@fuzdev/fuz_app 0.147.0 → 0.148.0

package/dist/testing/cross_backend/role_grant_offer_notification_ws.js

@@ -26,7 +26,13 @@ import '../assert_dev_env.js';
  * drives the lifecycle RPC over HTTP, then asserts the frame lands on that
  * socket and strict-parses against the canonical wire schema — the guard
  * against serialization drift (field / null / datetime / the flat revoke shape /
- * the supersede `reason` + `cause_id`).
+ * the supersede `reason` + `cause_id`). Every case also holds a third account's
+ * admitted socket open — a bystander, party to nothing the case drives — and,
+ * once the targeted frame has landed, asserts the bystander received nothing
+ * but the answers to its own requests, behind a `heartbeat` barrier on its
+ * socket (`assert_bystander_heard_nothing` says why the barrier makes the
+ * silence meaningful). A fan-out that reached past its target account fails
+ * there.
  *
  * Sends are queued on the post-commit drain (handler-emit, not audit-derived),
  * so a frame may land a beat after the RPC resolves — `WsClient.wait_for` polls
@@ -53,15 +59,17 @@ import '../assert_dev_env.js';
  */
 import { assert, describe } from 'vitest';
 import { rpc_call } from '../rpc_helpers.js';
-import { create_admitted_ws_transport } from '../transports/ws_transport.js';
-import { is_notification_with } from '../transports/ws_client.js';
+import { WS_ADMISSION_PROBE_ID } from '../transports/ws_transport.js';
+import { is_notification_with, is_response_for } from '../transports/ws_client.js';
 import { ROLE_ADMIN } from '../../auth/role_schema.js';
 import { WS_CLOSE_PERMISSION_REVOKED } from '../../actions/transports.js';
 import { ROLE_GRANT_OFFER_RECEIVED_NOTIFICATION_METHOD, ROLE_GRANT_OFFER_ACCEPTED_NOTIFICATION_METHOD, ROLE_GRANT_OFFER_DECLINED_NOTIFICATION_METHOD, ROLE_GRANT_OFFER_RETRACTED_NOTIFICATION_METHOD, ROLE_GRANT_OFFER_SUPERSEDE_NOTIFICATION_METHOD, ROLE_GRANT_REVOKE_NOTIFICATION_METHOD, RoleGrantOfferReceivedParams, RoleGrantOfferAcceptedParams, RoleGrantOfferDeclinedParams, RoleGrantOfferRetractedParams, RoleGrantOfferSupersedeParams, RoleGrantRevokeParams } from '../../auth/role_grant_offer_notifications.js';
 import { test_if } from './capabilities.js';
 import { create_active_role_grant, create_pending_role_grant_offer } from './role_grant_cross_helpers.js';
-/** JSON-RPC endpoint path — matches the spine's `/api/rpc` (and the forge's). */
-const RPC_PATH = '/api/rpc';
+import { SPINE_RPC_PATH } from './spine_surface_constants.js';
+import { open_session_ws } from './ws_endpoint.js';
+/** The request id the bystander's barrier `heartbeat` goes out under. */
+const BYSTANDER_BARRIER_ID = 'bystander_barrier';
 /**
  * Register the role-grant-offer WS notification suite — seven cases over a real
  * upgrade, one per server-initiated notification (received / accepted /
@@ -71,28 +79,62 @@ const RPC_PATH = '/api/rpc';
  * params schema. Gated on `capabilities.ws`.
  */
 export const describe_role_grant_offer_notification_ws_tests = (options) => {
-    const { setup_test, capabilities, base_url, ws_path, ws_required_roles = [] } = options;
+    const { setup_test, capabilities, ws_required_roles = [] } = options;
     const revoke_closes_the_socket = ws_required_roles.includes(ROLE_ADMIN);
     // -- shared helpers -------------------------------------------------------
     /**
-     * Open a WS transport for a single session cookie (`<name>=<value>`),
-     * admitted before it resolves: a targeted notification is delivered only to
-     * an admitted connection, and the handshake alone doesn't say it is one.
+     * Open a WS transport on an account's session, admitted before it resolves:
+     * a targeted notification is delivered only to an admitted connection, and
+     * the handshake alone doesn't say it is one.
      */
-    const open_ws = (cookie) => {
-        assert.ok(cookie, 'expected a session cookie for the WS upgrade');
-        return create_admitted_ws_transport({
-            base_url,
-            ws_path,
-            cookies: [cookie],
-            origin: base_url
-        });
+    const open_ws = (account) => open_session_ws(options, account, { admitted: true });
+    /**
+     * A third account's admitted socket — party to nothing a case drives. It
+     * holds `ROLE_ADMIN`, as every account here does, so it opens a socket
+     * gated on that role too. Opened before the lifecycle call, after the
+     * account's own offer and accept have run.
+     */
+    const open_bystander = async (fixture) => {
+        const bystander = await fixture.create_account({ roles: [ROLE_ADMIN] });
+        return open_ws(bystander);
+    };
+    /**
+     * Assert the bystander's socket received nothing but the answers to its
+     * own requests. Called once the targeted party holds its frame, and
+     * meaningful only behind the barrier it sends first: a `heartbeat` round
+     * trip on the bystander's socket.
