@pplethai/cli 0.7.0 → 0.8.0

package/templates/golden-path/test/harness.ts

@@ -1,31 +1,98 @@
 import { env } from "cloudflare:test";
+import { callRegistry as dispatchRegistry, type CallRegistryOptions } from "../src/dev-registry";
 import type { Env } from "../src/env";
-import { createApp } from "../src/index";
+import worker, { createApp } from "../src/index";
 
 // A placeholder bearer. In tests `import.meta.env.DEV` is true, so the Worker
 // signs in as the default persona and ignores the token — the value only
 // matters on the real PPLE ID path, where tests pass an explicit one.
 export const DEV_TOKEN = "dev";
 
+/** What `callService` sent. The App Key and the user token are not kept. */
+export interface RecordedServiceCall {
+  /** Path and query, under the services origin. */
+  path: string;
+  method: string;
+  /** Headers other than `authorization` and `x-pple-user-token`. */
+  headers: Record<string, string>;
+}
+
+/**
+ * The Workers runtime builds this. Tests only need the methods a handler may
+ * call; the rest exists on the real context and nowhere a test can construct.
+ */
+export function testExecutionContext(): ExecutionContext {
+  return {
+    waitUntil() {},
+    passThroughOnException() {},
+    props: {},
+    exports: {},
+  } as unknown as ExecutionContext;
+}
+
 export interface Fakes {
   /** Handles GET {SSO_BASE_URL}/oidc/v1/userinfo */
   sso?: (req: Request) => Response | Promise<Response>;
   /** Handles POST {NOTIFY_API_BASE}/notifications */
   notify?: (req: Request) => Response | Promise<Response>;
+  /**
+   * Handles `{PPLE_SERVICES_URL}/<provider>/<name>/…` for `callService` and
+   * `readDataset`. Answer as the platform, or refuse with `serviceRefusal`
+   * and any `x-pple-error` code.
+   */
+  services?: (req: Request) => Response | Promise<Response>;
 }
 
+const SECRET_HEADERS = new Set(["authorization", "x-pple-user-token"]);
+
 /**
- * A copy of the Worker wired to fake PPLE ID / notification services (via an
- * injected fetch) and the real local D1 + R2 from the test runtime. Records
- * the requests sent to the notification endpoint so tests can assert the wire
- * shape — above all that every send states its audience.
+ * A platform refusal the services fake can return. `code` is not checked:
+ * a test can refuse with any `x-pple-error` value.
+ */
+export function serviceRefusal(code: string, status: number): Response {
+  return new Response(JSON.stringify({ error: code }), {
+    status,
+    headers: {
+      "content-type": "application/json",
+      "x-pple-error": code,
+    },
+  });
+}
+
+/**
+ * A copy of the Worker wired to fake PPLE ID, notifications, and Platform
+ * Services (via an injected fetch) and the real local D1 + R2 from the test
+ * runtime. Records the requests sent to the notification endpoint, and the
+ * path, method, and non-secret headers of each Service call.
  */
 export function makeHarness(fakes: Fakes = {}, envOverrides: Partial<Env> = {}) {
-  const calls = { notify: [] as Request[] };
+  const calls = {
+    notify: [] as Request[],
+    services: [] as RecordedServiceCall[],
+  };
+
+  const testEnv: Env = {
+    ...env,
+    SSO_BASE_URL: "https://sso.test",
+    NOTIFY_API_BASE: "",
+    // No DEV_PERSONA ⇒ the default persona. Pass { DEV_PERSONA: "none" } to
+    // exercise the real PPLE ID path instead.
+    ...envOverrides,
+  };
+
+  const servicesBase = (testEnv.PPLE_SERVICES_URL ?? "").replace(/\/+$/, "");
 
   const fetchImpl: typeof fetch = async (input, init) => {
     const req = new Request(input as RequestInfo, init);
     const url = new URL(req.url);
+    if (servicesBase && isServicesUrl(req.url, servicesBase)) {
+      calls.services.push({
+        path: url.pathname + url.search,
+        method: req.method,
+        headers: publicHeaders(req.headers),
+      });
+      return fakes.services ? fakes.services(req) : new Response(null, { status: 502 });
+    }
     if (url.pathname.endsWith("/oidc/v1/userinfo")) {
       return fakes.sso ? fakes.sso(req) : new Response(null, { status: 502 });
     }
@@ -38,15 +105,6 @@ export function makeHarness(fakes: Fakes = {}, envOverrides: Partial<Env> = {})
 
   const app = createApp({ fetchImpl });
 
