@owlmeans/server-planning 0.1.18-rc.2 → 0.1.18-rc.21

package/src/store/types.ts

@@ -1,6 +1,7 @@
 import type {
   CommitEvent, CommitSource, CommitStatus, PlanningStore, ProjectionStore, Relationship,
-  RelationshipStore, SpecificationStore, Transition, TransitionStore, Workcard,
+  RelationshipStore, SchemaStore, ScopedSchemaRecord, SpecificationStore, Transition, TransitionStore,
+  Workcard,
 } from '@owlmeans/planning'
 
 /** What a folding store calls for every committed transition — the service's `committed`. */
@@ -49,6 +50,11 @@ export interface FoldOptions {
   limit?: number
   /** Called between transitions — a queue processor renews its lock here. */
   touch?: () => Promise<void>
+  /**
+   * Runs one transition's store writes as a unit — a transactional store opens a savepoint here, so
+   * a write the database refuses leaves nothing of that transition behind and the fold goes past it.
+   */
+  unit?: <R>(run: () => Promise<R>) => Promise<R>
 }
 
 export interface FoldResult {
@@ -63,6 +69,8 @@ export interface MemoryPlanningStoreSeed {
   cards?: Workcard[]
   links?: Relationship[]
   transitions?: Transition[]
+  /** Data-defined type and flow records — kept only by a store built with `schemas: true`. */
+  schemas?: ScopedSchemaRecord[]
 }
 
 export interface MemoryPlanningStoreOptions {
@@ -74,6 +82,11 @@ export interface MemoryPlanningStoreOptions {
   /** The commit listener used until a service binds its own. */
   onCommitted?: CommitListener
   alias?: string
+  /**
+   * Hold data-defined types and flows (the `schemas` port). Off by default: a store without it
+   * resolves every type and flow from the code registry, exactly as before.
+   */
+  schemas?: boolean
 }
 
 export interface MemoryPlanningStore extends BindablePlanningStore {
@@ -82,6 +95,8 @@ export interface MemoryPlanningStore extends BindablePlanningStore {
   specs: SpecificationStore
   links: RelationshipStore
   commits: CommitHub
+  /** Present when the store was built with `schemas: true`. */
+  schemas?: SchemaStore
   bind: (committed: CommitListener) => void
   /** Fold what is pending — for one card, or for every card with a pending transition. */
   flush: (card?: string) => Promise<void>

package/src/types.local.ts

@@ -0,0 +1,7 @@
+import { PlanningSchemaKind, type StatusFlowSchema, type WorkcardTypeSchema } from '@owlmeans/planning'
+
+export interface Planned {
+  kind: PlanningSchemaKind
+  key: string
+  definition: WorkcardTypeSchema | StatusFlowSchema
+}

package/src/types.ts

@@ -1,11 +1,10 @@
 import type { BasicConfig, BasicContext, LazyService } from '@owlmeans/context'
 import type { AbstractRequest } from '@owlmeans/entrypoint'
-import type {
-  AnyTypeSchema, PlanningPlugin, PlanningScope, PlanningService, PlanningStore, StatusFlowSchema,
-  WithPlanningService,
-} from '@owlmeans/planning'
+import type { AnyTypeSchema, PlanningPlugin, PlanningScope, PlanningService, PlanningStore, StatusFlowSchema, WithPlanningService, PlanningSchemaRegistry, SchemaStore, ScopedSchemaRegistry, CommitEvent, PlanningExecContext, PlanningHookContext, TransitionExecution, WorkcardDraft } from '@owlmeans/planning'
 import type { ApiServerAppend } from '@owlmeans/server-api'
 import type { ServerConfig, ServerContext } from '@owlmeans/server-context'
+import type { StoreRoute } from './store/types.js'
+
 
 export interface Config extends ServerConfig { }
 
@@ -37,6 +36,51 @@ export interface PlanningScopeExtractor {
   (req: AbstractRequest, ctx: BasicContext<BasicConfig>): Partial<PlanningScope> | Promise<Partial<PlanningScope>>
 }
 
