@fuzdev/fuz_app 0.146.1 → 0.148.0

package/dist/testing/cross_backend/cell_crud.js

@@ -23,6 +23,9 @@ import '../assert_dev_env.js';
  * - a non-owner non-admin editing / reading / deleting another's private cell
  *   gets 404 (IDOR mask), never 403;
  * - admin reaches any cell;
+ * - `cell_list` pages honor `limit` + `offset`, and a page is visible rows:
+ *   a newer run of cells the caller can't see never crowds the visible ones
+ *   out, for a non-owner and for anon, and an admin's pages tile every row;
  * - duplicate active `path` → 409 (`cell_path_taken`);
  * - `path` write by a non-admin → 403 (`cell_path_admin_only`), on both create
  *   and update (even by the owner);
@@ -47,7 +50,7 @@ import '../assert_dev_env.js';
 import { describe, assert } from 'vitest';
 import { CELL_KIND_LENGTH_MAX, CellCreateOutput, CellDeleteOutput, CellGetOutput, CellListOutput, CellUpdateOutput } from '../../auth/cell_action_specs.js';
 import { test_if } from './capabilities.js';
-import { cross_rpc_call, error_reason, expect_output } from './cell_cross_helpers.js';
+import { cross_rpc_call, error_reason, expect_output } from './cross_rpc.js';
 import { assert_iso8601_seconds, assert_iso8601_seconds_nullable } from './wire_shapes.js';
 import { SPINE_RPC_PATH } from './spine_surface_constants.js';
 export const describe_cell_crud_cross_tests = (options) => {
@@ -194,6 +197,59 @@ export const describe_cell_crud_cross_tests = (options) => {
             assert.ok(!update_path.ok, 'non-admin set a path on update');
             assert.strictEqual(error_reason(update_path), 'cell_path_admin_only');
         });
+        test_if(capabilities.cell_crud, 'cell_list pages: limit + offset honored; hidden rows never crowd visible ones out of a page', async () => {
+            const fixture = await setup_test();
+            const owner = await fixture.create_account({ username: 'cell_page_owner' });
+            const other = await fixture.create_account({ username: 'cell_page_other' });
+            const viewer = await fixture.create_account({ username: 'cell_page_viewer' });
+            const t = fixture.fresh_transport();
+            const kind = 'page_probe';
+            const create = async (headers, visibility) => expect_output(await cross_rpc_call(t, rpc_path, 'cell_create', { kind, data: {}, visibility }, headers), CellCreateOutput).cell.id;
+            const owner_h = owner.create_session_headers();
+            const other_h = other.create_session_headers();
+            // oldest first: the visible rows, then a newer run of hidden ones —
+            // two owners' private cells — longer than a page, so the newest
+            // `limit` rows are all hidden from the viewer
+            const visible = [];
+            for (let i = 0; i < 5; i++) {
+                visible.push(await create(i % 2 === 0 ? owner_h : other_h, 'public'));
+            }
+            const hidden = [];
+            for (let i = 0; i < 6; i++) {
+                hidden.push(await create(i % 2 === 0 ? owner_h : other_h, 'private'));
+            }
+            const limit = 3;
+            const page = async (transport, headers, params) => expect_output(await cross_rpc_call(transport, rpc_path, 'cell_list', { kind, ...params }, headers), CellListOutput).cells.map((c) => c.id);
+            // newest first (the default order), so the visible rows, newest first
+            const visible_desc = [...visible].reverse();
+            for (const [label, transport, headers] of [
+                ['a non-owner viewer', t, viewer.create_session_headers()],
+                ['anon', fixture.fresh_transport({ origin: null }), {}]
+            ]) {
+                const first = await page(transport, headers, { limit });
+                assert.deepStrictEqual(first, visible_desc.slice(0, limit), `${label}: the first page is the newest visible rows, full to limit`);
+                const second = await page(transport, headers, { limit, offset: limit });
+                assert.deepStrictEqual(second, visible_desc.slice(limit), `${label}: the next page is the rest of the visible rows`);
+                const past = await page(transport, headers, { limit, offset: visible.length });
+                assert.deepStrictEqual(past, [], `${label}: a page past the visible rows is empty`);
+                for (const id of [...first, ...second]) {
+                    assert.ok(!hidden.includes(id), `${label}: a page leaked a hidden row`);
+                }
+            }
+            // an admin sees every row, paged the same way
+            const admin_h = fixture.create_session_headers();
+            const all_desc = [...visible, ...hidden].reverse();
+            const admin_pages = [];
+            for (let offset = 0; offset < all_desc.length; offset += 4) {
+                const rows = await page(t, admin_h, { limit: 4, offset });
+                assert.ok(rows.length <= 4, `admin page at offset ${offset} exceeds limit`);
+                admin_pages.push(...rows);
+            }
+            assert.deepStrictEqual(admin_pages, all_desc, 'admin pages tile the whole list in order');
+            // the owner sees its own private rows beside every public one
+            const owner_rows = await page(t, owner_h, { limit: 50 });
+            assert.deepStrictEqual(owner_rows, all_desc.filter((id) => visible.includes(id) || hidden.indexOf(id) % 2 === 0), 'the owner reads public rows plus its own private ones');
+        });
         test_if(capabilities.cell_crud, 'cell_get without id or path → invalid_params', async () => {
             const fixture = await setup_test();
             const bad = await cross_rpc_call(fixture.fresh_transport(), rpc_path, 'cell_get', {}, fixture.create_session_headers());