+     *
+     * Why the barrier makes the silence a finding: both spines queue one
+     * fan-out to every recipient in a single pass with no await in it (the TS
+     * transport's `broadcast_filtered` loop, the Rust registry's
+     * `deliver_all`), and neither writes a response ahead of a notification
+     * already queued for the same connection. On the TS spine responses and
+     * notifications share one outbound queue. On the Rust spine a response is
+     * written directly, but the loop's completion arm first writes every
+     * frame already queued for the connection (`flush_queued_frames` in
+     * `fuz_realtime`'s `ws_endpoint.rs`). So a frame the pass addressed to the
+     * bystander reaches it ahead of the barrier's response, and reading that
+     * response first means the pass sent it nothing. On the TS spine this is
+     * strict: a fan-out is sent in one synchronous closure. On the Rust spine
+     * `deliver_all` pushes to recipients one after another on one worker
+     * while the target's connection loop runs on another, so the target's
+     * frame can be written while the pass is still pushing — a window the
+     * barrier's round trip outlasts in practice. Either way the check covers
+     * every pass of the drain, not just the one that reached the target: TS
+     * runs them in one closure, and `PostCommitEffects::drain_all` joins
+     * effects whose notify futures push synchronously, so every pass
+     * completes in the drain's first poll.
+     */
+    const assert_bystander_heard_nothing = async (bystander_ws) => {
+        await bystander_ws.request(BYSTANDER_BARRIER_ID, 'heartbeat', {}, 5000);
+        const strays = bystander_ws.messages.filter((msg) => !is_response_for(WS_ADMISSION_PROBE_ID)(msg) && !is_response_for(BYSTANDER_BARRIER_ID)(msg));
+        assert.deepStrictEqual(strays, [], 'a bystander socket received frames addressed to others');
     };
     /** Drive a JSON-RPC call over the fixture's HTTP transport. */
-    const rpc = (fixture, method, params, headers) => rpc_call({ app: fixture.transport, path: RPC_PATH, method, params, headers });
+    const rpc = (fixture, method, params, headers) => rpc_call({ app: fixture.transport, path: SPINE_RPC_PATH, method, params, headers });
     /** A fresh pending `ROLE_ADMIN` offer, from the keeper unless a grantor is given. */
     const create_pending_offer = (fixture, to_account_id, grantor_headers) => create_pending_role_grant_offer(fixture, to_account_id, grantor_headers, {
-        rpc_path: RPC_PATH
+        rpc_path: SPINE_RPC_PATH
     });
     // -- tests ----------------------------------------------------------------
     describe('role_grant_offer WS notifications (cross-process)', () => {
@@ -104,77 +146,105 @@ export const describe_role_grant_offer_notification_ws_tests = (options) => {
             // earlier notification lands before the socket opens, so it's not
             // the one we observe).
             const recipient = await fixture.create_account({ roles: [ROLE_ADMIN] });
-            const recipient_ws = await open_ws(recipient.create_session_headers().cookie);
+            const bystander_ws = await open_bystander(fixture);
             try {
-                // The keeper (grantor, holds ROLE_ADMIN) offers the recipient a
-                // role over RPC — fresh pending offer, emits the notification
-                // post-commit.
-                const created = await rpc(fixture, 'role_grant_offer_create', { to_account_id: recipient.account.id, role: ROLE_ADMIN }, fixture.create_session_headers());
-                assert.isTrue(created.ok, `offer create failed: ${JSON.stringify(created)}`);
-                const frame = await recipient_ws.wait_for(is_notification_with(ROLE_GRANT_OFFER_RECEIVED_NOTIFICATION_METHOD, (p) => p.offer.to_account_id === recipient.account.id), 5000);
-                // Params strict-parse against the canonical wire schema — guards
-                // the serialization against field/null/datetime drift.
-                const params = RoleGrantOfferReceivedParams.parse(frame.params);
-                assert.strictEqual(params.offer.to_account_id, recipient.account.id);
-                assert.strictEqual(params.offer.role, ROLE_ADMIN);
+                const recipient_ws = await open_ws(recipient);
+                try {
+                    // The keeper (grantor, holds ROLE_ADMIN) offers the recipient a
+                    // role over RPC — fresh pending offer, emits the notification
+                    // post-commit.
+                    const created = await rpc(fixture, 'role_grant_offer_create', { to_account_id: recipient.account.id, role: ROLE_ADMIN }, fixture.create_session_headers());
+                    assert.isTrue(created.ok, `offer create failed: ${JSON.stringify(created)}`);
+                    const frame = await recipient_ws.wait_for(is_notification_with(ROLE_GRANT_OFFER_RECEIVED_NOTIFICATION_METHOD, (p) => p.offer.to_account_id === recipient.account.id), 5000);
+                    // Params strict-parse against the canonical wire schema — guards
+                    // the serialization against field/null/datetime drift.
