@quenty/permissionprovider 14.42.0 → 14.44.0

package/CHANGELOG.md

@@ -3,6 +3,16 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+# [14.44.0](https://github.com/Quenty/NevermoreEngine/compare/@quenty/permissionprovider@14.43.0...@quenty/permissionprovider@14.44.0) (2026-07-23)
+
+### Features
+
+- Add baseline player-mock and support across Nevermore for mocked players. ([567d121](https://github.com/Quenty/NevermoreEngine/commit/567d121ffc014b42391554088189a1a6296dda83))
+
+# [14.43.0](https://github.com/Quenty/NevermoreEngine/compare/@quenty/permissionprovider@14.42.0...@quenty/permissionprovider@14.43.0) (2026-07-22)
+
+**Note:** Version bump only for package @quenty/permissionprovider
+
 # [14.42.0](https://github.com/Quenty/NevermoreEngine/compare/@quenty/permissionprovider@14.41.0...@quenty/permissionprovider@14.42.0) (2026-07-18)
 
 ### Bug Fixes

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@quenty/permissionprovider",
-  "version": "14.42.0",
+  "version": "14.44.0",
   "description": "Permission provider for Roblox, including authenticating against group membership",
   "keywords": [
     "Roblox",
@@ -28,23 +28,24 @@
     "Quenty"
   ],
   "dependencies": {
-    "@quenty/baseobject": "10.14.0",
-    "@quenty/brio": "14.32.0",
+    "@quenty/baseobject": "10.15.0",
+    "@quenty/brio": "14.33.0",
     "@quenty/enums": "1.3.0",
-    "@quenty/grouputils": "10.22.0",
+    "@quenty/grouputils": "10.23.0",
     "@quenty/loader": "10.11.0",
-    "@quenty/maid": "3.10.0",
-    "@quenty/nevermore-test-runner": "1.4.0",
-    "@quenty/playerutils": "8.35.0",
-    "@quenty/promise": "10.20.0",
-    "@quenty/remoting": "12.34.0",
-    "@quenty/rx": "13.30.0",
-    "@quenty/servicebag": "11.19.0",
+    "@quenty/maid": "3.11.0",
+    "@quenty/nevermore-test-runner": "1.5.0",
+    "@quenty/playermock": "1.1.0",
+    "@quenty/playerutils": "8.36.0",
+    "@quenty/promise": "10.21.0",
+    "@quenty/remoting": "12.36.0",
+    "@quenty/rx": "13.31.0",
+    "@quenty/servicebag": "11.20.0",
     "@quenty/table": "3.9.2",
     "@quentystudios/jest-lua": "3.10.0-quenty.2"
   },
   "publishConfig": {
     "access": "public"
   },
-  "gitHead": "647acfad93dca41c38f59cda247d2bfc0fff36d4"
+  "gitHead": "1de37218a2bedb8e3f8614a2e09bba9eddc812da"
 }

