@fuzdev/fuz_app 0.146.1 → 0.148.0

package/dist/testing/cross_backend/cell_gated_create.js

@@ -46,33 +46,11 @@ import '../assert_dev_env.js';
  * @module
  */
 import { describe, assert } from 'vitest';
-import { fractional_index_between } from '@fuzdev/fuz_util/fractional_index.ts';
-import { CellCloneOutput, CellCreateOutput, CellGetOutput, CellListOutput, CellModerateOutput, CellUpdateOutput } from '../../auth/cell_action_specs.js';
-import { CellItemInsertOutput, CellItemListOutput } from '../../auth/cell_item_action_specs.js';
-import { CellGrantCreateOutput } from '../../auth/cell_grant_action_specs.js';
-import { CellFieldListOutput, CellFieldSetOutput } from '../../auth/cell_field_action_specs.js';
-import { z } from 'zod';
-import { FactHashSchema } from '../../primitive_schemas.js';
-import { JSONRPC_ERROR_CODES } from '../../http/jsonrpc_errors.js';
+import { CellCreateOutput } from '../../auth/cell_action_specs.js';
 import { test_if } from './capabilities.js';
-import { cross_rpc_call, error_reason, expect_output } from './cell_cross_helpers.js';
+import { cross_rpc_call, error_reason, expect_output } from './cross_rpc.js';
 import { SPINE_RPC_PATH } from './spine_surface_constants.js';
-import { SPACE_CELL_KIND, PARTICIPATION_ROLE } from './test_cell_gated_create_authorize.js';
-/**
- * A space `data.policy` mirroring the test ladder: gated `post` (moderated) +
- * `react` (live) + `comment` (live). `comment` exists so the deep-case test can
- * create a comment under a post (`root_id !== parent_id`) and prove the policy
- * resolves from the governing root (the space), not the immediate parent.
- */
-const SPACE_POLICY = {
-    policy: {
-        post: { min_role: PARTICIPATION_ROLE, moderation_required: true },
-        react: { min_role: PARTICIPATION_ROLE, moderation_required: false },
-        comment: { min_role: PARTICIPATION_ROLE, moderation_required: false }
-    }
-};
-/** `_testing_put_fact`'s output envelope. */
-const TestingPutFactOutput = z.strictObject({ hash: FactHashSchema });
+import { PARTICIPATION_ROLE, SPACE_CELL_KIND, TEST_SPACE_POLICY } from './test_cell_gated_create_authorize.js';
 export const describe_cell_gated_create_cross_tests = (options) => {
     const { setup_test, capabilities } = options;
     const rpc_path = options.rpc_path ?? SPINE_RPC_PATH;
@@ -83,7 +61,7 @@ export const describe_cell_gated_create_cross_tests = (options) => {
             const denied = await cross_rpc_call(fixture.transport, rpc_path, 'cell_create', { kind: SPACE_CELL_KIND, data: {} }, stranger.create_session_headers());
             assert.ok(!denied.ok, 'a non-admin must not create a space root');
             assert.strictEqual(error_reason(denied), 'cell_create_forbidden');
-            const space = expect_output(await cross_rpc_call(fixture.transport, rpc_path, 'cell_create', { kind: SPACE_CELL_KIND, data: SPACE_POLICY, visibility: 'public' }, fixture.create_session_headers()), CellCreateOutput);
+            const space = expect_output(await cross_rpc_call(fixture.transport, rpc_path, 'cell_create', { kind: SPACE_CELL_KIND, data: TEST_SPACE_POLICY, visibility: 'public' }, fixture.create_session_headers()), CellCreateOutput);
             assert.strictEqual(space.cell.kind, SPACE_CELL_KIND, 'admin creates the space root');
             assert.strictEqual(space.cell.parent_id, null, 'a root is parentless');
             assert.strictEqual(space.cell.root_id, null, 'a root has no governing root');
@@ -91,7 +69,7 @@ export const describe_cell_gated_create_cross_tests = (options) => {
         });
         test_if(capabilities.cell_gated_create, 'a contribution under a public space: unauthorized → 403, participant → allowed', async () => {
             const fixture = await setup_test();
-            const space = expect_output(await cross_rpc_call(fixture.transport, rpc_path, 'cell_create', { kind: SPACE_CELL_KIND, data: SPACE_POLICY, visibility: 'public' }, fixture.create_session_headers()), CellCreateOutput);
+            const space = expect_output(await cross_rpc_call(fixture.transport, rpc_path, 'cell_create', { kind: SPACE_CELL_KIND, data: TEST_SPACE_POLICY, visibility: 'public' }, fixture.create_session_headers()), CellCreateOutput);
             // A non-participant sees the public space but can't contribute → 403.
             const stranger = await fixture.create_account({ username: 'post_stranger' });
             const forbidden = await cross_rpc_call(fixture.transport, rpc_path, 'cell_create', { kind: 'post', data: {}, parent_id: space.cell.id }, stranger.create_session_headers());
@@ -108,7 +86,7 @@ export const describe_cell_gated_create_cross_tests = (options) => {
         });
         test_if(capabilities.cell_gated_create, 'moderation is set per `moderation_required` (post → pending+private, react → approved)', async () => {
             const fixture = await setup_test();
-            const space = expect_output(await cross_rpc_call(fixture.transport, rpc_path, 'cell_create', { kind: SPACE_CELL_KIND, data: SPACE_POLICY, visibility: 'public' }, fixture.create_session_headers()), CellCreateOutput);
+            const space = expect_output(await cross_rpc_call(fixture.transport, rpc_path, 'cell_create', { kind: SPACE_CELL_KIND, data: TEST_SPACE_POLICY, visibility: 'public' }, fixture.create_session_headers()), CellCreateOutput);
             const participant = await fixture.create_account({
                 username: 'mod_participant',
                 roles: [PARTICIPATION_ROLE]
@@ -125,7 +103,7 @@ export const describe_cell_gated_create_cross_tests = (options) => {
         test_if(capabilities.cell_gated_create, 'a contribution under a hidden (private) space is 404-masked (not 403)', async () => {
             const fixture = await setup_test();
             // A private space — only admin/owner can view it.
