@iwentsourcing/core 0.1.0

package/dist/management/permission/permission-aggregation.test.js

@@ -0,0 +1,943 @@
+/* eslint-disable @typescript-eslint/no-unsafe-call, @typescript-eslint/require-await, @typescript-eslint/no-unused-vars */
+import { describe, it } from 'node:test';
+import { deepEqual, equal, rejects, ok } from 'node:assert';
+import { browse } from '../../storage/browse.js';
+import { createTestCase } from '../../testing/create-test-case.js';
+import { todoExampleStream } from '../../example/todo-example.js';
+import { dedupeSerialized, mergeEventPolicyJson, mergeStatePolicyJson, materializeDeclaredState, materializeDeclaredEvent, revokeAccess, } from './permission-aggregation.js';
+describe('permission-aggregation unit', () => {
+    describe('dedupeSerialized', () => {
+        it('removes exact duplicates based on JSON stringification', () => {
+            deepEqual(dedupeSerialized([
+                { a: 1, b: 2 },
+                { a: 1, b: 2 },
+                { a: 3, b: 4 },
+            ]), [
+                { a: 1, b: 2 },
+                { a: 3, b: 4 },
+            ]);
+        });
+        it('preserves non-duplicates', () => {
+            deepEqual(dedupeSerialized([{ x: 1 }, { x: 2 }, { x: 3 }]), [
+                { x: 1 },
+                { x: 2 },
+                { x: 3 },
+            ]);
+        });
+        it('handles empty array', () => {
+            deepEqual(dedupeSerialized([]), []);
+        });
+        it('keeps only first occurrence of duplicate', () => {
+            const a = { order: 'first' };
+            const b = { order: 'second' };
+            deepEqual(dedupeSerialized([a, b, a]), [a, b]);
+        });
+    });
+    describe('mergeEventPolicyJson', () => {
+        it('returns undefined for all empty filter lists', () => {
+            equal(mergeEventPolicyJson([[], []]), undefined);
+        });
+        it('returns single variant structure when all identical', () => {
+            deepEqual(JSON.parse(mergeEventPolicyJson([[{ field: 'tenant', value: 't1' }]])), {
+                filters: [{ field: 'tenant', value: 't1' }],
+            });
+        });
+        it('returns variants array when different filter lists exist', () => {
+            deepEqual(JSON.parse(mergeEventPolicyJson([
+                [{ field: 'tenant', value: 't1' }],
+                [{ field: 'tenant', value: 't2' }],
+            ])), {
+                variants: [
+                    { filters: [{ field: 'tenant', value: 't1' }] },
+                    { filters: [{ field: 'tenant', value: 't2' }] },
+                ],
+            });
+        });
+        it('deduplicates identical filter lists in variants', () => {
+            deepEqual(JSON.parse(mergeEventPolicyJson([
+                [{ field: 'a', value: '1' }],
+                [{ field: 'a', value: '1' }],
+                [{ field: 'b', value: '2' }],
+            ])), {
+                variants: [
+                    { filters: [{ field: 'a', value: '1' }] },
+                    { filters: [{ field: 'b', value: '2' }] },
+                ],
+            });
+        });
+    });
+    describe('mergeStatePolicyJson', () => {
+        it('returns undefined for empty readSpecs', () => {
+            equal(mergeStatePolicyJson([]), undefined);
+        });
+        it('returns single variant for one spec', () => {
+            deepEqual(JSON.parse(mergeStatePolicyJson([
+                {
+                    methods: ['get', 'range'],
+                    filters: [{ field: 'x', value: 'y' }],
+                },
+            ])), {
+                methods: ['get', 'range'],
+                filters: [{ field: 'x', value: 'y' }],
+            });
+        });
+        it('returns variants array for multiple specs', () => {
+            deepEqual(JSON.parse(mergeStatePolicyJson([
+                { methods: ['get'], filters: [] },
+                { methods: ['range'], filters: [{ field: 'a', value: 'b' }] },
+            ])), {
+                variants: [
+                    { methods: ['get'], filters: [] },
+                    { methods: ['range'], filters: [{ field: 'a', value: 'b' }] },
+                ],
+            });
+        });
+    });
+    describe('materializeDeclaredState', () => {
+        it('returns null when no matching state', () => {
+            equal(materializeDeclaredState('nonexistent', [
+                { state: 'other', access: 'read', methods: ['get'], filters: [] },
+            ]), null);
+        });
+        it('returns null when no read/write access', () => {
+            equal(materializeDeclaredState('s', []), null);
+        });
+        it('builds read-only result with methods and filters', () => {
+            deepEqual(materializeDeclaredState('todos', [
+                {
+                    state: 'todos',
+                    access: 'read',
+                    methods: ['get', 'range'],
+                    filters: [{ field: 'authId', value: '$(auth.id)' }],
+                },
+            ]), {
+                read: true,
+                write: false,
+                policyJson: JSON.stringify({
+                    methods: ['get', 'range'],