package/src/Server/PermissionProviderUtils.spec.lua

@@ -0,0 +1,118 @@
+--!strict
+--[[
+	@class PermissionProviderUtils.spec.lua
+]]
+
+local require = require(script.Parent.loader).load(script)
+
+local Jest = require("Jest")
+local PermissionProviderConstants = require("PermissionProviderConstants")
+local PermissionProviderUtils = require("PermissionProviderUtils")
+
+local describe = Jest.Globals.describe
+local expect = Jest.Globals.expect
+local it = Jest.Globals.it
+
+describe("PermissionProviderUtils.createGroupRankConfig", function()
+	it("should create a group rank config with the given ranks", function()
+		local config = PermissionProviderUtils.createGroupRankConfig({
+			groupId = 12345,
+			minAdminRequiredRank = 250,
+			minCreatorRequiredRank = 254,
+		})
+
+		expect(config.type).toEqual(PermissionProviderConstants.GROUP_RANK_CONFIG_TYPE)
+		expect(config.groupId).toEqual(12345)
+		expect(config.minAdminRequiredRank).toEqual(250)
+		expect(config.minCreatorRequiredRank).toEqual(254)
+	end)
+
+	it("should default the remote function name", function()
+		local config = PermissionProviderUtils.createGroupRankConfig({
+			groupId = 12345,
+			minAdminRequiredRank = 250,
+			minCreatorRequiredRank = 254,
+		})
+
+		expect(config.remoteFunctionName).toEqual(PermissionProviderConstants.DEFAULT_REMOTE_FUNCTION_NAME)
+	end)
+
+	it("should honor a custom remote function name", function()
+		local config = PermissionProviderUtils.createGroupRankConfig({
+			groupId = 12345,
+			minAdminRequiredRank = 250,
+			minCreatorRequiredRank = 254,
+			remoteFunctionName = "CustomRemoteFunction",
+		})
+
+		expect(config.remoteFunctionName).toEqual("CustomRemoteFunction")
+	end)
+
+	it("should reject a missing groupId", function()
+		expect(function()
+			PermissionProviderUtils.createGroupRankConfig({
+				minAdminRequiredRank = 250,
+				minCreatorRequiredRank = 254,
+			} :: any)
+		end).toThrow("Bad groupId")
+	end)
+
+	it("should reject a missing minCreatorRequiredRank", function()
+		expect(function()
+			PermissionProviderUtils.createGroupRankConfig({
+				groupId = 12345,
+				minAdminRequiredRank = 250,
+			} :: any)
+		end).toThrow("Bad minCreatorRequiredRank")
+	end)
+
+	it("should reject a missing minAdminRequiredRank", function()
+		expect(function()
+			PermissionProviderUtils.createGroupRankConfig({
+				groupId = 12345,
+				minCreatorRequiredRank = 254,
+			} :: any)
+		end).toThrow("Bad minAdminRequiredRank")
+	end)
+end)
+
+describe("PermissionProviderUtils.createSingleUserConfig", function()
+	it("should create a single user config", function()
+		local config = PermissionProviderUtils.createSingleUserConfig({
+			userId = 12345,
+		})
+
+		expect(config.type).toEqual(PermissionProviderConstants.SINGLE_USER_CONFIG_TYPE)
+		expect(config.userId).toEqual(12345)
+		expect(config.remoteFunctionName).toEqual(PermissionProviderConstants.DEFAULT_REMOTE_FUNCTION_NAME)
+	end)
+
+	it("should honor a custom remote function name", function()
+		local config = PermissionProviderUtils.createSingleUserConfig({
+			userId = 12345,
+			remoteFunctionName = "CustomRemoteFunction",
+		})
+
+		expect(config.remoteFunctionName).toEqual("CustomRemoteFunction")
+	end)
+
+	it("should reject a missing userId", function()
+		expect(function()
+			PermissionProviderUtils.createSingleUserConfig({} :: any)
+		end).toThrow("Bad userId")
+	end)
+end)
+
+describe("PermissionProviderUtils.createConfigFromGame", function()
+	it("should create a config matching the game's creator type", function()
+		local config = PermissionProviderUtils.createConfigFromGame()
+
+		if game.CreatorType == Enum.CreatorType.Group then
+			expect(config.type).toEqual(PermissionProviderConstants.GROUP_RANK_CONFIG_TYPE)
+			expect((config :: any).groupId).toEqual(game.CreatorId)
+		else
+			expect(config.type).toEqual(PermissionProviderConstants.SINGLE_USER_CONFIG_TYPE)
+			expect((config :: any).userId).toEqual(game.CreatorId)
+		end
+	end)
+end)

package/src/Server/PermissionService.lua

@@ -22,6 +22,7 @@ local Observable = require("Observable")
 local PermissionLevel = require("PermissionLevel")
 local PermissionProviderConstants = require("PermissionProviderConstants")
 local PermissionProviderUtils = require("PermissionProviderUtils")
+local PlayerMock = require("PlayerMock")
 local Promise = require("Promise")
 local Rx = require("Rx")
 local RxBrioUtils = require("RxBrioUtils")
@@ -67,9 +68,9 @@ function PermissionService.SetProviderFromConfig(
 	assert(not self._provider, "Already have provider set")
 