+                    const params = RoleGrantOfferReceivedParams.parse(frame.params);
+                    assert.strictEqual(params.offer.to_account_id, recipient.account.id);
+                    assert.strictEqual(params.offer.role, ROLE_ADMIN);
+                    await assert_bystander_heard_nothing(bystander_ws);
+                }
+                finally {
+                    await recipient_ws.close();
+                }
             }
             finally {
-                await recipient_ws.close();
+                await bystander_ws.close();
             }
         });
         test_if(capabilities.ws, 'accept delivers role_grant_offer_accepted to the grantor WS', async () => {
             const fixture = await setup_test();
             const recipient = await fixture.create_account({ roles: [ROLE_ADMIN] });
             // Grantor = keeper; open its socket BEFORE the recipient accepts.
-            const grantor = await open_ws(fixture.create_session_headers().cookie);
+            const bystander_ws = await open_bystander(fixture);
             try {
-                const offer = await create_pending_offer(fixture, recipient.account.id);
-                const accepted = await rpc(fixture, 'role_grant_offer_accept', { offer_id: offer.id }, recipient.create_session_headers());
-                assert.isTrue(accepted.ok, `accept failed: ${JSON.stringify(accepted)}`);
-                const frame = await grantor.wait_for(is_notification_with(ROLE_GRANT_OFFER_ACCEPTED_NOTIFICATION_METHOD, (p) => p.offer.id === offer.id), 5000);
-                const params = RoleGrantOfferAcceptedParams.parse(frame.params);
-                assert.strictEqual(params.offer.id, offer.id);
-                assert.isNotNull(params.offer.accepted_at);
+                const grantor = await open_ws(fixture);
+                try {
+                    const offer = await create_pending_offer(fixture, recipient.account.id);
+                    const accepted = await rpc(fixture, 'role_grant_offer_accept', { offer_id: offer.id }, recipient.create_session_headers());
+                    assert.isTrue(accepted.ok, `accept failed: ${JSON.stringify(accepted)}`);
+                    const frame = await grantor.wait_for(is_notification_with(ROLE_GRANT_OFFER_ACCEPTED_NOTIFICATION_METHOD, (p) => p.offer.id === offer.id), 5000);
+                    const params = RoleGrantOfferAcceptedParams.parse(frame.params);
+                    assert.strictEqual(params.offer.id, offer.id);
+                    assert.isNotNull(params.offer.accepted_at);
+                    await assert_bystander_heard_nothing(bystander_ws);
+                }
+                finally {
+                    await grantor.close();
+                }
             }
             finally {
-                await grantor.close();
+                await bystander_ws.close();
             }
         });
         test_if(capabilities.ws, 'decline delivers role_grant_offer_declined to the grantor WS', async () => {
             const fixture = await setup_test();
             const recipient = await fixture.create_account({ roles: [ROLE_ADMIN] });
-            const grantor = await open_ws(fixture.create_session_headers().cookie);
+            const bystander_ws = await open_bystander(fixture);
             try {
-                const offer = await create_pending_offer(fixture, recipient.account.id);
-                const declined = await rpc(fixture, 'role_grant_offer_decline', { offer_id: offer.id, reason: 'no thanks' }, recipient.create_session_headers());
-                assert.isTrue(declined.ok, `decline failed: ${JSON.stringify(declined)}`);
-                const frame = await grantor.wait_for(is_notification_with(ROLE_GRANT_OFFER_DECLINED_NOTIFICATION_METHOD, (p) => p.offer.id === offer.id), 5000);
-                const params = RoleGrantOfferDeclinedParams.parse(frame.params);
-                assert.strictEqual(params.offer.id, offer.id);
-                // Decline reason rides inside the offer row, not a sibling field.
-                assert.strictEqual(params.offer.decline_reason, 'no thanks');
+                const grantor = await open_ws(fixture);
+                try {
+                    const offer = await create_pending_offer(fixture, recipient.account.id);
+                    const declined = await rpc(fixture, 'role_grant_offer_decline', { offer_id: offer.id, reason: 'no thanks' }, recipient.create_session_headers());
+                    assert.isTrue(declined.ok, `decline failed: ${JSON.stringify(declined)}`);
+                    const frame = await grantor.wait_for(is_notification_with(ROLE_GRANT_OFFER_DECLINED_NOTIFICATION_METHOD, (p) => p.offer.id === offer.id), 5000);
+                    const params = RoleGrantOfferDeclinedParams.parse(frame.params);
+                    assert.strictEqual(params.offer.id, offer.id);
+                    // Decline reason rides inside the offer row, not a sibling field.
+                    assert.strictEqual(params.offer.decline_reason, 'no thanks');
+                    await assert_bystander_heard_nothing(bystander_ws);
+                }
+                finally {
+                    await grantor.close();
+                }
             }
             finally {
-                await grantor.close();
+                await bystander_ws.close();
             }
         });
         test_if(capabilities.ws, 'retract delivers role_grant_offer_retracted to the recipient WS', async () => {
             const fixture = await setup_test();
             const recipient = await fixture.create_account({ roles: [ROLE_ADMIN] });
             // Recipient learns their pending offer was pulled — open its socket.