+                    filters: [{ field: 'authId', value: '$(auth.id)' }],
+                }),
+            });
+        });
+        it('builds write-only result with empty policyJson', () => {
+            deepEqual(materializeDeclaredState('todos', [
+                { state: 'todos', access: 'write', methods: [], filters: [] },
+            ]), {
+                read: false,
+                write: true,
+                policyJson: '',
+            });
+        });
+        it('builds read+write result combining read specs', () => {
+            deepEqual(materializeDeclaredState('todos', [
+                {
+                    state: 'todos',
+                    access: 'read',
+                    methods: ['get'],
+                    filters: [{ field: 'a', value: '1' }],
+                },
+                {
+                    state: 'todos',
+                    access: 'write',
+                    methods: [],
+                    filters: [],
+                },
+            ]), {
+                read: true,
+                write: true,
+                policyJson: JSON.stringify({
+                    methods: ['get'],
+                    filters: [{ field: 'a', value: '1' }],
+                }),
+            });
+        });
+        it('ignores grants for other states', () => {
+            deepEqual(materializeDeclaredState('target', [
+                {
+                    state: 'other',
+                    access: 'read',
+                    methods: ['get'],
+                    filters: [],
+                },
+                {
+                    state: 'target',
+                    access: 'read',
+                    methods: ['range'],
+                    filters: [],
+                },
+            ]), {
+                read: true,
+                write: false,
+                policyJson: JSON.stringify({
+                    methods: ['range'],
+                    filters: [],
+                }),
+            });
+        });
+        it('merges multiple read grants into variants', () => {
+            const result = materializeDeclaredState('s', [
+                {
+                    state: 's',
+                    access: 'read',
+                    methods: ['get'],
+                    filters: [{ field: 'x', value: '1' }],
+                },
+                {
+                    state: 's',
+                    access: 'read',
+                    methods: ['range'],
+                    filters: [{ field: 'y', value: '2' }],
+                },
+            ]);
+            deepEqual(result, {
+                read: true,
+                write: false,
+                policyJson: JSON.stringify({
+                    variants: [
+                        { methods: ['get'], filters: [{ field: 'x', value: '1' }] },
+                        { methods: ['range'], filters: [{ field: 'y', value: '2' }] },
+                    ],
+                }),
+            });
+        });
+    });
+    describe('materializeDeclaredEvent', () => {
+        it('returns null when no matching event', () => {
+            equal(materializeDeclaredEvent('missing', [
+                { event: 'other', access: 'read', filters: [] },
+            ]), null);
+        });
+        it('returns open read+write when no filters', () => {
+            deepEqual(materializeDeclaredEvent('evt', [
+                { event: 'evt', access: 'read', filters: [] },
+                { event: 'evt', access: 'write', filters: [] },
+            ]), {
+                read: true,
+                write: true,
+                policyJson: '',
+            });
+        });
+        it('returns single variant when one filter list', () => {
+            const result = materializeDeclaredEvent('evt', [
+                {
+                    event: 'evt',
+                    access: 'write',
+                    filters: [{ field: 't', value: 'v' }],
+                },
+            ]);
+            deepEqual(result, {
+                read: false,
+                write: true,
+                policyJson: JSON.stringify({
+                    filters: [{ field: 't', value: 'v' }],
+                }),
+            });
+        });
+        it('deduplicates identical filter lists', () => {
+            const result = materializeDeclaredEvent('evt', [
+                {
+                    event: 'evt',
+                    access: 'write',
+                    filters: [{ field: 'x', value: '1' }],
+                },
+                {
+                    event: 'evt',
+                    access: 'write',
+                    filters: [{ field: 'x', value: '1' }],
+                },
+            ]);
+            deepEqual(result, {
+                read: false,
+                write: true,
+                policyJson: JSON.stringify({
+                    filters: [{ field: 'x', value: '1' }],
+                }),
+            });
+        });
+    });
+});
+// ───────────────────────────────────────────────────────────────────────────────
+// Handler unit tests: directly invoke grant/revoke/stream-run-created logic
+// without full integration through workers.