+/**
+ * A grant: `true` for everything the request can see, a list for those project cards only (the
+ * parent of a created project, the deleted project, the schema layer).
+ */
+export type PlanningGrant = boolean | string[]
+
+export interface PlanningAccessGrants {
+  /** Create a project — at the root only with `true`; a list names the parent projects. */
+  createProjects?: PlanningGrant
+  /** Delete a project — a list names the projects. */
+  deleteProjects?: PlanningGrant
+  /** Write data-defined types and flows — the organization-wide layer only with `true`. */
+  defineSchemas?: PlanningGrant
+}
+
+/** What a hosting application decides about one request. */
+export interface PlanningAccess {
+  /** The organization the request acts in — the only source of it once a resolver is given. */
+  entityId: string
+  /** Narrows every read and write to these project cards. Every project when omitted. */
+  projects?: string[]
+  /**
+   * The project cards the request may WRITE in: `execute` on a card, specification or link inside
+   * one of them (the same rule a narrowed read admits — the project, the cards whose `parents` name
+   * it, a specification through its parent card), and `schema.define` of a project layer. A project
+   * outside `projects` is still unreachable. Omitted — writes reach every project `projects` admits;
+   * present — anything else is refused with `PlanningForbidden` (403). Creating a project is
+   * `grants.createProjects`' alone; the organization-wide schema layer is `grants.defineSchemas`'.
+   */
+  writes?: string[]
+  /**
+   * Gates the writes above. Omitted — nothing is gated; present — a flag it leaves out is refused
+   * with `PlanningForbidden`.
+   */
+  grants?: PlanningAccessGrants
+}
+
+/**
+ * Resolves a request's access. A throw is the request's answer (an `AuthForbidden` answers 403
+ * like any other guard refusal).
+ */
+export interface PlanningAccessResolver {
+  (req: AbstractRequest, ctx: BasicContext<BasicConfig>): Promise<PlanningAccess>
+}
+
 export interface PlanningHandlerOptions {
   /** The planning service alias. `PLANNING_SERVICE` when omitted. */
   service?: string
@@ -45,4 +89,82 @@ export interface PlanningHandlerOptions {
   /** The longest single long poll, in seconds — clamps `commit.get`'s `wait` and `execute`'s `timeout`. */
   maxPoll?: number
   scope?: PlanningScopeExtractor
+  /**
+   * The hosting application's access decision per request. Without it the organization is the
+   * request's own (`requireEntityKey`) and nothing is narrowed or gated.
+   */
+  access?: PlanningAccessResolver
+}
+
+export interface SchemaViewsOptions {
+  /** The code registry every layer starts from. */
+  code: () => PlanningSchemaRegistry
+  /** Bumps whenever the code registry changes (a plugin's `use`). */
+  version: () => number
+  /** The schema port, when the store has one. */
+  port: () => SchemaStore | undefined
+  /** How many resolved layers are kept. */
+  limit?: number
+}
+
+export interface SchemaViews {
+  /** The code registry itself without a port; the resolved layer with one. */
+  of: (entityId: string, project?: string) => Promise<PlanningSchemaRegistry>
+  /** @throws {PlanningUnsupported} without a port */
+  scoped: (entityId: string, project?: string) => Promise<ScopedSchemaRegistry>
+}
+
+export interface ProjectionOptions {
+  /** The planning service alias. */
+  service?: string
+  /** The store the queue folds — the service's default store when omitted. */
+  store?: (service: PlanningService) => PlanningStore
+  /** Where events go — the store's commit hub `publish` when it has one. */
+  publish?: (event: CommitEvent) => Promise<void>
+}
+
+export interface PluginRegistry {
+  /** Register, or replace the plugin of the same `name`. Its schemas are contributed now. */
+  use: (plugin: PlanningPlugin) => void
+  /** Every plugin, `order` ascending (registration order among equals). */
+  plugins: () => PlanningPlugin[]
+  /** The owning plugins that supply a store, in plugin order, each store resolved once. */
+  routes: (ctx?: BasicContext<BasicConfig>) => StoreRoute[]
+  /** The first owning plugin's store for a type, else `fallback`. */
+  storeFor: (type: string | undefined, fallback: PlanningStore, ctx?: BasicContext<BasicConfig>) => PlanningStore
+  /** The first plugin answering a code wins. */
+  mintCode: (
+    draft: WorkcardDraft, taken: (code: string) => Promise<boolean>, contextOf: (plugin: PlanningPlugin) => PlanningExecContext
+  ) => Promise<string | undefined>
+  /** The `before` chain; answers the execution the chain left. */
+  before: (
+    exec: TransitionExecution, contextOf: (plugin: PlanningPlugin) => PlanningExecContext
+  ) => Promise<TransitionExecution>
+  /** The `after` chain; a failing hook is logged and the chain goes on. */
+  after: (event: CommitEvent, contextOf: (plugin: PlanningPlugin) => PlanningHookContext) => Promise<void>
+  /** Bumps on every `use` — what a cached composite store is keyed by. */
+  version: () => number
+}
+
+export type PlanningServiceApi = Pick<PlanningService, 'use' | 'plugins' | 'schemas' | 'store' | 'for' | 'committed'>
+
+/** What the facade and the executor reach the service through. */
+export interface PlanningRuntime {
+  service: () => PlanningService
+  registry: PluginRegistry
+  options: PlanningServiceOptions
+  context: () => BasicContext<BasicConfig> | undefined
+  /** The composite store reads and commits go through. */
+  reader: () => PlanningStore
+  /** Every distinct store: the default one first, then each plugin's. */
+  stores: () => PlanningStore[]
+  /** The default store's data-defined schema port, when it has one. */
+  schemaStore: () => SchemaStore | undefined
+  /**
+   * The registry a card of this organization (and project) resolves through. Without a schema
+   * port it is the service's code registry itself — the very same object.
+   */
+  schemasFor: (entityId: string, project?: string) => Promise<PlanningSchemaRegistry>
+  /** The resolved layer. @throws {PlanningUnsupported} without a schema port */
+  scopedSchemas: (entityId: string, project?: string) => Promise<ScopedSchemaRegistry>
 }