-            const recipient_ws = await open_ws(recipient.create_session_headers().cookie);
+            const bystander_ws = await open_bystander(fixture);
             try {
-                const offer = await create_pending_offer(fixture, recipient.account.id);
-                const retracted = await rpc(fixture, 'role_grant_offer_retract', { offer_id: offer.id }, fixture.create_session_headers());
-                assert.isTrue(retracted.ok, `retract failed: ${JSON.stringify(retracted)}`);
-                const frame = await recipient_ws.wait_for(is_notification_with(ROLE_GRANT_OFFER_RETRACTED_NOTIFICATION_METHOD, (p) => p.offer.id === offer.id), 5000);
-                const params = RoleGrantOfferRetractedParams.parse(frame.params);
-                assert.strictEqual(params.offer.id, offer.id);
-                assert.strictEqual(params.offer.to_account_id, recipient.account.id);
-                assert.isNotNull(params.offer.retracted_at);
+                const recipient_ws = await open_ws(recipient);
+                try {
+                    const offer = await create_pending_offer(fixture, recipient.account.id);
+                    const retracted = await rpc(fixture, 'role_grant_offer_retract', { offer_id: offer.id }, fixture.create_session_headers());
+                    assert.isTrue(retracted.ok, `retract failed: ${JSON.stringify(retracted)}`);
+                    const frame = await recipient_ws.wait_for(is_notification_with(ROLE_GRANT_OFFER_RETRACTED_NOTIFICATION_METHOD, (p) => p.offer.id === offer.id), 5000);
+                    const params = RoleGrantOfferRetractedParams.parse(frame.params);
+                    assert.strictEqual(params.offer.id, offer.id);
+                    assert.strictEqual(params.offer.to_account_id, recipient.account.id);
+                    assert.isNotNull(params.offer.retracted_at);
+                    await assert_bystander_heard_nothing(bystander_ws);
+                }
+                finally {
+                    await recipient_ws.close();
+                }
             }
             finally {
-                await recipient_ws.close();
+                await bystander_ws.close();
             }
         });
         test_if(capabilities.ws, revoke_closes_the_socket
@@ -183,38 +253,46 @@ export const describe_role_grant_offer_notification_ws_tests = (options) => {
             const fixture = await setup_test();
             const revokee = await fixture.create_account({ roles: [ROLE_ADMIN] });
             const role_grant_id = await create_active_role_grant(fixture, revokee, {
-                rpc_path: RPC_PATH
+                rpc_path: SPINE_RPC_PATH
             });
-            const revokee_ws = await open_ws(revokee.create_session_headers().cookie);
+            const bystander_ws = await open_bystander(fixture);
             try {
-                const revoked = await rpc(fixture, 'role_grant_revoke', { actor_id: revokee.actor.id, role_grant_id, reason: 'cleanup' }, fixture.create_session_headers());
-                assert.isTrue(revoked.ok, `revoke failed: ${JSON.stringify(revoked)}`);
-                const is_revoke_frame = is_notification_with(ROLE_GRANT_REVOKE_NOTIFICATION_METHOD, (p) => p.role_grant_id === role_grant_id);
-                // Flat params — guards the no-`offer`-wrapper, `revoked_by`-omitted
-                // shape against drift.
-                const assert_flat_revoke = (frame) => {
-                    const params = RoleGrantRevokeParams.parse(frame.params);
-                    assert.strictEqual(params.role_grant_id, role_grant_id);
-                    assert.strictEqual(params.role, ROLE_ADMIN);
-                    assert.strictEqual(params.reason, 'cleanup');
-                    assert.notProperty(frame.params, 'revoked_by');
-                };
-                if (revoke_closes_the_socket) {
-                    // the socket lost the role its endpoint requires; the revoke
-                    // notification may land just ahead of the close or not at all,
-                    // and is held to the same shape when it does
-                    const closed = await revokee_ws.wait_for_close(5000);
-                    assert.ok(closed, 'the gated socket did not close after the revoke');
-                    assert.strictEqual(revokee_ws.close_code, WS_CLOSE_PERMISSION_REVOKED);
-                    const early = revokee_ws.messages.find(is_revoke_frame);
-                    if (early)
-                        assert_flat_revoke(early);
-                    return;
+                const revokee_ws = await open_ws(revokee);
+                try {
+                    const revoked = await rpc(fixture, 'role_grant_revoke', { actor_id: revokee.actor.id, role_grant_id, reason: 'cleanup' }, fixture.create_session_headers());
+                    assert.isTrue(revoked.ok, `revoke failed: ${JSON.stringify(revoked)}`);
+                    const is_revoke_frame = is_notification_with(ROLE_GRANT_REVOKE_NOTIFICATION_METHOD, (p) => p.role_grant_id === role_grant_id);
+                    // Flat params — guards the no-`offer`-wrapper, `revoked_by`-omitted
+                    // shape against drift.