+// ───────────────────────────────────────────────────────────────────────────────
+function createMockCtx() {
+    const permissions = {};
+    const streams = {};
+    const streamDefs = {};
+    function permKey(row) {
+        return JSON.stringify({
+            type: row.type,
+            identifier: row.identifier,
+            authId: row.authId,
+            streamName: row.streamName,
+            streamVersion: row.streamVersion,
+            run: row.run,
+            realm: row.realm,
+        });
+    }
+    const ctx = {
+        stream: { name: 'test-stream', version: 'v1', run: 0, realm: 'test' },
+        env: {
+            async sha1(_) {
+                return 'static-hash';
+            },
+        },
+        snapshot(name) {
+            return {
+                async get(id, _opts) {
+                    if (name === 'permissions') {
+                        const k = permKey(id);
+                        return permissions[k] ?? null;
+                    }
+                    if (name === 'streams') {
+                        const k = JSON.stringify({
+                            version: id.version,
+                            name: id.name,
+                            pattern: id.pattern,
+                            realm: id.realm,
+                        });
+                        return streams[k] ?? null;
+                    }
+                    if (name === 'streamDefinition') {
+                        const k = JSON.stringify({
+                            version: id.version,
+                            pattern: id.pattern,
+                            realm: id.realm,
+                        });
+                        return streamDefs[k] ?? null;
+                    }
+                    return null;
+                },
+            };
+        },
+        state(name) {
+            return {
+                async insert(row) {
+                    if (name === 'permissions') {
+                        const k = permKey(row);
+                        if (permissions[k])
+                            throw new Error('already exists');
+                        permissions[k] = { data: row };
+                    }
+                    else if (name === 'streams') {
+                        const k = JSON.stringify({
+                            version: row.version,
+                            name: row.name,
+                            pattern: row.pattern,
+                            realm: row.realm,
+                        });
+                        streams[k] = { data: row };
+                    }
+                    else if (name === 'streamDefinition') {
+                        const k = JSON.stringify({
+                            version: row.version,
+                            pattern: row.pattern,
+                            realm: row.realm,
+                        });
+                        streamDefs[k] = { data: row };
+                    }
+                },
+                async upsert(row) {
+                    if (name === 'permissions') {
+                        const k = permKey(row);
+                        permissions[k] = { data: row };
+                    }
+                },
+                async patch(row) {
+                    if (name === 'permissions') {
+                        const k = permKey(row);
+                        if (!permissions[k])
+                            throw new Error('not found');
+                        permissions[k] = {
+                            data: { ...permissions[k].data, ...row },
+                        };
+                    }
+                },
+                async delete(row) {
+                    if (name === 'permissions') {
+                        const k = permKey(row);
+                        delete permissions[k];
+                    }
+                },
+            };
+        },
+    };
+    return {
+        ctx,
+        permissions,
+        getPermRows: () => Object.values(permissions).map((p) => p.data),
+    };
+}
+describe('permission-aggregation handlers', () => {
+    // We need to import the handlers from the aggregation definition.
+    // Because they are defined inline inside defineAggregation, we can't easily access them.
+    // However, the materializeDeclaredState / materializeDeclaredEvent and revokeAccess
+    // functions are exported, so we test the core logic directly.
+    // For the grant-access handler we replicate its behavior in a focused function.