package/src/utils/index.ts

@@ -1,2 +1,3 @@
 export * from './guard.js'
 export * from './scope.js'
+export type * from './types.js'

package/src/utils/scope.ts

@@ -1,9 +1,11 @@
 import { requireEntityKey } from '@owlmeans/auth-common'
 import type { BasicConfig, BasicContext } from '@owlmeans/context'
 import type { AbstractRequest } from '@owlmeans/entrypoint'
-import { PLANNING_SERVICE } from '@owlmeans/planning'
-import type { PlanningFacade, PlanningScope, PlanningService, TransitionActor } from '@owlmeans/planning'
-import type { PlanningHandlerOptions, PlanningHostService } from '../types.js'
+import { PLANNING_SERVICE, PlanningForbidden, type PlanningFacade, type PlanningScope, type PlanningService, type TransitionActor, type Workcard } from '@owlmeans/planning'
+import type {
+  PlanningAccess, PlanningAccessGrants, PlanningHandlerOptions, PlanningHostService,
+} from '../types.js'
+import type { HandlerScope } from './types.js'
 
 const clean = <T extends object>(record: T): T =>
   Object.fromEntries(Object.entries(record).filter(([, value]) => value != null && value !== '')) as T
@@ -14,17 +16,7 @@ export const actorOf = (req: AbstractRequest): TransitionActor => clean({
   userId: req.auth?.userId,
 })
 