+                    const assert_flat_revoke = (frame) => {
+                        const params = RoleGrantRevokeParams.parse(frame.params);
+                        assert.strictEqual(params.role_grant_id, role_grant_id);
+                        assert.strictEqual(params.role, ROLE_ADMIN);
+                        assert.strictEqual(params.reason, 'cleanup');
+                        assert.notProperty(frame.params, 'revoked_by');
+                    };
+                    if (revoke_closes_the_socket) {
+                        // the socket lost the role its endpoint requires; the revoke
+                        // notification may land just ahead of the close or not at all,
+                        // and is held to the same shape when it does
+                        const closed = await revokee_ws.wait_for_close(5000);
+                        assert.ok(closed, 'the gated socket did not close after the revoke');
+                        assert.strictEqual(revokee_ws.close_code, WS_CLOSE_PERMISSION_REVOKED);
+                        const early = revokee_ws.messages.find(is_revoke_frame);
+                        if (early)
+                            assert_flat_revoke(early);
+                        await assert_bystander_heard_nothing(bystander_ws);
+                        return;
+                    }
+                    assert_flat_revoke(await revokee_ws.wait_for(is_revoke_frame, 5000));
+                    await assert_bystander_heard_nothing(bystander_ws);
+                }
+                finally {
+                    await revokee_ws.close();
                 }
-                assert_flat_revoke(await revokee_ws.wait_for(is_revoke_frame, 5000));
             }
             finally {
-                await revokee_ws.close();
+                await bystander_ws.close();
             }
         });
         test_if(capabilities.ws, 'accept of a sibling delivers role_grant_offer_supersede to the other grantor WS', async () => {
@@ -229,20 +307,27 @@ export const describe_role_grant_offer_notification_ws_tests = (options) => {
             const grantor2_offer = await create_pending_offer(fixture, recipient.account.id, grantor2.create_session_headers());
             // Open grantor 1 (keeper) — its offer is the one that gets superseded
             // when the recipient accepts grantor 2's offer.
-            const grantor1_ws = await open_ws(fixture.create_session_headers().cookie);
+            const bystander_ws = await open_bystander(fixture);
             try {
-                const accepted = await rpc(fixture, 'role_grant_offer_accept', { offer_id: grantor2_offer.id }, recipient.create_session_headers());
-                assert.isTrue(accepted.ok, `accept failed: ${JSON.stringify(accepted)}`);
-                const frame = await grantor1_ws.wait_for(is_notification_with(ROLE_GRANT_OFFER_SUPERSEDE_NOTIFICATION_METHOD, (p) => p.offer.id === keeper_offer.id), 5000);
-                const params = RoleGrantOfferSupersedeParams.parse(frame.params);
-                assert.strictEqual(params.offer.id, keeper_offer.id);
-                assert.strictEqual(params.reason, 'sibling_accepted');
-                // cause_id points at the accepted sibling (grantor 2's offer).
-                assert.strictEqual(params.cause_id, grantor2_offer.id);
-                assert.isNotNull(params.offer.superseded_at);
+                const grantor1_ws = await open_ws(fixture);
+                try {
+                    const accepted = await rpc(fixture, 'role_grant_offer_accept', { offer_id: grantor2_offer.id }, recipient.create_session_headers());
+                    assert.isTrue(accepted.ok, `accept failed: ${JSON.stringify(accepted)}`);
+                    const frame = await grantor1_ws.wait_for(is_notification_with(ROLE_GRANT_OFFER_SUPERSEDE_NOTIFICATION_METHOD, (p) => p.offer.id === keeper_offer.id), 5000);
+                    const params = RoleGrantOfferSupersedeParams.parse(frame.params);
+                    assert.strictEqual(params.offer.id, keeper_offer.id);
+                    assert.strictEqual(params.reason, 'sibling_accepted');
+                    // cause_id points at the accepted sibling (grantor 2's offer).
+                    assert.strictEqual(params.cause_id, grantor2_offer.id);
+                    assert.isNotNull(params.offer.superseded_at);
+                    await assert_bystander_heard_nothing(bystander_ws);
+                }
+                finally {
+                    await grantor1_ws.close();
+                }
             }
             finally {
-                await grantor1_ws.close();
+                await bystander_ws.close();
             }
         });
         test_if(capabilities.ws, 'revoke supersedes a pending sibling offer and notifies its grantor WS', async () => {
@@ -250,26 +335,33 @@ export const describe_role_grant_offer_notification_ws_tests = (options) => {
             const grantor = await fixture.create_account({ roles: [ROLE_ADMIN] });
             const revokee = await fixture.create_account({ roles: [ROLE_ADMIN] });
             const role_grant_id = await create_active_role_grant(fixture, revokee, {
-                rpc_path: RPC_PATH
+                rpc_path: SPINE_RPC_PATH
             });
             // A *pending* sibling offer for the same (account, role) — this is what
             // the revoke cascade supersedes.
             const sibling_offer = await create_pending_offer(fixture, revokee.account.id, grantor.create_session_headers());
             // Watch the sibling grantor's socket for the supersede push.
