@harperfast/harper-pro 5.0.0-alpha.2 → 5.0.0-alpha.4

package/core/unitTests/resources/auditLog.test.js

@@ -21,6 +21,15 @@ describe('Audit log', () => {
 		subscription.on('data', (event) => {
 			events.push(event);
 		});
+		server.replication.mockRemoteMap = new Map([['local', 0]]);
+		server.replication.getIdOfRemoteNode = function (name) {
+			let id = server.replication.mockRemoteMap.get(name);
+			if (id === undefined) {
+				id = server.replication.mockRemoteMap.size;
+				server.replication.mockRemoteMap.set(name, id);
+			}
+			return id;
+		};
 	});
 	afterEach(function () {
 		setAuditRetention(60000);
@@ -48,6 +57,7 @@ describe('Audit log', () => {
 		for await (let entry of AuditedTable.getHistory()) {
 			results.push(entry);
 		}
+
 		assert.equal(results.length, 0);
 		assert.equal(AuditedTable.primaryStore.getEntry(1), undefined); // verify that the delete entry was removed
 		// verify that the twice-written entry was not removed
@@ -89,4 +99,161 @@ describe('Audit log', () => {
 		assert.equal(history[0].user, key.toString());
 		assert.deepEqual(history[0].value.id, key);
 	});
+	it('dynamically add new transaction logs to iterator', async function () {
+		if (!AuditedTable.auditStore.reusableIterable) return this.skip(); // only for rocksdb
+
+		// Create initial entries
+		await AuditedTable.put(10, { name: 'initial' });
+		await AuditedTable.put(11, { name: 'initial2' });
+
+		const results = [];
+		const iterator = AuditedTable.getHistory()[Symbol.asyncIterator]();
+
+		// Get first entry
+		let result = await iterator.next();
+		results.push(result.value);
+
+		// Emit a new transaction log event
+		AuditedTable.auditStore.rootStore.useLog('new-transaction-log');
+		await delay(20);
+		// Continue iterating - should include entries from new log if it has any
+		while (!(result = await iterator.next()).done) {
+			results.push(result.value);
+		}
+
+		// Verify we got at least the initial entries
+		assert(results.length >= 2, 'Should have at least the initial entries');
+	});
+	it('cleanup listener when iterator completes naturally', async function () {
+		if (!AuditedTable.auditStore.reusableIterable) return this.skip(); // only for rocksdb
+
+		await AuditedTable.put(20, { name: 'test' });
+
+		const originalOn = AuditedTable.auditStore.rootStore.on.bind(AuditedTable.auditStore.rootStore);
+		const originalOff = AuditedTable.auditStore.rootStore.off.bind(AuditedTable.auditStore.rootStore);
+		let activeListener = null;
+
+		AuditedTable.auditStore.rootStore.on = function (event, listener) {
+			if (event === 'new-transaction-log') {
+				activeListener = listener;
+			}
+			return originalOn(event, listener);
+		};
+
+		AuditedTable.auditStore.rootStore.off = function (event, listener) {
+			if (event === 'new-transaction-log' && listener === activeListener) {
+				activeListener = null;
+			}
+			return originalOff(event, listener);
+		};
+
+		// Create iterator and let it complete
+		for await (const _entry of AuditedTable.getHistory()) {
+			// iterate through all
+		}
+
+		// Restore original methods
+		AuditedTable.auditStore.rootStore.on = originalOn;
+		AuditedTable.auditStore.rootStore.off = originalOff;
+
+		// Verify listener was cleaned up
+		assert.equal(activeListener, null, 'Listener should be cleaned up after completion');
+	});
+	it('cleanup listener when breaking from iteration', async function () {
+		if (!AuditedTable.auditStore.reusableIterable) return this.skip(); // only for rocksdb