-            const space = expect_output(await cross_rpc_call(fixture.transport, rpc_path, 'cell_create', { kind: SPACE_CELL_KIND, data: SPACE_POLICY, visibility: 'private' }, fixture.create_session_headers()), CellCreateOutput);
+            const space = expect_output(await cross_rpc_call(fixture.transport, rpc_path, 'cell_create', { kind: SPACE_CELL_KIND, data: TEST_SPACE_POLICY, visibility: 'private' }, fixture.create_session_headers()), CellCreateOutput);
             const stranger = await fixture.create_account({ username: 'hidden_stranger' });
             const masked = await cross_rpc_call(fixture.transport, rpc_path, 'cell_create', { kind: 'post', data: {}, parent_id: space.cell.id }, stranger.create_session_headers());
             assert.ok(!masked.ok, 'a stranger must not contribute under a hidden space');
@@ -133,7 +111,7 @@ export const describe_cell_gated_create_cross_tests = (options) => {
         });
         test_if(capabilities.cell_gated_create, 'a deep contribution (comment under a post) resolves policy from the governing root, not the parent', async () => {
             const fixture = await setup_test();
-            const space = expect_output(await cross_rpc_call(fixture.transport, rpc_path, 'cell_create', { kind: SPACE_CELL_KIND, data: SPACE_POLICY, visibility: 'public' }, fixture.create_session_headers()), CellCreateOutput);
+            const space = expect_output(await cross_rpc_call(fixture.transport, rpc_path, 'cell_create', { kind: SPACE_CELL_KIND, data: TEST_SPACE_POLICY, visibility: 'public' }, fixture.create_session_headers()), CellCreateOutput);
             const participant = await fixture.create_account({
                 username: 'deep_participant',
                 roles: [PARTICIPATION_ROLE]
@@ -159,7 +137,7 @@ export const describe_cell_gated_create_cross_tests = (options) => {
         test_if(capabilities.cell_gated_create, 'a contribution under a soft-deleted root is 404 cell_not_found (the missing-parent shape)', async () => {
             const fixture = await setup_test();
             const admin_headers = fixture.create_session_headers();
-            const space = expect_output(await cross_rpc_call(fixture.transport, rpc_path, 'cell_create', { kind: SPACE_CELL_KIND, data: SPACE_POLICY, visibility: 'public' }, admin_headers), CellCreateOutput);
+            const space = expect_output(await cross_rpc_call(fixture.transport, rpc_path, 'cell_create', { kind: SPACE_CELL_KIND, data: TEST_SPACE_POLICY, visibility: 'public' }, admin_headers), CellCreateOutput);
             const participant = await fixture.create_account({
                 username: 'tombstone_participant',
                 roles: [PARTICIPATION_ROLE]
@@ -179,459 +157,3 @@ export const describe_cell_gated_create_cross_tests = (options) => {
         });
     });
 };
-/**
- * Cross-backend parity for the **`cell_moderate` verb** (the `pending →
- * approved | rejected` transition) — root-authority-gated.
- *
- * Builds a moderated public space (admin) + a `participant`'s `post` (born
- * `pending` + private under the `moderation_required: true` policy), then
- * proves both spines agree:
- *
- * - **a root manager (admin) approves** → `moderation: 'approved'` +
- *   `visibility: 'public'` (the contribution goes live).
- * - **the author cannot self-approve** → `403 cell_moderate_forbidden` (the
- *   author can *view* their own pending cell, so they reach the gate, and are
- *   denied — moderation authority is over the governing root, not the
- *   contribution).
- * - **a non-viewer is 404-masked** → a stranger who can't see the pending
- *   contribution gets `cell_not_found`, never learns it exists.
- * - **reject** → `moderation: 'rejected'`, visibility stays private.
- *
- * And that moderation gates reads — a cell's effective audience is its
- * visibility or grants **and** its moderation admission (unmoderated or
- * `approved`), so a pending or rejected contribution reaches no one past its
- * author and admins:
- *
- * - **an author's self-flip to public admits nobody** — a pending post its
- *   author makes public stays 404 to anon and a fresh non-admin on `cell_get`,
- *   and out of their `cell_list`; the author and admin still read it.
- * - **rejection holds a public post back** — pending → rejected → public, and
- *   approved → rejected (approval made it public, rejection leaves visibility
- *   alone), both 404 past the author; a grant made while the post was approved
- *   stops admitting once it is rejected, on `cell_get` and `shared_with: 'me'`.
- * - **an approved post is live** — the control.
- * - **relation reads follow** — a pending post in a public collection is
- *   omitted from anon `cell_item_list`, beside a live sibling that isn't; at
- *   the far end of all four relation lists, a pending post is hidden from
- *   anon even flipped public, and a rejected one from its grant holder.
- * - **fact serving follows** — a pending post's fact is 404 to anon, even
- *   with the post flipped public (also gated on `capabilities.fact_serving`).
- *
- * And the steward arm — the owner of a **non-admin** root (a parentless
- * non-`space` kind carrying the same policy, which the test authorizer leaves
- * open) reads the pending posts under it and moderates them:
- *
- * - **the queue** — `cell_list({root_id, moderation: 'pending'})` and
- *   `cell_get` (with `can_edit` / `can_grant` false) → 200; a stranger 404s.