-            const grantor_ws = await open_ws(grantor.create_session_headers().cookie);
+            const bystander_ws = await open_bystander(fixture);
             try {
-                const revoked = await rpc(fixture, 'role_grant_revoke', { actor_id: revokee.actor.id, role_grant_id }, fixture.create_session_headers());
-                assert.isTrue(revoked.ok, `revoke failed: ${JSON.stringify(revoked)}`);
-                const frame = await grantor_ws.wait_for(is_notification_with(ROLE_GRANT_OFFER_SUPERSEDE_NOTIFICATION_METHOD, (p) => p.offer.id === sibling_offer.id), 5000);
-                const params = RoleGrantOfferSupersedeParams.parse(frame.params);
-                assert.strictEqual(params.offer.id, sibling_offer.id);
-                assert.strictEqual(params.reason, 'role_grant_revoked');
-                // cause_id points at the revoked role_grant.
-                assert.strictEqual(params.cause_id, role_grant_id);
-                assert.isNotNull(params.offer.superseded_at);
+                const grantor_ws = await open_ws(grantor);
+                try {
+                    const revoked = await rpc(fixture, 'role_grant_revoke', { actor_id: revokee.actor.id, role_grant_id }, fixture.create_session_headers());
+                    assert.isTrue(revoked.ok, `revoke failed: ${JSON.stringify(revoked)}`);
+                    const frame = await grantor_ws.wait_for(is_notification_with(ROLE_GRANT_OFFER_SUPERSEDE_NOTIFICATION_METHOD, (p) => p.offer.id === sibling_offer.id), 5000);
+                    const params = RoleGrantOfferSupersedeParams.parse(frame.params);
+                    assert.strictEqual(params.offer.id, sibling_offer.id);
+                    assert.strictEqual(params.reason, 'role_grant_revoked');
+                    // cause_id points at the revoked role_grant.
+                    assert.strictEqual(params.cause_id, role_grant_id);
+                    assert.isNotNull(params.offer.superseded_at);
+                    await assert_bystander_heard_nothing(bystander_ws);
+                }
+                finally {
+                    await grantor_ws.close();
+                }
             }
             finally {
-                await grantor_ws.close();
+                await bystander_ws.close();
             }
         });
     });

package/dist/testing/cross_backend/role_grant_participation.d.ts

@@ -6,6 +6,19 @@ export interface RoleGrantParticipationCrossTestOptions {
     readonly setup_test: SetupTest;
     /** RPC endpoint path. Default `/api/rpc`. */
     readonly rpc_path?: string;
+    /**
+     * The role conferred — one the backend's registry holds with the `admin`
+     * grant path. Default `SPINE_PARTICIPANT_ROLE`, the spine's own; a backend
+     * with only the builtin roles passes `ROLE_ADMIN`.
+     */
+    readonly role?: string;
+    /**
+     * A scope kind `role` applies to, for the scoped-assign case; `null` skips
+     * that case. Default `'space'` (the spine participant's), or `null` for a
+     * builtin role, which is global-only (a scoped builtin is refused
+     * `role_grant_builtin_scoped`).
+     */
+    readonly scope_kind?: string | null;
 }
 export declare const describe_role_grant_participation_cross_tests: (options: RoleGrantParticipationCrossTestOptions) => void;
 //# sourceMappingURL=role_grant_participation.d.ts.map

package/dist/testing/cross_backend/role_grant_participation.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"role_grant_participation.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/role_grant_participation.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAqD9B,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAE5C,0EAA0E;AAC1E,MAAM,WAAW,sCAAsC;IACtD,+DAA+D;IAC/D,QAAQ,CAAC,UAAU,EAAE,SAAS,CAAC;IAC/B,6CAA6C;IAC7C,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED,eAAO,MAAM,6CAA6C,GACzD,SAAS,sCAAsC,KAC7C,IAuQF,CAAC"}
+{"version":3,"file":"role_grant_participation.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/role_grant_participation.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AA2D9B,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAE5C,0EAA0E;AAC1E,MAAM,WAAW,sCAAsC;IACtD,+DAA+D;IAC/D,QAAQ,CAAC,UAAU,EAAE,SAAS,CAAC;IAC/B,6CAA6C;IAC7C,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B;;;;OAIG;IACH,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB;;;;;OAKG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACpC;AAED,eAAO,MAAM,6CAA6C,GACzD,SAAS,sCAAsC,KAC7C,IA6QF,CAAC"}

package/dist/testing/cross_backend/role_grant_participation.js

@@ -36,50 +36,61 @@ import '../assert_dev_env.js';
  * The `participant` role is registered admin-grantable on both spines
  * (`spine_roles` / the Rust stub's `RoleRegistry`), so the suite is ungated;
  * every spine mounts the standard RPC surface it drives.
+ * The role is the `role` option, `participant` by default: a backend without
+ * it passes another admin-grantable role (`ROLE_ADMIN` for one with only the
+ * builtins, which skips the scoped case — builtins are global-only).
