@fuzdev/fuz_app 0.147.0 → 0.148.0

package/dist/testing/cross_backend/cell_relations.js

@@ -35,7 +35,8 @@ import '../assert_dev_env.js';
  *   read oldest edge first.
  * - **items** — `cell_item_insert` at fractional-index positions, forward
  *   (lex-ordered) + reverse `cell_item_list`, `cell_item_move`, idempotent
- *   `cell_item_delete`.
+ *   `cell_item_delete`; an insert or a move onto a taken position →
+ *   `invalid_params` `cell_item_position_taken`, leaving the rows as they were.
  * - **clone** — shallow copies item / field *edges* (shared `child_id` /
  *   `target_id`); deep clones each viewable child into a fresh cell at the
  *   same position. Both null `path` and stamp the caller as owner.
@@ -69,15 +70,15 @@ import '../assert_dev_env.js';
 import { describe, assert } from 'vitest';
 import { fractional_index_between, fractional_indices_between } from '@fuzdev/fuz_util/fractional_index.ts';
 import { CellCreateOutput, CellUpdateOutput, CellCloneOutput, CellGetOutput, CellListOutput } from '../../auth/cell_action_specs.js';
-import { AuditLogListOutput } from '../../auth/admin_action_specs.js';
 import { ERROR_CELL_GRANT_PRINCIPAL_IS_OWNER, CellGrantCreateOutput, CellGrantListOutput, CellGrantRevokeOutput } from '../../auth/cell_grant_action_specs.js';
 import { CellFieldDeleteOutput, CellFieldListOutput, CellFieldSetOutput } from '../../auth/cell_field_action_specs.js';
 import { CellItemDeleteOutput, CellItemInsertOutput, CellItemListOutput, CellItemMoveOutput } from '../../auth/cell_item_action_specs.js';
 import { CellAuditListOutput } from '../../auth/cell_audit_action_specs.js';
 import { JSONRPC_INVALID_PARAMS } from '../../http/jsonrpc.js';
 import { CELL_RELATION_LIST_LIMIT_DEFAULT, CELL_RELATION_LIST_LIMIT_MAX } from '../../auth/cell_relation_list_limit.js';
+import { list_audit_events } from './audit_cross_helpers.js';
 import { test_if } from './capabilities.js';
-import { cross_rpc_call, error_reason, expect_output } from './cell_cross_helpers.js';
+import { cross_rpc_call, error_reason, expect_output } from './cross_rpc.js';
 import { SPINE_RPC_PATH } from './spine_surface_constants.js';
 /** Create a cell over the wire and return its id (the parity gate parses the output). */
 const create_cell = async (t, rpc_path, h, params) => expect_output(await cross_rpc_call(t, rpc_path, 'cell_create', params, h), CellCreateOutput).cell
@@ -96,16 +97,6 @@ const wire_children = async (t, rpc_path, owner_h, parent, pub_child, priv_child
     expect_output(await cross_rpc_call(t, rpc_path, 'cell_field_set', { source_id: parent, name: 'pub_link', target_id: pub_child }, owner_h), CellFieldSetOutput);
     expect_output(await cross_rpc_call(t, rpc_path, 'cell_field_set', { source_id: parent, name: 'priv_link', target_id: priv_child }, owner_h), CellFieldSetOutput);
 };
-/**
- * Await in-flight fire-and-forget audit writes so a following `audit_log_list`
- * is authoritative on both spines (the real await on Rust; satisfied by
- * construction on the TS spine's `await_pending_effects`). Mirrors the
- * `account_lifecycle` cross suite's barrier.