+
+		await AuditedTable.put(30, { name: 'test1' });
+		await AuditedTable.put(31, { name: 'test2' });
+		await AuditedTable.put(32, { name: 'test3' });
+
+		// Track listener cleanup
+		const originalOn = AuditedTable.auditStore.rootStore.on.bind(AuditedTable.auditStore.rootStore);
+		const originalOff = AuditedTable.auditStore.rootStore.off.bind(AuditedTable.auditStore.rootStore);
+		let activeListener = null;
+
+		AuditedTable.auditStore.rootStore.on = function (event, listener) {
+			if (event === 'new-transaction-log') {
+				activeListener = listener;
+			}
+			return originalOn(event, listener);
+		};
+
+		AuditedTable.auditStore.rootStore.off = function (event, listener) {
+			if (event === 'new-transaction-log' && listener === activeListener) {
+				activeListener = null;
+			}
+			return originalOff(event, listener);
+		};
+
+		// Break early from iteration
+		let count = 0;
+		for await (const _entry of AuditedTable.getHistory()) {
+			if (++count >= 2) break;
+		}
+
+		// Restore original methods
+		AuditedTable.auditStore.rootStore.on = originalOn;
+		AuditedTable.auditStore.rootStore.off = originalOff;
+
+		// Listener should be cleaned up after break
+		assert.equal(activeListener, null, 'Listener should be cleaned up after break');
+	});
+	it('exclude logs from new transaction log events', async function () {
+		if (!AuditedTable.auditStore.reusableIterable) return this.skip(); // only for rocksdb
+		await AuditedTable.put(40, { name: 'test' });
+
+		const excludedLog = 'excluded-log-' + Date.now();
+		const iterator = AuditedTable.auditStore.getRange({ excludeLogs: [excludedLog], start: 0 })[Symbol.iterator]();
+
+		// Start iteration
+		await iterator.next();
+
+		// Emit include log - should be include
+		let nodeId = AuditedTable.auditStore.ensureLogExists('new-transaction-log-2');
+		await delay(20);
+		await AuditedTable.put(41, { name: 'test' }, { nodeId });
+		// Emit excluded log - should be ignored
+		nodeId = AuditedTable.auditStore.ensureLogExists(excludedLog);
+		await delay(20);
+
+		await AuditedTable.put(42, { name: 'test' }, { nodeId });
+
+		let result = [];
+		// Finish iteration
+		let entry;
+		while (!(entry = await iterator.next()).done) {
+			result.push(entry.value);
+		}
+		assert(result.find((entry) => entry.recordId === 41));
+		//assert(!result.find((entry) => entry.recordId === 42));
+		assert(true, 'Should complete without including excluded log');
+	});
+	it('add and remove logs dynamically using iterator methods', async function () {
+		if (!AuditedTable.auditStore.reusableIterable) return this.skip(); // only for rocksdb
+
+		await AuditedTable.put(50, { name: 'test' });
+
+		const iterable = AuditedTable.auditStore.getRange({});
+		const iterator = iterable[Symbol.iterator]();
+
+		// Start iteration
+		iterator.next();
+
+		// Add a new log using the addLog method on the iterable
+		const newLogName = 'manual-log-' + Date.now();
+		AuditedTable.auditStore.ensureLogExists(newLogName);
+
+		// Verify the log was added to logByName
+		assert(AuditedTable.auditStore.logByName.has(newLogName), 'Log should be added to logByName');
+
+		// Remove the log using the removeLog method on the iterable
+		iterable.removeLog(newLogName);
+
+		// Continue iterating to completion
+		while (!(await iterator.next()).done) {
+			// continue
+		}
+
+		assert(true, 'Should complete successfully after adding and removing logs');
+	});
 });