  *
  * @module
  */
 import { describe, test, assert } from 'vitest';
+import { is_builtin_role } from '../../auth/role_schema.js';
 import { rpc_call } from '../rpc_helpers.js';
-import { AuditLogListOutput } from '../../auth/admin_action_specs.js';
 import { ERROR_ROLE_GRANT_OFFER_SELF_TARGET, ERROR_ROLE_GRANT_OFFER_TERMINAL } from '../../auth/role_grant_offer_action_specs.js';
 import { JSONRPC_INVALID_PARAMS, JSONRPC_INVALID_REQUEST } from '../../http/jsonrpc.js';
+import { list_audit_events } from './audit_cross_helpers.js';
+import { test_if } from './capabilities.js';
 import { SPINE_PARTICIPANT_ROLE, SPINE_RPC_PATH } from './spine_surface_constants.js';
 export const describe_role_grant_participation_cross_tests = (options) => {
     const { setup_test } = options;
     const rpc_path = options.rpc_path ?? SPINE_RPC_PATH;
+    const role = options.role ?? SPINE_PARTICIPANT_ROLE;
+    const scope_kind = options.scope_kind === undefined
+        ? is_builtin_role(role)
+            ? null
+            : 'space'
+        : options.scope_kind;
     const rpc = (transport, method, params, headers) => rpc_call({ app: transport, path: rpc_path, method, params, headers });
     describe('role-gated participation conferral (success paths)', () => {
-        test('admin assigns the participant app-role to a fresh account (idempotent)', async () => {
+        test(`admin assigns the ${role} app-role to a fresh account (idempotent)`, async () => {
             const fixture = await setup_test();
             const recipient = await fixture.create_account({ username: 'participation_assignee' });
             // The keeper holds ROLE_ADMIN (seeded via extra_keeper_roles), so it
             // clears the dispatcher admin gate; `participant` is admin-grantable, so
             // it clears the grant-path gate; the recipient is single-actor, so the
             // target actor resolves without `to_actor_id`.
-            const first = await rpc(fixture.transport, 'role_grant_assign', { to_account_id: recipient.account.id, role: SPINE_PARTICIPANT_ROLE }, fixture.create_session_headers());
+            const first = await rpc(fixture.transport, 'role_grant_assign', { to_account_id: recipient.account.id, role }, fixture.create_session_headers());
             assert.ok(first.ok, `assign must succeed: ${JSON.stringify(first)}`);
             const assigned = first.result;
             assert.strictEqual(assigned.ok, true);
             assert.ok(typeof assigned.role_grant_id === 'string' && assigned.role_grant_id.length > 0, 'assign returns the new role_grant id');
             // Idempotent — re-assigning the active grant returns the existing id.
-            const second = await rpc(fixture.transport, 'role_grant_assign', { to_account_id: recipient.account.id, role: SPINE_PARTICIPANT_ROLE }, fixture.create_session_headers());
+            const second = await rpc(fixture.transport, 'role_grant_assign', { to_account_id: recipient.account.id, role }, fixture.create_session_headers());
             assert.ok(second.ok, `re-assign must succeed: ${JSON.stringify(second)}`);
             assert.strictEqual(second.result.role_grant_id, assigned.role_grant_id, 're-assigning an active grant returns the existing role_grant id');
         });
-        test('admin assigns a scoped participant grant that round-trips scope_kind', async () => {
+        test_if(scope_kind !== null, `admin assigns a scoped ${role} grant that round-trips scope_kind`, async () => {
             const fixture = await setup_test();
             const recipient = await fixture.create_account({ username: 'participation_scoped' });
             const scope_id = '33333333-3333-4333-8333-333333333333';
             const scoped = await rpc(fixture.transport, 'role_grant_assign', {
                 to_account_id: recipient.account.id,
-                role: SPINE_PARTICIPANT_ROLE,
-                scope_kind: 'space',
+                role,
+                scope_kind,
                 scope_id
             }, fixture.create_session_headers());
             assert.ok(scoped.ok, `scoped assign must succeed: ${JSON.stringify(scoped)}`);
             const scoped_id = scoped.result.role_grant_id;
-            const global = await rpc(fixture.transport, 'role_grant_assign', { to_account_id: recipient.account.id, role: SPINE_PARTICIPANT_ROLE }, fixture.create_session_headers());
+            const global = await rpc(fixture.transport, 'role_grant_assign', { to_account_id: recipient.account.id, role }, fixture.create_session_headers());
             assert.ok(global.ok, `global assign must succeed: ${JSON.stringify(global)}`);
             const global_id = global.result.role_grant_id;
             assert.notStrictEqual(global_id, scoped_id, 'the global grant is a distinct row');
@@ -90,21 +101,21 @@ export const describe_role_grant_participation_cross_tests = (options) => {
             const by_id = new Map(entry.role_grants.map((g) => [g.id, g]));
             const scoped_row = by_id.get(scoped_id);
             assert.ok(scoped_row, 'the scoped grant is listed');
-            assert.strictEqual(scoped_row.role, SPINE_PARTICIPANT_ROLE);
-            assert.strictEqual(scoped_row.scope_kind, 'space', 'scope_kind round-trips');
+            assert.strictEqual(scoped_row.role, role);
+            assert.strictEqual(scoped_row.scope_kind, scope_kind, 'scope_kind round-trips');
             assert.strictEqual(scoped_row.scope_id, scope_id, 'scope_id round-trips');
             const global_row = by_id.get(global_id);
             assert.ok(global_row, 'the global grant is listed');
             assert.strictEqual(global_row.scope_kind, null);
             assert.strictEqual(global_row.scope_id, null);
         });
-        test('admin offers the participant app-role and the recipient accepts', async () => {
+        test(`admin offers the ${role} app-role and the recipient accepts`, async () => {
             const fixture = await setup_test();
             const recipient = await fixture.create_account({ username: 'participation_offeree' });
             // Admin-only conferral via the consent flow: the keeper (admin) offers
             // the app-role, proving the widened grant-path gate admits it through
             // the offer path too.