- */
-const drain_effects = async (td, rpc_path, daemon_h) => {
-    const drained = await cross_rpc_call(td, rpc_path, '_testing_drain_effects', undefined, daemon_h);
-    assert.ok(drained.ok, `_testing_drain_effects failed: ${JSON.stringify(drained.error)}`);
-};
 export const describe_cell_relations_cross_tests = (options) => {
     const { setup_test, capabilities } = options;
     const rpc_path = options.rpc_path ?? SPINE_RPC_PATH;
@@ -395,6 +386,40 @@ export const describe_cell_relations_cross_tests = (options) => {
             const del2 = expect_output(await cross_rpc_call(t, rpc_path, 'cell_item_delete', { parent_id: parent, position: pos_a }, h), CellItemDeleteOutput);
             assert.strictEqual(del2.deleted, false);
         });
+        test_if(capabilities.cell_relations, 'a taken item position → invalid_params cell_item_position_taken, on insert and on move', async () => {
+            const fixture = await setup_test();
+            const owner = await fixture.create_account({ username: 'cell_item_taken' });
+            const t = fixture.fresh_transport();
+            const h = owner.create_session_headers();
+            const make = async () => expect_output(await cross_rpc_call(t, rpc_path, 'cell_create', { kind: 'note', data: {} }, h), CellCreateOutput).cell.id;
+            const parent = await make();
+            const child_a = await make();
+            const child_b = await make();
+            const child_c = await make();
+            const pos_a = fractional_index_between(null, null);
+            const pos_b = fractional_index_between(pos_a, null);
+            for (const [child_id, position] of [
+                [child_a, pos_a],
+                [child_b, pos_b]
+            ]) {
+                expect_output(await cross_rpc_call(t, rpc_path, 'cell_item_insert', { parent_id: parent, child_id, position }, h), CellItemInsertOutput);
+            }
+            const refusals = {
+                insert: await cross_rpc_call(t, rpc_path, 'cell_item_insert', { parent_id: parent, child_id: child_c, position: pos_a }, h),
+                move: await cross_rpc_call(t, rpc_path, 'cell_item_move', { parent_id: parent, position: pos_b, new_position: pos_a }, h)
+            };
+            for (const [label, refused] of Object.entries(refusals)) {
+                assert.ok(!refused.ok, `${label} onto a taken position succeeded`);
+                assert.strictEqual(refused.error?.code, JSONRPC_INVALID_PARAMS, `${label}: code`);
+                assert.strictEqual(error_reason(refused), 'cell_item_position_taken', `${label}: reason`);
+            }
+            // neither refusal added or moved a row
+            const items = expect_output(await cross_rpc_call(t, rpc_path, 'cell_item_list', { parent_id: parent }, h), CellItemListOutput).items;
+            assert.deepStrictEqual(items.map((item) => [item.position, item.child_id]), [
+                [pos_a, child_a],
+                [pos_b, child_b]
+            ]);
+        });
         test_if(capabilities.cell_relations, 'clone: shallow shares edges; deep clones children', async () => {
             const fixture = await setup_test();
             const owner = await fixture.create_account({ username: 'cell_clone_owner' });
@@ -542,9 +567,7 @@ export const describe_cell_relations_cross_tests = (options) => {
             // No skipped-child count surfaced in the clone's audit row — the
             // hidden child's existence must not leak to the cloner. (`_testing_reset`
             // wiped audit_log at setup, so this is the only cell_clone event.)
-            const td = fixture.fresh_transport({ origin: null });
-            await drain_effects(td, rpc_path, fixture.create_daemon_token_headers());
-            const events = expect_output(await cross_rpc_call(t, rpc_path, 'audit_log_list', { event_type: 'cell_clone' }, admin_h), AuditLogListOutput).events;
+            const events = await list_audit_events(fixture, { event_type: 'cell_clone' }, rpc_path);
             const ev = events.find((e) => e.metadata?.new_id === clone.id);
             assert.ok(ev, 'no cell_clone audit row for the shallow clone');
             assert.strictEqual(ev.metadata.skipped_item_count, undefined, 'shallow clone leaked the hidden-child count via skipped_item_count');
@@ -577,9 +600,7 @@ export const describe_cell_relations_cross_tests = (options) => {
             const admin_items = expect_output(await cross_rpc_call(t, rpc_path, 'cell_item_list', { parent_id: clone.id }, admin_h), CellItemListOutput);
             assert.strictEqual(admin_items.items.length, 1, 'deep clone cloned the non-viewable child');
             assert.notStrictEqual(admin_items.items[0].child_id, pub_child, 'deep clone reused the original child instead of cloning it');
-            const td = fixture.fresh_transport({ origin: null });
-            await drain_effects(td, rpc_path, fixture.create_daemon_token_headers());
-            const events = expect_output(await cross_rpc_call(t, rpc_path, 'audit_log_list', { event_type: 'cell_clone' }, admin_h), AuditLogListOutput).events;
+            const events = await list_audit_events(fixture, { event_type: 'cell_clone' }, rpc_path);
             const ev = events.find((e) => e.metadata?.new_id === clone.id);
             assert.ok(ev, 'no cell_clone audit row for the deep clone');
             const meta = ev.metadata;

package/dist/testing/cross_backend/conformance_case.d.ts

@@ -27,7 +27,7 @@ import { z } from 'zod';
 /**
  * Closed enum of fixture-provisioned principals a case runs `as`. Each
  * value maps to a `TestFixture` accessor (or a seeded `extra_accounts`
- * entry) in the runner's `resolve_principal` — there is **no** inline
+ * entry) in the runner's `resolve_conformance_principal` — there is **no** inline
  * credential minting in a case (that would be the setup-DSL trap).