- * - **moderation** — the root owner approves → 200; the author 403, a
- *   stranger 404.
- * - **the arm stops there** — the root owner's `cell_clone` of the pending
- *   post and a contribution under it are both 404.
- * - **fact serving** — the root owner fetches a pending post's fact → 200,
- *   anon 404 (also gated on `capabilities.fact_serving`).
- *
- * And that `cell_grant_create` refuses a pending contribution — **403**
- * `cell_grant_unapproved` for its author and an admin, actor- and role-shaped,
- * while a non-manager keeps the **404** mask; the same grant lands once the
- * post is approved.
- *
- * Gated on `capabilities.cell_gated_create` — a `pending` contribution only
- * exists when the directory authorizer is mounted (reference spine binaries).
- */
-export const describe_cell_moderate_cross_tests = (options) => {
-    const { setup_test, capabilities } = options;
-    const rpc_path = options.rpc_path ?? SPINE_RPC_PATH;
-    // Seed `content` as an embedded fact the author holds (as their upload
-    // would) — a non-admin cell may reference only a fact its writer holds —
-    // and return the post `data` referencing it, `{}` for no fact.
-    const author_post_data = async (fixture, author, post_fact_content) => {
-        if (post_fact_content === undefined)
-            return { post_data: {}, hash: null };
-        const { hash } = expect_output(await cross_rpc_call(
-        // origin-free — the daemon-token middleware discards the credential beside an `Origin`
-        fixture.fresh_transport({ origin: null }), rpc_path, '_testing_put_fact', { content: post_fact_content, holder: author.actor.id }, fixture.create_daemon_token_headers()), TestingPutFactOutput);
-        return { post_data: { cover: hash }, hash };
-    };
-    // Build an admin-owned public space (moderated `post` policy) + a
-    // participant's pending post under it, optionally carrying a fact the
-    // author put.
-    const setup_pending_post_on = async (fixture, post_fact_content) => {
-        const space = expect_output(await cross_rpc_call(fixture.transport, rpc_path, 'cell_create', { kind: SPACE_CELL_KIND, data: SPACE_POLICY, visibility: 'public' }, fixture.create_session_headers()), CellCreateOutput);
-        const author = await fixture.create_account({
-            username: 'moderate_author',
-            roles: [PARTICIPATION_ROLE]
-        });
-        const { post_data, hash } = await author_post_data(fixture, author, post_fact_content);
-        const post = expect_output(await cross_rpc_call(fixture.transport, rpc_path, 'cell_create', { kind: 'post', data: post_data, parent_id: space.cell.id }, author.create_session_headers()), CellCreateOutput);
-        return { fixture, space, author, post, hash };
-    };
-    const setup_pending_post = async () => setup_pending_post_on(await setup_test());
-    // A non-admin's policy root (a parentless non-`space` kind stays open under
-    // the test authorizer, and contributions read the policy off any root) + a
-    // participant's pending post under it, optionally carrying a fact the author
-    // put.
-    const setup_stewarded_post_on = async (fixture, post_fact_content) => {
-        const root_owner = await fixture.create_account({ username: 'steward_root_owner' });
-        const root = expect_output(await cross_rpc_call(fixture.transport, rpc_path, 'cell_create', { kind: 'forum', data: SPACE_POLICY, visibility: 'public' }, root_owner.create_session_headers()), CellCreateOutput);
-        const author = await fixture.create_account({
-            username: 'steward_author',
-            roles: [PARTICIPATION_ROLE]
-        });
-        const { post_data, hash } = await author_post_data(fixture, author, post_fact_content);
-        const post = expect_output(await cross_rpc_call(fixture.transport, rpc_path, 'cell_create', { kind: 'post', data: post_data, parent_id: root.cell.id }, author.create_session_headers()), CellCreateOutput);
-        assert.strictEqual(post.cell.moderation, 'pending', "the root's policy gates the post");
-        return { fixture, root, root_owner, author, post, hash };
-    };
-    const setup_stewarded_post = async () => setup_stewarded_post_on(await setup_test());
-    /** The status of a fact GET — `null` headers = anon. */
-    const fact_status = async (fixture, path, headers) => {
-        const transport = headers === null ? fixture.fresh_transport({ origin: null }) : fixture.transport;
-        const res = await transport(path, { method: 'GET', headers: headers ?? {} });
-        await res.text();
-        return res.status;
-    };
-    /** `'ok'`, or the refusal reason, for one caller's RPC — `null` headers = anon. */
-    const outcome = async (fixture, method, params, headers) => {
-        const r = headers === null
-            ? await cross_rpc_call(fixture.fresh_transport({ origin: null }), rpc_path, method, params, {})
-            : await cross_rpc_call(fixture.transport, rpc_path, method, params, headers);
-        return r.ok ? 'ok' : error_reason(r);
-    };
-    /** The ids a caller's `cell_list` returns — `null` headers = anon. */
-    const listed_ids = async (fixture, params, headers) => {
-        const r = headers === null
-            ? await cross_rpc_call(fixture.fresh_transport({ origin: null }), rpc_path, 'cell_list', params, {})
-            : await cross_rpc_call(fixture.transport, rpc_path, 'cell_list', params, headers);
-        return expect_output(r, CellListOutput).cells.map((c) => c.id);
-    };
-    const moderate = async (fixture, cell_id, moderation, headers = fixture.create_session_headers()) => expect_output(await cross_rpc_call(fixture.transport, rpc_path, 'cell_moderate', { cell_id, moderation }, headers), CellModerateOutput).cell;
-    const set_visibility = async (fixture, headers, cell_id, visibility) => expect_output(await cross_rpc_call(fixture.transport, rpc_path, 'cell_update', { cell_id, visibility }, headers), CellUpdateOutput).cell;
-    describe('cell_moderate verb parity (root-authority-gated)', () => {