+    async function applyGrant(ctx, evt) {
+        // Replicates 'grant-access' handler logic from permission-aggregation.ts
+        const authId = evt.auth.sub; // simplified, in real code uses getAuthId
+        const baseRow = {
+            streamName: ctx.stream.name,
+            authId,
+            streamVersion: ctx.stream.version,
+            run: ctx.stream.run,
+            realm: ctx.stream.realm,
+        };
+        const eventGrants = evt.eventGrants ?? [];
+        const byEvent = new Map();
+        for (const g of eventGrants) {
+            let m = byEvent.get(g.event);
+            if (!m) {
+                m = { read: false, write: false, filterLists: [] };
+                byEvent.set(g.event, m);
+            }
+            if (g.access === 'read')
+                m.read = true;
+            if (g.access === 'write')
+                m.write = true;
+            m.filterLists.push([...g.filters]);
+        }
+        for (const [event, m] of byEvent) {
+            const policyJson = mergeEventPolicyJson(m.filterLists);
+            await ctx.state('permissions').upsert({
+                ...baseRow,
+                type: 'event',
+                identifier: event,
+                read: m.read ? true : undefined,
+                write: m.write ? true : undefined,
+                policyJson: policyJson ?? '',
+            });
+        }
+        const stateGrants = evt.stateGrants ?? [];
+        const byState = new Map();
+        for (const g of stateGrants) {
+            let m = byState.get(g.state);
+            if (!m) {
+                m = { read: false, write: false, readSpecs: [] };
+                byState.set(g.state, m);
+            }
+            if (g.access === 'read') {
+                m.read = true;
+                m.readSpecs.push({
+                    methods: [...g.methods],
+                    filters: [...g.filters],
+                });
+            }
+            if (g.access === 'write')
+                m.write = true;
+        }
+        for (const [state, m] of byState) {
+            const policyJson = mergeStatePolicyJson(m.readSpecs);
+            await ctx.state('permissions').upsert({
+                ...baseRow,
+                type: 'state',
+                identifier: state,
+                read: m.read ? true : undefined,
+                write: m.write ? true : undefined,
+                policyJson: policyJson ?? '',
+            });
+        }
+    }
+    async function applyRevoke(ctx, evt) {
+        // Replicates 'revoke-access' handler logic
+        const signal = new AbortController().signal;
+        const authId = evt.auth.sub;
+        for (const g of evt.eventGrants ?? []) {
+            await revokeAccess(ctx, authId, {
+                type: 'event',
+                identifier: g.event,
+                access: g.access,
+            }, signal);
+        }
+        for (const g of evt.stateGrants ?? []) {
+            await revokeAccess(ctx, authId, {
+                type: 'state',
+                identifier: g.state,
+                access: g.access,
+            }, signal);
+        }
+    }
+    describe('grant-access handler', () => {
+        it('creates event permission row when none existed', async () => {
+            const { ctx, getPermRows } = createMockCtx();
+            await applyGrant(ctx, {
+                auth: { sub: 'alice' },
+                eventGrants: [{ event: 'create-item', access: 'write', filters: [] }],
+            });
+            const rows = getPermRows();
+            equal(rows.length, 1);
+            deepEqual(rows[0], {
+                type: 'event',
+                identifier: 'create-item',
+                streamName: 'test-stream',
+                authId: 'alice',
+                streamVersion: 'v1',
+                run: 0,
+                realm: 'test',
+                read: undefined,
+                write: true,
+                policyJson: '',
+            });
+        });
+        it('merges multiple event grants into variants', async () => {
+            const { ctx, getPermRows } = createMockCtx();
+            await applyGrant(ctx, {
+                auth: { sub: 'alice' },
+                eventGrants: [
+                    {
+                        event: 'create-item',
+                        access: 'write',
+                        filters: [{ field: 'tenant', value: 't1' }],
+                    },
+                    {
+                        event: 'create-item',
+                        access: 'write',
+                        filters: [{ field: 'tenant', value: 't2' }],
+                    },
+                ],
+            });
+            const rows = getPermRows();
+            equal(rows.length, 1);
+            ok(rows[0].policyJson.includes('variants'));
+        });
+        it('upserts event permission when one already exists', async () => {
