@interop/was-conformance-suite 0.1.2 → 0.3.0

package/dist/suites/spaces-api.js

@@ -76,6 +76,7 @@ export const spacesApi = {
             id: 'repository.anonymous-list-empty',
             name: 'GET /spaces/ without auth headers returns the empty listing (200)',
             group: 'Spaces Repository API',
+            specRefs: ['https://wallet.storage/spec#list-spaces-operation'],
             run: async (ctx) => {
                 const { serverUrl } = ctx;
                 // List Spaces is the spec's exception to 404 masking: an anonymous
@@ -93,6 +94,7 @@ export const spacesApi = {
             id: 'repository.list-scoped-to-controller',
             name: '[root] GET /spaces/ lists only spaces controlled by the requester',
             group: 'Spaces Repository API',
+            specRefs: ['https://wallet.storage/spec#list-spaces-operation'],
             run: async (ctx, state) => {
                 const { serverUrl, createSpace, generateId } = ctx;
                 const { alice, bob } = state;
@@ -133,6 +135,7 @@ export const spacesApi = {
             id: 'repository.create-unauthorized-401',
             name: 'POST /spaces/ should 401 error when no authorization headers',
             group: 'Spaces Repository API',
+            specRefs: ['https://wallet.storage/spec#create-space-operation'],
             run: async (ctx) => {
                 const { serverUrl } = ctx;
                 const response = await fetch(new URL('/spaces/', serverUrl), {
@@ -142,10 +145,264 @@ export const spacesApi = {
                 assert.match(response.headers.get('content-type'), /application\/problem\+json/);
             }
         },
+        {
+            id: 'repository.create-missing-controller-400',
+            name: 'POST /spaces/ without a "controller" in the body yields invalid-request-body (400)',
+            group: 'Spaces Repository API',
+            specRefs: [
+                'https://wallet.storage/spec#create-space-errors',
+                'https://wallet.storage/spec#invalid-request-body'
+            ],
+            run: async (ctx, state) => {
+                const { createSpace, generateId } = ctx;
+                const { alice } = state;
+                // The `controller` requirement applies before any provisioning or
+                // capability concern, so this holds on both the onboarding-token and
+                // signed-zcap paths. The token path of createSpace() returns the
+                // status; the zcap path throws on non-2xx -- capture either shape.
+                let status, problem;
+                try {
+                    const response = await createSpace({
+                        spaceDescription: {
+                            id: generateId(),
+                            name: 'Space With No Controller'
+                        },
+                        rootClient: alice.rootClient
+                    });
+                    status = response.status;
+                    problem = response.data;
+                }
+                catch (err) {
+                    status = err.response?.status;
+                    problem = err.data;
+                }
+                assert.equal(status, 400);
+                assert.equal(problem.type, 'https://wallet.storage/spec#invalid-request-body');
+            }
+        },
+        {
+            id: 'repository.create-controller-mismatch-400',
+            name: "[root] POST /spaces/ signed by a key that is not the body's controller yields controller-mismatch (400)",
+            group: 'Spaces Repository API',
+            specRefs: [
+                'https://wallet.storage/spec#create-space-errors',
+                'https://wallet.storage/spec#controller-mismatch'
+            ],
+            run: async (ctx, state) => {
+                const { serverUrl, generateId } = ctx;
+                const { alice, bob } = state;
+                if (ctx.onboardingToken) {
+                    // With an onboarding token configured, the token itself vouches for
+                    // provisioning (delegated provisioning), so the signer-vs-body
+                    // consent check under test here is legitimately skipped.
+                    ctx.skip('onboarding token configured: token vouches for provisioning');
+                }
+                // Create Space is verified against the *body's* controller: Bob signs
+                // the invocation but names Alice as controller, with no delegation
+                // chain rooted in her -- the direct signer-mismatch shape.
+                const spaceId = generateId();
+                let expectedError;
+                try {
+                    await bob.rootClient.request({
+                        url: new URL('/spaces/', serverUrl).toString(),
+                        method: 'POST',
+                        action: 'POST',
+                        json: {
+                            id: spaceId,
+                            name: 'Space Bob Claims For Alice',
+                            controller: alice.did
+                        }
+                    });
+                }
+                catch (err) {
+                    expectedError = err;
+                }
+                assert.ok(expectedError, 'expected the mismatched create to fail');
+                assert.equal(expectedError.response.status, 400);
+                assert.equal(expectedError.data.type, 'https://wallet.storage/spec#controller-mismatch');
+                // The Space must not have been created: its named controller (Alice)
+                // would be able to read it if it had been.