-/**
- * The scope a request reads and writes as.
- *
- * `entityId` is `requireEntityKey(req)` — the resolved organization id, never a value from the
- * body or the query — and `extra` cannot replace it; `extra` adds what the deployment derives
- * (a `channel`, a `service`). The actor is the authenticated subject plus that channel.
- *
- * @throws {AuthorizationError} when the request carries no organization
- */
-export const scopeOf = (req: AbstractRequest, extra?: Partial<PlanningScope>): PlanningScope => {
-  const entityId = requireEntityKey(req)
+const scopeWith = (req: AbstractRequest, entityId: string, extra?: Partial<PlanningScope>): PlanningScope => {
   const subject = actorOf(req)
   const channel = extra?.channel ?? extra?.actor?.channel
 
@@ -37,15 +29,103 @@ export const scopeOf = (req: AbstractRequest, extra?: Partial<PlanningScope>): P
   }) as PlanningScope
 }
 
+/**
+ * The scope a request reads and writes as.
+ *
+ * `entityId` is `requireEntityKey(req)` — the resolved organization id, never a value from the
+ * body or the query — and `extra` cannot replace it; `extra` adds what the deployment derives
+ * (a `channel`, a `service`). The actor is the authenticated subject plus that channel.
+ *
+ * @throws {AuthorizationError} when the request carries no organization
+ */
+export const scopeOf = (req: AbstractRequest, extra?: Partial<PlanningScope>): PlanningScope =>
+  scopeWith(req, requireEntityKey(req), extra)
+
+/**
+ * The scope of a request under a resolved {@link PlanningAccess}: the organization is the
+ * resolver's — never the token's, never `extra`'s — and `projects` narrows it.
+ */
+export const accessScopeOf = (
+  req: AbstractRequest, access: PlanningAccess, extra?: Partial<PlanningScope>
+): PlanningScope => {
+  const { projects: _projects, entityId: _entityId, ...rest } = extra ?? {}
+  const scope = scopeWith(req, access.entityId, rest)
+
+  return access.projects != null ? { ...scope, projects: [...access.projects] } : scope
+}
+
 export const planningServiceOf = (
   ctx: BasicContext<BasicConfig>, opts?: Pick<PlanningHandlerOptions, 'service'>
 ): PlanningService => ctx.service<PlanningHostService>(opts?.service ?? PLANNING_SERVICE)
 
+/**
+ * The facade a handler works through, and the access it was resolved under.
+ *
+ * Without `opts.access` it is exactly the request's scope plus what `opts.scope` derives. With it,
+ * the resolver names the organization and the visible projects; a throw from the resolver is the
+ * request's error.
+ */
+export const handlerScopeOf = async (
+  ctx: BasicContext<BasicConfig>, req: AbstractRequest, opts?: PlanningHandlerOptions
+): Promise<HandlerScope> => {
+  const extra = await opts?.scope?.(req, ctx)
+  if (opts?.access == null) {
+    return { facade: planningServiceOf(ctx, opts).for(scopeOf(req, extra ?? undefined)) }
+  }
+  const access = await opts.access(req, ctx)
+
+  return { facade: planningServiceOf(ctx, opts).for(accessScopeOf(req, access, extra ?? undefined)), access }
+}
+
 /** The facade a handler works through: the request's scope plus what `opts.scope` derives. */
 export const handlerFacade = async (
   ctx: BasicContext<BasicConfig>, req: AbstractRequest, opts?: PlanningHandlerOptions
-): Promise<PlanningFacade> => {
-  const extra = await opts?.scope?.(req, ctx)
+): Promise<PlanningFacade> => (await handlerScopeOf(ctx, req, opts)).facade
+
+/**
+ * Refuse a write the access does not grant. No access, or access without `grants`, gates nothing;
+ * a `grants` object refuses every flag it leaves out. `true` grants everything; a list grants the
+ * project ids it names — `target` is the project the write is about (`undefined` for the
+ * organization's root, which only `true` reaches).
+ *
+ * @throws {PlanningForbidden}
+ */
+export const assertGranted = (
+  access: PlanningAccess | undefined, grant: keyof PlanningAccessGrants, target?: string
+): void => {
+  if (access?.grants == null) {
+    return
+  }
+  const granted = access.grants[grant]
+  if (granted === true || (Array.isArray(granted) && target != null && granted.includes(target))) {
+    return
+  }
+  throw new PlanningForbidden(`${grant}:${target ?? 'root'}`)
+}
 
