@homeflare/alchemy 0.50.0 → 0.52.0

package/src/unifi/wire-guard-anchor.test.ts

@@ -0,0 +1,198 @@
+/**
+ * The wire guard's ANCHORING, redirect handling and redaction — red team round 1 on PR 377.
+ * The first block runs a real `Bun.serve` through the real `FetchHttpClient` (no fake fetch), because
+ * the redirect finding is about what real fetch does with the fiber's `RequestInit`.
+ */
+import { afterAll, describe, expect, test } from 'bun:test';
+import * as Cause from 'effect/Cause';
+import * as Effect from 'effect/Effect';
+import * as Exit from 'effect/Exit';
+import * as FetchHttpClient from 'effect/http/FetchHttpClient';
+import * as HttpClient from 'effect/http/HttpClient';
+import * as HttpClientRequest from 'effect/http/HttpClientRequest';
+import { networkAllowedWrite } from './network.ts';
+import { GetOnlyHttpClient, UnifiRefusedRequest, guardedHttpClient } from './wire-guard.ts';
+
+const hits: Array<{ method: string; path: string }> = [];
+let status = 307;
+const server = Bun.serve({
+  port: 0,
+  hostname: '127.0.0.1',
+  fetch(req) {
+    const u = new URL(req.url);
+    hits.push({ method: req.method, path: u.pathname + u.search });
+    return u.pathname.endsWith('/networks/n')
+      ? new Response(null, { status, headers: { location: '/elsewhere/v1/sites/s/networks/O' } })
+      : Response.json({ ok: true });
+  },
+});
+afterAll(() => server.stop(true));
+
+const ROOT = '/proxy/network/integration';
+const PORT = server.port as number;
+const BASE = `http://127.0.0.1:${PORT}${ROOT}`;
+const ALLOW = [networkAllowedWrite({ siteId: 's', networkId: 'n' } as never)];
+
+const call = (
+  method: string,
+  url: string,
+  base: string | null = BASE,
+  outer: FetchHttpClient.RequestInit['Service'] = {},
+) =>
+  Effect.runPromiseExit(
+    Effect.gen(function* () {
+      const client = yield* HttpClient.HttpClient;
+      return yield* client.execute(
+        HttpClientRequest.make(method as never)(url).pipe(
+          HttpClientRequest.bodyText('{"x":1}', 'application/json'),
+        ),
+      );
+    }).pipe(
+      Effect.provide(guardedHttpClient(ALLOW, base ?? undefined)),
+      // ⛔ An OUTER RequestInit on the calling fiber: `layerMergedContext` lets it replace the guard's.
+      Effect.provideService(FetchHttpClient.RequestInit, outer),
+      Effect.provide(FetchHttpClient.layer),
+    ),
+  );
+
+const refusal = (exit: Exit.Exit<unknown, unknown>) => {
+  expect(Exit.isFailure(exit)).toBe(true);
+  if (!Exit.isFailure(exit)) throw new Error('unreachable');
+  expect(Cause.hasDies(exit.cause)).toBe(true);
+  const defect = Cause.squash(exit.cause);
+  expect(defect).toBeInstanceOf(UnifiRefusedRequest);
+  return defect as UnifiRefusedRequest;
+};
+
+describe('redirect: manual survives an OUTER FetchHttpClient.RequestInit', () => {
+  test('outer RequestInit, real 307 => exactly one request, then the refusal', async () => {
+    status = 307;
+    hits.length = 0;
+    const exit = await call('PUT', `${BASE}/v1/sites/s/networks/n`, BASE, {
+      keepalive: false,
+    });
+    expect(refusal(exit).message).toContain('307 redirect');
+    expect(hits).toEqual([{ method: 'PUT', path: `${ROOT}/v1/sites/s/networks/n` }]);
+  });
+
+  // ⚠️ Mutation gap: narrowing the 3xx check to 307 only. Real fetch with redirect:manual returns
+  //   each of these as-is, and the guard must refuse every one.
