual(await items(author_h), [post.cell.id, react.cell.id]);
+        });
+        test_if(capabilities.cell_gated_create, 'every relation list hides a pending end, and a rejected one from its grant holder', async () => {
+            const { fixture, author, post } = await setup_pending_post();
+            const author_h = author.create_session_headers();
+            const holder = await fixture.create_account({ username: 'relation_grant_holder' });
+            const holder_h = holder.create_session_headers();
+            const create = async (kind) => expect_output(await cross_rpc_call(fixture.transport, rpc_path, 'cell_create', { kind, data: {}, visibility: 'public' }, author_h), CellCreateOutput).cell.id;
+            const call = async (method, params) => cross_rpc_call(fixture.transport, rpc_path, method, params, author_h);
+            // The post at the far end of all four lists: a public source and
+            // collection point at it, and it points at a public target and child.
+            const source = await create('note');
+            const collection = await create('collection');
+            const target = await create('note');
+            const child = await create('note');
+            const post_id = post.cell.id;
+            expect_output(await call('cell_field_set', { source_id: source, name: 'post', target_id: post_id }), CellFieldSetOutput);
+            expect_output(await call('cell_item_insert', {
+                parent_id: collection,
+                child_id: post_id,
+                position: 'a0'
+            }), CellItemInsertOutput);
+            expect_output(await call('cell_field_set', { source_id: post_id, name: 'link', target_id: target }), CellFieldSetOutput);
+            expect_output(await call('cell_item_insert', { parent_id: post_id, child_id: child, position: 'a0' }), CellItemInsertOutput);
+            // Which lists show the post to a caller — `null` headers = anon.
+            const reach = async (headers) => {
+                const list = async (method, params) => headers === null
+                    ? cross_rpc_call(fixture.fresh_transport({ origin: null }), rpc_path, method, params, {})
+                    : cross_rpc_call(fixture.transport, rpc_path, method, params, headers);
+                const forward_fields = expect_output(await list('cell_field_list', { source_id: source }), CellFieldListOutput).fields.map((f) => f.target_id);
+                const forward_items = expect_output(await list('cell_item_list', { parent_id: collection }), CellItemListOutput).items.map((i) => i.child_id);
+                const reverse_fields = expect_output(await list('cell_field_list', { target_id: target }), CellFieldListOutput).fields.map((f) => f.source_id);
+                const reverse_items = expect_output(await list('cell_item_list', { child_id: child }), CellItemListOutput).items.map((i) => i.parent_id);
+                return [forward_fields, forward_items, reverse_fields, reverse_items].map((ids) => ids.includes(post_id));
+            };
+            const everywhere = [true, true, true, true];
+            const nowhere = [false, false, false, false];
+            // pending, flipped public: the audience sees nothing, the author all
+            await set_visibility(fixture, author_h, post_id, 'public');
+            assert.deepStrictEqual(await reach(null), nowhere, 'anon, pending + public');
+            assert.deepStrictEqual(await reach(author_h), everywhere, 'author, pending + public');
+            // approved and granted, then private: the grant admits it
+            await moderate(fixture, post_id, 'approved');
+            expect_output(await cross_rpc_call(fixture.transport, rpc_path, 'cell_grant_create', {
+                cell_id: post_id,
+                level: 'viewer',
+                principal: { kind: 'actor', actor_id: holder.actor.id }
+            }, author_h), CellGrantCreateOutput);
+            await set_visibility(fixture, author_h, post_id, 'private');
+            assert.deepStrictEqual(await reach(holder_h), everywhere, 'grant holder, approved');
+            assert.deepStrictEqual(await reach(null), nowhere, 'anon, approved + private');
+            // rejected: the grant admits nothing, public or not
+            await moderate(fixture, post_id, 'rejected');
+            assert.deepStrictEqual(await reach(holder_h), nowhere, 'grant holder, rejected');
+            await set_visibility(fixture, author_h, post_id, 'public');
+            assert.deepStrictEqual(await reach(holder_h), nowhere, 'grant holder, rejected + public');
+            assert.deepStrictEqual(await reach(null), nowhere, 'anon, rejected + public');