+            const { ctx, getPermRows } = createMockCtx();
+            // First grant
+            await applyGrant(ctx, {
+                auth: { sub: 'alice' },
+                eventGrants: [{ event: 'create-item', access: 'write', filters: [] }],
+            });
+            // Second grant adds read (write becomes undefined because grant-access
+            // handler sets write only when m.write is true)
+            await applyGrant(ctx, {
+                auth: { sub: 'alice' },
+                eventGrants: [{ event: 'create-item', access: 'read', filters: [] }],
+            });
+            const rows = getPermRows();
+            equal(rows.length, 1);
+            equal(rows[0].read, true);
+            equal(rows[0].write, undefined);
+        });
+        it('creates state permission row with methods and filters', async () => {
+            const { ctx, getPermRows } = createMockCtx();
+            await applyGrant(ctx, {
+                auth: { sub: 'alice' },
+                stateGrants: [
+                    {
+                        state: 'items',
+                        access: 'read',
+                        methods: ['get', 'range'],
+                        filters: [{ field: 'ownerId', value: 'alice' }],
+                    },
+                ],
+            });
+            const rows = getPermRows();
+            equal(rows.length, 1);
+            equal(rows[0].type, 'state');
+            equal(rows[0].identifier, 'items');
+            equal(rows[0].read, true);
+            equal(rows[0].write, undefined);
+            deepEqual(JSON.parse(rows[0].policyJson), {
+                methods: ['get', 'range'],
+                filters: [{ field: 'ownerId', value: 'alice' }],
+            });
+        });
+        it('separates permissions for different users', async () => {
+            const { ctx, getPermRows } = createMockCtx();
+            await applyGrant(ctx, {
+                auth: { sub: 'alice' },
+                eventGrants: [{ event: 'create-item', access: 'write', filters: [] }],
+            });
+            await applyGrant(ctx, {
+                auth: { sub: 'bob' },
+                eventGrants: [{ event: 'delete-item', access: 'write', filters: [] }],
+            });
+            const rows = getPermRows();
+            equal(rows.length, 2);
+            ok(rows.some((r) => r.authId === 'alice' && r.identifier === 'create-item'));
+            ok(rows.some((r) => r.authId === 'bob' && r.identifier === 'delete-item'));
+        });
+        it('accumulates multiple state read grants into variants', async () => {
+            const { ctx, getPermRows } = createMockCtx();
+            await applyGrant(ctx, {
+                auth: { sub: 'alice' },
+                stateGrants: [
+                    {
+                        state: 'items',
+                        access: 'read',
+                        methods: ['get'],
+                        filters: [{ field: 'id', value: '1' }],
+                    },
+                    {
+                        state: 'items',
+                        access: 'read',
+                        methods: ['get'],
+                        filters: [{ field: 'id', value: '2' }],
+                    },
+                ],
+            });
+            const rows = getPermRows();
+            equal(rows.length, 1);
+            const policy = JSON.parse(rows[0].policyJson);
+            ok(Array.isArray(policy.variants));
+            equal(policy.variants.length, 2);
+        });
+    });
+    describe('revoke-access handler', () => {
+        it('removes permission row when revoking sole access level', async () => {
+            const { ctx, permissions, getPermRows } = createMockCtx();
+            // Setup a permission row with only write
+            await ctx.state('permissions').upsert({
+                type: 'event',
+                identifier: 'create-item',
+                streamName: 'test-stream',
+                authId: 'alice',
+                streamVersion: 'v1',
+                run: 0,
+                realm: 'test',
+                read: false,
+                write: true,
+                policyJson: '',
+            });
+            await applyRevoke(ctx, {
+                auth: { sub: 'alice' },
+                eventGrants: [{ event: 'create-item', access: 'write' }],
+            });
+            const rows = getPermRows();
+            equal(rows.length, 0);
+        });
+        it('keeps row and flips boolean when other access remains', async () => {
+            const { ctx, getPermRows } = createMockCtx();
+            await ctx.state('permissions').upsert({
+                type: 'event',
+                identifier: 'create-item',
+                streamName: 'test-stream',
+                authId: 'alice',