package/dist/testing/cross_backend/cell_gated_create.d.ts

@@ -1,64 +1,4 @@
 import '../assert_dev_env.js';
 import type { RpcPathCapabilityGatedCrossSuiteOptions } from './setup.js';
 export declare const describe_cell_gated_create_cross_tests: (options: RpcPathCapabilityGatedCrossSuiteOptions) => void;
-/**
- * Cross-backend parity for the **`cell_moderate` verb** (the `pending →
- * approved | rejected` transition) — root-authority-gated.
- *
- * Builds a moderated public space (admin) + a `participant`'s `post` (born
- * `pending` + private under the `moderation_required: true` policy), then
- * proves both spines agree:
- *
- * - **a root manager (admin) approves** → `moderation: 'approved'` +
- *   `visibility: 'public'` (the contribution goes live).
- * - **the author cannot self-approve** → `403 cell_moderate_forbidden` (the
- *   author can *view* their own pending cell, so they reach the gate, and are
- *   denied — moderation authority is over the governing root, not the
- *   contribution).
- * - **a non-viewer is 404-masked** → a stranger who can't see the pending
- *   contribution gets `cell_not_found`, never learns it exists.
- * - **reject** → `moderation: 'rejected'`, visibility stays private.
- *
- * And that moderation gates reads — a cell's effective audience is its
- * visibility or grants **and** its moderation admission (unmoderated or
- * `approved`), so a pending or rejected contribution reaches no one past its
- * author and admins:
- *
- * - **an author's self-flip to public admits nobody** — a pending post its
- *   author makes public stays 404 to anon and a fresh non-admin on `cell_get`,
- *   and out of their `cell_list`; the author and admin still read it.
- * - **rejection holds a public post back** — pending → rejected → public, and
- *   approved → rejected (approval made it public, rejection leaves visibility
- *   alone), both 404 past the author; a grant made while the post was approved
- *   stops admitting once it is rejected, on `cell_get` and `shared_with: 'me'`.
- * - **an approved post is live** — the control.
- * - **relation reads follow** — a pending post in a public collection is
- *   omitted from anon `cell_item_list`, beside a live sibling that isn't; at
- *   the far end of all four relation lists, a pending post is hidden from
- *   anon even flipped public, and a rejected one from its grant holder.
- * - **fact serving follows** — a pending post's fact is 404 to anon, even
- *   with the post flipped public (also gated on `capabilities.fact_serving`).
- *
- * And the steward arm — the owner of a **non-admin** root (a parentless
- * non-`space` kind carrying the same policy, which the test authorizer leaves
- * open) reads the pending posts under it and moderates them:
- *
- * - **the queue** — `cell_list({root_id, moderation: 'pending'})` and
- *   `cell_get` (with `can_edit` / `can_grant` false) → 200; a stranger 404s.
- * - **moderation** — the root owner approves → 200; the author 403, a
- *   stranger 404.
- * - **the arm stops there** — the root owner's `cell_clone` of the pending
- *   post and a contribution under it are both 404.
- * - **fact serving** — the root owner fetches a pending post's fact → 200,
- *   anon 404 (also gated on `capabilities.fact_serving`).
- *
- * And that `cell_grant_create` refuses a pending contribution — **403**
- * `cell_grant_unapproved` for its author and an admin, actor- and role-shaped,
- * while a non-manager keeps the **404** mask; the same grant lands once the
- * post is approved.
- *
- * Gated on `capabilities.cell_gated_create` — a `pending` contribution only
- * exists when the directory authorizer is mounted (reference spine binaries).
- */
-export declare const describe_cell_moderate_cross_tests: (options: RpcPathCapabilityGatedCrossSuiteOptions) => void;
 //# sourceMappingURL=cell_gated_create.d.ts.map

package/dist/testing/cross_backend/cell_gated_create.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cell_gated_create.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/cell_gated_create.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAoE9B,OAAO,KAAK,EAAE,uCAAuC,EAAE,MAAM,YAAY,CAAC;AAqB1E,eAAO,MAAM,sCAAsC,GAClD,SAAS,uCAAuC,KAC9C,IAuTF,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0DG;AACH,eAAO,MAAM,kCAAkC,GAC9C,SAAS,uCAAuC,KAC9C,IAs6BF,CAAC"}
+{"version":3,"file":"cell_gated_create.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/cell_gated_create.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAsD9B,OAAO,KAAK,EAAE,uCAAuC,EAAE,MAAM,YAAY,CAAC;AAQ1E,eAAO,MAAM,sCAAsC,GAClD,SAAS,uCAAuC,KAC9C,IAuTF,CAAC"}