-  const testEnv: Env = {
-    ...env,
-    SSO_BASE_URL: "https://sso.test",
-    NOTIFY_API_BASE: "",
-    // No DEV_PERSONA ⇒ the default persona. Pass { DEV_PERSONA: "none" } to
-    // exercise the real PPLE ID path instead.
-    ...envOverrides,
-  };
-
   const request = (
     path: string,
     init: RequestInit = {},
@@ -57,5 +115,32 @@ export function makeHarness(fakes: Fakes = {}, envOverrides: Partial<Env> = {})
     return app.request(path, { ...init, headers }, testEnv);
   };
 
-  return { app, request, testEnv, calls };
+  const execution = testExecutionContext();
+
+  /**
+   * Call `registry[name]` the way the platform does: the tail path and the
+   * `x-pple-*` facts. `persona` and `consumer` override this harness's env.
+   * An entry with no fetch-shaped handler throws `registry handler missing`
+   * — the platform wrapper's error. pple-services turns that into
+   * `provider_unavailable` (502) for the Consumer; this does not, because
+   * that response is not what the Provider's handler sees.
+   */
+  const callRegistry = (name: string, path: string, options: CallRegistryOptions = {}) =>
+    dispatchRegistry(worker, testEnv, execution, name, path, options);
+
+  return { app, request, testEnv, calls, fetchImpl, callRegistry };
+}
+
+function isServicesUrl(url: string, base: string): boolean {
+  return url === base || url.startsWith(`${base}/`) || url.startsWith(`${base}?`);
+}
+
+function publicHeaders(headers: Headers): Record<string, string> {
+  const recorded: Record<string, string> = {};
+  headers.forEach((value, key) => {
+    const name = key.toLowerCase();
+    if (SECRET_HEADERS.has(name)) return;
+    recorded[name] = value;
+  });
+  return recorded;
 }

package/templates/golden-path/test/legal-identity.test.ts

@@ -10,9 +10,8 @@ import {
   OFFLINE_INVALID_ID,
   OFFLINE_LEGAL_NAME,
   thaiIdChecksumValid,
-  type LegalIdentityReason,
 } from "../src/legal-identity";
-import { makeHarness } from "./harness";
+import { makeHarness, serviceRefusal } from "./harness";
 
 describe("actor.kyc", () => {
   it("gives every Persona a KYC Status, and members are verified via membership", () => {
@@ -179,33 +178,101 @@ describe("getLegalIdentity against Platform Services", () => {
     expect(fetchImpl).not.toHaveBeenCalled();
   });
 
-  it("names every error the service can return", async () => {
-    const reasons: LegalIdentityReason[] = [
-      "invalid_app_key",
-      "not_granted",
-      "not_verified",
-      "user_token_invalid",
-      "identity_not_enabled",
-      "upstream_unavailable",
+  it("posts to platform/legal-identity with the App Key and the user token, and no body", async () => {
+    let seen: { authorization: string | null; userToken: string | null; body: string } | undefined;
+    const h = makeHarness(
+      {
+        services: async (req) => {
+          seen = {
+            authorization: req.headers.get("authorization"),
+            userToken: req.headers.get("x-pple-user-token"),
+            body: await req.text(),
+          };
+          return Response.json({ source: "kyc", name: "นาย ก", idCardNumber: "1100000000008" });
+        },
+      },
+      env,
+    );
+
+    expect(await getLegalIdentity(h.testEnv, "user-token", h.fetchImpl)).toEqual({
+      ok: true,
+      legalIdentity: { source: "kyc", name: "นาย ก", idCardNumber: "1100000000008" },
+    });
+    expect(seen).toEqual({
+      authorization: "Bearer app-key",
+      userToken: "user-token",
+      body: "",
+    });
+    expect(h.calls.services).toEqual([
+      { path: "/platform/legal-identity", method: "POST", headers: {} },
+    ]);
+  });
+
+  it("maps each platform code, and keeps needs_beta as its own reason", async () => {
+    type Mapped =
+      | "invalid_app_key"
+      | "not_granted"
+      | "needs_beta"
+      | "user_token_invalid"
+      | "upstream_unavailable";
+    const mapped: [string, number, Mapped][] = [
+      ["invalid_app_key", 401, "invalid_app_key"],
+      ["not_granted", 403, "not_granted"],
+      ["needs_beta", 403, "needs_beta"],
+      ["user_token_invalid", 401, "user_token_invalid"],
+      ["not_listed", 404, "upstream_unavailable"],
+      ["identity_unavailable", 503, "upstream_unavailable"],
+      ["provider_unavailable", 502, "upstream_unavailable"],
+      ["provider_timeout", 504, "upstream_unavailable"],
     ];
-    for (const reason of reasons) {
-      const status = reason === "invalid_app_key" || reason === "user_token_invalid" ? 401 : 403;
-      const fetchImpl = vi.fn<typeof fetch>(async () => Response.json({ error: reason }, { status }));
-      expect(await getLegalIdentity(env, "user-token", fetchImpl)).toEqual({ ok: false, reason });
-      const [url, init] = fetchImpl.mock.calls[0]!;
-      expect(url).toBe("https://services.test/legal-identity");
-      expect(new Headers(init?.headers).get("authorization")).toBe("Bearer app-key");
-      expect(JSON.parse(String(init?.body))).toEqual({ token: "user-token" });
+    let next = serviceRefusal("invalid_app_key", 401);
+    const h = makeHarness({ services: () => next }, env);
+    for (const [code, status, reason] of mapped) {
+      next = serviceRefusal(code, status);
+      expect(await getLegalIdentity(h.testEnv, "user-token", h.fetchImpl)).toEqual({ ok: false, reason });
     }
+
+    // A code this helper does not name is still a platform refusal.
+    next = serviceRefusal("identity_not_enabled", 403);
+    expect(await getLegalIdentity(h.testEnv, "user-token", h.fetchImpl)).toEqual({
+      ok: false,
+      reason: "upstream_unavailable",
+    });
   });
 