-  return planningServiceOf(ctx, opts).for(scopeOf(req, extra ?? undefined))
+/**
+ * A card the access's `writes` admits — the rule a narrowed read admits, over `writes`: a project
+ * it names, or a card whose `parents` name one. A specification is admitted through its parent card
+ * by the caller. No `writes` admits everything.
+ */
+export const writableIn = (access: PlanningAccess | undefined, card: Pick<Workcard, 'id' | 'parents'>): boolean => {
+  const writes = access?.writes
+  if (writes == null) {
+    return true
+  }
+  return (card.id != null && writes.includes(card.id)) || card.parents.some(parent => writes.includes(parent))
+}
+
+/**
+ * Refuse a write into a project the access's `writes` leaves out. No `writes` refuses nothing;
+ * `target` is the project the write is in (`undefined` for the organization's root, which a set
+ * `writes` never admits).
+ *
+ * @throws {PlanningForbidden}
+ */
+export const assertWrites = (access: PlanningAccess | undefined, target?: string): void => {
+  if (access?.writes == null || (target != null && access.writes.includes(target))) {
+    return
+  }
+  throw new PlanningForbidden(`writes:${target ?? 'root'}`)
 }

package/src/utils/types.ts

@@ -0,0 +1,8 @@
+import type { PlanningFacade } from '@owlmeans/planning'
+import type { PlanningAccess } from '../types.js'
+
+export interface HandlerScope {
+  facade: PlanningFacade
+  /** The resolver's answer, when the handler options carry one. */
+  access?: PlanningAccess
+}