+                let checkError;
+                try {
+                    await alice.rootClient.request({
+                        url: new URL(`/space/${spaceId}`, serverUrl).toString(),
+                        method: 'GET'
+                    });
+                }
+                catch (err) {
+                    checkError = err;
+                }
+                assert.ok(checkError, 'the rejected Space must not exist');
+                assert.equal(checkError.response.status, 404);
+            }
+        },
+        {
+            id: 'repository.create-invalid-id-400',
+            name: 'POST /spaces/ with a non-URL-safe space id yields invalid-id (400)',
+            group: 'Spaces Repository API',
+            specRefs: [
+                'https://wallet.storage/spec#identifiers',
+                'https://wallet.storage/spec#invalid-id'
+            ],
+            run: async (ctx, state) => {
+                const { createSpace } = ctx;
+                const { alice } = state;
+                // The id is carried in the request body (not the URL), so it reaches
+                // id validation rather than being reshaped by routing. A space
+                // character is outside the RFC 3986 unreserved set, so the id is not
+                // URL-safe (spec: Identifier Required Properties). Rejection precedes
+                // any provisioning concern, so this holds on both the onboarding-token
+                // and signed-zcap paths: the token path of createSpace() returns the
+                // status; the zcap path throws on non-2xx -- capture either shape.
+                let status, problem;
+                try {
+                    const response = await createSpace({
+                        spaceDescription: {
+                            id: 'a b',
+                            name: 'Space With An Unsafe Id',
+                            controller: alice.did
+                        },
+                        rootClient: alice.rootClient
+                    });
+                    status = response.status;
+                    problem = response.data;
+                }
+                catch (err) {
+                    status = err.response?.status;
+                    problem = err.data;
+                }
+                assert.equal(status, 400);
+                assert.equal(problem.type, 'https://wallet.storage/spec#invalid-id');
+            }
+        },
+        {
+            id: 'repository.create-controller-not-did-400',
+            name: 'POST /spaces/ whose body controller is not a DID is rejected (400 invalid-request-body)',
+            group: 'Spaces Repository API',
+            specRefs: [
+                'https://wallet.storage/spec#create-space-errors',
+                'https://wallet.storage/spec#invalid-request-body'
+            ],
+            run: async (ctx, state) => {
+                const { createSpace, generateId } = ctx;
+                const { alice } = state;
+                // A `controller` that is present but not a DID (here an https URL) is a
+                // malformed request body -- rejected before any provisioning concern,
+                // so this holds on both the onboarding-token and signed-zcap paths. The
+                // token path of createSpace() returns the status; the zcap path throws
+                // on non-2xx -- capture either shape.
+                let status, problem;
+                try {
+                    const response = await createSpace({
+                        spaceDescription: {
+                            id: generateId(),
+                            name: 'Space With A Non-DID Controller',
+                            controller: 'https://example.com/alice'
+                        },
+                        rootClient: alice.rootClient
+                    });
+                    status = response.status;
+                    problem = response.data;
+                }
+                catch (err) {
+                    status = err.response?.status;
+                    problem = err.data;
+                }
+                assert.equal(status, 400);
+                assert.equal(problem.type, 'https://wallet.storage/spec#invalid-request-body');
+            }
+        },
+        {
+            id: 'repository.create-delegated-201',
+            name: "[delegated] a provisioning app creates a Space on Alice's behalf via POST (201)",
+            group: 'Spaces Repository API',
+            specRefs: [
+                'https://wallet.storage/spec#create-space-operation',
+                'https://wallet.storage/spec#was-authorization-profile-v0-1'
+            ],
+            run: async (ctx, state) => {
+                const { serverUrl, zcapClient, generateId } = ctx;
+                const { alice, aliceDelegatedApp } = state;
+                if (ctx.onboardingToken) {
+                    // With an onboarding token configured, the token vouches for
+                    // provisioning, so the delegated-consent path under test here is
+                    // legitimately bypassed.
+                    ctx.skip('onboarding token configured: token vouches for provisioning');
+                }
+                // Alice delegates a POST /spaces/ capability to her app; the app
+                // invokes it, naming Alice as the controller. The invocation is
+                // authorized by a delegation chain rooted in the body's controller, so
+                // the create succeeds and Alice controls the Space from the start
+                // (delegated provisioning).
