@fuzdev/fuz_app 0.147.0 → 0.148.0

package/dist/testing/cross_backend/cell_grant_role.js

@@ -18,34 +18,44 @@ import '../assert_dev_env.js';
  *   role grant can `cell_update` the cell's content.
  *
  * The holder is seeded via `extra_accounts` under `CELL_ROLE_HOLDER_USERNAME`
- * holding `CELL_EDITOR_ROLE` (the role has no grant path, so it can't be
- * offered — the bootstrap-cradle seed is the only path). Both legs configure
- * that seed and register `CELL_EDITOR_ROLE` in their role registry; the Rust
- * `testing_spine_stub` mirrors the same membership in its `known_roles`.
+ * holding the suite's `role` — `CELL_EDITOR_ROLE` by default, which has no
+ * grant path, so it can't be offered and the bootstrap-cradle seed is the only
+ * path. Both legs configure that seed and register `CELL_EDITOR_ROLE` in their
+ * role registry; the Rust `testing_spine_stub` mirrors the same membership in
+ * its `known_roles`. A backend with only the builtin roles passes `ROLE_KEEPER`
+ * (no admin reach, so every arm still turns on the grant); `ROLE_ADMIN` is
+ * refused, since an admin reaches every cell whatever its grants.
  *
  * Cites `security.md` §Authorization (role-shaped cell-grant validation).
  * Runs both legs via the shared `{setup_test}` protocol: in-process
  * (`auth/cell_grant_role_parity.db.test.ts`) + cross-process
- * (`cross_backend/cell_grant_role.cross.test.ts`). Gated on
- * `capabilities.cell_relations` (true on every spine, so it never skips).
+ * (`cross_backend/spine_suites.cross.test.ts`). Gated on
+ * `capabilities.cell_relations` (`true` on the in-process app and fuz_app's
+ * spine presets; a consumer states it like every `MountFlag`).
  *
  * @module
  */
 import { describe, assert } from 'vitest';
 import { CellCreateOutput, CellGetOutput, CellListOutput, CellUpdateOutput } from '../../auth/cell_action_specs.js';
 import { CellGrantCreateOutput, ERROR_CELL_GRANT_UNKNOWN_ROLE } from '../../auth/cell_grant_action_specs.js';
+import { ROLE_ADMIN } from '../../auth/role_schema.js';
 import { test_if } from './capabilities.js';
-import { cross_rpc_call, error_reason, expect_output } from './cell_cross_helpers.js';
+import { cross_rpc_call, error_reason, expect_output } from './cross_rpc.js';
 import { SPINE_CELL_EDITOR_ROLE, SPINE_RPC_PATH } from './spine_surface_constants.js';
 /** App role the holder is seeded with; matches the spine's registered role. */
 export const CELL_EDITOR_ROLE = SPINE_CELL_EDITOR_ROLE;
-/** Username the fixture seeds (via `extra_accounts`) holding `CELL_EDITOR_ROLE`. */
+/** Username the fixture seeds (via `extra_accounts`) holding the suite's `role`. */
 export const CELL_ROLE_HOLDER_USERNAME = 'cell_role_holder';
 /** A role string deliberately absent from the registry. */
 const UNREGISTERED_ROLE = 'not_a_registered_role';
 export const describe_cell_grant_role_cross_tests = (options) => {
     const { setup_test, capabilities } = options;
     const rpc_path = options.rpc_path ?? SPINE_RPC_PATH;
+    const role = options.role ?? CELL_EDITOR_ROLE;
+    if (role === ROLE_ADMIN) {
+        throw new Error('describe_cell_grant_role_cross_tests: `role` must not be admin — an admin reaches every ' +
+            'cell, so the holder cases would pass without the grant');
+    }
     describe('cell_grant role-shaped parity', () => {
         test_if(capabilities.cell_relations, 'role grant admits a holder of the role and excludes a non-holder', async () => {
             const fixture = await setup_test();
@@ -56,10 +66,10 @@ export const describe_cell_grant_role_cross_tests = (options) => {
             assert.ok(holder, `fixture must seed the ${CELL_ROLE_HOLDER_USERNAME} extra account`);
             const stranger = await fixture.create_account({ username: 'cell_role_stranger' });
             // Owner creates a private cell (default visibility) and grants
-            // view access to anyone holding CELL_EDITOR_ROLE.
+            // view access to anyone holding the role.
             const created = expect_output(await cross_rpc_call(t, rpc_path, 'cell_create', { kind: 'note', data: {} }, owner_h), CellCreateOutput);
             const cell_id = created.cell.id;
-            expect_output(await cross_rpc_call(t, rpc_path, 'cell_grant_create', { cell_id, level: 'viewer', principal: { kind: 'role', role: CELL_EDITOR_ROLE } }, owner_h), CellGrantCreateOutput);
+            expect_output(await cross_rpc_call(t, rpc_path, 'cell_grant_create', { cell_id, level: 'viewer', principal: { kind: 'role', role } }, owner_h), CellGrantCreateOutput);
             // Holder of the role is admitted through the role-shaped grant.
             const holder_view = expect_output(await cross_rpc_call(t, rpc_path, 'cell_get', { id: cell_id }, holder.create_session_headers()), CellGetOutput);
             assert.strictEqual(holder_view.cell.id, cell_id, 'holder sees the granted cell');
@@ -93,7 +103,7 @@ export const describe_cell_grant_role_cross_tests = (options) => {
             expect_output(await cross_rpc_call(t, rpc_path, 'cell_grant_create', {
                 cell_id: granted.cell.id,
                 level: 'viewer',
-                principal: { kind: 'role', role: CELL_EDITOR_ROLE }
+                principal: { kind: 'role', role }
             }, owner_h), CellGrantCreateOutput);
             const holder_list = expect_output(await cross_rpc_call(t, rpc_path, 'cell_list', { shared_with: 'me' }, holder.create_session_headers()), CellListOutput);
             const holder_ids = holder_list.cells.map((c) => c.id);
@@ -125,7 +135,7 @@ export const describe_cell_grant_role_cross_tests = (options) => {
             assert.ok(holder, `fixture must seed the ${CELL_ROLE_HOLDER_USERNAME} extra account`);
             const created = expect_output(await cross_rpc_call(t, rpc_path, 'cell_create', { kind: 'note', data: {} }, owner_h), CellCreateOutput);
             const cell_id = created.cell.id;
-            expect_output(await cross_rpc_call(t, rpc_path, 'cell_grant_create', { cell_id, level: 'editor', principal: { kind: 'role', role: CELL_EDITOR_ROLE } }, owner_h), CellGrantCreateOutput);
+            expect_output(await cross_rpc_call(t, rpc_path, 'cell_grant_create', { cell_id, level: 'editor', principal: { kind: 'role', role } }, owner_h), CellGrantCreateOutput);
             const edited = expect_output(await cross_rpc_call(t, rpc_path, 'cell_update', { cell_id, data: { label: 'by role editor' } }, holder.create_session_headers()), CellUpdateOutput);
             assert.strictEqual(edited.cell.updated_by, holder.actor.id, 'edit attributed to the holder');
         });