+  test.each([301, 302, 303, 307, 308])('a %d answer is refused', async (code) => {
+    status = code;
+    hits.length = 0;
+    refusal(await call('PUT', `${BASE}/v1/sites/s/networks/n`));
+    expect(hits).toHaveLength(1);
+  });
+
+  test('a 3xx answer to HEAD is refused too (HEAD is not GET)', async () => {
+    status = 302;
+    // HEAD is not on the allow list, so it dies at the request guard before any redirect exists.
+    hits.length = 0;
+    refusal(await call('HEAD', `${BASE}/v1/sites/s/networks/n`));
+    expect(hits).toEqual([]);
+  });
+});
+
+describe('a 3xx answer to a GET is refused under BOTH postures (2026-10-10 symmetry fix)', () => {
+  // ⛔ ROUND-2 FINDING: `redirect: 'manual'` was scoped to a non-empty allow list, so reconcile's
+  //   OWN GETs surfaced a raw 3xx and failed the SDK decode, while read/diff's GETs silently
+  //   followed it. Both postures must behave identically — and a followed GET re-sends the request,
+  //   API-key header included, to a URL the guard never vetted — so both refuse it, never follow.
+  //   Real fetch, no fake: the point is what fetch does with the fiber's `RequestInit`.
+  test.each([
+    ['GetOnlyHttpClient (read/diff/delete)', () => GetOnlyHttpClient],
+    ['the row allow list (reconcile)', () => guardedHttpClient(ALLOW, BASE)],
+  ])('%s: refused, never followed', async (_n, layer) => {
+    status = 301;
+    hits.length = 0;
+    const exit = await Effect.runPromiseExit(
+      Effect.gen(function* () {
+        const client = yield* HttpClient.HttpClient;
+        return yield* client.execute(HttpClientRequest.get(`${BASE}/v1/sites/s/networks/n`));
+      }).pipe(Effect.provide(layer()), Effect.provide(FetchHttpClient.layer)),
+    );
+    const defect = refusal(exit);
+    expect(defect.method).toBe('GET');
+    expect(defect.message).toContain('301 redirect');
+    // Exactly ONE request reached the server: the redirect was never followed.
+    expect(hits).toEqual([{ method: 'GET', path: `${ROOT}/v1/sites/s/networks/n` }]);
+  });
+});
+
+describe('the allowed path is anchored to the configured base URL', () => {
+  test('the exact route passes', async () => {
+    status = 200;
+    hits.length = 0;
+    expect(Exit.isSuccess(await call('PUT', `${BASE}/v1/sites/s/networks/n`))).toBe(true);
+    expect(hits).toHaveLength(1);
+  });
+
+  test.each([
+    ['a query string', `${ROOT}/v1/sites/s/networks/n?force=true`],
+    ['a nested route', `${ROOT}/v1/sites/OTHER/v1/sites/s/networks/n`],
+    ['a doubled slash', `${ROOT}//v1/sites/s/networks/n`],
+    ['a doubled slash at the root', `//v1/sites/s/networks/n`],
+    ['a trailing slash', `${ROOT}/v1/sites/s/networks/n/`],
+    ['a fragment', `${ROOT}/v1/sites/s/networks/n#frag`],
+    ['a different base path', `/totally/different/v1/sites/s/networks/n`],
+  ])('%s is refused before the transport', async (_n, path) => {
+    status = 200;
+    hits.length = 0;
+    refusal(await call('PUT', `http://127.0.0.1:${PORT}${path}`));
+    expect(hits).toEqual([]);
+  });
+
+  test('another origin is refused even with the right path', async () => {
+    hits.length = 0;
+    refusal(await call('PUT', `http://127.0.0.1:${PORT + 1}${ROOT}/v1/sites/s/networks/n`));
+    expect(hits).toEqual([]);
+  });
+
+  test('no configured base URL allows nothing (fail closed)', async () => {
+    hits.length = 0;
+    refusal(await call('PUT', `${BASE}/v1/sites/s/networks/n`, null));
+    expect(hits).toEqual([]);
+  });
+
+  // ⚠️ Mutation gap: a regex-escaped id. A `.` in an id must be literal, never "any character".