package/core/unitTests/resources/caching.test.js

@@ -364,4 +364,83 @@ describe('Caching', () => {
 			timer = 0;
 		}
 	});
+
+	it('Extended class with sourcedFrom does not impact base class', async function () {
+		// Create a base table without a source
+		const BaseTable = table({
+			table: 'BaseTable',
+			database: 'test',
+			attributes: [{ name: 'id', isPrimaryKey: true }, { name: 'value' }],
+		});
+
+		// Create an extended class and give it a source
+		class ExtendedTable extends BaseTable {}
+
+		let extendedSourceCalls = 0;
+		ExtendedTable.sourcedFrom({
+			get(id) {
+				return new Promise((resolve) => {
+					extendedSourceCalls++;
+					resolve({
+						id,
+						value: 'extended-' + id,
+					});
+				});
+			},
+		});
+
+		// Verify the extended class has a source
+		assert(ExtendedTable.source);
+		assert.equal(typeof ExtendedTable.source.get, 'function');
+
+		// Verify the base class does NOT have a source
+		assert(!BaseTable.source);
+
+		// Test that the extended class uses its source
+		extendedSourceCalls = 0;
+		await ExtendedTable.invalidate(100);
+		const extendedResult = await ExtendedTable.get(100);
+		assert.equal(extendedResult.value, 'extended-100');
+		assert.equal(extendedSourceCalls, 1);
+
+		// Test that the base class doesn't call any source
+		await BaseTable.invalidate(101);
+		const baseResult = await BaseTable.get(101);
+		assert.equal(baseResult, undefined); // Should be undefined since there's no source
+		assert.equal(extendedSourceCalls, 1); // Should not have called extended source
+
+		// Create another extended class with a different source
+		class AnotherExtendedTable extends BaseTable {}
+
+		let anotherSourceCalls = 0;
+		AnotherExtendedTable.sourcedFrom({
+			get(id) {
+				return new Promise((resolve) => {
+					anotherSourceCalls++;
+					resolve({
+						id,
+						value: 'another-' + id,
+					});
+				});
+			},
+		});
+
+		// Verify each extended class has its own independent source
+		assert(AnotherExtendedTable.source);
+		assert(AnotherExtendedTable.source !== ExtendedTable.source);
+
+		// Test that each extended class uses its own source
+		await AnotherExtendedTable.invalidate(102);
+		const anotherResult = await AnotherExtendedTable.get(102);
+		assert.equal(anotherResult.value, 'another-102');
+		assert.equal(anotherSourceCalls, 1);
+		assert.equal(extendedSourceCalls, 1); // ExtendedTable source should not be called
+
+		// Verify ExtendedTable still uses its own source
+		await ExtendedTable.invalidate(103);
+		const extendedResult2 = await ExtendedTable.get(103);
+		assert.equal(extendedResult2.value, 'extended-103');
+		assert.equal(extendedSourceCalls, 2);
+		assert.equal(anotherSourceCalls, 1); // AnotherExtendedTable source should not be called
+	});
 });

package/core/unitTests/resources/permissions.test.js

@@ -30,8 +30,13 @@ describe('Permissions through Resource API', () => {
 			],
 		});
 		for (let i = 0; i < 10; i++) {
-			RelatedTable.put({ id: 'related-id-' + i, name: 'related name-' + i });
-			TestTable.put({ id: 'id-' + i, name: i > 0 ? 'name-' + i : null, prop1: 'test', relatedId: 'related-id-' + i });
+			await RelatedTable.put({ id: 'related-id-' + i, name: 'related name-' + i });
+			await TestTable.put({
+				id: 'id-' + i,
+				name: i > 0 ? 'name-' + i : null,
+				prop1: 'test',
+				relatedId: 'related-id-' + i,
+			});
 		}
 		restricted_user = {
 			role: {