+                streamVersion: 'v1',
+                run: 0,
+                realm: 'test',
+                read: true,
+                write: true,
+                policyJson: '',
+            });
+            await applyRevoke(ctx, {
+                auth: { sub: 'alice' },
+                eventGrants: [{ event: 'create-item', access: 'read' }],
+            });
+            const rows = getPermRows();
+            equal(rows.length, 1);
+            equal(rows[0].read, false);
+            equal(rows[0].write, true);
+        });
+        it('clears policyJson when revoking read while keeping write', async () => {
+            const { ctx, getPermRows } = createMockCtx();
+            await ctx.state('permissions').upsert({
+                type: 'state',
+                identifier: 'items',
+                streamName: 'test-stream',
+                authId: 'alice',
+                streamVersion: 'v1',
+                run: 0,
+                realm: 'test',
+                read: true,
+                write: false,
+                policyJson: JSON.stringify({ methods: ['get'], filters: [] }),
+            });
+            await applyRevoke(ctx, {
+                auth: { sub: 'alice' },
+                stateGrants: [{ state: 'items', access: 'read' }],
+            });
+            const rows = getPermRows();
+            equal(rows.length, 0);
+        });
+        it('does nothing when row does not exist', async () => {
+            const { ctx, getPermRows } = createMockCtx();
+            await applyRevoke(ctx, {
+                auth: { sub: 'alice' },
+                eventGrants: [{ event: 'missing', access: 'write' }],
+            });
+            const rows = getPermRows();
+            equal(rows.length, 0);
+        });
+    });
+    describe('stream-run-created default-deny logic (security fix)', () => {
+        it('denies ALL events when eventGrant is non-empty and event is not listed', async () => {
+            const { ctx, getPermRows } = createMockCtx();
+            // Seed stream-def with eventGrant that only allows create-item
+            await ctx.state('streamDefinition').insert({
+                version: 'v1',
+                pattern: 'p',
+                realm: 'test',
+                currentRun: 0,
+                events: { 'create-item': {}, 'delete-item': {} },
+                state: {},
+                stateGrant: [],
+                eventGrant: [{ event: 'create-item', access: 'write', filters: [] }],
+            });
+            // Simulate the stream-run-created handler logic for eventGrants
+            const streamDef = await ctx
+                .snapshot('streamDefinition')
+                .get({ version: 'v1', pattern: 'p', realm: 'test' }, { signal: new AbortController().signal });
+            ok(streamDef);
+            const eventGrants = streamDef.data.eventGrant;
+            for (const evtKey of Object.keys(streamDef.data.events)) {
+                const decl = eventGrants.length > 0
+                    ? materializeDeclaredEvent(evtKey, eventGrants)
+                    : null;
+                await ctx.state('permissions').upsert({
+                    type: 'event',
+                    identifier: evtKey,
+                    streamName: 'test-stream',
+                    authId: 'alice',
+                    streamVersion: 'v1',
+                    run: 0,
+                    realm: 'test',
+                    read: decl ? decl.read : eventGrants.length > 0 ? false : true,
+                    write: decl ? decl.write : eventGrants.length > 0 ? false : true,
+                    policyJson: decl ? decl.policyJson : '',
+                });
+            }
+            const rows = getPermRows();
+            const createRow = rows.find((r) => r.identifier === 'create-item');
+            const deleteRow = rows.find((r) => r.identifier === 'delete-item');
+            ok(createRow);
+            equal(createRow.write, true);
+            ok(deleteRow);
+            equal(deleteRow.write, false); // core security assertion
+            equal(deleteRow.read, false);
+        });
+        it('denies ALL states when stateGrant is non-empty and state is not listed', async () => {
+            const { ctx, getPermRows } = createMockCtx();
+            await ctx.state('streamDefinition').insert({
+                version: 'v1',
+                pattern: 'p',
+                realm: 'test',
+                currentRun: 0,
+                events: {},
+                state: { items: {}, secrets: {} },
+                stateGrant: [
+                    { state: 'items', access: 'read', methods: ['get'], filters: [] },
+                ],
+                eventGrant: [],
+            });
+            const streamDef = await ctx
+                .snapshot('streamDefinition')
+                .get({ version: 'v1', pattern: 'p', realm: 'test' }, { signal: new AbortController().signal });
