@interop/was-conformance-suite 0.15.0 → 0.16.0

package/dist/suites/spaces-api.js

@@ -100,6 +100,29 @@ function failureDetail(problem) {
         .filter(value => typeof value === 'string' && value.length > 0)
         .join('\n');
 }
+/**
+ * The Space container URL, in its v0.5 canonical (trailing-slash) form: lists
+ * Collections (`GET`), adds one (`POST`), and removes the Space (`DELETE`).
+ *
+ * @param serverUrl {string}
+ * @param spaceId {string}
+ * @returns {string}
+ */
+function spaceUrl(serverUrl, spaceId) {
+    return new URL(`/space/${spaceId}/`, serverUrl).toString();
+}
+/**
+ * The Space Metadata object URL (spec "Space Metadata Data Model"): where
+ * Read Space and Update (or Create by Id) Space now live, since v0.5 moved
+ * them off the bare (no-slash) Space URL.
+ *
+ * @param serverUrl {string}
+ * @param spaceId {string}
+ * @returns {string}
+ */
+function spaceMetaUrl(serverUrl, spaceId) {
+    return new URL(`/space/${spaceId}/meta`, serverUrl).toString();
+}
 /**
  * Asserts the Space at `spaceId` was never created: its named controller
  * (Alice) could read it if it had been, so her authorized read must 404.
@@ -114,7 +137,7 @@ async function assertSpaceNotCreated({ ctx, alice, spaceId }) {
     let checkError;
     try {
         await alice.rootClient.request({
-            url: new URL(`/space/${spaceId}`, ctx.serverUrl).toString(),
+            url: spaceMetaUrl(ctx.serverUrl, spaceId),
             method: 'GET'
         });
     }
@@ -153,7 +176,7 @@ export const spacesApi = {
         for (const spaceId of [alice.space1.id, alice.space2.id, alice.space3.id]) {
             try {
                 await alice.rootClient.request({
-                    url: new URL(`/space/${spaceId}`, ctx.serverUrl).toString(),
+                    url: spaceUrl(ctx.serverUrl, spaceId),
                     method: 'DELETE'
                 });
             }
@@ -178,7 +201,7 @@ export const spacesApi = {
                     rootClient: alice.rootClient
                 });
                 await alice.rootClient.request({
-                    url: new URL(`/space/${alice.space3.id}/${state.collectionId}`, ctx.serverUrl).toString(),
+                    url: new URL(`/space/${alice.space3.id}/${state.collectionId}/meta`, ctx.serverUrl).toString(),
                     method: 'PUT',
                     json: { id: state.collectionId, name: 'Test Collection' }
                 });
@@ -239,12 +262,14 @@ export const spacesApi = {
                     assert.equal(listing.totalItems, listing.items.length);
                     const aliceItem = listing.items.find((item) => item.id === alice.space1.id);
                     assert.ok(aliceItem, "Alice's listing includes her pre-created space");
-                    assert.equal(aliceItem.url, `/space/${alice.space1.id}`);
+                    // A Space is a container, so its listed `url` carries the
+                    // canonical trailing slash (spec "Space Metadata Data Model").
+                    assert.equal(aliceItem.url, `/space/${alice.space1.id}/`);
                     assert.ok(!listing.items.some((item) => item.id === bobSpaceId), "Alice's listing must not reveal Bob's space");
                 }
                 finally {
                     await bob.rootClient.request({
-                        url: new URL(`/space/${bobSpaceId}`, serverUrl).toString(),
+                        url: spaceUrl(serverUrl, bobSpaceId),
                         method: 'DELETE'
                     });
                 }
@@ -344,7 +369,7 @@ export const spacesApi = {
                 let checkError;
                 try {
                     await alice.rootClient.request({
-                        url: new URL(`/space/${spaceId}`, serverUrl).toString(),
+                        url: spaceMetaUrl(serverUrl, spaceId),
                         method: 'GET'
                     });
                 }
@@ -499,7 +524,6 @@ export const spacesApi = {
                     controller: aliceDelegatedApp.did
                 });
                 const spaceId = generateId();
-                const spaceUrl = new URL(`/space/${spaceId}`, serverUrl).toString();
                 try {
                     const response = await aliceAppClient.request({
                         url: spacesUrl,
@@ -516,7 +540,7 @@ export const spacesApi = {
                     assert.equal(response.data.controller, alice.did);
                     // The Space exists and is controlled by Alice: her root key reads it.