 	if config.type == PermissionProviderConstants.GROUP_RANK_CONFIG_TYPE then
-		self._provider = GroupPermissionProvider.new(config)
+		self._provider = self._maid:Add(GroupPermissionProvider.new(config))
 	elseif config.type == PermissionProviderConstants.SINGLE_USER_CONFIG_TYPE then
-		self._provider = CreatorPermissionProvider.new(config)
+		self._provider = self._maid:Add(CreatorPermissionProvider.new(config))
 	else
 		error("Bad provider")
 	end
@@ -106,7 +107,7 @@ end
 	@return Promise<boolean>
 ]=]
 function PermissionService.PromiseIsAdmin(self: PermissionService, player: Player): Promise.Promise<boolean>
-	assert(typeof(player) == "Instance" and player:IsA("Player"), "bad player")
+	assert((typeof(player) == "Instance" and player:IsA("Player")) or PlayerMock.isMock(player), "bad player")
 
 	return self:PromiseIsPermissionLevel(player, PermissionLevel.ADMIN)
 end
@@ -117,7 +118,7 @@ end
 	@return Promise<boolean>
 ]=]
 function PermissionService.PromiseIsCreator(self: PermissionService, player: Player): Promise.Promise<boolean>
-	assert(typeof(player) == "Instance" and player:IsA("Player"), "bad player")
+	assert((typeof(player) == "Instance" and player:IsA("Player")) or PlayerMock.isMock(player), "bad player")
 
 	return self:PromiseIsPermissionLevel(player, PermissionLevel.CREATOR)
 end
@@ -133,7 +134,7 @@ function PermissionService.PromiseIsPermissionLevel(
 	player: Player,
 	permissionLevel: PermissionLevel.PermissionLevel
 ): Promise.Promise<boolean>
-	assert(typeof(player) == "Instance" and player:IsA("Player"), "bad player")
+	assert((typeof(player) == "Instance" and player:IsA("Player")) or PlayerMock.isMock(player), "bad player")
 	assert(PermissionLevel:IsValue(permissionLevel), "Bad permissionLevel")
 