+            ok(streamDef);
+            const stateGrants = streamDef.data.stateGrant;
+            for (const stateName of Object.keys(streamDef.data.state)) {
+                const decl = stateGrants.length > 0
+                    ? materializeDeclaredState(stateName, stateGrants)
+                    : null;
+                await ctx.state('permissions').upsert({
+                    type: 'state',
+                    identifier: stateName,
+                    streamName: 'test-stream',
+                    authId: 'alice',
+                    streamVersion: 'v1',
+                    run: 0,
+                    realm: 'test',
+                    read: decl ? decl.read : stateGrants.length > 0 ? false : true,
+                    write: decl ? decl.write : stateGrants.length > 0 ? false : false,
+                    policyJson: decl ? decl.policyJson : '',
+                });
+            }
+            const rows = getPermRows();
+            const itemsRow = rows.find((r) => r.identifier === 'items');
+            const secretsRow = rows.find((r) => r.identifier === 'secrets');
+            ok(itemsRow);
+            equal(itemsRow.read, true);
+            ok(secretsRow);
+            equal(secretsRow.read, false); // core security assertion
+            equal(secretsRow.write, false);
+        });
+        it('allows ALL events when eventGrant is empty (backward compat)', async () => {
+            const { ctx, getPermRows } = createMockCtx();
+            await ctx.state('streamDefinition').insert({
+                version: 'v1',
+                pattern: 'p',
+                realm: 'test',
+                currentRun: 0,
+                events: { 'create-item': {}, 'delete-item': {} },
+                state: {},
+                stateGrant: [],
+                eventGrant: [],
+            });
+            const streamDef = await ctx
+                .snapshot('streamDefinition')
+                .get({ version: 'v1', pattern: 'p', realm: 'test' }, { signal: new AbortController().signal });
+            ok(streamDef);
+            const eventGrants = streamDef.data.eventGrant;
+            for (const evtKey of Object.keys(streamDef.data.events)) {
+                const decl = eventGrants.length > 0
+                    ? materializeDeclaredEvent(evtKey, eventGrants)
+                    : null;
+                await ctx.state('permissions').upsert({
+                    type: 'event',
+                    identifier: evtKey,
+                    streamName: 'test-stream',
+                    authId: 'alice',
+                    streamVersion: 'v1',
+                    run: 0,
+                    realm: 'test',
+                    read: decl ? decl.read : eventGrants.length > 0 ? false : true,
+                    write: decl ? decl.write : eventGrants.length > 0 ? false : true,
+                    policyJson: decl ? decl.policyJson : '',
+                });
+            }
+            const rows = getPermRows();
+            equal(rows.length, 2);
+            ok(rows.every((r) => r.read === true && r.write === true));
+        });
+    });
+});
+// ───────────────────────────────────────────────────────────────────────────────
+// Full integration tests: event and state access through the managed store
+// using the existing todoExampleStream (empty grants = open access)
+// ───────────────────────────────────────────────────────────────────────────────
+describe('permission-aggregation integration with existing streams', () => {
+    it('default grants allow all access when no grants declared', async (test) => {
+        const testCase = createTestCase({
+            signal: test.signal,
+            registry: undefined,
+        });
+        // eslint-disable-next-line @typescript-eslint/no-var-requires
+        const { createExampleRegistry } = await import('../create-example-registry.js');
+        const registry = createExampleRegistry(test.signal);
+        const realTestCase = createTestCase({
+            signal: test.signal,
+            registry,
+        });
+        await realTestCase.run(async (run) => {
+            const stream = run.management.getStream('tenant', todoExampleStream, {
+                args: { param: 'open' },
+                auth: { sub: 'user1', iss: 'custom', aud: 'test' },
+                signal: test.signal,
+            });
+            await stream.push('create-todo', { title: 'hello' }, { await: true, id: '1', signal: test.signal });
+            const result = await browse(stream.snapshot('todos').range(null, { signal: test.signal }), 10);
+            equal(result.items.length, 1);
+            deepEqual(result.items[0].data, {
+                id: '1',
+                title: 'hello',
+                completed: false,
+            });
+        });
+    });