                     const checkResponse = await alice.rootClient.request({
-                        url: spaceUrl,
+                        url: spaceMetaUrl(serverUrl, spaceId),
                         method: 'GET',
                         action: 'GET'
                     });
@@ -525,7 +549,10 @@ export const spacesApi = {
                 }
                 finally {
                     try {
-                        await alice.rootClient.request({ url: spaceUrl, method: 'DELETE' });
+                        await alice.rootClient.request({
+                            url: spaceUrl(serverUrl, spaceId),
+                            method: 'DELETE'
+                        });
                     }
                     catch {
                         /* best-effort cleanup */
@@ -686,17 +713,20 @@ export const spacesApi = {
                     rootClient: alice.rootClient
                 });
                 assert.equal(response.status, 201);
+                // The container `url` is the canonical trailing-slash form (spec
+                // "Space Metadata Data Model").
                 assert.deepStrictEqual(withoutCreatedBy(response.data), {
                     id: freshSpaceId,
                     name: 'Conformance Test Space',
                     type: ['Space'],
-                    controller: alice.did
+                    controller: alice.did,
+                    url: `/space/${freshSpaceId}/`
                 });
                 assert.match(response.headers.get('content-type'), /application\/json/);
-                assert.equal(response.headers.get('location'), `${serverUrl}/spaces/${freshSpaceId}`);
+                assert.equal(response.headers.get('location'), spaceUrl(serverUrl, freshSpaceId));
                 // Clean up the space created by this test
                 await alice.rootClient.request({
-                    url: new URL(`/space/${freshSpaceId}`, serverUrl).toString(),
+                    url: spaceUrl(serverUrl, freshSpaceId),
                     method: 'DELETE'
                 });
             }
@@ -735,7 +765,7 @@ export const spacesApi = {
         },
         {
             id: 'space.create-put',
-            name: '[root] create space by id via PUT',
+            name: '[root] create space by id via PUT of its Space Metadata object',
             group: 'Space API',
             specRefs: [
                 'https://wallet.storage/spec#update-or-create-by-id-space-operation'
@@ -748,15 +778,16 @@ export const spacesApi = {
                     name: "Alice's Space #2 (School)",
                     controller: alice.did
                 };
-                const spaceUrl = new URL(`/space/${alice.space2.id}`, serverUrl).toString();
+                // The `Location` names the Space container, not the Metadata object
+                // that was written (spec "Update (or Create by Id) Space Operation").
                 const response = await alice.rootClient.request({
-                    url: spaceUrl,
+                    url: spaceMetaUrl(serverUrl, alice.space2.id),
                     method: 'PUT',
                     json: spaceDescription
                 });
-                assert.equal(response.headers.get('location'), spaceUrl);
+                assert.equal(response.headers.get('location'), spaceUrl(serverUrl, alice.space2.id));
                 const checkResponse = await alice.rootClient.request({
-                    url: spaceUrl,
+                    url: spaceMetaUrl(serverUrl, alice.space2.id),
                     method: 'GET'
                 });
                 assert.equal(checkResponse.status, 200);
@@ -787,12 +818,12 @@ export const spacesApi = {
                     },
                     rootClient: alice.rootClient
                 });
-                const spaceUrl = new URL(`/space/${spaceId}`, serverUrl).toString();
+                const metaUrl = spaceMetaUrl(serverUrl, spaceId);
                 try {
                     let expectedError;
                     try {
                         await bob.rootClient.request({
-                            url: spaceUrl,
+                            url: metaUrl,
                             method: 'PUT',
                             action: 'PUT',
                             json: {
@@ -812,7 +843,7 @@ export const spacesApi = {
                     // The operation must not have been performed: Alice still controls
                     // the Space, name and controller unchanged.