+                const spacesUrl = new URL('/spaces/', serverUrl).toString();
+                const aliceAppClient = zcapClient({ signer: aliceDelegatedApp.signer });
+                const provisioningCapability = await alice.rootClient.delegate({
+                    allowedActions: ['POST'],
+                    invocationTarget: spacesUrl,
+                    controller: aliceDelegatedApp.did
+                });
+                const spaceId = generateId();
+                const spaceUrl = new URL(`/space/${spaceId}`, serverUrl).toString();
+                try {
+                    const response = await aliceAppClient.request({
+                        url: spacesUrl,
+                        capability: provisioningCapability,
+                        method: 'POST',
+                        action: 'POST',
+                        json: {
+                            id: spaceId,
+                            name: 'Provisioned for Alice',
+                            controller: alice.did
+                        }
+                    });
+                    assert.equal(response.status, 201);
+                    assert.equal(response.data.controller, alice.did);
+                    // The Space exists and is controlled by Alice: her root key reads it.
+                    const checkResponse = await alice.rootClient.request({
+                        url: spaceUrl,
+                        method: 'GET',
+                        action: 'GET'
+                    });
+                    assert.equal(checkResponse.status, 200);
+                    assert.equal(checkResponse.data.controller, alice.did);
+                }
+                finally {
+                    try {
+                        await alice.rootClient.request({ url: spaceUrl, method: 'DELETE' });
+                    }
+                    catch {
+                        /* best-effort cleanup */
+                    }
+                }
+            }
+        },
+        {
+            id: 'repository.error-body-type-and-title',
+            name: 'an error response carries both a non-empty `type` and a non-empty `title`',
+            group: 'Spaces Repository API',
+            specRefs: ['https://wallet.storage/spec#error-handling'],
+            run: async (ctx) => {
+                const { serverUrl } = ctx;
+                // An unauthenticated Create Space is a request/credential failure (401),
+                // returned as problem+json. The spec makes `type` and `title` REQUIRED
+                // members of every error body.
+                const response = await fetch(new URL('/spaces/', serverUrl), {
+                    method: 'POST'
+                });
+                assert.equal(response.status, 401);
+                assert.match(response.headers.get('content-type'), /application\/problem\+json/);
+                const problem = (await response.json());
+                assert.equal(typeof problem.type, 'string');
+                assert.ok(problem.type.length > 0, 'error `type` must be non-empty');
+                assert.equal(typeof problem.title, 'string');
+                assert.ok(problem.title.length > 0, 'error `title` must be non-empty');
+            }
+        },
         {
             id: 'space.create-post',
             name: '[root] create space via POST',
             group: 'Space API',
+            specRefs: ['https://wallet.storage/spec#create-space-operation'],
             run: async (ctx, state) => {
                 const { serverUrl, createSpace, generateId, withoutCreatedBy } = ctx;
                 const { alice } = state;
@@ -211,6 +468,9 @@ export const spacesApi = {
             id: 'space.create-put',
             name: '[root] create space by id via PUT',
             group: 'Space API',
+            specRefs: [
+                'https://wallet.storage/spec#update-or-create-by-id-space-operation'
+            ],
             run: async (ctx, state) => {
                 const { serverUrl } = ctx;
                 const { alice } = state;
@@ -233,10 +493,81 @@ export const spacesApi = {
                 assert.equal(checkResponse.status, 200);
             }
         },
+        {
+            id: 'space.update-controller-swap-404',
+            name: "[root] a PUT swapping 'controller', signed by the would-be new controller, yields 404 and does not transfer the Space",
+            group: 'Space API',
+            specRefs: [
+                'https://wallet.storage/spec#update-or-create-by-id-space-operation',
+                'https://wallet.storage/spec#not-found'
+            ],
+            run: async (ctx, state) => {
+                const { serverUrl, createSpace, generateId } = ctx;
+                const { alice, bob } = state;
+                // An update MUST be verified against the *stored* controller, not the
+                // body's proposed one -- otherwise any caller could seize an existing
+                // Space by PUTting its id with themselves as controller. Bob attempts
+                // exactly that takeover; as an unauthorized write to an existing
+                // Space, it gets the privacy-merged not-found (404) mask.