 	if RunService:IsStudio() then

package/src/Server/PermissionService.spec.lua

@@ -0,0 +1,203 @@
+--!strict
+--[[
+	Coverage for PermissionService's ServiceBag-driven lifecycle and permission queries, with a
+	single-user (creator) provider config and PlayerMock players.
+
+	The deny cases assume RunService:IsStudio() == false (true in the cloud test runner); in Studio
+	the service short-circuits every permission query to true.
+
+	@class PermissionService.spec.lua
+]]
+
+local require = require(script.Parent.loader).load(script)
+
+local Jest = require("Jest")
+local Maid = require("Maid")
+local PermissionLevel = require("PermissionLevel")
+local PermissionProviderUtils = require("PermissionProviderUtils")
+local PermissionService = require("PermissionService")
+local PlayerMock = require("PlayerMock")
+local PromiseTestUtils = require("PromiseTestUtils")
+local ServiceBag = require("ServiceBag")
+
+local describe = Jest.Globals.describe
+local expect = Jest.Globals.expect
+local it = Jest.Globals.it
+
+local CREATOR_USER_ID = 12345
+
+local remoteNameCounter = 0
+
+local function setup()
+	local maid = Maid.new()
+	local serviceBag = maid:Add(ServiceBag.new())
+	local permissionService: PermissionService.PermissionService = serviceBag:GetService(PermissionService) :: any
+	serviceBag:Init()
+
+	-- Unique remote function name so services from separate tests never share the global remote.
+	remoteNameCounter += 1
+	local remoteFunctionName = string.format("PermissionServiceSpecRemote%d", remoteNameCounter)
+
+	return {
+		serviceBag = serviceBag,
+		permissionService = permissionService,
+		singleUserConfig = function(userId: number)
+			return PermissionProviderUtils.createSingleUserConfig({
+				userId = userId,
+				remoteFunctionName = remoteFunctionName,
+			})
+		end,
+		fakePlayer = function(userId: number): Player
+			return maid:Add(PlayerMock.new({ UserId = userId }))
+		end,
+		awaitBool = function(promise: any): boolean
+			expect(PromiseTestUtils.awaitSettled(promise, 5)).toEqual(true)
+			local ok, value = promise:Yield()
+			expect(ok).toEqual(true)
+			return value
+		end,
+		destroy = function(_self)
+			maid:DoCleaning()
+		end,
+	}
+end
+
+describe("PermissionService initialization", function()
+	it("should initialize and start with a configured provider", function()
+		local controller = setup()
+		controller.permissionService:SetProviderFromConfig(controller.singleUserConfig(CREATOR_USER_ID))
+
+		expect(function()
+			controller.serviceBag:Start()
+		end).never.toThrow()
+
+		controller:destroy()
+	end)
+
+	it("should start with a provider derived from the game when none is configured", function()
+		local controller = setup()
+
+		expect(function()
+			controller.serviceBag:Start()
+		end).never.toThrow()
+
+		controller:destroy()
+	end)
+
+	it("should resolve the permission provider after start", function()
+		local controller = setup()
+		controller.permissionService:SetProviderFromConfig(controller.singleUserConfig(CREATOR_USER_ID))
+
+		local promise = controller.permissionService:PromisePermissionProvider()
+		expect(promise:IsPending()).toEqual(true)
+
+		controller.serviceBag:Start()
+
+		expect(PromiseTestUtils.awaitSettled(promise, 5)).toEqual(true)
+		local ok, provider = promise:Yield()
+		expect(ok).toEqual(true)
+		expect((provider :: any).ClassName).toEqual("CreatorPermissionProvider")
+
+		controller:destroy()
+	end)
+end)
+
+describe("PermissionService.SetProviderFromConfig", function()
+	it("should reject a second provider config", function()
+		local controller = setup()
+		controller.permissionService:SetProviderFromConfig(controller.singleUserConfig(CREATOR_USER_ID))
+
+		expect(function()
+			controller.permissionService:SetProviderFromConfig(controller.singleUserConfig(CREATOR_USER_ID))
+		end).toThrow("Already have provider set")
+
+		controller:destroy()
+	end)
+
+	it("should reject an unknown config type", function()
+		local controller = setup()
+
+		expect(function()
+			controller.permissionService:SetProviderFromConfig({ type = "UnknownConfigType" } :: any)
+		end).toThrow("Bad provider")
+
+		controller:destroy()
+	end)
+end)
+
+describe("PermissionService permission queries", function()
+	it("should treat the configured user as an admin", function()
+		local controller = setup()
+		controller.permissionService:SetProviderFromConfig(controller.singleUserConfig(CREATOR_USER_ID))
+		controller.serviceBag:Start()
+
+		local player = controller.fakePlayer(CREATOR_USER_ID)
+		expect(controller.awaitBool(controller.permissionService:PromiseIsAdmin(player))).toEqual(true)
+
+		controller:destroy()
+	end)
+
+	it("should treat the configured user as a creator", function()
+		local controller = setup()
+		controller.permissionService:SetProviderFromConfig(controller.singleUserConfig(CREATOR_USER_ID))
+		controller.serviceBag:Start()
+
+		local player = controller.fakePlayer(CREATOR_USER_ID)
+		expect(controller.awaitBool(controller.permissionService:PromiseIsCreator(player))).toEqual(true)
+
+		controller:destroy()
+	end)
+
+	it("should deny another user admin permission", function()
+		local controller = setup()
+		controller.permissionService:SetProviderFromConfig(controller.singleUserConfig(CREATOR_USER_ID))
+		controller.serviceBag:Start()
+
+		local player = controller.fakePlayer(CREATOR_USER_ID + 1)
+		expect(controller.awaitBool(controller.permissionService:PromiseIsAdmin(player))).toEqual(false)
+
+		controller:destroy()
+	end)
+
+	it("should reject a non-player value", function()
+		local controller = setup()
+		controller.permissionService:SetProviderFromConfig(controller.singleUserConfig(CREATOR_USER_ID))
+		controller.serviceBag:Start()
+
+		expect(function()
+			controller.permissionService:PromiseIsAdmin(nil :: any)
+		end).toThrow("bad player")
+
+		controller:destroy()
+	end)
+
+	it("should reject an invalid permission level", function()
+		local controller = setup()
+		controller.permissionService:SetProviderFromConfig(controller.singleUserConfig(CREATOR_USER_ID))
+		controller.serviceBag:Start()
+
+		local player = controller.fakePlayer(CREATOR_USER_ID)
+		expect(function()
+			controller.permissionService:PromiseIsPermissionLevel(player, "not-a-level" :: any)
+		end).toThrow("Bad permissionLevel")
+
+		controller:destroy()
+	end)
+end)
+
+describe("PermissionService.ObservePermissionedPlayersBrio", function()
+	it("should subscribe and unsubscribe without error on an empty server", function()
+		local controller = setup()
+		controller.permissionService:SetProviderFromConfig(controller.singleUserConfig(CREATOR_USER_ID))
+		controller.serviceBag:Start()
+
+		expect(function()
+			local subscription = controller.permissionService
+				:ObservePermissionedPlayersBrio(PermissionLevel.ADMIN)
+				:Subscribe(function() end)
+			subscription:Destroy()
+		end).never.toThrow()
+
+		controller:destroy()
+	end)
+end)