package/tests/access.spec.ts

@@ -0,0 +1,160 @@
+import { describe, expect, test } from 'bun:test'
+import { AuthForbidden } from '@owlmeans/auth'
+import {
+  CommitState, makePlanningProtocols, ParentNotFound, PlanningForbidden, PlanningSchemaKind, SchemaOrigin,
+  TransitionAction, WorkcardKind, WorkcardNotFound,
+} from '@owlmeans/planning'
+import type { CommitEvent, SchemaDefineReply, ScopedSchemaBundle } from '@owlmeans/planning'
+import {
+  defineSchemas, executePlanning, getCard, getCommit, listCards, listLinks, listSchemas, summarizeCards,
+} from '../src/actions/index.js'
+import type { PlanningAccess, PlanningHandlerOptions } from '../src/types.js'
+import {
+  createProject, createTask, ENTITY, invoke, makeTestPlanning, OTHER_ENTITY, PROJECT, session, TASK,
+} from './context.js'
+
+const tree = makePlanningProtocols({ base: { alias: 'test:planning' }, guards: 'test-guard', definitions: true })
+
+const withAccess = (access: PlanningAccess | (() => PlanningAccess)): PlanningHandlerOptions => ({
+  access: async () => typeof access === 'function' ? access() : access,
+})
+
+describe('@owlmeans/server-planning — access resolver', () => {
+  test('the organization is the resolver\'s, never the token\'s, and a resolver throw is the answer', async () => {
+    const { context, facade } = await makeTestPlanning()
+    const theirs = await createProject(facade(OTHER_ENTITY), 'Theirs')
+    await createProject(facade(), 'Mine')
+
+    const listed = await invoke(listCards(tree.card.list, withAccess({ entityId: OTHER_ENTITY })), context, { ...session(ENTITY), query: {} })
+    expect(listed.items.map((card: { id: string }) => card.id)).toEqual([theirs.id])
+
+    const refusing: PlanningHandlerOptions = { access: async () => { throw new AuthForbidden('no-seat') } }
+    await expect(invoke(listCards(tree.card.list, refusing), context, { ...session(), query: {} })).rejects.toBeInstanceOf(AuthForbidden)
+  })
+
+  test('projects narrow reads: an invisible project and its cards are absent, lists and summaries shrink', async () => {
+    const { context, facade } = await makeTestPlanning()
+    const visible = await createProject(facade(), 'Visible')
+    const hidden = await createProject(facade(), 'Hidden')
+    const seen = (await createTask(facade(), visible.id!, 'Seen')).card!
+    const unseen = (await createTask(facade(), hidden.id!, 'Unseen')).card!
+    await facade().execute({ card: unseen.id!, action: TransitionAction.Link, link: { type: 'blocks', to: seen.id! } }, { wait: true })
+    const opts = withAccess({ entityId: ENTITY, projects: [visible.id!] })
+
+    await expect(invoke(getCard(tree.card.get, opts), context, { ...session(), params: { id: unseen.id } })).rejects.toBeInstanceOf(WorkcardNotFound)
+    await expect(invoke(getCard(tree.card.get, opts), context, { ...session(), params: { id: hidden.id } })).rejects.toBeInstanceOf(WorkcardNotFound)
+    expect((await invoke(getCard(tree.card.get, opts), context, { ...session(), params: { id: seen.id } })).id).toBe(seen.id)
+
+    const listed = await invoke(listCards(tree.card.list, opts), context, { ...session(), query: { type: TASK } })
+    expect(listed.items.map((card: { id: string }) => card.id)).toEqual([seen.id])
+    const summary = await invoke(summarizeCards(tree.card.summary, opts), context, { ...session(), query: { parents: `${visible.id},${hidden.id}` } })
+    expect(Object.keys(summary)).toEqual([visible.id!])
+    expect((await invoke(listLinks(tree.link.list, opts), context, { ...session(), query: { to: seen.id } })).total).toBe(0)
+  })
+
+  test('projects narrow writes: an invisible parent is ParentNotFound, an invisible card absent', async () => {
+    const { context, facade } = await makeTestPlanning()
+    const visible = await createProject(facade(), 'Visible')
+    const hidden = await createProject(facade(), 'Hidden')
+    const unseen = (await createTask(facade(), hidden.id!, 'Unseen')).card!
+    const execute = executePlanning(tree.execute, withAccess({ entityId: ENTITY, projects: [visible.id!] }))
+
+    await expect(invoke(execute, context, {
+      ...session(), body: { card: { kind: WorkcardKind.Card, type: TASK, parent: hidden.id, title: 'Sneaky' }, action: TransitionAction.Create },
+    })).rejects.toBeInstanceOf(ParentNotFound)
+    await expect(invoke(execute, context, {
+      ...session(), body: { card: unseen.id, action: TransitionAction.Update, changes: { title: 'Renamed' } },
+    })).rejects.toBeInstanceOf(WorkcardNotFound)
+
+    const made = await invoke(execute, context, {
+      ...session(), body: { card: { kind: WorkcardKind.Card, type: TASK, parent: visible.id, title: 'Allowed' }, action: TransitionAction.Create, wait: true },
+    })
+    expect(made.card.title).toBe('Allowed')
+    expect((await facade().cards.get(unseen.id!)).title).toBe('Unseen')
+  })
+
+  test('commit status and subscriptions stay inside the visible projects', async () => {
+    const { context, facade, service } = await makeTestPlanning()
+    const visible = await createProject(facade(), 'Visible')
+    const hidden = await createProject(facade(), 'Hidden')
+    const narrowed = service.for({ entityId: ENTITY, projects: [visible.id!] })
+    const heard: CommitEvent[] = []