-  it("returns the Legal Identity the service answered with", async () => {
-    const fetchImpl = vi.fn<typeof fetch>(async () =>
-      Response.json({ source: "kyc", name: "นาย ก", idCardNumber: "1100000000008" }),
+  it("maps this Service's own answers, which carry no x-pple-error", async () => {
+    type Answer = "not_verified" | "user_token_invalid" | "upstream_unavailable";
+    const answers: [string, number, Answer][] = [
+      ["not_verified", 404, "not_verified"],
+      ["user_token_invalid", 401, "user_token_invalid"],
+      ["upstream_unavailable", 502, "upstream_unavailable"],
+    ];
+    let next = Response.json({ error: "not_verified" }, { status: 404 });
+    const h = makeHarness(
+      {
+        services: (req) => {
+          expect(req.headers.get("x-pple-error")).toBeNull();
+          return next;
+        },
+      },
+      env,
     );
-    expect(await getLegalIdentity(env, "user-token", fetchImpl)).toEqual({
-      ok: true,
-      legalIdentity: { source: "kyc", name: "นาย ก", idCardNumber: "1100000000008" },
+    for (const [error, status, reason] of answers) {
+      next = Response.json({ error }, { status });
+      expect(await getLegalIdentity(h.testEnv, "user-token", h.fetchImpl)).toEqual({ ok: false, reason });
+    }
+
+    // The old reason is not read off a Provider body.
+    next = Response.json({ error: "identity_not_enabled" }, { status: 403 });
+    expect(await getLegalIdentity(h.testEnv, "user-token", h.fetchImpl)).toEqual({
+      ok: false,
+      reason: "upstream_unavailable",
+    });
+    // needs_beta is a platform code. Without the header it is not that reason.
+    next = Response.json({ error: "needs_beta" }, { status: 403 });
+    expect(await getLegalIdentity(h.testEnv, "user-token", h.fetchImpl)).toEqual({
+      ok: false,
+      reason: "upstream_unavailable",
     });
   });
 