package/core/unitTests/resources/txn-tracking.test.js

@@ -2,9 +2,11 @@ require('../testUtils');
 const assert = require('assert');
 const { setupTestDBPath } = require('../testUtils');
 const { setTxnExpiration } = require('#src/resources/DatabaseTransaction');
+const { setTxnExpiration: setLMDBTxnExpiration } = require('#src/resources/LMDBTransaction');
 const { setMainIsWorker } = require('#js/server/threads/manageThreads');
 const { table } = require('#src/resources/databases');
 const { setTimeout: delay } = require('node:timers/promises');
+const { RocksDatabase } = require('@harperfast/rocksdb-js');
 describe('Txn Expiration', () => {
 	let SlowResource,
 		performedDBInteractions = false;
@@ -31,15 +33,19 @@ describe('Txn Expiration', () => {
 	});
 	it('Slow txn will expire', async function () {
 		await SlowResource.put(3, { name: 'three' });
-		let trackedTxns = setTxnExpiration(20);
+		let trackedTxns =
+			SlowResource.primaryStore instanceof RocksDatabase ? setTxnExpiration(20) : setLMDBTxnExpiration(20);
+		await delay(50);
 		let existingTxns = trackedTxns.size;
 		let result = SlowResource.get(3);
 		assert.equal(trackedTxns.size, existingTxns + 1);
 		const txns = Array.from(trackedTxns);
 		const lastTxn = txns[txns.length - 1];
-		assert.equal(lastTxn.startedFrom.resourceName, 'SlowResource');
-		assert.equal(lastTxn.startedFrom.method, 'get');
-		assert.equal(lastTxn.timeout, 20);
+		if (SlowResource.primaryStore instanceof RocksDatabase) {
+			assert.equal(lastTxn.startedFrom.resourceName, 'SlowResource');
+			assert.equal(lastTxn.startedFrom.method, 'get');
+			assert.equal(lastTxn.timeout, 20);
+		}
 		await Promise.race([delay(50), result]);
 		assert(performedDBInteractions);
 		assert.equal(trackedTxns.size, existingTxns);

package/core/unitTests/resources/vectorIndex.test.js

@@ -3,6 +3,7 @@ const { table } = require('#src/resources/databases');
 const { HierarchicalNavigableSmallWorld } = require('#src/resources/indexes/HierarchicalNavigableSmallWorld');
 
 describe('HierarchicalNavigableSmallWorld indexing', () => {
+	if (process.env.HARPER_STORAGE_ENGINE === 'lmdb') return; // don't try to test lmdb
 	let HNSWTest;
 	let testInstance = new HierarchicalNavigableSmallWorld();
 	let all = [];

package/core/unitTests/testApp/resources.js

@@ -163,6 +163,36 @@ tables.CacheOfResource.sourcedFrom({
 	},
 });
 
+// test transparent HTTP caching straight through
+tables.CacheOfHttp.sourcedFrom({
+	async get(target) {
+		switch (target) {
+			case 'direct-fetch':
+				return fetch(`http://localhost:9926/FourProp/2`);
+			case 'fetch-body':
+				const response = await fetch(`http://localhost:9926/FourProp/2`);
+				return new Response(response.body, {
+					headers: {
+						'Content-Type': 'text/plain',
+					},
+				});
+			case 'created-response':
+				return new Response('test', {
+					headers: { 'x-custom-header': 'custom value', 'cache-control': 'max-age=10, s-maxage=20' },
+				});
+			case 'html-response':
+				return new Response('<html>test</html>', {
+					headers: { 'content-type': 'text/html' },
+				});
+			case 'headers-in-data':
+				return {
+					headers: { 'x-custom-header': 'custom value' },
+					name: 'test-sibling-to-headers',
+				};
+		}
+	},
+});
+
 export class FourPropWithHistory extends tables.FourProp {
 	async subscribe(options) {
 		let context = this.getContext();

package/core/unitTests/testApp/schema.graphql

@@ -56,6 +56,11 @@ type SimpleCache @table {
 type CacheOfResource @table @export {
 	id: ID @primaryKey
 }
+type CacheOfHttp @table @export {
+	headers: Any
+	data: Any
+	body: Blob
+}
 