                     const checkResponse = await alice.rootClient.request({
-                        url: spaceUrl,
+                        url: metaUrl,
                         method: 'GET'
                     });
                     assert.equal(checkResponse.status, 200);
@@ -821,7 +852,10 @@ export const spacesApi = {
                 }
                 finally {
                     try {
-                        await alice.rootClient.request({ url: spaceUrl, method: 'DELETE' });
+                        await alice.rootClient.request({
+                            url: spaceUrl(serverUrl, spaceId),
+                            method: 'DELETE'
+                        });
                     }
                     catch {
                         /* best-effort cleanup */
@@ -857,12 +891,12 @@ export const spacesApi = {
                     },
                     rootClient: alice.rootClient
                 });
-                const spaceUrl = new URL(`/space/${spaceId}`, serverUrl).toString();
+                const metaUrl = spaceMetaUrl(serverUrl, spaceId);
                 try {
                     let expectedError;
                     try {
                         await alice.rootClient.request({
-                            url: spaceUrl,
+                            url: metaUrl,
                             method: 'PUT',
                             action: 'PUT',
                             json: {
@@ -880,7 +914,7 @@ export const spacesApi = {
                     assert.match(expectedError.response.headers.get('content-type'), /application\/problem\+json/);
                     assert.equal(expectedError.data.type, 'https://wallet.storage/spec#invalid-request-body');
                     const checkResponse = await alice.rootClient.request({
-                        url: spaceUrl,
+                        url: metaUrl,
                         method: 'GET'
                     });
                     assert.equal(checkResponse.status, 200);
@@ -888,7 +922,10 @@ export const spacesApi = {
                 }
                 finally {
                     try {
-                        await alice.rootClient.request({ url: spaceUrl, method: 'DELETE' });
+                        await alice.rootClient.request({
+                            url: spaceUrl(serverUrl, spaceId),
+                            method: 'DELETE'
+                        });
                     }
                     catch {
                         /* best-effort cleanup */
@@ -898,7 +935,7 @@ export const spacesApi = {
         },
         {
             id: 'space.anonymous-read-404',
-            name: 'GET a space with no auth headers falls through to policy and 404s (no public policy)',
+            name: 'GET /space/:spaceId/meta with no auth headers falls through to policy and 404s (no public policy)',
             group: 'Space API',
             specRefs: [
                 'https://wallet.storage/spec#read-space-operation',
@@ -909,15 +946,74 @@ export const spacesApi = {
                 const { alice } = state;
                 // Reads no longer 401 at the hook: an anonymous read is allowed to
                 // attempt, and is denied as 404 (no-leak) when no policy grants it.
-                const spaceUrl = new URL(`/space/${alice.space1.id}`, serverUrl).toString();
-                const response = await fetch(spaceUrl, { method: 'GET' });
+                const response = await fetch(spaceMetaUrl(serverUrl, alice.space1.id), {
+                    method: 'GET'
+                });
                 assert.equal(response.status, 404);
                 assert.match(response.headers.get('content-type'), /application\/problem\+json/);
             }
         },
+        {
+            id: 'space.noncanonical-redirect-308',
+            name: '[root] the non-canonical Space URL 308s to the canonical trailing-slash form; the canonical form is not redirected',
+            group: 'Space API',
+            optional: true,
+            specRefs: ['https://wallet.storage/spec#reading-this-document'],
+            run: async (ctx, state) => {
+                const { serverUrl } = ctx;
+                const { alice } = state;
+                const bareUrl = new URL(`/space/${alice.space1.id}`, serverUrl).toString();
+                const canonicalUrl = spaceUrl(serverUrl, alice.space1.id);
+                const canonicalPath = `/space/${alice.space1.id}/`;
+                // Asserted for more than one method, so a server that serves both
+                // forms without redirecting does not pass by accident.
+                for (const method of ['GET', 'HEAD']) {
+                    const response = await fetch(bareUrl, { method, redirect: 'manual' });
+                    assert.equal(response.status, 308, `expected a 308 for ${method} on the non-canonical Space URL`);
+                    assert.equal(response.headers.get('location'), canonicalPath);
+                }
+                // The canonical form itself is not redirected.