package/templates/golden-path/test/membership.test.ts

@@ -0,0 +1,105 @@
+// Actor membership (ADR-0028): userinfo onto the Persona path, and the
+// member-only Persona that makes member and internal differ offline.
+
+import { describe, expect, it } from "vitest";
+import { DEV_PERSONAS } from "../src/dev-personas";
+import { passesLevel } from "../src/levels";
+import { makeHarness } from "./harness";
+
+const AD = {
+  user: { id: 7, role: "hq", mobile: "0810000007" },
+  actualPpleUser: { id: 7, role: "hq", mobile: "0810000007" },
+  activeRole: "hq",
+  eligibleRoles: ["hq"],
+  eligibleProvinces: ["all"],
+};
+
+function signedIn(membership: unknown) {
+  return makeHarness(
+    {
+      sso: () =>
+        Response.json({
+          sub: "u-42",
+          name: "Somchai",
+          ad: AD,
+          ...(membership === undefined ? {} : { membership }),
+        }),
+    },
+    { DEV_PERSONA: "none" },
+  );
+}
+
+describe("actor.membership", () => {
+  it("keeps memberSince from userinfo and drops the address", async () => {
+    const h = signedIn({
+      type: "yearly",
+      memberSince: "2020-05-01",
+      registeredAddress: { province: "เชียงใหม่", district: "เมืองเชียงใหม่" },
+    });
+    const me = await (await h.request("/api/me", {}, "valid-token")).json<{
+      actor: { membership: { memberSince: string } | null };
+      effective: Record<string, unknown>;
+    }>();
+    expect(me.actor.membership).toEqual({ memberSince: "2020-05-01" });
+    expect(JSON.stringify(me)).not.toContain("registeredAddress");
+    expect(me.effective.membership).toBeUndefined();
+  });
+
+  it.each([
+    ["missing", undefined],
+    ["null", null],
+    ["an empty object", {}],
+    ["a datetime", { memberSince: "2020-05-01T00:00:00.000Z" }],
+  ] as const)("is null when userinfo membership is %s", async (_label, membership) => {
+    const h = signedIn(membership);
+    const me = await (await h.request("/api/me", {}, "valid-token")).json<{
+      actor: { membership: unknown };
+    }>();
+    expect(me.actor.membership).toBeNull();
+  });
+
+  it("gives every Persona a membership, and member has no Role", () => {
+    for (const persona of Object.values(DEV_PERSONAS)) {
+      expect(persona.actor.membership === null || typeof persona.actor.membership?.memberSince === "string").toBe(
+        true,
+      );
+      expect("membership" in persona.effective).toBe(false);
+      expect(typeof persona.effective.sub).toBe("string");
+      if (persona.effective.isDelegated) {
+        expect(persona.effective.sub).not.toBe(persona.actor.sub);
+      } else {
+        expect(persona.effective.sub).toBe(persona.actor.sub);
+      }
+    }
+    expect(DEV_PERSONAS.member).toMatchObject({
+      actor: { sub: "dev-member", membership: { memberSince: "2024-06-01" } },
+      effective: { sub: "dev-member", activeRole: "", isDelegated: false, extraRoles: [] },
+    });
+    expect(DEV_PERSONAS["hq-staff"]?.actor.membership).toEqual({ memberSince: "2024-01-01" });
+    expect(DEV_PERSONAS.unverified?.actor.membership).toBeNull();
+    expect(DEV_PERSONAS["kyc-pending"]?.actor.membership).toBeNull();
+    expect(DEV_PERSONAS["kyc-verified-nonmember"]?.actor.membership).toBeNull();
+  });
+
+  it("lets a member pass member and not internal, and staff pass both", () => {
+    const persona = DEV_PERSONAS.member;
+    if (!persona) throw new Error("member persona missing");
+    expect(passesLevel(null, "public")).toBe(true);
+    expect(passesLevel(null, "member")).toBe(false);
+    expect(passesLevel(persona, "public")).toBe(true);
+    expect(passesLevel(persona, "member")).toBe(true);
+    expect(passesLevel(persona, "internal")).toBe(false);
+    expect(passesLevel(persona, { roles: ["pple-ad:hq"] })).toBe(false);
+    expect(passesLevel(DEV_PERSONAS["hq-staff"]!, "internal")).toBe(true);
+    expect(passesLevel(DEV_PERSONAS["hq-staff"]!, "member")).toBe(true);
+    expect(passesLevel(DEV_PERSONAS.unverified!, "member")).toBe(false);
+    expect(passesLevel(DEV_PERSONAS["kyc-verified-nonmember"]!, "member")).toBe(false);
+    expect(passesLevel(DEV_PERSONAS.delegate!, "member")).toBe(true);
+    expect(passesLevel(DEV_PERSONAS.delegate!, { subs: ["dev-delegate"] })).toBe(true);
+    expect(passesLevel(DEV_PERSONAS.delegate!, { subs: ["dev-province-coordinator"] })).toBe(true);
+    expect(DEV_PERSONAS.delegate?.effective.sub).toBe("dev-province-coordinator");
+    expect(passesLevel(DEV_PERSONAS["hq-staff"]!, { subs: ["dev-province-coordinator"] })).toBe(false);
+    expect(passesLevel(DEV_PERSONAS["platform-admin"]!, { roles: ["pple-ad:mp"] })).toBe(false);
+    expect(passesLevel(DEV_PERSONAS["platform-admin"]!, { roles: ["pple-ad:platform:admin"] })).toBe(true);
+  });
+});