+    it('prevents one user from pushing events on another user stream', async (test) => {
+        const { createExampleRegistry } = await import('../create-example-registry.js');
+        const registry = createExampleRegistry(test.signal);
+        const testCase = createTestCase({
+            signal: test.signal,
+            registry,
+        });
+        await testCase.run(async (run) => {
+            const streamSub1 = run.management.getStream('push-event-others', todoExampleStream, {
+                args: { param: 'test' },
+                auth: { aud: 'aud', sub: 'sub1', iss: 'iss' },
+                signal: test.signal,
+            });
+            const streamSub2 = run.management.getStream('push-event-others', todoExampleStream, {
+                args: { param: 'test' },
+                auth: { aud: 'aud', sub: 'sub2', iss: 'iss' },
+                signal: test.signal,
+            });
+            await streamSub1.push('create-todo', { title: 'test1' }, {
+                await: true,
+                id: '1',
+                signal: test.signal,
+            });
+            await rejects(() => streamSub2.push('create-todo', { title: 'test2' }, {
+                await: true,
+                id: '2',
+                signal: test.signal,
+            }), /no permission/);
+        });
+    });
+    it('prevents reading state on another users stream', async (test) => {
+        const { createExampleRegistry } = await import('../create-example-registry.js');
+        const registry = createExampleRegistry(test.signal);
+        const testCase = createTestCase({
+            signal: test.signal,
+            registry,
+        });
+        await testCase.run(async (run) => {
+            const streamSub1 = run.management.getStream('test-read-others-state', todoExampleStream, {
+                args: { param: 'test' },
+                auth: { aud: 'aud', sub: 'sub1', iss: 'iss' },
+                signal: test.signal,
+            });
+            const streamSub2 = run.management.getStream('test-read-others-state', todoExampleStream, {
+                args: { param: 'test' },
+                auth: { aud: 'aud', sub: 'sub2', iss: 'iss' },
+                signal: test.signal,
+            });
+            await streamSub1.push('create-todo', { title: 'test1' }, {
+                await: true,
+                id: '1',
+                signal: test.signal,
+            });
+            await rejects(() => browse(streamSub2.snapshot('todos').range(null, {
+                signal: test.signal,
+            }), 10), /no permission/);
+        });
+    });
+});
+describe('permission-aggregation state-read-policy enforcement', () => {
+    // The policy enforcement wrapper tests are already in state-read-policy.enforcement.test.ts
+    // so here we simply assert the overall grant policy builds the correct policyJson.
+    it('materializeDeclaredState produces correct policyJson for single variant', () => {
+        const result = materializeDeclaredState('items', [
+            {
+                state: 'items',
+                access: 'read',
+                methods: ['get'],
+                filters: [{ field: 'ownerId', value: 'alice' }],
+            },
+        ]);
+        ok(result);
+        equal(result.read, true);
+        equal(result.write, false);
+        deepEqual(JSON.parse(result.policyJson), {
+            methods: ['get'],
+            filters: [{ field: 'ownerId', value: 'alice' }],
+        });
+    });
+    it('materializeDeclaredState produces correct policyJson for multiple variants', () => {
+        const result = materializeDeclaredState('items', [
+            {
+                state: 'items',
+                access: 'read',
+                methods: ['get'],
+                filters: [{ field: 'ownerId', value: 'alice' }],
+            },
+            {
+                state: 'items',
+                access: 'read',
+                methods: ['range'],
+                filters: [{ field: 'tenant', value: 't1' }],
+            },
+        ]);
+        ok(result);
+        const policy = JSON.parse(result.policyJson);
+        ok(Array.isArray(policy.variants));
+        equal(policy.variants.length, 2);
+    });
+    it('materializeDeclaredEvent produces correct policyJson for write with filters', () => {
+        const result = materializeDeclaredEvent('update-item', [
+            {
+                event: 'update-item',
+                access: 'write',
+                filters: [{ field: 'ownerId', value: '$(auth.id)' }],
+            },
+        ]);
+        ok(result);
+        equal(result.read, false);
+        equal(result.write, true);
+        equal(result.policyJson, JSON.stringify({
+            filters: [{ field: 'ownerId', value: '$(auth.id)' }],
+        }));
+    });
+});
+//# sourceMappingURL=permission-aggregation.test.js.map