+            assert.deepStrictEqual(await reach(author_h), everywhere, 'author, rejected');
+        });
+        test_if(capabilities.cell_gated_create && capabilities.fact_serving, "a pending post's fact is 404 to anon, even flipped public; live once approved", async () => {
+            const fixture = await setup_test();
+            const hash = await put_fact(fixture, 'pending-post-fact');
+            const { author, post } = await setup_pending_post_on(fixture, { cover: hash });
+            await set_visibility(fixture, author.create_session_headers(), post.cell.id, 'public');
+            const path = `/api/cells/${post.cell.id}/facts/${hash}`;
+            assert.strictEqual(await fact_status(fixture, path, null), 404, 'anon');
+            assert.strictEqual(await fact_status(fixture, path, author.create_session_headers()), 200, 'author');
+            await moderate(fixture, post.cell.id, 'approved');
+            assert.strictEqual(await fact_status(fixture, path, null), 200, 'approved is live');
+        });
+    });
+    describe('the steward arm: a root owner moderates (parity)', () => {
+        test_if(capabilities.cell_gated_create, 'a non-admin root owner reads the pending queue and the post, and moderates it', async () => {
+            const { fixture, root, root_owner, author, post } = await setup_stewarded_post();
+            const steward_h = root_owner.create_session_headers();
+            const stranger = await fixture.create_account({ username: 'steward_stranger' });
+            const stranger_h = stranger.create_session_headers();
+            const queue = { root_id: root.cell.id, moderation: 'pending' };
+            assert.deepStrictEqual(await listed_ids(fixture, queue, steward_h), [post.cell.id]);
+            assert.deepStrictEqual(await listed_ids(fixture, queue, stranger_h), []);
+            const got = expect_output(await cross_rpc_call(fixture.transport, rpc_path, 'cell_get', { id: post.cell.id }, steward_h), CellGetOutput);
+            assert.strictEqual(got.cell.id, post.cell.id);
+            assert.isFalse(got.can_edit, 'a steward does not edit');
+            assert.isFalse(got.can_grant, 'a steward does not manage');
+            assert.strictEqual(await outcome(fixture, 'cell_get', { id: post.cell.id }, stranger_h), 'cell_not_found');
+            // a self-flip to public still reaches no one past author, steward, and admin
+            await set_visibility(fixture, author.create_session_headers(), post.cell.id, 'public');
+            assert.strictEqual(await outcome(fixture, 'cell_get', { id: post.cell.id }, null), 'cell_not_found');
+            assert.strictEqual(await outcome(fixture, 'cell_get', { id: post.cell.id }, steward_h), 'ok');
+            const by_author = await cross_rpc_call(fixture.transport, rpc_path, 'cell_moderate', { cell_id: post.cell.id, moderation: 'approved' }, author.create_session_headers());
+            assert.strictEqual(error_reason(by_author), 'cell_moderate_forbidden');
+            assert.strictEqual(await outcome(fixture, 'cell_moderate', { cell_id: post.cell.id, moderation: 'approved' }, stranger_h), 'cell_not_found');
+            const approved = await moderate(fixture, post.cell.id, 'approved', steward_h);
+            assert.strictEqual(approved.moderation, 'approved', 'the root owner moderates');
+            assert.strictEqual(approved.visibility, 'public');
+        });
+        test_if(capabilities.cell_gated_create, 'the steward arm stops at the moderator surfaces: clone and create-under are 404', async () => {
+            const { fixture, root_owner, post } = await setup_stewarded_post();
+            const steward_h = root_owner.create_session_headers();
+            assert.strictEqual(await outcome(fixture, 'cell_clone', { source_id: post.cell.id }, steward_h), 'cell_not_found');
+            assert.strictEqual(await outcome(fixture, 'cell_create', { kind: 'comment', data: {}, parent_id: post.cell.id }, steward_h), 'cell_not_found');
+        });
+        test_if(capabilities.cell_gated_create, 'the steward arm keys on the governing root, not the parent: a rejected comment under an approved post', async () => {
+            const { fixture, root_owner, author, post } = await setup_stewarded_post();
+            const steward_h = root_owner.create_session_headers();
+            await moderate(fixture, post.cell.id, 'approved', steward_h);
+            const commenter = await fixture.create_account({
+                username: 'steward_commenter',
+                roles: [PARTICIPATION_ROLE]
+            });