+                const canonicalResponse = await fetch(canonicalUrl, {
+                    method: 'GET',
+                    redirect: 'manual'
+                });
+                assert.notEqual(canonicalResponse.status, 308);
+            }
+        },
+        {
+            id: 'space.put-container-405',
+            name: '[root] PUT /space/:spaceId/ (the container URL) is refused with 405 and an Allow header that excludes PUT',
+            group: 'Space API',
+            specRefs: ['https://wallet.storage/spec#space-metadata-data-model'],
+            run: async (ctx, state) => {
+                const { serverUrl } = ctx;
+                const { alice } = state;
+                let expectedError;
+                try {
+                    await alice.rootClient.request({
+                        url: spaceUrl(serverUrl, alice.space1.id),
+                        method: 'PUT',
+                        action: 'PUT',
+                        json: { name: 'Attempted Container Replacement' }
+                    });
+                }
+                catch (err) {
+                    expectedError = err;
+                }
+                assert.ok(expectedError, 'expected a PUT at the Space container URL to be refused');
+                assert.equal(expectedError.response.status, 405);
+                const allow = (expectedError.response.headers.get('allow') ?? '')
+                    .split(',')
+                    .map((method) => method.trim())
+                    .filter(Boolean);
+                assert.ok(allow.length > 0, 'expected a non-empty Allow header');
+                assert.ok(!allow.includes('PUT'), 'the Allow header must not include PUT: a container is described ' +
+                    'at its "meta" sub-resource');
+            }
+        },
         {
             id: 'space.read-missing-404',
-            name: 'GET /space/:spaceId should 404 error on not found space id',
+            name: 'GET /space/:spaceId/meta should 404 error on not found space id',
             group: 'Space API',
             specRefs: [
                 'https://wallet.storage/spec#read-space-operation',
@@ -926,11 +1022,10 @@ export const spacesApi = {
             run: async (ctx, state) => {
                 const { serverUrl } = ctx;
                 const { alice } = state;
-                const spaceUrl = new URL('/space/space-id-that-does-not-exist', serverUrl).toString();
                 let expectedError;
                 try {
                     await alice.rootClient.request({
-                        url: spaceUrl,
+                        url: spaceMetaUrl(serverUrl, 'space-id-that-does-not-exist'),
                         method: 'GET',
                         action: 'GET'
                     });
@@ -944,15 +1039,14 @@ export const spacesApi = {
         },
         {
             id: 'space.read-authorized',
-            name: '[root] read space via GET with proper authorization',
+            name: '[root] read the Space Metadata object via GET with proper authorization',
             group: 'Space API',
             specRefs: ['https://wallet.storage/spec#read-space-operation'],
             run: async (ctx, state) => {
                 const { serverUrl, withoutCreatedBy } = ctx;
                 const { alice } = state;
-                const spaceUrl = new URL(`/space/${alice.space1.id}`, serverUrl).toString();
                 const response = await alice.rootClient.request({
-                    url: spaceUrl,
+                    url: spaceMetaUrl(serverUrl, alice.space1.id),
                     method: 'GET',
                     action: 'GET'
                 });
@@ -963,14 +1057,14 @@ export const spacesApi = {
                     name: "Alice's Space #1 (Home)",
                     type: ['Space'],
                     controller: alice.did,
-                    url: `/space/${alice.space1.id}`,
+                    url: `/space/${alice.space1.id}/`,
                     linkset: `/space/${alice.space1.id}/linkset`
                 });
             }
         },
         {
             id: 'space.read-delegated',
-            name: '[delegated] authorized app should GET /space/:spaceId',
+            name: '[delegated] authorized app should GET /space/:spaceId/meta',
             group: 'Space API',
             specRefs: [
                 'https://wallet.storage/spec#read-space-operation',
@@ -980,14 +1074,16 @@ export const spacesApi = {
                 const { serverUrl, zcapClient, withoutCreatedBy } = ctx;
                 const { alice, aliceDelegatedApp } = state;
                 const aliceAppClient = zcapClient({ signer: aliceDelegatedApp.signer });
-                const spaceUrl = new URL(`/space/${alice.space1.id}`, serverUrl).toString();
+                // A capability delegated on the Space container covers its `meta`
+                // sub-resource too (spec "Reading This Document"; ARCHITECTURE.md's
+                // v0.5 subtree-attenuation note).