+                const spaceId = generateId();
+                await createSpace({
+                    spaceDescription: {
+                        id: spaceId,
+                        name: 'Escalation Target Space',
+                        controller: alice.did
+                    },
+                    rootClient: alice.rootClient
+                });
+                const spaceUrl = new URL(`/space/${spaceId}`, serverUrl).toString();
+                try {
+                    let expectedError;
+                    try {
+                        await bob.rootClient.request({
+                            url: spaceUrl,
+                            method: 'PUT',
+                            action: 'PUT',
+                            json: {
+                                id: spaceId,
+                                name: 'Seized Space',
+                                controller: bob.did
+                            }
+                        });
+                    }
+                    catch (err) {
+                        expectedError = err;
+                    }
+                    assert.ok(expectedError, 'expected the takeover PUT to fail');
+                    assert.equal(expectedError.response.status, 404);
+                    assert.match(expectedError.response.headers.get('content-type'), /application\/problem\+json/);
+                    assert.equal(expectedError.data.type, 'https://wallet.storage/spec#not-found');
+                    // The operation must not have been performed: Alice still controls
+                    // the Space, name and controller unchanged.
+                    const checkResponse = await alice.rootClient.request({
+                        url: spaceUrl,
+                        method: 'GET'
+                    });
+                    assert.equal(checkResponse.status, 200);
+                    assert.equal(checkResponse.data.controller, alice.did);
+                    assert.equal(checkResponse.data.name, 'Escalation Target Space');
+                }
+                finally {
+                    try {
+                        await alice.rootClient.request({ url: spaceUrl, method: 'DELETE' });
+                    }
+                    catch {
+                        /* best-effort cleanup */
+                    }
+                }
+            }
+        },
         {
             id: 'space.anonymous-read-404',
             name: 'GET a space with no auth headers falls through to policy and 404s (no public policy)',
             group: 'Space API',
+            specRefs: [
+                'https://wallet.storage/spec#read-space-operation',
+                'https://wallet.storage/spec#read-space-errors'
+            ],
             run: async (ctx, state) => {
                 const { serverUrl } = ctx;
                 const { alice } = state;
@@ -252,6 +583,10 @@ export const spacesApi = {
             id: 'space.read-missing-404',
             name: 'GET /space/:spaceId should 404 error on not found space id',
             group: 'Space API',
+            specRefs: [
+                'https://wallet.storage/spec#read-space-operation',
+                'https://wallet.storage/spec#read-space-errors'
+            ],
             run: async (ctx, state) => {
                 const { serverUrl } = ctx;
                 const { alice } = state;
@@ -275,6 +610,7 @@ export const spacesApi = {
             id: 'space.read-authorized',
             name: '[root] read space via GET with proper authorization',
             group: 'Space API',
+            specRefs: ['https://wallet.storage/spec#read-space-operation'],
             run: async (ctx, state) => {
                 const { serverUrl, withoutCreatedBy } = ctx;
                 const { alice } = state;
@@ -300,6 +636,10 @@ export const spacesApi = {
             id: 'space.read-delegated',
             name: '[delegated] authorized app should GET /space/:spaceId',
             group: 'Space API',
+            specRefs: [
+                'https://wallet.storage/spec#read-space-operation',
+                'https://wallet.storage/spec#was-authorization-profile-v0-1'
+            ],
             run: async (ctx, state) => {
                 const { serverUrl, zcapClient, withoutCreatedBy } = ctx;
                 const { alice, aliceDelegatedApp } = state;
@@ -332,6 +672,10 @@ export const spacesApi = {
             id: 'space.cross-user-read-404',
             name: '[root] Bob should not be able to GET Alice space',
             group: 'Space API',
+            specRefs: [
+                'https://wallet.storage/spec#read-space-operation',
+                'https://wallet.storage/spec#read-space-errors'
+            ],
             run: async (ctx, state) => {
                 const { serverUrl } = ctx;
                 const { alice, bob } = state;
@@ -352,6 +696,7 @@ export const spacesApi = {
             id: 'space.delete',
             name: '[root] Alice should be able to DELETE her provisioned space',
             group: 'Space API',
+            specRefs: ['https://wallet.storage/spec#delete-space-operation'],
             run: async (ctx, state) => {
                 const { serverUrl, createSpace, generateId } = ctx;
                 const { alice } = state;
@@ -380,10 +725,230 @@ export const spacesApi = {
                 assert.equal(checkResponse.status, 404);
             }
         },
+        {
+            id: 'space.create-post-conflict-preserves-original',
+            name: '[root] a conflicting POST leaves the original Space untouched (409)',
+            group: 'Space API',
+            specRefs: [
+                'https://wallet.storage/spec#create-space-errors',
+                'https://wallet.storage/spec#id-conflict'
+            ],
+            run: async (ctx, state) => {
+                const { serverUrl, createSpace, generateId } = ctx;
+                const { alice, bob } = state;
+                const spaceId = generateId();
+                const spaceUrl = new URL(`/space/${spaceId}`, serverUrl).toString();
+                await createSpace({
+                    spaceDescription: {
+                        id: spaceId,
+                        name: 'Original Space',
+                        controller: alice.did
+                    },
+                    rootClient: alice.rootClient
+                });
+                try {
+                    // POST the same id again with a different name and controller. The
+                    // existence check precedes any provisioning concern, so this is a 409
+                    // id-conflict; create-or-replace by id is PUT's job. The token path
+                    // of createSpace() returns the status; the zcap path throws on
+                    // non-2xx -- capture either shape.