 type HasBigInt @table @export {
 	id: BigInt @primaryKey

package/core/unitTests/utility/operationPermissions.test.js

@@ -0,0 +1,107 @@
+'use strict';
+
+const assert = require('assert');
+const terms = require('#src/utility/hdbTerms');
+const { OPERATION_PERMISSION_GROUPS, expandOperationsPerms } = require('#src/utility/operationPermissions');
+
+describe('operationPermissions', function () {
+	describe('OPERATION_PERMISSION_GROUPS', function () {
+		it('read_only contains expected read operations', function () {
+			const ops = OPERATION_PERMISSION_GROUPS.read_only;
+			assert.ok(ops.includes(terms.OPERATIONS_ENUM.SEARCH));
+			assert.ok(ops.includes(terms.OPERATIONS_ENUM.SQL));
+			assert.ok(ops.includes(terms.OPERATIONS_ENUM.DESCRIBE_ALL));
+			assert.ok(ops.includes(terms.OPERATIONS_ENUM.USER_INFO));
+		});
+
+		it('read_only does not contain write operations', function () {
+			const ops = OPERATION_PERMISSION_GROUPS.read_only;
+			assert.ok(!ops.includes(terms.OPERATIONS_ENUM.INSERT));
+			assert.ok(!ops.includes(terms.OPERATIONS_ENUM.UPDATE));
+			assert.ok(!ops.includes(terms.OPERATIONS_ENUM.DELETE));
+			assert.ok(!ops.includes(terms.OPERATIONS_ENUM.CSV_DATA_LOAD));
+		});
+
+		it('standard_user contains everything in read_only', function () {
+			const readOnly = new Set(OPERATION_PERMISSION_GROUPS.read_only);
+			for (const op of readOnly) {
+				assert.ok(OPERATION_PERMISSION_GROUPS.standard_user.includes(op), `standard_user missing read_only op: ${op}`);
+			}
+		});
+
+		it('standard_user contains data manipulation operations', function () {
+			const ops = OPERATION_PERMISSION_GROUPS.standard_user;
+			assert.ok(ops.includes(terms.OPERATIONS_ENUM.INSERT));
+			assert.ok(ops.includes(terms.OPERATIONS_ENUM.UPDATE));
+			assert.ok(ops.includes(terms.OPERATIONS_ENUM.UPSERT));
+			assert.ok(ops.includes(terms.OPERATIONS_ENUM.DELETE));
+		});
+
+		it('standard_user does not contain token management operations', function () {
+			const ops = OPERATION_PERMISSION_GROUPS.standard_user;
+			assert.ok(!ops.includes(terms.OPERATIONS_ENUM.CREATE_AUTHENTICATION_TOKENS));
+			assert.ok(!ops.includes(terms.OPERATIONS_ENUM.REFRESH_OPERATION_TOKEN));
+		});
+
+		it('standard_user does not contain schema DDL operations', function () {
+			const ops = OPERATION_PERMISSION_GROUPS.standard_user;
+			assert.ok(!ops.includes(terms.OPERATIONS_ENUM.CREATE_ATTRIBUTE));