                 const delegatedSpaceCapability = await alice.rootClient.delegate({
                     allowedActions: ['GET'],
-                    invocationTarget: spaceUrl,
+                    invocationTarget: spaceUrl(serverUrl, alice.space1.id),
                     controller: aliceDelegatedApp.did
                 });
                 const appResponse = await aliceAppClient.request({
-                    url: spaceUrl,
+                    url: spaceMetaUrl(serverUrl, alice.space1.id),
                     capability: delegatedSpaceCapability,
                     method: 'GET',
                     action: 'GET'
@@ -999,14 +1095,14 @@ export const spacesApi = {
                     name: "Alice's Space #1 (Home)",
                     type: ['Space'],
                     controller: alice.did,
-                    url: `/space/${alice.space1.id}`,
+                    url: `/space/${alice.space1.id}/`,
                     linkset: `/space/${alice.space1.id}/linkset`
                 });
             }
         },
         {
             id: 'space.cross-user-read-404',
-            name: '[root] Bob should not be able to GET Alice space',
+            name: "[root] Bob should not be able to GET Alice's Space Metadata object",
             group: 'Space API',
             specRefs: [
                 'https://wallet.storage/spec#read-space-operation',
@@ -1015,10 +1111,13 @@ export const spacesApi = {
             run: async (ctx, state) => {
                 const { serverUrl } = ctx;
                 const { alice, bob } = state;
-                const spaceUrl = new URL(`/space/${alice.space1.id}`, serverUrl).toString();
                 let expectedError;
                 try {
-                    await bob.rootClient.request({ url: spaceUrl, action: 'GET' });
+                    await bob.rootClient.request({
+                        url: spaceMetaUrl(serverUrl, alice.space1.id),
+                        method: 'GET',
+                        action: 'GET'
+                    });
                 }
                 catch (err) {
                     expectedError = err;
@@ -1045,15 +1144,17 @@ export const spacesApi = {
                     },
                     rootClient: alice.rootClient
                 });
-                const spaceUrl = new URL(`/space/${spaceId}`, serverUrl).toString();
                 const deleteResponse = await alice.rootClient.request({
-                    url: spaceUrl,
+                    url: spaceUrl(serverUrl, spaceId),
                     method: 'DELETE'
                 });
                 assert.equal(deleteResponse.status, 204);
                 let checkResponse;
                 try {
-                    await alice.rootClient.request({ url: spaceUrl, method: 'GET' });
+                    await alice.rootClient.request({
+                        url: spaceMetaUrl(serverUrl, spaceId),
+                        method: 'GET'
+                    });
                 }
                 catch (err) {
                     checkResponse = err.response;
@@ -1073,7 +1174,6 @@ export const spacesApi = {
                 const { serverUrl, createSpace, generateId } = ctx;
                 const { alice, bob } = state;
                 const spaceId = generateId();
-                const spaceUrl = new URL(`/space/${spaceId}`, serverUrl).toString();
                 await createSpace({
                     spaceDescription: {
                         id: spaceId,
@@ -1110,7 +1210,7 @@ export const spacesApi = {
                     // The original Space is untouched: its name and controller are as
                     // first created, not the conflicting POST's proposed values.
                     const checkResponse = await alice.rootClient.request({
-                        url: spaceUrl,
+                        url: spaceMetaUrl(serverUrl, spaceId),
                         method: 'GET',
                         action: 'GET'
                     });
@@ -1120,7 +1220,10 @@ export const spacesApi = {
                 }
                 finally {
                     try {
-                        await alice.rootClient.request({ url: spaceUrl, method: 'DELETE' });
+                        await alice.rootClient.request({
+                            url: spaceUrl(serverUrl, spaceId),
+                            method: 'DELETE'
+                        });
                     }
                     catch {
                         /* best-effort cleanup */
@@ -1132,7 +1235,7 @@ export const spacesApi = {
             id: 'space.create-ignores-body-createdby',
             name: '[root] a body-supplied `createdBy` is ignored by the server',
             group: 'Space API',
-            specRefs: ['https://wallet.storage/spec#space-data-model'],
+            specRefs: ['https://wallet.storage/spec#space-metadata-data-model'],
             run: async (ctx, state) => {
                 const { serverUrl, createSpace, generateId } = ctx;
                 const { alice } = state;
@@ -1141,7 +1244,6 @@ export const spacesApi = {
                 // below is a well-formed but bogus DID that is not the creator.
                 const bogusCreatedBy = 'did:key:z6MkpBMbMaRSv5nsgifRAwEKvHHoiKDMhiAHShTFNmkJXXXX';
                 const spaceId = generateId();
-                const spaceUrl = new URL(`/space/${spaceId}`, serverUrl).toString();
                 await createSpace({
                     spaceDescription: {
                         id: spaceId,
@@ -1153,7 +1255,7 @@ export const spacesApi = {
                 });
                 try {
                     const response = await alice.rootClient.request({
-                        url: spaceUrl,
+                        url: spaceMetaUrl(serverUrl, spaceId),
                         method: 'GET',
                         action: 'GET'
                     });
@@ -1164,7 +1266,10 @@ export const spacesApi = {
                 }
                 finally {
                     try {
-                        await alice.rootClient.request({ url: spaceUrl, method: 'DELETE' });
+                        await alice.rootClient.request({
+                            url: spaceUrl(serverUrl, spaceId),
+                            method: 'DELETE'
+                        });
                     }
                     catch {
                         /* best-effort cleanup */
@@ -1189,11 +1294,11 @@ export const spacesApi = {
                 // in her -- the direct signer-mismatch shape (this is the CREATE
                 // branch; the update branch is covered by space.update-controller-swap).