  *
  * - `keeper` — the per-test bootstrapped keeper (holds `ROLE_KEEPER` +
@@ -97,13 +97,13 @@ import { z } from 'zod';
 export declare const ConformancePrincipal: z.ZodEnum<{
     keeper: "keeper";
     token: "token";
+    anonymous: "anonymous";
     daemon: "daemon";
     invalid_daemon: "invalid_daemon";
     daemon_browser: "daemon_browser";
     bearer_browser: "bearer_browser";
     malformed_bearer: "malformed_bearer";
     scoped_token: "scoped_token";
-    anonymous: "anonymous";
     fresh_non_admin: "fresh_non_admin";
     role_holder: "role_holder";
     wrong_role: "wrong_role";
@@ -121,6 +121,35 @@ export type ConformancePrincipal = z.infer<typeof ConformancePrincipal>;
  * scope gate and nothing else.
  */
 export declare const SCOPED_TOKEN_ADMITTED_METHOD = "account_verify";
+/**
+ * Which actor the runner writes into a case's `params.acting` at run time.
+ *
+ * An actor id exists only once a fixture has seeded it, so a case names the
+ * actor by its relation to the fixture and the runner fills in the id:
+ *
+ * - `principal` — the actor of the account the principal's credential names:
+ *   the keeper's bootstrap actor for the keeper-credential principals
+ *   (`keeper`, `daemon`, `token`, `scoped_token`, …), the account's one actor
+ *   for `fresh_non_admin` / `role_holder` / `wrong_role`. Binding it makes a
+ *   row hold whether the account has one actor or several: a single-actor
+ *   account resolves the same actor with or without the selector, a
+ *   multi-actor one needs it.
+ * - `extra_actor` — the keeper's first seeded extra actor
+ *   (`fixture.extra_actors[0]`); the fixture must declare `extra_actors`.
+ *   With a keeper-credential principal, the request acts as a sibling actor
+ *   on the keeper's own account that holds none of the keeper's roles.
+ * - `keeper_actor` — the keeper's bootstrap actor whatever the principal, so
+ *   a principal on another account names a real actor that is not its own.
+ *
+ * Unavailable for principals that present no account (`anonymous`,
+ * `bearer_browser`, `malformed_bearer`) — the runner throws.
+ */
+export declare const ConformanceActingBinding: z.ZodEnum<{
+    principal: "principal";
+    keeper_actor: "keeper_actor";
+    extra_actor: "extra_actor";
+}>;
+export type ConformanceActingBinding = z.infer<typeof ConformanceActingBinding>;
 /** The request a conformance case issues. */
 export declare const ConformanceCaseRequest: z.ZodObject<{
     method: z.ZodString;
@@ -128,18 +157,23 @@ export declare const ConformanceCaseRequest: z.ZodObject<{
     as: z.ZodEnum<{
         keeper: "keeper";
         token: "token";
+        anonymous: "anonymous";
         daemon: "daemon";
         invalid_daemon: "invalid_daemon";
         daemon_browser: "daemon_browser";
         bearer_browser: "bearer_browser";
         malformed_bearer: "malformed_bearer";
         scoped_token: "scoped_token";
-        anonymous: "anonymous";
         fresh_non_admin: "fresh_non_admin";
         role_holder: "role_holder";
         wrong_role: "wrong_role";
         expired_session: "expired_session";
     }>;
+    acting: z.ZodOptional<z.ZodEnum<{
+        principal: "principal";
+        keeper_actor: "keeper_actor";
+        extra_actor: "extra_actor";
+    }>>;
     verb: z.ZodOptional<z.ZodEnum<{
         GET: "GET";
         POST: "POST";
@@ -186,18 +220,23 @@ export declare const ConformanceCase: z.ZodObject<{
         as: z.ZodEnum<{
             keeper: "keeper";
             token: "token";
+            anonymous: "anonymous";
             daemon: "daemon";
             invalid_daemon: "invalid_daemon";
             daemon_browser: "daemon_browser";
             bearer_browser: "bearer_browser";
             malformed_bearer: "malformed_bearer";
             scoped_token: "scoped_token";
-            anonymous: "anonymous";
             fresh_non_admin: "fresh_non_admin";
             role_holder: "role_holder";
             wrong_role: "wrong_role";
             expired_session: "expired_session";
         }>;