-        test_if(capabilities.cell_gated_create, 'a root manager (admin) approves a pending post → approved + public', async () => {
-            const { fixture, post } = await setup_pending_post();
-            assert.strictEqual(post.cell.moderation, 'pending', 'the post is born pending');
-            const moderated = expect_output(await cross_rpc_call(fixture.transport, rpc_path, 'cell_moderate', { cell_id: post.cell.id, moderation: 'approved' }, fixture.create_session_headers() // keeper = admin = root manager
-            ), CellModerateOutput);
-            assert.strictEqual(moderated.cell.moderation, 'approved', 'approval sets the marker');
-            assert.strictEqual(moderated.cell.visibility, 'public', 'approval publishes the post');
-        });
-        test_if(capabilities.cell_gated_create, 'the author (non-manager) cannot moderate their own pending post → 403', async () => {
-            const { fixture, author, post } = await setup_pending_post();
-            const denied = await cross_rpc_call(fixture.transport, rpc_path, 'cell_moderate', { cell_id: post.cell.id, moderation: 'approved' }, author.create_session_headers());
-            assert.ok(!denied.ok, 'the author must not self-approve');
-            assert.strictEqual(error_reason(denied), 'cell_moderate_forbidden');
-        });
-        test_if(capabilities.cell_gated_create, 'a non-viewer is 404-masked from moderating a pending post', async () => {
-            const { fixture, post } = await setup_pending_post();
-            const stranger = await fixture.create_account({ username: 'moderate_stranger' });
-            const masked = await cross_rpc_call(fixture.transport, rpc_path, 'cell_moderate', { cell_id: post.cell.id, moderation: 'approved' }, stranger.create_session_headers());
-            assert.ok(!masked.ok, 'a non-viewer must not moderate');
-            assert.strictEqual(error_reason(masked), 'cell_not_found', 'a non-viewer never learns the pending post exists');
-        });
-        test_if(capabilities.cell_gated_create, 'a root manager rejects a pending post → rejected, stays private', async () => {
-            const { fixture, post } = await setup_pending_post();
-            const moderated = expect_output(await cross_rpc_call(fixture.transport, rpc_path, 'cell_moderate', { cell_id: post.cell.id, moderation: 'rejected' }, fixture.create_session_headers()), CellModerateOutput);
-            assert.strictEqual(moderated.cell.moderation, 'rejected', 'rejection sets the marker');
-            assert.strictEqual(moderated.cell.visibility, 'private', 'rejection leaves the post private');
-        });
-    });
-    describe('moderation gates reads (parity)', () => {
-        test_if(capabilities.cell_gated_create, 'a pending post its author flips public stays hidden past the author and admins', async () => {
-            const { fixture, space, author, post } = await setup_pending_post();
-            const author_h = author.create_session_headers();
-            const flipped = await set_visibility(fixture, author_h, post.cell.id, 'public');
-            assert.strictEqual(flipped.visibility, 'public', 'the author manages their own post');
-            assert.strictEqual(flipped.moderation, 'pending', 'a visibility write leaves moderation');
-            const stranger = await fixture.create_account({ username: 'flip_stranger' });
-            const stranger_h = stranger.create_session_headers();
-            const get = { id: post.cell.id };
-            assert.strictEqual(await outcome(fixture, 'cell_get', get, null), 'cell_not_found');
-            assert.strictEqual(await outcome(fixture, 'cell_get', get, stranger_h), 'cell_not_found');
-            assert.strictEqual(await outcome(fixture, 'cell_get', get, author_h), 'ok');
-            assert.strictEqual(await outcome(fixture, 'cell_get', get, fixture.create_session_headers()), 'ok');
-            const feed = { root_id: space.cell.id };
-            assert.notInclude(await listed_ids(fixture, feed, null), post.cell.id, 'anon list');
-            assert.notInclude(await listed_ids(fixture, feed, stranger_h), post.cell.id, 'stranger');
-            assert.include(await listed_ids(fixture, feed, author_h), post.cell.id, 'author list');
-            assert.include(await listed_ids(fixture, feed, fixture.create_session_headers()), post.cell.id, 'admin list');
-        });
-        test_if(capabilities.cell_gated_create, 'pending → rejected → public stays hidden past the author', async () => {
-            const { fixture, author, post } = await setup_pending_post();
-            const author_h = author.create_session_headers();
-            assert.strictEqual((await moderate(fixture, post.cell.id, 'rejected')).moderation, 'rejected');
-            await set_visibility(fixture, author_h, post.cell.id, 'public');
-            const stranger = await fixture.create_account({ username: 'rejected_stranger' });
-            const get = { id: post.cell.id };
-            assert.strictEqual(await outcome(fixture, 'cell_get', get, null), 'cell_not_found');
-            assert.strictEqual(await outcome(fixture, 'cell_get', get, stranger.create_session_headers()), 'cell_not_found');
-            assert.strictEqual(await outcome(fixture, 'cell_get', get, author_h), 'ok');
-        });
-        test_if(capabilities.cell_gated_create, 'approved → rejected stays hidden, and a grant made while approved stops admitting', async () => {
-            const { fixture, author, post } = await setup_pending_post();
-            const author_h = author.create_session_headers();
-            const friend = await fixture.create_account({ username: 'approved_friend' });
-            const friend_h = friend.create_session_headers();
-            const stranger = await fixture.create_account({ username: 'approved_stranger' });
-            const get = { id: post.cell.id };
-            const shared = { shared_with: 'me' };
-            // The control: approval publishes the post to everyone.