+                    let status, problem;
+                    try {
+                        const response = await createSpace({
+                            spaceDescription: {
+                                id: spaceId,
+                                name: 'Usurping Space',
+                                controller: bob.did
+                            },
+                            rootClient: alice.rootClient
+                        });
+                        status = response.status;
+                        problem = response.data;
+                    }
+                    catch (err) {
+                        status = err.response?.status;
+                        problem = err.data;
+                    }
+                    assert.equal(status, 409);
+                    assert.equal(problem.type, 'https://wallet.storage/spec#id-conflict');
+                    // The original Space is untouched: its name and controller are as
+                    // first created, not the conflicting POST's proposed values.
+                    const checkResponse = await alice.rootClient.request({
+                        url: spaceUrl,
+                        method: 'GET',
+                        action: 'GET'
+                    });
+                    assert.equal(checkResponse.status, 200);
+                    assert.equal(checkResponse.data.name, 'Original Space');
+                    assert.equal(checkResponse.data.controller, alice.did);
+                }
+                finally {
+                    try {
+                        await alice.rootClient.request({ url: spaceUrl, method: 'DELETE' });
+                    }
+                    catch {
+                        /* best-effort cleanup */
+                    }
+                }
+            }
+        },
+        {
+            id: 'space.create-ignores-body-createdby',
+            name: '[root] a body-supplied `createdBy` is ignored by the server',
+            group: 'Space API',
+            specRefs: ['https://wallet.storage/spec#space-data-model'],
+            run: async (ctx, state) => {
+                const { serverUrl, createSpace, generateId } = ctx;
+                const { alice } = state;
+                // `createdBy` is server-managed and read-only: the spec requires a
+                // server to ignore a `createdBy` supplied in a request body. The value
+                // below is a well-formed but bogus DID that is not the creator.
+                const bogusCreatedBy = 'did:key:z6MkpBMbMaRSv5nsgifRAwEKvHHoiKDMhiAHShTFNmkJXXXX';
+                const spaceId = generateId();
+                const spaceUrl = new URL(`/space/${spaceId}`, serverUrl).toString();
+                await createSpace({
+                    spaceDescription: {
+                        id: spaceId,
+                        name: 'Space With A Bogus createdBy',
+                        controller: alice.did,
+                        createdBy: bogusCreatedBy
+                    },
+                    rootClient: alice.rootClient
+                });
+                try {
+                    const response = await alice.rootClient.request({
+                        url: spaceUrl,
+                        method: 'GET',
+                        action: 'GET'
+                    });
+                    assert.equal(response.status, 200);
+                    // Either absent (token-provisioned create records no createdBy) or
+                    // set to the real invoker -- never the bogus body value.