+        acting: z.ZodOptional<z.ZodEnum<{
+            principal: "principal";
+            keeper_actor: "keeper_actor";
+            extra_actor: "extra_actor";
+        }>>;
         verb: z.ZodOptional<z.ZodEnum<{
             GET: "GET";
             POST: "POST";

package/dist/testing/cross_backend/conformance_case.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"conformance_case.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/conformance_case.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAE9B;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqEG;AACH,eAAO,MAAM,oBAAoB;;;;;;;;;;;;;;EAc/B,CAAC;AACH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAExE;;;;;;;;;GASG;AACH,eAAO,MAAM,4BAA4B,mBAAmB,CAAC;AAE7D,6CAA6C;AAC7C,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;;;;;;;;;;kBAgBjC,CAAC;AACH,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAE5E,8DAA8D;AAC9D,eAAO,MAAM,0BAA0B;;;;;;;kBA+DrC,CAAC;AACH,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAEpF;;;;;;GAMG;AACH,eAAO,MAAM,oBAAoB;;;kBAK/B,CAAC;AACH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAExE;;;;;;;;;GASG;AACH,eAAO,MAAM,eAAe;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAS1B,CAAC;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC"}
+{"version":3,"file":"conformance_case.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/conformance_case.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAE9B;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqEG;AACH,eAAO,MAAM,oBAAoB;;;;;;;;;;;;;;EAc/B,CAAC;AACH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAExE;;;;;;;;;GASG;AACH,eAAO,MAAM,4BAA4B,mBAAmB,CAAC;AAE7D;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,eAAO,MAAM,wBAAwB;;;;EAAuD,CAAC;AAC7F,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAEhF,6CAA6C;AAC7C,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAqBjC,CAAC;AACH,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAE5E,8DAA8D;AAC9D,eAAO,MAAM,0BAA0B;;;;;;;kBA+DrC,CAAC;AACH,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAEpF;;;;;;GAMG;AACH,eAAO,MAAM,oBAAoB;;;kBAK/B,CAAC;AACH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAExE;;;;;;;;;GASG;AACH,eAAO,MAAM,eAAe;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAS1B,CAAC;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC"}

package/dist/testing/cross_backend/conformance_case.js

@@ -27,7 +27,7 @@ import { z } from 'zod';
 /**
  * Closed enum of fixture-provisioned principals a case runs `as`. Each
  * value maps to a `TestFixture` accessor (or a seeded `extra_accounts`
- * entry) in the runner's `resolve_principal` — there is **no** inline
+ * entry) in the runner's `resolve_conformance_principal` — there is **no** inline
  * credential minting in a case (that would be the setup-DSL trap).
  *
  * - `keeper` — the per-test bootstrapped keeper (holds `ROLE_KEEPER` +
@@ -120,6 +120,30 @@ export const ConformancePrincipal = z.enum([
  * scope gate and nothing else.
  */
 export const SCOPED_TOKEN_ADMITTED_METHOD = 'account_verify';
+/**
+ * Which actor the runner writes into a case's `params.acting` at run time.
+ *
+ * An actor id exists only once a fixture has seeded it, so a case names the
+ * actor by its relation to the fixture and the runner fills in the id:
+ *
+ * - `principal` — the actor of the account the principal's credential names:
+ *   the keeper's bootstrap actor for the keeper-credential principals
+ *   (`keeper`, `daemon`, `token`, `scoped_token`, …), the account's one actor
+ *   for `fresh_non_admin` / `role_holder` / `wrong_role`. Binding it makes a
+ *   row hold whether the account has one actor or several: a single-actor
+ *   account resolves the same actor with or without the selector, a
+ *   multi-actor one needs it.
+ * - `extra_actor` — the keeper's first seeded extra actor
+ *   (`fixture.extra_actors[0]`); the fixture must declare `extra_actors`.
+ *   With a keeper-credential principal, the request acts as a sibling actor
+ *   on the keeper's own account that holds none of the keeper's roles.