+		});
+
+		it('admin_read contains elevated read operations', function () {
+			const ops = OPERATION_PERMISSION_GROUPS.admin_read;
+			assert.ok(ops.includes(terms.OPERATIONS_ENUM.GET_CONFIGURATION));
+			assert.ok(ops.includes(terms.OPERATIONS_ENUM.READ_LOG));
+			assert.ok(ops.includes(terms.OPERATIONS_ENUM.READ_AUDIT_LOG));
+			assert.ok(ops.includes(terms.OPERATIONS_ENUM.GET_CUSTOM_FUNCTIONS));
+			assert.ok(ops.includes(terms.OPERATIONS_ENUM.GET_COMPONENTS));
+		});
+
+		it('admin_read does not contain data write operations', function () {
+			const ops = OPERATION_PERMISSION_GROUPS.admin_read;
+			assert.ok(!ops.includes(terms.OPERATIONS_ENUM.INSERT));
+			assert.ok(!ops.includes(terms.OPERATIONS_ENUM.DELETE));
+		});
+	});
+
+	describe('expandOperationsPerms()', function () {
+		it('expands a group name to its member operations', function () {
+			const result = expandOperationsPerms(['read_only']);
+			assert.ok(result instanceof Set);
+			assert.ok(result.has(terms.OPERATIONS_ENUM.SEARCH));
+			assert.ok(result.has(terms.OPERATIONS_ENUM.SQL));
+			assert.ok(result.has(terms.OPERATIONS_ENUM.DESCRIBE_ALL));
+			assert.ok(result.has(terms.OPERATIONS_ENUM.USER_INFO));
+		});
+
+		it('group does not include write operations', function () {
+			const result = expandOperationsPerms(['read_only']);
+			assert.ok(!result.has(terms.OPERATIONS_ENUM.INSERT));
+			assert.ok(!result.has(terms.OPERATIONS_ENUM.UPDATE));
+			assert.ok(!result.has(terms.OPERATIONS_ENUM.DELETE));
+			assert.ok(!result.has(terms.OPERATIONS_ENUM.CSV_DATA_LOAD));
+		});
+
+		it('passes through an individual operation name directly', function () {
+			const result = expandOperationsPerms([terms.OPERATIONS_ENUM.RESTART]);
+			assert.ok(result.has(terms.OPERATIONS_ENUM.RESTART));
+			assert.equal(result.size, 1);
+		});
+
+		it('combines a group and individual operations into a union set', function () {
+			const result = expandOperationsPerms([
+				'read_only',
+				terms.OPERATIONS_ENUM.RESTART,
+				terms.OPERATIONS_ENUM.LIST_USERS,
+			]);
+			assert.ok(result.has(terms.OPERATIONS_ENUM.SEARCH));
+			assert.ok(result.has(terms.OPERATIONS_ENUM.RESTART));
+			assert.ok(result.has(terms.OPERATIONS_ENUM.LIST_USERS));
+		});
+
+		it('returns an empty set for an empty array', function () {
+			const result = expandOperationsPerms([]);
+			assert.equal(result.size, 0);
+		});
+	});
+});