-            assert.strictEqual((await moderate(fixture, post.cell.id, 'approved')).visibility, 'public');
-            assert.strictEqual(await outcome(fixture, 'cell_get', get, null), 'ok', 'approved is live');
-            assert.strictEqual(await outcome(fixture, 'cell_get', get, stranger.create_session_headers()), 'ok');
-            // A grant made while approved admits on its own once the post is private.
-            expect_output(await cross_rpc_call(fixture.transport, rpc_path, 'cell_grant_create', {
-                cell_id: post.cell.id,
-                level: 'viewer',
-                principal: { kind: 'actor', actor_id: friend.actor.id }
-            }, author_h), CellGrantCreateOutput);
-            await set_visibility(fixture, author_h, post.cell.id, 'private');
-            assert.strictEqual(await outcome(fixture, 'cell_get', get, friend_h), 'ok', 'grant admits');
-            assert.include(await listed_ids(fixture, shared, friend_h), post.cell.id);
-            // Rejection holds it back from the grant holder ...
-            assert.strictEqual((await moderate(fixture, post.cell.id, 'rejected')).moderation, 'rejected');
-            assert.strictEqual(await outcome(fixture, 'cell_get', get, friend_h), 'cell_not_found');
-            assert.notInclude(await listed_ids(fixture, shared, friend_h), post.cell.id);
-            // ... and from everyone once public again; the author still reads it.
-            await set_visibility(fixture, author_h, post.cell.id, 'public');
-            assert.strictEqual(await outcome(fixture, 'cell_get', get, null), 'cell_not_found');
-            assert.strictEqual(await outcome(fixture, 'cell_get', get, stranger.create_session_headers()), 'cell_not_found');
-            assert.strictEqual(await outcome(fixture, 'cell_get', get, friend_h), 'cell_not_found');
-            assert.strictEqual(await outcome(fixture, 'cell_get', get, author_h), 'ok');
-        });
-        test_if(capabilities.cell_gated_create, 'approval leaves visibility to rejection: an approved-then-rejected post is still public, and hidden', async () => {
-            const { fixture, post } = await setup_pending_post();
-            await moderate(fixture, post.cell.id, 'approved');
-            const rejected = await moderate(fixture, post.cell.id, 'rejected');
-            assert.strictEqual(rejected.visibility, 'public', 'rejection does not reset visibility');
-            assert.strictEqual(await outcome(fixture, 'cell_get', { id: post.cell.id }, null), 'cell_not_found');
-        });
-        test_if(capabilities.cell_gated_create, 'an editor grant made while approved admits no write once rejected; the author keeps the owner arm', async () => {
-            const { fixture, author, post } = await setup_pending_post();
-            const author_h = author.create_session_headers();
-            const editor = await fixture.create_account({ username: 'rejected_editor' });
-            const editor_h = editor.create_session_headers();
-            const other = expect_output(await cross_rpc_call(fixture.transport, rpc_path, 'cell_create', { kind: 'note', data: {}, visibility: 'public' }, editor_h), CellCreateOutput);
-            await moderate(fixture, post.cell.id, 'approved');
-            expect_output(await cross_rpc_call(fixture.transport, rpc_path, 'cell_grant_create', {
-                cell_id: post.cell.id,
-                level: 'editor',
-                principal: { kind: 'actor', actor_id: editor.actor.id }
-            }, author_h), CellGrantCreateOutput);
-            const update = { cell_id: post.cell.id };
-            assert.strictEqual(await outcome(fixture, 'cell_update', update, editor_h), 'ok', 'the grant admits a write while approved');
-            await moderate(fixture, post.cell.id, 'rejected');
-            const writes = [
-                ['cell_get', { id: post.cell.id }],
-                ['cell_update', update],
-                ['cell_field_set', { source_id: post.cell.id, name: 'link', target_id: other.cell.id }],
-                [
-                    'cell_item_insert',
-                    { parent_id: post.cell.id, child_id: other.cell.id, position: 'a0' }
-                ],
-                ['cell_delete', { cell_id: post.cell.id }]
-            ];
-            for (const [method, params] of writes) {
-                assert.strictEqual(await outcome(fixture, method, params, editor_h), 'cell_not_found', method);
-            }
-            assert.strictEqual(await outcome(fixture, 'cell_update', update, author_h), 'ok', 'author');
-        });
-        test_if(capabilities.cell_gated_create, 'a pending post in a public collection is omitted from anon cell_item_list', async () => {
-            const { fixture, space, author, post } = await setup_pending_post();
-            const author_h = author.create_session_headers();
-            // A live sibling under the same space: a `react` is born approved + public.