package/templates/golden-path/test/read-dataset.test.ts

@@ -0,0 +1,214 @@
+// readDataset (issue #270). The harness is the platform: tests see the URL,
+// the headers, the page, and the refusal a Builder would observe.
+
+import { describe, expect, it, vi } from "vitest";
+import { platformError } from "../src/call-service";
+import { readDataset } from "../src/read-dataset";
+import { makeHarness, serviceRefusal } from "./harness";
+
+const env = {
+  DEV_PERSONA: "none",
+  PPLE_SERVICES_URL: "https://services.test",
+  PPLE_APP_KEY: "app-key",
+};
+
+const SWEPT = "2026-11-01T00:00:00.000Z";
+
+describe("readDataset", () => {
+  it("sends the App Key, the user token and the query, and returns one page", async () => {
+    let seen: { authorization: string | null; userToken: string | null } | undefined;
+    const h = makeHarness(
+      {
+        services: (req) => {
+          seen = {
+            authorization: req.headers.get("authorization"),
+            userToken: req.headers.get("x-pple-user-token"),
+          };
+          return Response.json(
+            {
+              objects: [{ id: "branch-a", province: "เชียงใหม่" }],
+              next: "cursor-1",
+              sweptAt: SWEPT,
+              snapshot: 3,
+            },
+            { headers: { etag: '"3-abc"' } },
+          );
+        },
+      },
+      env,
+    );
+
+    const result = await readDataset(h.testEnv, "directory/branches", "offices", {
+      userToken: "user-token",
+      filter: { province: "เชียงใหม่", seats: { gte: 4, lt: 9 }, status: ["open", "closed"] },
+      sort: "-seats",
+      limit: 2,
+      fetchImpl: h.fetchImpl,
+    });
+
+    expect(result).toEqual({
+      ok: true,
+      status: 200,
+      etag: '"3-abc"',
+      data: {
+        objects: [{ id: "branch-a", province: "เชียงใหม่" }],
+        next: "cursor-1",
+        sweptAt: SWEPT,
+        snapshot: 3,
+      },
+    });
+    expect(seen).toEqual({ authorization: "Bearer app-key", userToken: "user-token" });
+    const url = new URL(`https://services.test${h.calls.services[0]?.path ?? ""}`);
+    expect(url.pathname).toBe("/directory/branches/offices");
+    expect(url.searchParams.get("province")).toBe("เชียงใหม่");
+    expect(url.searchParams.get("seats[gte]")).toBe("4");
+    expect(url.searchParams.get("seats[lt]")).toBe("9");
+    expect(url.searchParams.getAll("status")).toEqual(["open", "closed"]);
+    expect(url.searchParams.get("sort")).toBe("-seats");
+    expect(url.searchParams.get("limit")).toBe("2");
+    expect(h.calls.services[0]?.method).toBe("GET");
+    expect(h.calls.services[0]?.headers).not.toHaveProperty("authorization");
+    expect(h.calls.services[0]?.headers).not.toHaveProperty("x-pple-user-token");
+  });
+
+  it("omits the user token unless one was given, and looks an object up by id", async () => {
+    let userToken: string | null = "unset";
+    const h = makeHarness(
+      {
+        services: (req) => {
+          userToken = req.headers.get("x-pple-user-token");
+          return Response.json({
+            object: { id: "branch-b", province: "กรุงเทพ" },
+            sweptAt: SWEPT,
+            snapshot: 3,
+          });
+        },
+      },
+      env,
+    );
+
+    const result = await readDataset(h.testEnv, "directory/branches", "offices", {
+      id: "branch-b",
+      fetchImpl: h.fetchImpl,
+    });
+
+    expect(userToken).toBeNull();
+    expect(result.ok).toBe(true);
+    if (!result.ok) return;
+    expect(result.data).toEqual({
+      object: { id: "branch-b", province: "กรุงเทพ" },
+      sweptAt: SWEPT,
+      snapshot: 3,
+    });
+    expect(h.calls.services[0]?.path).toBe("/directory/branches/offices/branch-b");
+  });
+
+  it("reads a singleton", async () => {
+    const h = makeHarness(
+      {