+ * - `keeper_actor` — the keeper's bootstrap actor whatever the principal, so
+ *   a principal on another account names a real actor that is not its own.
+ *
+ * Unavailable for principals that present no account (`anonymous`,
+ * `bearer_browser`, `malformed_bearer`) — the runner throws.
+ */
+export const ConformanceActingBinding = z.enum(['principal', 'extra_actor', 'keeper_actor']);
 /** The request a conformance case issues. */
 export const ConformanceCaseRequest = z.strictObject({
     method: z.string().meta({
@@ -132,6 +156,10 @@ export const ConformanceCaseRequest = z.strictObject({
         .optional()
         .meta({ description: 'Request params / body. Omit for nullary methods.' }),
     as: ConformancePrincipal,
+    acting: ConformanceActingBinding.optional().meta({
+        description: 'Bind `params.acting` at run time to the named actor (`ConformanceActingBinding`). ' +
+            'Params must be an object or omitted, and must not carry `acting` themselves.'
+    }),
     verb: z
         .enum(['POST', 'GET'])
         .optional()

package/dist/testing/cross_backend/conformance_rpc_auth.d.ts

@@ -0,0 +1,93 @@
+import '../assert_dev_env.js';
+/**
+ * Per-method RPC auth rows for the conformance table, generated from the
+ * declared surface and, when given, the methods a backend live-mounts off it.
+ *
+ * `describe_rpc_attack_surface_tests` walks every declared method's auth, but
+ * only in-process against stub apps with no database, so it never reaches a
+ * spawned backend. The hand-written conformance rows reach every backend but
+ * cover a chosen few methods. A spine that hand-implements a method's gate can
+ * drift on any method nobody wrote a row for, and the action-manifest parity
+ * gate only compares what the spines *declare*. These rows close that: each
+ * method's declared `RouteAuth` becomes `ConformanceCase` data that
+ * `describe_conformance_table_tests` fires at the live gate, in-process and
+ * cross-process alike.
+ *
+ * Rows per method, from its declared auth:
+ *
+ * - **account or actor required** — `anonymous` → 401
+ *   `authentication_required`. The 401 body is method-independent, so every
+ *   such row joins one equivalence group: a caller with no credential learns
+ *   nothing that tells one method from another.
+ * - **credential-gated** (`credential_types`) — each builtin channel the gate
+ *   does not admit (`keeper` for `session`, `token` for `api_token`, `daemon`
+ *   for `daemon_token`) → 403 `credential_type_required`, echoing the declared
+ *   `required_credential_types`. Each of those principals is the keeper.
+ * - **role-gated** (`roles`) and admitting a session — `fresh_non_admin` →
+ *   403 `insufficient_permissions`, echoing `required_roles`. A role gate
+ *   behind a credential gate that refuses sessions is skipped: every
+ *   role-less principal would hit the credential gate first.
+ * - **public** — no rows.
+ *
+ * **Acting.** On both spines the authorization phase resolves the acting
+ * actor before the credential gate runs, so a keeper with a second actor
+ * (`extra_actors`) would answer `actor_required` (400) to a request with no
+ * `acting` on an actor-bound method. Every credential and role row on such a
+ * method therefore binds `acting` to its principal's own actor at run time
+ * (`request.acting: 'principal'`): a single-actor account resolves the same
+ * actor with or without it, a multi-actor keeper resolves the one holding its
+ * roles, and either way the gate under test is the first that can refuse. The
+ * anonymous rows send none — the 401 precedes actor resolution.
+ *
+ * Every refusal row sends schema-valid params where they can be generated
+ * (`generate_valid_body`, its generated `acting` dropped for the binding),
+ * so the gate is the only thing that can refuse. A backend
+ * whose gate is missing reaches its handler and answers something else. The
+ * rows therefore pin each gate, not the gate order against validation — the
+ * 401-before-400 rows of the security slate pin that.
+ *
+ * **Off the declared surface.** `live_rpc_endpoints` adds the methods a
+ * backend mounts beyond the declared surface — cell verbs, opt-in resolvers,
+ * the `_testing_*` backdoors — read from their action specs the same way, a
+ * method the declared surface already has taken from there. The rows then
+ * need the same endpoints to resolve: pass them to the table runner's
+ * `live_rpc_endpoints` too.
+ *
+ * Skipped: the protocol actions (`PROTOCOL_ACTION_METHODS`): their auth is
+ * fixed by fuz_app's shared specs rather than declared per consumer, they are
+ * WebSocket-scoped (`cancel` is a notification with no reply to assert,
+ * `peer/ping` is public, `heartbeat` rides an admitted socket), and the WS
+ * suites cover them.