-            const react = expect_output(await cross_rpc_call(fixture.transport, rpc_path, 'cell_create', { kind: 'react', data: {}, parent_id: space.cell.id, visibility: 'public' }, author_h), CellCreateOutput);
-            await set_visibility(fixture, author_h, post.cell.id, 'public');
-            const collection = expect_output(await cross_rpc_call(fixture.transport, rpc_path, 'cell_create', { kind: 'collection', data: {}, visibility: 'public' }, author_h), CellCreateOutput);
-            const pos_a = fractional_index_between(null, null);
-            const pos_b = fractional_index_between(pos_a, null);
-            for (const [child_id, position] of [
-                [post.cell.id, pos_a],
-                [react.cell.id, pos_b]
-            ]) {
-                expect_output(await cross_rpc_call(fixture.transport, rpc_path, 'cell_item_insert', { parent_id: collection.cell.id, child_id, position }, author_h), CellItemInsertOutput);
-            }
-            const items = async (headers) => {
-                const params = { parent_id: collection.cell.id };
-                const r = headers === null
-                    ? await cross_rpc_call(fixture.fresh_transport({ origin: null }), rpc_path, 'cell_item_list', params, {})
-                    : await cross_rpc_call(fixture.transport, rpc_path, 'cell_item_list', params, headers);
-                return expect_output(r, CellItemListOutput).items.map((i) => i.child_id);
-            };
-            assert.deepStrictEqual(await items(null), [react.cell.id], 'anon sees the live sibling only');
-            assert.deepStrictEqual(await items(author_h), [post.cell.id, react.cell.id]);
-        });
-        test_if(capabilities.cell_gated_create, 'every relation list hides a pending end, and a rejected one from its grant holder', async () => {
-            const { fixture, author, post } = await setup_pending_post();
-            const author_h = author.create_session_headers();
-            const holder = await fixture.create_account({ username: 'relation_grant_holder' });
-            const holder_h = holder.create_session_headers();
-            const create = async (kind) => expect_output(await cross_rpc_call(fixture.transport, rpc_path, 'cell_create', { kind, data: {}, visibility: 'public' }, author_h), CellCreateOutput).cell.id;
-            const call = async (method, params) => cross_rpc_call(fixture.transport, rpc_path, method, params, author_h);
-            // The post at the far end of all four lists: a public source and
-            // collection point at it, and it points at a public target and child.
-            const source = await create('note');
-            const collection = await create('collection');
-            const target = await create('note');
-            const child = await create('note');
-            const post_id = post.cell.id;
-            expect_output(await call('cell_field_set', { source_id: source, name: 'post', target_id: post_id }), CellFieldSetOutput);
-            expect_output(await call('cell_item_insert', {
-                parent_id: collection,
-                child_id: post_id,
-                position: 'a0'
-            }), CellItemInsertOutput);
-            expect_output(await call('cell_field_set', { source_id: post_id, name: 'link', target_id: target }), CellFieldSetOutput);
-            expect_output(await call('cell_item_insert', { parent_id: post_id, child_id: child, position: 'a0' }), CellItemInsertOutput);
-            // Which lists show the post to a caller — `null` headers = anon.
-            const reach = async (headers) => {
-                const list = async (method, params) => headers === null
-                    ? cross_rpc_call(fixture.fresh_transport({ origin: null }), rpc_path, method, params, {})
-                    : cross_rpc_call(fixture.transport, rpc_path, method, params, headers);
-                const forward_fields = expect_output(await list('cell_field_list', { source_id: source }), CellFieldListOutput).fields.map((f) => f.target_id);
-                const forward_items = expect_output(await list('cell_item_list', { parent_id: collection }), CellItemListOutput).items.map((i) => i.child_id);
-                const reverse_fields = expect_output(await list('cell_field_list', { target_id: target }), CellFieldListOutput).fields.map((f) => f.source_id);
-                const reverse_items = expect_output(await list('cell_item_list', { child_id: child }), CellItemListOutput).items.map((i) => i.parent_id);
-                return [forward_fields, forward_items, reverse_fields, reverse_items].map((ids) => ids.includes(post_id));
-            };
-            const everywhere = [true, true, true, true];
-            const nowhere = [false, false, false, false];
-            // pending, flipped public: the audience sees nothing, the author all
-            await set_visibility(fixture, author_h, post_id, 'public');
-            assert.deepStrictEqual(await reach(null), nowhere, 'anon, pending + public');
-            assert.deepStrictEqual(await reach(author_h), everywhere, 'author, pending + public');
-            // approved and granted, then private: the grant admits it
-            await moderate(fixture, post_id, 'approved');
-            expect_output(await cross_rpc_call(fixture.transport, rpc_path, 'cell_grant_create', {
-                cell_id: post_id,
-                level: 'viewer',
-                principal: { kind: 'actor', actor_id: holder.actor.id }
-            }, author_h), CellGrantCreateOutput);
-            await set_visibility(fixture, author_h, post_id, 'private');
-            assert.deepStrictEqual(await reach(holder_h), everywhere, 'grant holder, approved');
-            assert.deepStrictEqual(await reach(null), nowhere, 'anon, approved + private');
-            // rejected: the grant admits nothing, public or not
-            await moderate(fixture, post_id, 'rejected');
-            assert.deepStrictEqual(await reach(holder_h), nowhere, 'grant holder, rejected');
-            await set_visibility(fixture, author_h, post_id, 'public');
-            assert.deepStrictEqual(await reach(holder_h), nowhere, 'grant holder, rejected + public');
-            assert.deepStrictEqual(await reach(null), nowhere, 'anon, rejected + public');
-            assert.deepStrictEqual(await reach(author_h), everywhere, 'author, rejected');
-        });
-        test_if(capabilities.cell_gated_create && capabilities.fact_serving, "a pending post's fact is 404 to anon, even flipped public; live once approved", async () => {
-            const { fixture, author, post, hash } = await setup_pending_post_on(await setup_test(), 'pending-post-fact');
-            assert.ok(hash !== null);
-            await set_visibility(fixture, author.create_session_headers(), post.cell.id, 'public');
-            const path = `/api/cells/${post.cell.id}/facts/${hash}`;
-            assert.strictEqual(await fact_status(fixture, path, null), 404, 'anon');
-            assert.strictEqual(await fact_status(fixture, path, author.create_session_headers()), 200, 'author');
-            await moderate(fixture, post.cell.id, 'approved');
-            assert.strictEqual(await fact_status(fixture, path, null), 200, 'approved is live');
-        });
-    });
-    describe('the steward arm: a root owner moderates (parity)', () => {
-        test_if(capabilities.cell_gated_create, 'a non-admin root owner reads the pending queue and the post, and moderates it', async () => {
-            const { fixture, root, root_owner, author, post } = await setup_stewarded_post();
-            const steward_h = root_owner.create_session_headers();