+  test('an id is compared as text, never as a pattern', async () => {
+    status = 200;
+    const dotted = [networkAllowedWrite({ siteId: 's', networkId: 'a.c' } as never)];
+    const run = (id: string) =>
+      Effect.runPromiseExit(
+        Effect.gen(function* () {
+          const client = yield* HttpClient.HttpClient;
+          return yield* client.execute(
+            HttpClientRequest.put(`${BASE}/v1/sites/s/networks/${id}`).pipe(
+              HttpClientRequest.bodyText('{}', 'application/json'),
+            ),
+          );
+        }).pipe(
+          Effect.provide(guardedHttpClient(dotted, BASE)),
+          Effect.provide(FetchHttpClient.layer),
+        ),
+      );
+    expect(Exit.isSuccess(await run('a.c'))).toBe(true);
+    refusal(await run('abc'));
+  });
+});
+
+describe('refusal messages redact the cloud connector Console ID', () => {
+  test('the segment after consoles/ never reaches the message or the path field', async () => {
+    const cloud =
+      'https://api.ui.com/v1/connector/consoles/SECRET-CONSOLE-ID/proxy/network/integration';
+    const exit = await Effect.runPromiseExit(
+      Effect.gen(function* () {
+        const client = yield* HttpClient.HttpClient;
+        return yield* client.execute(HttpClientRequest.put(`${cloud}/v1/sites/s/networks/OTHER`));
+      }).pipe(
+        Effect.provide(guardedHttpClient(ALLOW, cloud)),
+        Effect.provide(FetchHttpClient.layer),
+      ),
+    );
+    const defect = refusal(exit);
+    expect(defect.message).not.toContain('SECRET-CONSOLE-ID');
+    expect(defect.path).not.toContain('SECRET-CONSOLE-ID');
+    expect(defect.path).toContain('/consoles/<redacted>/proxy/network/integration');
+  });
+});

package/src/unifi/wire-guard-round2.test.ts

@@ -0,0 +1,120 @@
+/**
+ * Red team round 2 on PR 377, against the wire guard: an OUTER `RequestInit` that tries to turn
+ * redirects back on (F2), a consumer transform that replaces `manual` (F3, the response-URL
+ * backstop) and a query parameter added with `setUrlParam` (F5). Real `Bun.serve` + real fetch.
+ */
+import { afterAll, describe, expect, test } from 'bun:test';
+import * as Cause from 'effect/Cause';
+import * as Effect from 'effect/Effect';
+import * as Exit from 'effect/Exit';
+import * as Layer from 'effect/Layer';
+import * as FetchHttpClient from 'effect/http/FetchHttpClient';
+import * as HttpClient from 'effect/http/HttpClient';
+import * as HttpClientRequest from 'effect/http/HttpClientRequest';
+import { networkAllowedWrite } from './network.ts';
+import { UnifiRefusedRequest, guardedHttpClient } from './wire-guard.ts';
+
+const hits: Array<{ method: string; path: string }> = [];
+const server = Bun.serve({
+  port: 0,
+  hostname: '127.0.0.1',
+  fetch(req) {
+    const u = new URL(req.url);
+    hits.push({ method: req.method, path: u.pathname + u.search });
+    return u.pathname.endsWith('/networks/n')
+      ? new Response(null, {
+          status: 307,
+          headers: { location: '/elsewhere/v1/sites/s/networks/O' },
+        })