package/dist/testing/cross_backend/cell_moderate.d.ts

@@ -0,0 +1,66 @@
+import '../assert_dev_env.js';
+import type { RpcPathCapabilityGatedCrossSuiteOptions } from './setup.js';
+/**
+ * Cross-backend parity for the **`cell_moderate` verb** (the `pending →
+ * approved | rejected` transition) — root-authority-gated.
+ *
+ * Builds a moderated public space (admin) + a `participant`'s `post` (born
+ * `pending` + private under the `moderation_required: true` policy), then
+ * proves both spines agree:
+ *
+ * - **a root manager (admin) approves** → `moderation: 'approved'` +
+ *   `visibility: 'public'` (the contribution goes live).
+ * - **the author cannot self-approve** → `403 cell_moderate_forbidden` (the
+ *   author can *view* their own pending cell, so they reach the gate, and are
+ *   denied — moderation authority is over the governing root, not the
+ *   contribution).
+ * - **a non-viewer is 404-masked** → a stranger who can't see the pending
+ *   contribution gets `cell_not_found`, never learns it exists.
+ * - **reject** → `moderation: 'rejected'`, visibility stays private.
+ * - **a cell with no governing root** → `400 cell_not_a_contribution` for any
+ *   viewer (owner, admin), the cell left unmoderated; a non-viewer gets the
+ *   `cell_not_found` mask first.
+ *
+ * And that moderation gates reads — a cell's effective audience is its
+ * visibility or grants **and** its moderation admission (unmoderated or
+ * `approved`), so a pending or rejected contribution reaches no one past its
+ * author and admins:
+ *
+ * - **an author's self-flip to public admits nobody** — a pending post its
+ *   author makes public stays 404 to anon and a fresh non-admin on `cell_get`,
+ *   and out of their `cell_list`; the author and admin still read it.
+ * - **rejection holds a public post back** — pending → rejected → public, and
+ *   approved → rejected (approval made it public, rejection leaves visibility
+ *   alone), both 404 past the author; a grant made while the post was approved
+ *   stops admitting once it is rejected, on `cell_get` and `shared_with: 'me'`.
+ * - **an approved post is live** — the control.
+ * - **relation reads follow** — a pending post in a public collection is
+ *   omitted from anon `cell_item_list`, beside a live sibling that isn't; at
+ *   the far end of all four relation lists, a pending post is hidden from
+ *   anon even flipped public, and a rejected one from its grant holder.
+ * - **fact serving follows** — a pending post's fact is 404 to anon, even
+ *   with the post flipped public (also gated on `capabilities.fact_serving`).
+ *
+ * And the steward arm — the owner of a **non-admin** root (a parentless
+ * non-`space` kind carrying the same policy, which the test authorizer leaves
+ * open) reads the pending posts under it and moderates them:
+ *
+ * - **the queue** — `cell_list({root_id, moderation: 'pending'})` and
+ *   `cell_get` (with `can_edit` / `can_grant` false) → 200; a stranger 404s.
+ * - **moderation** — the root owner approves → 200; the author 403, a
+ *   stranger 404.
+ * - **the arm stops there** — the root owner's `cell_clone` of the pending
+ *   post and a contribution under it are both 404.
+ * - **fact serving** — the root owner fetches a pending post's fact → 200,
+ *   anon 404 (also gated on `capabilities.fact_serving`).
+ *
+ * And that `cell_grant_create` refuses a pending contribution — **403**
+ * `cell_grant_unapproved` for its author and an admin, actor- and role-shaped,
+ * while a non-manager keeps the **404** mask; the same grant lands once the
+ * post is approved.
+ *
+ * Gated on `capabilities.cell_gated_create` — a `pending` contribution only
+ * exists when the directory authorizer is mounted (reference spine binaries).
+ */
+export declare const describe_cell_moderate_cross_tests: (options: RpcPathCapabilityGatedCrossSuiteOptions) => void;
+//# sourceMappingURL=cell_moderate.d.ts.map

package/dist/testing/cross_backend/cell_moderate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cell_moderate.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/cell_moderate.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AA+B9B,OAAO,KAAK,EAAE,uCAAuC,EAAE,MAAM,YAAY,CAAC;AAQ1E;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6DG;AACH,eAAO,MAAM,kCAAkC,GAC9C,SAAS,uCAAuC,KAC9C,IA69BF,CAAC"}