@indigoai-us/hq-cloud 6.12.4 → 6.13.0

package/dist/bin/sync-runner.test.js

@@ -2877,6 +2877,41 @@ describe("resolvePullScope", () => {
         expect(scope.syncMode).toBe("shared");
         expect(scope.prefixSet).toEqual(["knowledge/", "shared/"]);
     });
+    // Regression lock-in (Michal / ridge report): a non-owner member whose
+    // ONLY grant is a COMPANY-WIDE write grant (surfaced by the server as
+    // `source: "open"`) on a projects prefix — and who has NO direct
+    // person/group/email grant — MUST resolve a non-empty shared scope that
+    // COVERS that prefix. The reported bug was the push resolving an empty/
+    // sparse prefixSet here (ignoring company-wide grants), so every file was
+    // scope-excluded (403 SCOPE_EXCEEDS_PARENT on old clients, silent no-op on
+    // 5.54.1). resolvePullScope treats a company-wide `open` grant identically
+    // to a direct grant; this test guards against a future filter that drops
+    // `source: "open"` and re-introduces the silent-drop regression.
+    it("honors a company-wide-only write grant as the shared push scope (no empty-prune)", async () => {
+        const scope = await resolvePullScope(stubClient({
+            listMyMemberships: async () => [membership("cmp_a", "mk_a")],
+            getMembershipSyncConfig: async () => ({
+                membershipId: "mk_a",
+                syncMode: "shared",
+                isDefault: false,
+            }),
+            // Exactly one grant, company-wide WRITE, no direct grant.
+            listMyExplicitGrants: async () => [
+                {
+                    companyUid: "cmp_a",
+                    path: "projects/alpha/",
+                    permission: "write",
+                    source: "open",
+                },
+            ],
+        }), "cmp_a", "acme");
+        expect(scope.syncMode).toBe("shared");
+        // The granted prefix is present — NOT an empty set (which would scope-
+        // exclude every file and silently push nothing).
+        expect(scope.prefixSet).toEqual(["projects/alpha/"]);
+        expect(scope.prefixSet).not.toEqual([]);
+        expect(scope.prefixSet?.length).toBeGreaterThan(0);
+    });
     it("normalizes real-world mixed/glob grant paths into company-relative prefixes", async () => {
         // The exact shapes observed in the live hq-pro vault for `indigo`:
         // bare glob, full-anchored + /*, full-anchored exact file, slug-anchored