-            const stranger = await fixture.create_account({ username: 'steward_stranger' });
-            const stranger_h = stranger.create_session_headers();
-            const queue = { root_id: root.cell.id, moderation: 'pending' };
-            assert.deepStrictEqual(await listed_ids(fixture, queue, steward_h), [post.cell.id]);
-            assert.deepStrictEqual(await listed_ids(fixture, queue, stranger_h), []);
-            const got = expect_output(await cross_rpc_call(fixture.transport, rpc_path, 'cell_get', { id: post.cell.id }, steward_h), CellGetOutput);
-            assert.strictEqual(got.cell.id, post.cell.id);
-            assert.isFalse(got.can_edit, 'a steward does not edit');
-            assert.isFalse(got.can_grant, 'a steward does not manage');
-            assert.strictEqual(await outcome(fixture, 'cell_get', { id: post.cell.id }, stranger_h), 'cell_not_found');
-            // a self-flip to public still reaches no one past author, steward, and admin
-            await set_visibility(fixture, author.create_session_headers(), post.cell.id, 'public');
-            assert.strictEqual(await outcome(fixture, 'cell_get', { id: post.cell.id }, null), 'cell_not_found');
-            assert.strictEqual(await outcome(fixture, 'cell_get', { id: post.cell.id }, steward_h), 'ok');
-            const by_author = await cross_rpc_call(fixture.transport, rpc_path, 'cell_moderate', { cell_id: post.cell.id, moderation: 'approved' }, author.create_session_headers());
-            assert.strictEqual(error_reason(by_author), 'cell_moderate_forbidden');
-            assert.strictEqual(await outcome(fixture, 'cell_moderate', { cell_id: post.cell.id, moderation: 'approved' }, stranger_h), 'cell_not_found');
-            const approved = await moderate(fixture, post.cell.id, 'approved', steward_h);
-            assert.strictEqual(approved.moderation, 'approved', 'the root owner moderates');
-            assert.strictEqual(approved.visibility, 'public');
-        });
-        test_if(capabilities.cell_gated_create, 'the steward arm stops at the moderator surfaces: clone and create-under are 404', async () => {
-            const { fixture, root_owner, post } = await setup_stewarded_post();
-            const steward_h = root_owner.create_session_headers();
-            assert.strictEqual(await outcome(fixture, 'cell_clone', { source_id: post.cell.id }, steward_h), 'cell_not_found');
-            assert.strictEqual(await outcome(fixture, 'cell_create', { kind: 'comment', data: {}, parent_id: post.cell.id }, steward_h), 'cell_not_found');
-        });
-        test_if(capabilities.cell_gated_create, 'the steward arm keys on the governing root, not the parent: a rejected comment under an approved post', async () => {
-            const { fixture, root_owner, author, post } = await setup_stewarded_post();
-            const steward_h = root_owner.create_session_headers();
-            await moderate(fixture, post.cell.id, 'approved', steward_h);
-            const commenter = await fixture.create_account({
-                username: 'steward_commenter',
-                roles: [PARTICIPATION_ROLE]
-            });
-            const commenter_h = commenter.create_session_headers();
-            const comment = expect_output(await cross_rpc_call(fixture.transport, rpc_path, 'cell_create', { kind: 'comment', data: {}, parent_id: post.cell.id, visibility: 'public' }, commenter_h), CellCreateOutput);
-            assert.strictEqual(comment.cell.root_id, post.cell.root_id, 'governed by the root');
-            const rejected = await moderate(fixture, comment.cell.id, 'rejected', steward_h);
-            assert.strictEqual(rejected.moderation, 'rejected');
-            const get = { id: comment.cell.id };
-            assert.strictEqual(await outcome(fixture, 'cell_get', get, steward_h), 'ok', 'root owner');
-            assert.strictEqual(await outcome(fixture, 'cell_get', get, author.create_session_headers()), 'cell_not_found', "the parent's author is not the steward");
-            assert.strictEqual(await outcome(fixture, 'cell_get', get, commenter_h), 'ok', 'author');
-            assert.strictEqual(await outcome(fixture, 'cell_get', get, null), 'cell_not_found', 'anon');
-        });
-        test_if(capabilities.cell_gated_create && capabilities.fact_serving, "the root owner fetches a pending post's fact; anon 404", async () => {
-            const { fixture, root_owner, post, hash } = await setup_stewarded_post_on(await setup_test(), 'stewarded-post-fact');
-            assert.ok(hash !== null);
-            const path = `/api/cells/${post.cell.id}/facts/${hash}`;
-            assert.strictEqual(await fact_status(fixture, path, null), 404, 'anon');
-            assert.strictEqual(await fact_status(fixture, path, root_owner.create_session_headers()), 200, 'steward');
-        });
-    });
-    describe('cell_grant_create refuses an unapproved contribution (parity)', () => {
-        test_if(capabilities.cell_gated_create, 'a grant on a pending post → 403 cell_grant_unapproved; non-manager 404; lands after approval', async () => {
-            const { fixture, author, post } = await setup_pending_post();
-            const friend = await fixture.create_account({ username: 'unapproved_friend' });
-            const stranger = await fixture.create_account({ username: 'unapproved_stranger' });
-            const actor_shaped = {
-                cell_id: post.cell.id,
-                level: 'viewer',
-                principal: { kind: 'actor', actor_id: friend.actor.id }
-            };
-            const role_shaped = {
-                cell_id: post.cell.id,
-                level: 'viewer',
-                principal: { kind: 'role', role: PARTICIPATION_ROLE }
-            };
-            for (const headers of [author.create_session_headers(), fixture.create_session_headers()]) {
-                for (const params of [actor_shaped, role_shaped]) {
-                    const refused = await cross_rpc_call(fixture.transport, rpc_path, 'cell_grant_create', params, headers);
-                    assert.ok(!refused.ok, 'a grant on a pending post must be refused');
-                    assert.strictEqual(refused.error?.code, JSONRPC_ERROR_CODES.forbidden, 'a 403');
-                    assert.strictEqual(error_reason(refused), 'cell_grant_unapproved');
-                }
-            }
-            assert.strictEqual(await outcome(fixture, 'cell_grant_create', actor_shaped, stranger.create_session_headers()), 'cell_not_found', 'a non-manager keeps the 404 mask');
-            await moderate(fixture, post.cell.id, 'approved');
-            for (const params of [actor_shaped, role_shaped]) {
-                expect_output(await cross_rpc_call(fixture.transport, rpc_path, 'cell_grant_create', params, author.create_session_headers()), CellGrantCreateOutput);
-            }
-        });
-    });
-    describe('cell_clone runs the creation authorizer (parity)', () => {
-        test_if(capabilities.cell_gated_create, 'a non-admin clone of a viewable `space` root → 403, admin clone succeeds', async () => {
-            const fixture = await setup_test();
-            const space = expect_output(await cross_rpc_call(fixture.transport, rpc_path, 'cell_create', { kind: SPACE_CELL_KIND, data: SPACE_POLICY, visibility: 'public' }, fixture.create_session_headers()), CellCreateOutput);
-            // Every cell a clone writes is a parentless create of the source's
-            // kind, gated like `cell_create` — so a caller denied a `space` root
-            // can't clone one they can see into one they own.