+    const unsubscribe = await narrowed.commits.subscribe(event => { heard.push(event) })
+
+    const seen = await createTask(facade(), visible.id!, 'Seen')
+    const unseen = await createTask(facade(), hidden.id!, 'Unseen')
+    unsubscribe()
+
+    expect(heard.map(event => event.card)).toEqual([seen.card!.id!])
+    await expect(invoke(getCommit(tree.commit.get, withAccess({ entityId: ENTITY, projects: [visible.id!] })), context, {
+      ...session(), params: { transition: unseen.transition.id }, query: {},
+    })).rejects.toBeInstanceOf(WorkcardNotFound)
+    expect((await narrowed.commits.status(seen.transition.id!)).state).toBe(CommitState.Committed)
+  })
+
+  test('grants gate project creation, project deletion and schema definitions with a 403 refusal', async () => {
+    const { context, facade } = await makeTestPlanning({}, { schemas: true })
+    const parent = await createProject(facade(), 'Parent')
+    const other = await createProject(facade(), 'Other')
+    const nested = { kind: WorkcardKind.Project, type: PROJECT, parent: parent.id, title: 'Nested' }
+    const scoped = (grants: PlanningAccess['grants']) => withAccess({ entityId: ENTITY, grants })
+
+    await expect(invoke(executePlanning(tree.execute, scoped({})), context, {
+      ...session(), body: { card: { kind: WorkcardKind.Project, type: PROJECT, title: 'Root' }, action: TransitionAction.Create },
+    })).rejects.toBeInstanceOf(PlanningForbidden)
+    expect(PlanningForbidden.httpStatus).toBe(403)
+    await expect(invoke(executePlanning(tree.execute, scoped({ createProjects: [parent.id!] })), context, {
+      ...session(), body: { card: { kind: WorkcardKind.Project, type: PROJECT, title: 'Root' }, action: TransitionAction.Create },
+    })).rejects.toBeInstanceOf(PlanningForbidden)
+    const made = await invoke(executePlanning(tree.execute, scoped({ createProjects: [parent.id!] })), context, {
+      ...session(), body: { card: nested, action: TransitionAction.Create, wait: true },
+    })
+    expect(made.card.parent).toBe(parent.id)
+    // A card is not a project: creating one needs no grant.
+    await invoke(executePlanning(tree.execute, scoped({})), context, {
+      ...session(), body: { card: { kind: WorkcardKind.Card, type: TASK, parent: parent.id, title: 'Task' }, action: TransitionAction.Create },
+    })
+
+    await expect(invoke(executePlanning(tree.execute, scoped({ deleteProjects: [other.id!] })), context, {
+      ...session(), body: { card: parent.id, action: TransitionAction.Delete },
+    })).rejects.toBeInstanceOf(PlanningForbidden)
+    await invoke(executePlanning(tree.execute, scoped({ deleteProjects: [other.id!] })), context, {
+      ...session(), body: { card: other.id, action: TransitionAction.Delete, wait: true },
+    })
+    expect(await facade().cards.load(other.id!)).toBeNull()
+
+    const flow = { id: 'test:rota', version: 1, statuses: [{ key: 'due', intrinsic: 'planned' }], transitions: [] }
+    await expect(invoke(defineSchemas(tree.schema.define!, scoped({ defineSchemas: [parent.id!] })), context, {
+      ...session(), body: { flows: [flow] },
+    })).rejects.toBeInstanceOf(PlanningForbidden)
+    const layer: SchemaDefineReply = await invoke(defineSchemas(tree.schema.define!, scoped({ defineSchemas: [parent.id!] })), context, {
+      ...session(), body: { project: parent.id, flows: [flow] },
+    })
+    expect([layer.bundle.origins?.flows['test:rota'], layer.records.map(record => record.key)]).toEqual([SchemaOrigin.Project, ['test:rota']])
+  })
+})
+
+describe('@owlmeans/server-planning — schema handlers', () => {
+  test('schema.list answers the code bundle without a schema port, and the scoped layer with one', async () => {
+    const plain = await makeTestPlanning()
+    const bundle = await invoke(listSchemas(tree.schema.list), plain.context, { ...session(), query: {} })
+    expect(bundle).toEqual(plain.service.schemas.bundle())
+
+    const scoped = await makeTestPlanning({}, { schemas: true })
+    const project = await createProject(scoped.facade(), 'Layered')
+    const note = { type: 'test:memo', kind: WorkcardKind.Card, version: 1, fields: { type: 'object' }, flows: ['test:task'], specifications: [] }
+    await invoke(defineSchemas(tree.schema.define!), scoped.context, { ...session(), body: { project: project.id, types: [note] } })
+
+    const entityLayer: ScopedSchemaBundle = await invoke(listSchemas(tree.schema.list), scoped.context, { ...session(), query: {} })
+    const projectLayer: ScopedSchemaBundle = await invoke(listSchemas(tree.schema.list), scoped.context, { ...session(), query: { project: project.id } })
+    expect(entityLayer.types.some(type => type.type === 'test:memo')).toBe(false)
+    expect(projectLayer.origins?.types['test:memo']).toBe(SchemaOrigin.Project)
+    await expect(invoke(listSchemas(tree.schema.list), scoped.context, { ...session(OTHER_ENTITY), query: { project: project.id } }))
+      .rejects.toBeInstanceOf(WorkcardNotFound)
+
+    const retired: SchemaDefineReply = await invoke(defineSchemas(tree.schema.define!), scoped.context, {
+      ...session(), body: { project: project.id, retire: [{ kind: PlanningSchemaKind.Type, key: 'test:memo' }] },
+    })
+    expect([retired.bundle.retired?.types, retired.records[0]?.retired]).toEqual([['test:memo'], true])
+  })
+})