+ *
+ * @module
+ */
+import type { AppSurfaceSpec, RpcEndpointSpec } from '../../http/surface.js';
+import type { ConformanceCase } from './conformance_case.js';
+/**
+ * The equivalence group every generated anonymous 401 row joins — the
+ * unauthenticated refusal must be byte-identical whatever the method.
+ */
+export declare const RPC_AUTH_ANONYMOUS_EQUIVALENCE_GROUP = "generated_rpc_auth_anonymous_401";
+/** Options for `generate_rpc_auth_conformance_cases`. */
+export interface RpcAuthConformanceOptions {
+    /** The declared surface; its `rpc_endpoints` supply each method's auth and input schema. */
+    readonly surface_source: AppSurfaceSpec;
+    /**
+     * The endpoints the backend live-mounts, for rows on the methods the
+     * declared surface lacks (resolved — `resolve_rpc_endpoints_for_setup` turns
+     * the factory form into this). Omitted, only declared methods get rows.
+     */
+    readonly live_rpc_endpoints?: ReadonlyArray<RpcEndpointSpec>;
+    /** Methods to leave out, beyond the protocol actions always skipped. */
+    readonly skip_methods?: ReadonlyArray<string>;
+}
+/**
+ * Generate the per-method auth rows for every declared RPC method, then every
+ * live-mounted one the declared surface lacks.
+ *
+ * @param options - the declared surface, the live mount, and any methods to skip
+ * @returns the conformance rows, grouped by method in declaration order, then
+ *   live-mount order
+ */
+export declare const generate_rpc_auth_conformance_cases: (options: RpcAuthConformanceOptions) => Array<ConformanceCase>;
+//# sourceMappingURL=conformance_rpc_auth.d.ts.map

package/dist/testing/cross_backend/conformance_rpc_auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"conformance_rpc_auth.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/conformance_rpc_auth.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAE9B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6DG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAc7E,OAAO,KAAK,EAAE,eAAe,EAAwB,MAAM,uBAAuB,CAAC;AAGnF;;;GAGG;AACH,eAAO,MAAM,oCAAoC,qCAAqC,CAAC;AAkBvF,yDAAyD;AACzD,MAAM,WAAW,yBAAyB;IACzC,4FAA4F;IAC5F,QAAQ,CAAC,cAAc,EAAE,cAAc,CAAC;IACxC;;;;OAIG;IACH,QAAQ,CAAC,kBAAkB,CAAC,EAAE,aAAa,CAAC,eAAe,CAAC,CAAC;IAC7D,wEAAwE;IACxE,QAAQ,CAAC,YAAY,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;CAC9C;AAyBD;;;;;;;GAOG;AACH,eAAO,MAAM,mCAAmC,GAC/C,SAAS,yBAAyB,KAChC,KAAK,CAAC,eAAe,CAsEvB,CAAC"}

package/dist/testing/cross_backend/conformance_rpc_auth.js

@@ -0,0 +1,125 @@
+import '../assert_dev_env.js';
+import { ERROR_AUTHENTICATION_REQUIRED, ERROR_CREDENTIAL_TYPE_REQUIRED, ERROR_INSUFFICIENT_PERMISSIONS } from '../../http/error_schemas.js';
+import { CREDENTIAL_TYPE_API_TOKEN, CREDENTIAL_TYPE_DAEMON_TOKEN, CREDENTIAL_TYPE_SESSION } from '../../auth/credential_type_schema.js';
+import { PROTOCOL_ACTION_METHODS } from '../../actions/action_codegen.js';
+import { generate_valid_body } from '../schema_generators.js';
+/**
+ * The equivalence group every generated anonymous 401 row joins — the
+ * unauthenticated refusal must be byte-identical whatever the method.
+ */
+export const RPC_AUTH_ANONYMOUS_EQUIVALENCE_GROUP = 'generated_rpc_auth_anonymous_401';
+/**
+ * The builtin credential channels a conformance principal presents, each the
+ * keeper on a different credential. A credential-gated method gets one row per
+ * channel its gate refuses.