                 const spaceId = generateId();
-                const spaceUrl = new URL(`/space/${spaceId}`, serverUrl).toString();
+                const metaUrl = spaceMetaUrl(serverUrl, spaceId);
                 let expectedError;
                 try {
                     await bob.rootClient.request({
-                        url: spaceUrl,
+                        url: metaUrl,
                         method: 'PUT',
                         action: 'PUT',
                         json: {
@@ -1214,7 +1319,7 @@ export const spacesApi = {
                 let checkError;
                 try {
                     await alice.rootClient.request({
-                        url: spaceUrl,
+                        url: metaUrl,
                         method: 'GET',
                         action: 'GET'
                     });
@@ -1238,7 +1343,6 @@ export const spacesApi = {
                 const { serverUrl, createSpace, generateId } = ctx;
                 const { alice } = state;
                 const spaceId = generateId();
-                const spaceUrl = new URL(`/space/${spaceId}`, serverUrl).toString();
                 const policyUrl = new URL(`/space/${spaceId}/policy`, serverUrl).toString();
                 await createSpace({
                     spaceDescription: {
@@ -1272,7 +1376,10 @@ export const spacesApi = {
                 }
                 finally {
                     try {
-                        await alice.rootClient.request({ url: spaceUrl, method: 'DELETE' });
+                        await alice.rootClient.request({
+                            url: spaceUrl(serverUrl, spaceId),
+                            method: 'DELETE'
+                        });
                     }
                     catch {
                         /* best-effort cleanup */
@@ -1282,15 +1389,17 @@ export const spacesApi = {
         },
         {
             id: 'collections.list-for-space',
-            name: '[root] GET /space/:spaceId/collections/ lists collections for a space',
+            name: '[root] GET /space/:spaceId/ lists collections for a space',
             group: 'Collections API',
             specRefs: ['https://wallet.storage/spec#list-all-collections-operation'],
             run: async (ctx, state) => {
                 const { serverUrl } = ctx;
                 const { alice, collectionId } = state;
-                const collectionsUrl = new URL(`/space/${alice.space3.id}/collections/`, serverUrl).toString();
+                // v0.5 moved listing (and creating) Collections onto the Space
+                // container URL itself; the retired `collections` sub-resource is
+                // covered separately (see `space.retired-collections-redirect`).
                 const response = await alice.rootClient.request({
-                    url: collectionsUrl,
+                    url: spaceUrl(serverUrl, alice.space3.id),
                     method: 'GET'
                 });
                 assert.equal(response.status, 200);
@@ -1308,17 +1417,38 @@ export const spacesApi = {
                     return core;
                 });
                 assert.deepStrictEqual({ ...response.data, items: coreItems }, {
-                    url: `/space/${alice.space3.id}/collections/`,
+                    url: `/space/${alice.space3.id}/`,
                     totalItems: 1,
                     items: [
                         {
                             id: collectionId,
                             name: 'Test Collection',
-                            url: `/space/${alice.space3.id}/${collectionId}`
+                            url: `/space/${alice.space3.id}/${collectionId}/`
                         }
                     ]
                 });
             }
+        },
+        {
+            id: 'space.retired-collections-redirect',
+            name: '[root] GET /space/:spaceId/collections/ (retired in v0.5) MAY 308 to the Space URL',
+            group: 'Collections API',
+            optional: true,
+            specRefs: ['https://wallet.storage/spec#space-level-reserved-endpoints'],
+            run: async (ctx, state) => {
+                const { serverUrl } = ctx;
+                const { alice } = state;
+                const retiredUrl = new URL(`/space/${alice.space3.id}/collections/`, serverUrl).toString();
+                const response = await fetch(retiredUrl, {
+                    method: 'GET',
+                    redirect: 'manual'
+                });
+                if (response.status !== 308) {
+                    ctx.skip('the retired `collections` endpoint is a MAY 308; this server ' +
+                        `answered ${response.status} instead`);
+                }
+                assert.equal(response.headers.get('location'), `/space/${alice.space3.id}/`);
+            }
         }
     ]
 };