-            const stranger = await fixture.create_account({ username: 'clone_stranger' });
-            const denied = await cross_rpc_call(fixture.transport, rpc_path, 'cell_clone', { source_id: space.cell.id }, stranger.create_session_headers());
-            assert.ok(!denied.ok, 'a non-admin must not clone a space root');
-            assert.strictEqual(denied.error?.code, JSONRPC_ERROR_CODES.forbidden, 'a 403');
-            assert.strictEqual(error_reason(denied), 'cell_create_forbidden');
-            const cloned = expect_output(await cross_rpc_call(fixture.transport, rpc_path, 'cell_clone', { source_id: space.cell.id }, fixture.create_session_headers()), CellCloneOutput);
-            assert.strictEqual(cloned.cell.kind, SPACE_CELL_KIND, 'the admin clones the space');
-            assert.notStrictEqual(cloned.cell.id, space.cell.id);
-            assert.strictEqual(cloned.cell.moderation, null, 'a clone stamps no moderation');
-        });
-    });
-};

package/dist/testing/cross_backend/cell_grant_role.d.ts

@@ -2,7 +2,19 @@ import '../assert_dev_env.js';
 import type { RpcPathCapabilityGatedCrossSuiteOptions } from './setup.js';
 /** App role the holder is seeded with; matches the spine's registered role. */
 export declare const CELL_EDITOR_ROLE = "cell_editor";
-/** Username the fixture seeds (via `extra_accounts`) holding `CELL_EDITOR_ROLE`. */
+/** Username the fixture seeds (via `extra_accounts`) holding the suite's `role`. */
 export declare const CELL_ROLE_HOLDER_USERNAME = "cell_role_holder";
-export declare const describe_cell_grant_role_cross_tests: (options: RpcPathCapabilityGatedCrossSuiteOptions) => void;
+/** Options for `describe_cell_grant_role_cross_tests`. */
+export interface CellGrantRoleCrossTestOptions extends RpcPathCapabilityGatedCrossSuiteOptions {
+    /**
+     * The role the grants name, which the `CELL_ROLE_HOLDER_USERNAME` account
+     * the setup seeds must hold and the backend's cell role registry must
+     * know. Default `CELL_EDITOR_ROLE`. It must not be `ROLE_ADMIN`: a global
+     * admin views and edits every cell, so the holder arms would pass without
+     * the grant — the call throws. `ROLE_KEEPER` serves a backend with only
+     * the builtin roles, since keeper reach is not admin reach.
+     */
+    readonly role?: string;
+}
+export declare const describe_cell_grant_role_cross_tests: (options: CellGrantRoleCrossTestOptions) => void;
 //# sourceMappingURL=cell_grant_role.d.ts.map

package/dist/testing/cross_backend/cell_grant_role.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cell_grant_role.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/cell_grant_role.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAiD9B,OAAO,KAAK,EAAE,uCAAuC,EAAE,MAAM,YAAY,CAAC;AAG1E,+EAA+E;AAC/E,eAAO,MAAM,gBAAgB,gBAAyB,CAAC;AAEvD,oFAAoF;AACpF,eAAO,MAAM,yBAAyB,qBAAqB,CAAC;AAK5D,eAAO,MAAM,oCAAoC,GAChD,SAAS,uCAAuC,KAC9C,IAsOF,CAAC"}
+{"version":3,"file":"cell_grant_role.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/cell_grant_role.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAsD9B,OAAO,KAAK,EAAE,uCAAuC,EAAE,MAAM,YAAY,CAAC;AAG1E,+EAA+E;AAC/E,eAAO,MAAM,gBAAgB,gBAAyB,CAAC;AAEvD,oFAAoF;AACpF,eAAO,MAAM,yBAAyB,qBAAqB,CAAC;AAK5D,0DAA0D;AAC1D,MAAM,WAAW,6BAA8B,SAAQ,uCAAuC;IAC7F;;;;;;;OAOG;IACH,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,eAAO,MAAM,oCAAoC,GAChD,SAAS,6BAA6B,KACpC,IA6OF,CAAC"}