package/tests/conformance.spec.ts

@@ -0,0 +1,47 @@
+import { describe, test } from 'bun:test'
+import { AppType, makeBasicContext } from '@owlmeans/context'
+import type { BasicConfig } from '@owlmeans/context'
+import { appendPlanningService } from '../src/service.js'
+import { makeMemoryPlanningStore } from '../src/store/memory.js'
+import {
+  conformanceCasesFor, conformanceClock, planningConformance, planningConformancePlugin,
+} from '../src/conformance/index.js'
+import type { ConformanceSubject } from '../src/conformance/index.js'
+
+/** The memory store, booted the way a backend boots it, answering every conformance case. */
+const boot = async (schemas: boolean): Promise<ConformanceSubject> => {
+  const now = conformanceClock()
+  const store = makeMemoryPlanningStore({ now, schemas })
+  const cfg: BasicConfig = { ready: false, service: 'planning-conformance', type: AppType.Backend, services: {} }
+  const context = appendPlanningService(makeBasicContext(cfg), { store, now, plugins: [planningConformancePlugin] })
+  context.configure()
+  await context.init()
+  const service = context.planning()
+
+  return {
+    service,
+    store,
+    facade: entityId => service.for({ entityId, profileId: 'conformance-librarian', channel: 'conformance' }),
+  }
+}
+
+describe('@owlmeans/server-planning — store conformance (memory, with data-defined schemas)', () => {
+  const probe = makeMemoryPlanningStore({ schemas: true })
+  for (const entry of conformanceCasesFor(probe)) {
+    test(entry.name, async () => { await entry.run(await boot(true)) })
+  }
+})
+
+describe('@owlmeans/server-planning — store conformance (memory, code schemas only)', () => {
+  const probe = makeMemoryPlanningStore()
+  const cases = conformanceCasesFor(probe)
+  test('a store without the schema port qualifies for every case but the data-defined ones', () => {
+    const skipped = planningConformance.filter(entry => !cases.includes(entry))
+    if (skipped.some(entry => !(entry.needs ?? []).includes('schemas')) || skipped.length === 0) {
+      throw new Error('only the data-defined cases are skipped')
+    }
+  })
+  for (const entry of cases) {
+    test(entry.name, async () => { await entry.run(await boot(false)) })
+  }
+})