+      : Response.json({ ok: true });
+  },
+});
+afterAll(() => server.stop(true));
+
+const BASE = `http://127.0.0.1:${server.port}/proxy/network/integration`;
+const ALLOW = [networkAllowedWrite({ siteId: 's', networkId: 'n' } as never)];
+const PUT = () =>
+  HttpClientRequest.put(`${BASE}/v1/sites/s/networks/n`).pipe(
+    HttpClientRequest.bodyText('{"x":1}', 'application/json'),
+  );
+
+const defectOf = (exit: Exit.Exit<unknown, unknown>) => {
+  expect(Exit.isFailure(exit)).toBe(true);
+  if (!Exit.isFailure(exit)) throw new Error('unreachable');
+  expect(Cause.hasDies(exit.cause)).toBe(true);
+  const defect = Cause.squash(exit.cause);
+  expect(defect).toBeInstanceOf(UnifiRefusedRequest);
+  return defect as UnifiRefusedRequest;
+};
+
+describe('an OUTER RequestInit that asks to follow redirects (F2)', () => {
+  test('redirect stays manual, and keepalive plus a tls option still reach fetch', async () => {
+    hits.length = 0;
+    const inits: Array<RequestInit & { tls?: unknown }> = [];
+    const spy = ((url: string | URL | Request, init?: RequestInit) => {
+      inits.push((init ?? {}) as RequestInit);
+      return fetch(url, init);
+    }) as typeof fetch;
+    const exit = await Effect.runPromiseExit(
+      HttpClient.HttpClient.pipe(
+        Effect.flatMap((client) => client.execute(PUT())),
+        Effect.provide(guardedHttpClient(ALLOW, BASE)),
+        Effect.provideService(FetchHttpClient.RequestInit, {
+          redirect: 'follow',
+          keepalive: true,
+          tls: { rejectUnauthorized: false },
+        } as never),
+        Effect.provideService(FetchHttpClient.Fetch, spy),
+        Effect.provide(FetchHttpClient.layer),
+      ),
+    );
+    expect(defectOf(exit).message).toContain('307 redirect');
+    expect(hits).toHaveLength(1);
+    expect(inits).toHaveLength(1);
+    expect(inits[0]?.redirect).toBe('manual');
+    expect(inits[0]?.keepalive).toBe(true);
+    expect(inits[0]?.tls).toEqual({ rejectUnauthorized: false });
+  });
+});
+
+describe('a consumer transform that replaces RequestInit without merging (F3 backstop)', () => {
+  test('a followed redirect dies on the response URL, even though manual was lost', async () => {
+    hits.length = 0;
+    const consumer = Layer.effect(
+      HttpClient.HttpClient,
+      Effect.map(HttpClient.HttpClient, (client) =>
+        HttpClient.transform(client, (effect) =>
+          Effect.provideService(effect, FetchHttpClient.RequestInit, { redirect: 'follow' }),
+        ),
+      ),
+    ).pipe(Layer.provide(FetchHttpClient.layer));
+    const exit = await Effect.runPromiseExit(
+      HttpClient.HttpClient.pipe(
+        Effect.flatMap((client) => client.execute(PUT())),
+        Effect.provide(guardedHttpClient(ALLOW, BASE)),
+        Effect.provide(consumer),
+      ),
+    );
+    // The redirect WAS followed (the consumer's transform won), so a second request hit the server...
+    expect(hits.map((h) => h.path)).toContain('/elsewhere/v1/sites/s/networks/O');
+    // ...but the guard refuses to hand the answer back as a success.