+        services: () => Response.json({ object: { title: "สรุปสาขา" }, sweptAt: SWEPT, snapshot: 1 }),
+      },
+      env,
+    );
+    const result = await readDataset(h.testEnv, "directory/branches", "summary", {
+      shape: "singleton",
+      fetchImpl: h.fetchImpl,
+    });
+    expect(result).toMatchObject({
+      ok: true,
+      data: { object: { title: "สรุปสาขา" }, sweptAt: SWEPT, snapshot: 1 },
+    });
+    expect(h.calls.services[0]?.path).toBe("/directory/branches/summary");
+  });
+
+  it("reads platform refusals from x-pple-error", async () => {
+    const codes = [
+      ["not_found", 404],
+      ["invalid_query", 400],
+      ["level_not_met", 403],
+      ["not_granted", 403],
+      ["user_token_invalid", 401],
+      ["no_mock", 404],
+    ] as const;
+    let next = serviceRefusal("not_found", 404);
+    const h = makeHarness({ services: () => next }, env);
+
+    for (const [code, status] of codes) {
+      next = serviceRefusal(code, status);
+      const result = await readDataset(h.testEnv, "directory/branches", "offices", {
+        userToken: "t",
+        fetchImpl: h.fetchImpl,
+      });
+      expect(result).toEqual({ ok: false, status, error: code });
+      const header = serviceRefusal(code, status);
+      if (code === "no_mock") expect(platformError(header)).toBeNull();
+      else expect(platformError(header)).toBe(code);
+    }
+  });
+
+  it("follows next and restarts when the snapshot changes", async () => {
+    const pages: { path: string }[] = [];
+    const h = makeHarness(
+      {
+        services: (req) => {
+          const url = new URL(req.url);
+          pages.push({ path: url.pathname + url.search });
+          const cursor = url.searchParams.get("next");
+          if (cursor === null && pages.length === 1) {
+            return Response.json({ objects: [{ id: "a" }], next: "old", sweptAt: SWEPT, snapshot: 1 });
+          }
+          if (cursor === "old") {
+            return Response.json({ objects: [{ id: "b" }], next: null, sweptAt: SWEPT, snapshot: 2 });
+          }
+          if (cursor === null) {
+            return Response.json({ objects: [{ id: "a2" }], next: "new", sweptAt: SWEPT, snapshot: 2 });
+          }
+          return Response.json({ objects: [{ id: "b2" }], next: null, sweptAt: SWEPT, snapshot: 2 });
+        },
+      },
+      env,
+    );
+
+    const result = await readDataset(h.testEnv, "directory/branches", "offices", {
+      limit: 1,
+      follow: true,
+      fetchImpl: h.fetchImpl,
+    });
+
+    expect(result).toMatchObject({
+      ok: true,
+      data: {
+        objects: [{ id: "a2" }, { id: "b2" }],
+        next: null,
+        snapshot: 2,
+        sweptAt: SWEPT,
+      },
+    });
+    expect(pages.map((page) => new URL(`https://services.test${page.path}`).searchParams.get("next"))).toEqual([
+      null,
+      "old",
+      null,
+      "new",
+    ]);
+  });
+
+  it("uses the injected fetch under vitest, including when a persona is set", async () => {
+    const fetchImpl = vi.fn<typeof fetch>(async () =>
+      Response.json({ objects: [], next: null, sweptAt: null, snapshot: null }),
+    );
+    const result = await readDataset(
+      { ...env, DEV_PERSONA: "hq-staff", DEV_REGISTRY_ERROR: "not_granted" },
+      "directory/branches",
+      "offices",
+      { fetchImpl },
+    );
+    expect(result).toMatchObject({ ok: true, data: { objects: [], next: null, sweptAt: null } });
+    expect(fetchImpl).toHaveBeenCalledOnce();
+    expect(String(fetchImpl.mock.calls[0]?.[0])).toBe("https://services.test/directory/branches/offices");
+
+    await expect(readDataset(env, "directory/branches", "offices")).rejects.toThrow(/injected fetch/);
+    await expect(
+      readDataset({ DEV_PERSONA: "none" }, "directory/branches", "offices", { fetchImpl }),
+    ).rejects.toThrow(/PPLE_SERVICES_URL/);
+  });
+});