+            const commenter_h = commenter.create_session_headers();
+            const comment = expect_output(await cross_rpc_call(fixture.transport, rpc_path, 'cell_create', { kind: 'comment', data: {}, parent_id: post.cell.id, visibility: 'public' }, commenter_h), CellCreateOutput);
+            assert.strictEqual(comment.cell.root_id, post.cell.root_id, 'governed by the root');
+            const rejected = await moderate(fixture, comment.cell.id, 'rejected', steward_h);
+            assert.strictEqual(rejected.moderation, 'rejected');
+            const get = { id: comment.cell.id };
+            assert.strictEqual(await outcome(fixture, 'cell_get', get, steward_h), 'ok', 'root owner');
+            assert.strictEqual(await outcome(fixture, 'cell_get', get, author.create_session_headers()), 'cell_not_found', "the parent's author is not the steward");
+            assert.strictEqual(await outcome(fixture, 'cell_get', get, commenter_h), 'ok', 'author');
+            assert.strictEqual(await outcome(fixture, 'cell_get', get, null), 'cell_not_found', 'anon');
+        });
+        test_if(capabilities.cell_gated_create && capabilities.fact_serving, "the root owner fetches a pending post's fact; anon 404", async () => {
+            const fixture = await setup_test();
+            const hash = await put_fact(fixture, 'stewarded-post-fact');
+            const { root_owner, post } = await setup_stewarded_post_on(fixture, { cover: hash });
+            const path = `/api/cells/${post.cell.id}/facts/${hash}`;
+            assert.strictEqual(await fact_status(fixture, path, null), 404, 'anon');
+            assert.strictEqual(await fact_status(fixture, path, root_owner.create_session_headers()), 200, 'steward');
+        });
+    });
+    describe('cell_grant_create refuses an unapproved contribution (parity)', () => {
+        test_if(capabilities.cell_gated_create, 'a grant on a pending post → 403 cell_grant_unapproved; non-manager 404; lands after approval', async () => {
+            const { fixture, author, post } = await setup_pending_post();
+            const friend = await fixture.create_account({ username: 'unapproved_friend' });
+            const stranger = await fixture.create_account({ username: 'unapproved_stranger' });
+            const actor_shaped = {
+                cell_id: post.cell.id,
+                level: 'viewer',
+                principal: { kind: 'actor', actor_id: friend.actor.id }
+            };
+            const role_shaped = {
+                cell_id: post.cell.id,
+                level: 'viewer',
+                principal: { kind: 'role', role: PARTICIPATION_ROLE }
+            };
+            for (const headers of [author.create_session_headers(), fixture.create_session_headers()]) {
+                for (const params of [actor_shaped, role_shaped]) {
+                    const refused = await cross_rpc_call(fixture.transport, rpc_path, 'cell_grant_create', params, headers);
+                    assert.ok(!refused.ok, 'a grant on a pending post must be refused');
+                    assert.strictEqual(refused.error?.code, JSONRPC_ERROR_CODES.forbidden, 'a 403');
+                    assert.strictEqual(error_reason(refused), 'cell_grant_unapproved');
+                }
+            }
+            assert.strictEqual(await outcome(fixture, 'cell_grant_create', actor_shaped, stranger.create_session_headers()), 'cell_not_found', 'a non-manager keeps the 404 mask');
+            await moderate(fixture, post.cell.id, 'approved');
+            for (const params of [actor_shaped, role_shaped]) {
+                expect_output(await cross_rpc_call(fixture.transport, rpc_path, 'cell_grant_create', params, author.create_session_headers()), CellGrantCreateOutput);
+            }
+        });
+    });
     describe('cell_clone runs the creation authorizer (parity)', () => {
         test_if(capabilities.cell_gated_create, 'a non-admin clone of a viewable `space` root → 403, admin clone succeeds', async () => {
             const fixture = await setup_test();

package/dist/testing/cross_backend/cell_relations.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cell_relations.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/cell_relations.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAyF9B,OAAO,KAAK,EAAE,uCAAuC,EAAE,MAAM,YAAY,CAAC;AAsF1E,eAAO,MAAM,mCAAmC,GAC/C,SAAS,uCAAuC,KAC9C,IAi2BF,CAAC"}
+{"version":3,"file":"cell_relations.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/cell_relations.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AA8G9B,OAAO,KAAK,EAAE,uCAAuC,EAAE,MAAM,YAAY,CAAC;AAsF1E,eAAO,MAAM,mCAAmC,GAC/C,SAAS,uCAAuC,KAC9C,IAioCF,CAAC"}