+    expect(defectOf(exit).message).toContain('response URL differs');
+  });
+});
+
+describe('query parameters added with setUrlParam (F5)', () => {
+  test('a PUT with ?force=true built by setUrlParam is refused before the transport', async () => {
+    hits.length = 0;
+    const exit = await Effect.runPromiseExit(
+      HttpClient.HttpClient.pipe(
+        Effect.flatMap((client) =>
+          client.execute(PUT().pipe(HttpClientRequest.setUrlParam('force', 'true'))),
+        ),
+        Effect.provide(guardedHttpClient(ALLOW, BASE)),
+        Effect.provide(FetchHttpClient.layer),
+      ),
+    );
+    defectOf(exit);
+    expect(hits).toEqual([]);
+  });
+});

package/src/unifi/wire-guard.test.ts

@@ -0,0 +1,218 @@
+/**
+ * `guardedHttpClient` (`wire-guard.ts`, B0a/T12) in isolation — against a bare `HttpClient`
+ * service, no `CredentialsFromEnv`, no real SDK operation — plus its installation in
+ * `unifiHandlers`. A `GET` reaches the wrapped transport; any other method dies with
+ * `UnifiRefusedRequest` BEFORE the fake server sees it (`fake.seen` stays empty) unless the row's
+ * allow entry names exactly that `(method, path)`.
+ *
+ * ⚠️ HISTORY (2026-09-26, red team, IMPORTANT-1): deleting `Effect.provide(GetOnlyHttpClient)` from
+ *   `withCredentials` once left every test green, because the family tests call `unifiOperations`
+ *   directly and bypass `unifiHandlers`. The `unifiHandlers` block below drives the real handler
+ *   entry points through a `ConfigProvider` override (the pattern `opnsense/write-refusal.test.ts`
+ *   uses for `CredentialsFromEnv`), so it fails if a guard is ever removed from `withCredentials`.
+ * ★ `fakeUnifi` records `seen` BEFORE calling `route`, so even a route that would throw still proves
+ *   whether the guard let a request through — the assertions are on `seen`, never on a caught throw.
+ */
+import { describe, expect, test } from 'bun:test';
+import * as Cause from 'effect/Cause';
+import * as ConfigProvider from 'effect/ConfigProvider';
+import * as Effect from 'effect/Effect';
+import * as Exit from 'effect/Exit';
+import * as Layer from 'effect/Layer';
+import * as HttpClient from 'effect/http/HttpClient';
+import type * as HttpClientError from 'effect/http/HttpClientError';
+import * as HttpClientRequest from 'effect/http/HttpClientRequest';
+import { FAKE_BASE, FAKE_KEY, fakeUnifi, fakeUnifiLayer } from './fake-unifi.ts';
+import { networkAllowedWrite } from './network.ts';
+import { type UnifiSpec, unifiHandlers } from './resource.ts';
+import { GetOnlyHttpClient, UnifiRefusedRequest, guardedHttpClient } from './wire-guard.ts';
+
+const ROOT = '/proxy/network/integration';
+const NET_PATH = `${ROOT}/v1/sites/s/networks/n`;
+const ALLOW = [networkAllowedWrite({ siteId: 's', networkId: 'n' } as never)];
+const url = (path: string) => `https://unifi.example.com${path}`;
+
+const send = (
+  method: string,
+  path: string,
+  fetchFn: typeof globalThis.fetch,
+  guard: Layer.Layer<HttpClient.HttpClient, never, HttpClient.HttpClient>,
+) =>
+  Effect.runPromiseExit(
+    Effect.gen(function* () {
+      const client = yield* HttpClient.HttpClient;
+      return yield* client.execute(HttpClientRequest.make(method as never)(url(path)));
+    }).pipe(Effect.provide(guard), Effect.provide(fakeUnifiLayer(fetchFn))),
+  );
+
+const expectRefused = (exit: Exit.Exit<unknown, unknown>, method?: string) => {
+  expect(Exit.isFailure(exit)).toBe(true);
+  if (!Exit.isFailure(exit)) return;
+  expect(Cause.hasDies(exit.cause)).toBe(true);
+  expect(Cause.hasFails(exit.cause)).toBe(false);
+  const defect = Cause.squash(exit.cause);
+  expect(defect).toBeInstanceOf(UnifiRefusedRequest);
+  if (method) expect((defect as UnifiRefusedRequest).method).toBe(method);
+};
+
+const neverReached = (what: string) =>
+  fakeUnifi(() => {
+    throw new Error(`wire-guard.test.ts: unexpected ${what} reached the fake transport`);
+  });
+
+describe('GetOnlyHttpClient (empty allow list)', () => {
+  test("a GET passes through and reaches the transport under redirect: 'manual' (LOW-7)", async () => {
+    const fake = fakeUnifi(() => Response.json({ ok: true }));
+    const exit = await send('GET', `${ROOT}/v1/sites/s/networks`, fake.fetch, GetOnlyHttpClient);
+    expect(Exit.isSuccess(exit)).toBe(true);
+    // 'manual' on GETs is DELIBERATE since 2026-10-10: the response guard refuses a GET's 3xx too,
+    // and under the default 'follow' the guard would never see it (the redirect would be followed).