-            const created = await rpc(fixture.transport, 'role_grant_offer_create', { to_account_id: recipient.account.id, role: SPINE_PARTICIPANT_ROLE }, fixture.create_session_headers());
+            const created = await rpc(fixture.transport, 'role_grant_offer_create', { to_account_id: recipient.account.id, role }, fixture.create_session_headers());
             assert.ok(created.ok, `offer create must succeed: ${JSON.stringify(created)}`);
             const offer_id = created.result.offer.id;
             // The recipient accepts → a role_grant lands.
@@ -112,9 +123,9 @@ export const describe_role_grant_participation_cross_tests = (options) => {
             assert.ok(accepted.ok, `accept must succeed: ${JSON.stringify(accepted)}`);
             assert.ok(typeof accepted.result.role_grant_id === 'string', 'accept lands a role_grant for the app-role');
         });
-        /** Offer `participant` to `recipient` as the keeper and accept it; returns the ids. */
+        /** Offer `role` to `recipient` as the keeper and accept it; returns the ids. */
         const offer_and_accept = async (fixture, recipient) => {
-            const created = await rpc(fixture.transport, 'role_grant_offer_create', { to_account_id: recipient.account.id, role: SPINE_PARTICIPANT_ROLE }, fixture.create_session_headers());
+            const created = await rpc(fixture.transport, 'role_grant_offer_create', { to_account_id: recipient.account.id, role }, fixture.create_session_headers());
             assert.ok(created.ok, `offer create must succeed: ${JSON.stringify(created)}`);
             const offer_id = created.result.offer.id;
             const accepted = await rpc(fixture.fresh_transport(), 'role_grant_offer_accept', { offer_id }, recipient.create_session_headers());
@@ -122,12 +133,12 @@ export const describe_role_grant_participation_cross_tests = (options) => {
             const { role_grant_id } = accepted.result;
             return { offer_id, role_grant_id };
         };
-        /** How many `event_type` audit rows the keeper can list. */
-        const count_audit_rows = async (fixture, event_type) => {
-            const listed = await rpc(fixture.transport, 'audit_log_list', { event_type }, fixture.create_session_headers());
-            assert.ok(listed.ok, `audit_log_list must succeed: ${JSON.stringify(listed)}`);
-            return AuditLogListOutput.parse(listed.result).events.length;
-        };
+        /**
+         * How many `event_type` audit rows the keeper can list, behind the drain
+         * barrier — without it a replay's late row could land after the count,
+         * and the no-new-row assertions would pass vacuously.
+         */
+        const count_audit_rows = async (fixture, event_type) => (await list_audit_events(fixture, { event_type }, rpc_path)).length;
         test('re-accepting an accepted offer answers the same grant and writes no audit row', async () => {
             const fixture = await setup_test();
             const recipient = await fixture.create_account({ username: 'participation_replayer' });
@@ -157,7 +168,7 @@ export const describe_role_grant_participation_cross_tests = (options) => {
             const fixture = await setup_test();
             const own_id = fixture.account.id;
             for (const to_account_id of [own_id, own_id.toUpperCase()]) {
-                const res = await rpc(fixture.transport, 'role_grant_offer_create', { to_account_id, role: SPINE_PARTICIPANT_ROLE }, fixture.create_session_headers());
+                const res = await rpc(fixture.transport, 'role_grant_offer_create', { to_account_id, role }, fixture.create_session_headers());
                 assert.ok(!res.ok, `a self-offer must be refused (${to_account_id}): ${JSON.stringify(res)}`);
                 assert.strictEqual(res.status, 400, to_account_id);
                 assert.strictEqual(res.error.code, JSONRPC_INVALID_PARAMS, to_account_id);

package/dist/testing/cross_backend/role_grant_role_grammar.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"role_grant_role_grammar.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/role_grant_role_grammar.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAsC9B,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,YAAY,CAAC;AAG3D,8EAA8E;AAC9E,MAAM,MAAM,oCAAoC,GAAG,wBAAwB,CAAC;AAoC5E,eAAO,MAAM,4CAA4C,GACxD,SAAS,oCAAoC,KAC3C,IAoGF,CAAC"}
+{"version":3,"file":"role_grant_role_grammar.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/role_grant_role_grammar.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAuC9B,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,YAAY,CAAC;AAG3D,8EAA8E;AAC9E,MAAM,MAAM,oCAAoC,GAAG,wBAAwB,CAAC;AAoC5E,eAAO,MAAM,4CAA4C,GACxD,SAAS,oCAAoC,KAC3C,IAyFF,CAAC"}