+ */
+const CREDENTIAL_PRINCIPALS = [
+    { as: 'keeper', credential_type: CREDENTIAL_TYPE_SESSION },
+    { as: 'token', credential_type: CREDENTIAL_TYPE_API_TOKEN },
+    { as: 'daemon', credential_type: CREDENTIAL_TYPE_DAEMON_TOKEN }
+];
+const PROTOCOL_METHODS = new Set(PROTOCOL_ACTION_METHODS);
+/**
+ * Generate schema-valid params for a method's input, without `acting`.
+ *
+ * `acting` is read raw by the authorization phase ahead of the gates, so the
+ * generator's actor id would answer `actor_not_on_account` instead of the gate
+ * under test; the rows bind the principal's real actor instead. A schema the
+ * generator can't satisfy sends no params: every gate fires before
+ * validation, so the row still pins the gate.
+ */
+const to_gate_params = (input) => {
+    let body;
+    try {
+        body = generate_valid_body(input);
+    }
+    catch {
+        return undefined;
+    }
+    if (!body)
+        return undefined;
+    const { acting: _acting, ...rest } = body;
+    return rest;
+};
+const format_auth = (auth) => JSON.stringify(auth);
+/**
+ * Generate the per-method auth rows for every declared RPC method, then every
+ * live-mounted one the declared surface lacks.
+ *
+ * @param options - the declared surface, the live mount, and any methods to skip
+ * @returns the conformance rows, grouped by method in declaration order, then
+ *   live-mount order
+ */
+export const generate_rpc_auth_conformance_cases = (options) => {
+    const skip = new Set(options.skip_methods);
+    const seen = new Set();
+    const cases = [];
+    const endpoints = [
+        ...options.surface_source.rpc_endpoints,
+        ...(options.live_rpc_endpoints ?? [])
+    ];
+    for (const endpoint of endpoints) {
+        for (const action of endpoint.actions) {
+            const { method, auth, input } = action.spec;
+            // a live mount repeats the declared methods; the first spec wins
+            if (seen.has(method))
+                continue;
+            seen.add(method);
+            if (PROTOCOL_METHODS.has(method))
+                continue;
+            if (skip.has(method))
+                continue;
+            const authenticated = auth.account === 'required' || auth.actor === 'required';
+            if (!authenticated)
+                continue; // public or identity-optional: no gate refuses a caller
+            const params = to_gate_params(input);
+            const declared = `declared auth ${format_auth(auth)}`;
+            // the actor-bound methods resolve an actor ahead of the gates
+            const acting = auth.actor !== 'none' ? { acting: 'principal' } : undefined;
+            cases.push({
+                name: `generated: anonymous → ${method} → 401`,
+                request: { method, as: 'anonymous', ...(params && { params }) },
+                expect: {
+                    status: 401,
+                    error_reason: ERROR_AUTHENTICATION_REQUIRED,
+                    equivalence_group: RPC_AUTH_ANONYMOUS_EQUIVALENCE_GROUP
+                },
+                note: `${declared}; the pre-authorization 401 precedes every other gate`
+            });
+            const credential_types = auth.credential_types;
+            if (credential_types?.length) {
+                for (const principal of CREDENTIAL_PRINCIPALS) {
+                    if (credential_types.includes(principal.credential_type))
+                        continue;
+                    cases.push({
+                        name: `generated: ${principal.credential_type} → ${method} → 403 credential_type_required`,
+                        request: { method, as: principal.as, ...acting, ...(params && { params }) },
+                        expect: {
+                            status: 403,
+                            error_reason: ERROR_CREDENTIAL_TYPE_REQUIRED,
+                            fields: { required_credential_types: [...credential_types] }
+                        },
+                        note: `${declared}; the keeper on another channel${acting ? ', acting as its own actor,' : ''} meets the credential gate first`
+                    });
+                }
+            }
+            const roles = auth.roles;
+            const session_admitted = !credential_types?.length
+                ? true
+                : credential_types.includes(CREDENTIAL_TYPE_SESSION);
+            if (roles?.length && session_admitted) {
+                cases.push({
+                    name: `generated: fresh non-admin → ${method} → 403 insufficient_permissions`,
+                    request: { method, as: 'fresh_non_admin', ...acting, ...(params && { params }) },
+                    expect: {
+                        status: 403,
+                        error_reason: ERROR_INSUFFICIENT_PERMISSIONS,
+                        fields: { required_roles: [...roles] }
+                    },
+                    note: `${declared}; a session with no roles clears the credential gate and meets the role gate`
+                });
+            }
+        }
+    }
+    return cases;
+};