+    expect(fake.seen).toEqual([
+      { method: 'GET', path: `${ROOT}/v1/sites/s/networks`, redirect: 'manual' },
+    ]);
+  });
+
+  test.each(['POST', 'PUT', 'PATCH', 'DELETE'])('%s dies before the transport', async (method) => {
+    const fake = neverReached(method);
+    expectRefused(await send(method, NET_PATH, fake.fetch, GetOnlyHttpClient), method);
+    // ⛔ THE PROOF: the transport never recorded the call -- refused in `mapRequestEffect`.
+    expect(fake.seen).toEqual([]);
+  });
+});
+
+describe('guardedHttpClient with the row allow entry', () => {
+  test('the one PUT to this row reaches the transport, with fetch redirect: manual', async () => {
+    const fake = fakeUnifi(() => Response.json({ ok: true }));
+    const exit = await send('PUT', NET_PATH, fake.fetch, guardedHttpClient(ALLOW, FAKE_BASE));
+    expect(Exit.isSuccess(exit)).toBe(true);
+    expect(fake.seen).toEqual([{ method: 'PUT', path: NET_PATH, redirect: 'manual' }]);
+  });
+
+  test.each([
+    ['the list route', 'PUT', `${ROOT}/v1/sites/s/networks`],
+    ['another network id', 'PUT', `${ROOT}/v1/sites/s/networks/other`],
+    ['an id this one is a prefix of', 'PUT', `${ROOT}/v1/sites/s/networks/n2`],
+    ['a sub-route of this network', 'PUT', `${NET_PATH}/extra`],
+    ['an id this one is a suffix of', 'PUT', `${ROOT}/v1/sites/s/networks/xn`],
+    ['another site', 'PUT', `${ROOT}/v1/sites/t/networks/n`],
+    ['another family', 'PUT', `${ROOT}/v1/sites/s/firewall/zones/z`],
+    ['POST on the row path', 'POST', NET_PATH],
+    ['PATCH on the row path', 'PATCH', NET_PATH],
+    ['DELETE on the row path', 'DELETE', NET_PATH],
+  ])('%s dies before the transport', async (_name, method, path) => {
+    const fake = neverReached(`${method} ${path}`);
+    expectRefused(
+      await send(method, path, fake.fetch, guardedHttpClient(ALLOW, FAKE_BASE)),
+      method,
+    );
+    expect(fake.seen).toEqual([]);
+  });
+
+  test('a 307 answer to the allowed PUT dies after exactly one request, never followed', async () => {
+    const fake = fakeUnifi(
+      () => new Response(null, { status: 307, headers: { location: 'https://evil.example/x' } }),
+    );
+    expectRefused(
+      await send('PUT', NET_PATH, fake.fetch, guardedHttpClient(ALLOW, FAKE_BASE)),
+      'PUT',
+    );
+    expect(fake.seen).toHaveLength(1);
+    expect(fake.seen[0]?.redirect).toBe('manual');
+  });
+});
+
+interface ProbeProps {
+  id: string;
+}
+
+/** A `fetchLive` that sends one raw request of the given method (not a real SDK operation). */
+const probeSpec = (
+  method: string,
+  withUpdate = false,
+): UnifiSpec<ProbeProps, ProbeProps, ProbeProps, HttpClientError.HttpClientError> => ({
+  type: 'Test.Probe',
+  describe: (props) => `probe/${props.id}`,
+  fetchLive: (props) =>
+    Effect.gen(function* () {
+      const client = yield* HttpClient.HttpClient;
+      yield* client.execute(HttpClientRequest.make(method as never)(`${FAKE_BASE}/probe`));