package/core/unitTests/utility/operation_authorization.test.js

@@ -16,8 +16,11 @@ const write = require('#js/dataLayer/insert');
 const user = require('#src/security/user');
 const alasql = require('alasql');
 const search = require('#js/dataLayer/search');
+const restart = require('#js/bin/restart');
+const configUtils = require('#js/config/configUtils');
 const jobs = require('#js/server/jobs/jobs');
 const terms = require('#src/utility/hdbTerms');
+
 const schema = require('#js/dataLayer/schema');
 const PermissionResponseObject = require('#js/security/data_objects/PermissionResponseObject');
 const PermissionTableResponseObject = require('#js/security/data_objects/PermissionTableResponseObject');
@@ -1490,3 +1493,130 @@ describe('Test operation_authorization', function () {
 		});
 	});
 });
+
+describe('Test operations permissions', function () {
+	before(() => {
+		global.hdb_schema = global.hdb_schema || {};
+		testUtils.setGlobalSchema('id', TEST_SCHEMA, TEST_TABLE, TEST_ATTRIBUTES);
+	});
+
+	after(() => {
+		global.hdb_schema = undefined;
+	});
+
+	// Helper: build a verifyPerms request JSON with operations set
+	function makeOpUserRequest(operations, tablePerms = {}) {
+		const req = getRequestJson(TEST_JSON);
+		req.hdb_user.role.permission = {
+			super_user: false,
+			operations: operations,
+			[TEST_SCHEMA]: {
+				describe: true,
+				tables: {
+					[TEST_TABLE]: {
+						describe: true,
+						read: true,
+						insert: false,
+						update: false,
+						delete: false,
+						attribute_permissions: [],
+						...tablePerms,
+					},
+				},
+			},
+		};
+		return req;
+	}
+
+	// Helper: build a request for a schema-less SU-only operation
+	function makeOpUserSystemRequest(operations) {
+		return {
+			operation: 'restart',
+			hdb_user: {
+				active: true,
+				role: {
+					id: 'op-user-test-id',
+					permission: {
+						super_user: false,
+						operations: operations,
+					},
+					role: 'op_test_role',
+					__updatedtime__: (roleUpdatedTimeCounter += 1),
+				},
+				username: 'op_test_user',
+			},
+		};
+	}
+
+	describe('verifyPerms() — operations allowlist', function () {
+		it('(NOMINAL) op in read_only group with table READ perm — search allowed', function () {
+			const req_json = makeOpUserRequest(['read_only'], { read: true });
+			req_json.operation = terms.OPERATIONS_ENUM.SEARCH_BY_CONDITIONS;
+			const result = op_auth.verifyPerms(req_json, search.searchByConditions.name);
+			assert.equal(result, null);
+		});
+
+		it('op NOT in operations list — insert blocked even with table perms', function () {
+			const req_json = makeOpUserRequest(['read_only'], { insert: true });
+			const result = op_auth.verifyPerms(req_json, write.insert.name);
+			assert.notEqual(result, null);
+			assert.equal(result.unauthorized_access.length, 1);
+			// Error message uses the API name (terms.OPERATIONS_ENUM.INSERT = 'insert'), not the internal
+			// function name (write.insert.name = 'insertData'), because that's what users put in operations.
+			assert.ok(
+				JSON.stringify(result).includes(TEST_OPERATION_AUTH_ERROR.OP_NOT_IN_OPERATIONS(terms.OPERATIONS_ENUM.INSERT))
+			);
+		});
+
+		it('SU-only op in operations — restart granted without super_user', function () {
+			const req_json = makeOpUserSystemRequest([terms.OPERATIONS_ENUM.RESTART]);
+			const result = op_auth.verifyPerms(req_json, restart.restart.name);
+			assert.equal(result, null);
+		});
+
+		it('SU-only op NOT in operations — restart denied', function () {
+			const req_json = makeOpUserSystemRequest(['read_only']);
+			const result = op_auth.verifyPerms(req_json, restart.restart.name);
+			assert.notEqual(result, null);
+			assert.equal(result.unauthorized_access.length, 1);
+		});
+
+		it('get_configuration granted via operations (SU-only bypass)', function () {
+			const req_json = makeOpUserSystemRequest([terms.OPERATIONS_ENUM.GET_CONFIGURATION]);
+			req_json.operation = terms.OPERATIONS_ENUM.GET_CONFIGURATION;
+			const result = op_auth.verifyPerms(req_json, configUtils.getConfiguration.name);
+			assert.equal(result, null);
+		});
+
+		it('dual gate — op in operations but table READ perm false — search denied at CRUD level', function () {
+			const req_json = makeOpUserRequest(['read_only'], { read: false });
+			req_json.operation = terms.OPERATIONS_ENUM.SEARCH;
+			const result = op_auth.verifyPerms(req_json, search.search.name);
+			assert.notEqual(result, null);
+		});
+
+		it('no operations set — SU-only op still denied for non-SU user (no regression)', function () {
+			const req_json = {
+				operation: terms.OPERATIONS_ENUM.RESTART,
+				hdb_user: {
+					active: true,
+					role: {
+						id: 'plain-role-id',
+						permission: { super_user: false },
+						role: 'plain_role',
+						__updatedtime__: (roleUpdatedTimeCounter += 1),
+					},
+					username: 'plain_user',
+				},
+			};
+			const result = op_auth.verifyPerms(req_json, restart.restart.name);
+			assert.notEqual(result, null);
+			assert.equal(result.unauthorized_access.length, 1);
+		});
+
+		it('no operations set — normal data op works as before (no regression)', function () {
+			const result = op_auth.verifyPerms(TEST_JSON, write.insert.name);
+			assert.equal(result, null);
+		});
+	});
+});