+                    assert.notEqual(response.data.createdBy, bogusCreatedBy, 'the server must ignore a body-supplied createdBy');
+                }
+                finally {
+                    try {
+                        await alice.rootClient.request({ url: spaceUrl, method: 'DELETE' });
+                    }
+                    catch {
+                        /* best-effort cleanup */
+                    }
+                }
+            }
+        },
+        {
+            id: 'space.create-put-controller-mismatch-400',
+            name: '[root] PUT-creating a new Space, signed by someone other than the body controller, yields controller-mismatch (400)',
+            group: 'Space API',
+            specRefs: [
+                'https://wallet.storage/spec#update-or-create-by-id-space-operation',
+                'https://wallet.storage/spec#controller-mismatch'
+            ],
+            run: async (ctx, state) => {
+                const { serverUrl, generateId } = ctx;
+                const { alice, bob } = state;
+                // The create branch of PUT is authorized by the *body's* controller,
+                // just like Create Space via POST. Bob signs a PUT that would create a
+                // new Space naming Alice as controller, with no delegation chain rooted
+                // in her -- the direct signer-mismatch shape (this is the CREATE
+                // branch; the update branch is covered by space.update-controller-swap).
+                const spaceId = generateId();
+                const spaceUrl = new URL(`/space/${spaceId}`, serverUrl).toString();
+                let expectedError;
+                try {
+                    await bob.rootClient.request({
+                        url: spaceUrl,
+                        method: 'PUT',
+                        action: 'PUT',
+                        json: {
+                            id: spaceId,
+                            name: 'Consentless Space',
+                            controller: alice.did
+                        }
+                    });
+                }
+                catch (err) {
+                    expectedError = err;
+                }
+                assert.ok(expectedError, 'expected the unconsented PUT-create to fail');
+                assert.equal(expectedError.response.status, 400);
+                assert.equal(expectedError.data.type, 'https://wallet.storage/spec#controller-mismatch');
+                // The Space must not have been created: its named controller (Alice)
+                // would be able to read it if it had been.
+                let checkError;
+                try {
+                    await alice.rootClient.request({
+                        url: spaceUrl,
+                        method: 'GET',
+                        action: 'GET'
+                    });
+                }
+                catch (err) {
+                    checkError = err;
+                }
+                assert.ok(checkError, 'the rejected Space must not exist');
+                assert.equal(checkError.response.status, 404);
+            }
+        },
+        {
+            id: 'space.reserved-policy-segment',
+            name: "[root] GET /space/:spaceId/policy is served as the policy endpoint, not a collection named 'policy'",
+            group: 'Space API',
+            specRefs: [
+                'https://wallet.storage/spec#reserved-path-segment-registry',
+                'https://wallet.storage/spec#space-level-reserved-endpoints'
+            ],
+            run: async (ctx, state) => {
+                const { serverUrl, createSpace, generateId } = ctx;
+                const { alice } = state;
+                const spaceId = generateId();
+                const spaceUrl = new URL(`/space/${spaceId}`, serverUrl).toString();
+                const policyUrl = new URL(`/space/${spaceId}/policy`, serverUrl).toString();
+                await createSpace({
+                    spaceDescription: {
+                        id: spaceId,
+                        name: 'Reserved Segment Space',
+                        controller: alice.did
+                    },
+                    rootClient: alice.rootClient
+                });
+                try {
+                    // `policy` is a reserved space-level segment: it addresses the
+                    // access-control policy resource, and MUST NOT be repurposed as a
+                    // Collection id. Set a policy, then read it back through the same
+                    // segment to confirm it is served as the policy endpoint.
+                    await alice.rootClient.request({
+                        url: policyUrl,
+                        method: 'PUT',
+                        action: 'PUT',
+                        json: { type: 'PublicCanRead' }
+                    });
+                    const response = await alice.rootClient.request({
+                        url: policyUrl,
+                        method: 'GET',
+                        action: 'GET'
+                    });
+                    assert.equal(response.status, 200);
+                    // The response is a policy document -- it carries the policy `type`
+                    // we stored -- not a Collection listing (which would carry `items`).
+                    assert.equal(response.data.type, 'PublicCanRead');
+                    assert.equal(response.data.items, undefined, 'the policy endpoint must not return a Collection listing');
+                }
+                finally {
+                    try {
+                        await alice.rootClient.request({ url: spaceUrl, method: 'DELETE' });
+                    }
+                    catch {
+                        /* best-effort cleanup */
+                    }
+                }
+            }
+        },
         {
             id: 'collections.list-for-space',
             name: '[root] GET /space/:spaceId/collections/ lists collections for a space',
             group: 'Collections API',
+            specRefs: ['https://wallet.storage/spec#list-all-collections-operation'],
             run: async (ctx, state) => {
                 const { serverUrl } = ctx;
                 const { alice, collectionId } = state;