+      return props;
+    }),
+  attributes: (live) => live,
+  matches: () => true,
+  ...(withUpdate
+    ? {
+        update: {
+          allowedWrite: () => ({ method: 'PUT' as const, tail: '/probe' }),
+          patchKeys: [],
+          driftOf: () => [],
+          checkScope: () => Effect.void,
+          write: (live: ProbeProps) => Effect.succeed(live),
+        },
+      }
+    : {}),
+});
+
+const configProvider = ConfigProvider.layer(
+  ConfigProvider.fromUnknown({
+    UNIFI_NETWORK_API_BASE_URL: FAKE_BASE,
+    UNIFI_NETWORK_API_KEY: FAKE_KEY,
+  }),
+);
+const session = { note: () => Effect.void };
+const args = { news: { id: 'w1' }, olds: undefined, output: undefined, session };
+
+const runHandler = <A, E>(
+  effect: Effect.Effect<A, E, HttpClient.HttpClient>,
+  fetchFn: typeof globalThis.fetch,
+): Promise<Exit.Exit<A, E>> =>
+  Effect.runPromiseExit(
+    effect.pipe(Effect.provide(Layer.mergeAll(fakeUnifiLayer(fetchFn), configProvider))) as never,
+  ) as never;
+
+describe('guards are installed in unifiHandlers (IMPORTANT-1, red team 2026-09-26)', () => {
+  test('a GET through the real read entry point reaches the transport', async () => {
+    const fake = fakeUnifi(() => Response.json({ id: 'w1' }));
+    const exit = await runHandler(
+      unifiHandlers(probeSpec('GET')).read({ olds: { id: 'w1' }, output: undefined }),
+      fake.fetch,
+    );
+    expect(Exit.isSuccess(exit)).toBe(true);
+    expect(fake.seen).toEqual([{ method: 'GET', path: `${ROOT}/probe`, redirect: 'manual' }]);
+  });
+
+  test('read dies on a PUT even when the spec declares update (guard scope is reconcile only)', async () => {
+    const fake = neverReached('PUT');
+    const exit = await runHandler(
+      unifiHandlers(probeSpec('PUT', true)).read({ olds: { id: 'w1' }, output: undefined }),
+      fake.fetch,
+    );
+    expectRefused(exit, 'PUT');
+    expect(fake.seen).toEqual([]);
+  });
+
+  test('reconcile dies on a PUT when the spec has no update (firewall-zone style)', async () => {
+    const fake = neverReached('PUT');
+    expectRefused(await runHandler(unifiHandlers(probeSpec('PUT')).reconcile(args), fake.fetch));
+    expect(fake.seen).toEqual([]);
+  });
+
+  test('reconcile lets the allowed PUT through when the spec declares update', async () => {
+    const fake = fakeUnifi(() => Response.json({ id: 'w1' }));
+    const exit = await runHandler(
+      unifiHandlers(probeSpec('PUT', true)).reconcile(args),
+      fake.fetch,
+    );
+    expect(Exit.isSuccess(exit)).toBe(true);
+    expect(fake.seen.map((s) => s.method)).toEqual(['PUT']);
+  });
+
+  test('reconcile still dies on a POST even when the spec declares update', async () => {
+    const fake = neverReached('POST');
+    expectRefused(
+      await runHandler(unifiHandlers(probeSpec('POST', true)).reconcile(args), fake.fetch),
+      'POST',
+    );
+    expect(fake.seen).toEqual([]);
+  });
+});