package/src/Server/Providers/BasePermissionProvider.lua

@@ -11,6 +11,7 @@ local BaseObject = require("BaseObject")
 local GetRemoteFunction = require("GetRemoteFunction")
 local PermissionLevel = require("PermissionLevel")
 local PermissionProviderUtils = require("PermissionProviderUtils")
+local PlayerMock = require("PlayerMock")
 local Promise = require("Promise")
 local Table = require("Table")
 
@@ -68,7 +69,7 @@ function BasePermissionProvider.PromiseIsPermissionLevel(
 	player: Player,
 	permissionLevel: PermissionLevel.PermissionLevel
 ): Promise.Promise<boolean>
-	assert(typeof(player) == "Instance" and player:IsA("Player"), "Bad player")
+	assert((typeof(player) == "Instance" and player:IsA("Player")) or PlayerMock.isMock(player), "Bad player")
 	assert(PermissionLevel:IsValue(permissionLevel))
 
 	error("Not implemented")
@@ -85,7 +86,7 @@ function BasePermissionProvider.IsPermissionLevel(
 	player: Player,
 	permissionLevel: PermissionLevel.PermissionLevel
 ): boolean
-	assert(typeof(player) == "Instance" and player:IsA("Player"), "Bad player")
+	assert((typeof(player) == "Instance" and player:IsA("Player")) or PlayerMock.isMock(player), "Bad player")
 	assert(PermissionLevel:IsValue(permissionLevel))
 
 	local promise = self:PromiseIsPermissionLevel(player, permissionLevel)
@@ -108,7 +109,7 @@ end
 	@return Promise<boolean>
 ]=]
 function BasePermissionProvider.PromiseIsCreator(self: BasePermissionProvider, player: Player): Promise.Promise<boolean>
-	assert(typeof(player) == "Instance" and player:IsA("Player"), "Bad player")
+	assert((typeof(player) == "Instance" and player:IsA("Player")) or PlayerMock.isMock(player), "Bad player")
 
 	return self:PromiseIsPermissionLevel(player, PermissionLevel.CREATOR)
 end
@@ -119,7 +120,7 @@ end
 	@return Promise<boolean>
 ]=]
 function BasePermissionProvider.PromiseIsAdmin(self: BasePermissionProvider, player: Player): Promise.Promise<boolean>
-	assert(typeof(player) == "Instance" and player:IsA("Player"), "Bad player")
+	assert((typeof(player) == "Instance" and player:IsA("Player")) or PlayerMock.isMock(player), "Bad player")
 
 	return self:PromiseIsPermissionLevel(player, PermissionLevel.ADMIN)
 end
@@ -135,7 +136,7 @@ end
 	@return boolean
 ]=]
 function BasePermissionProvider.IsCreator(self: BasePermissionProvider, player: Player): boolean
-	assert(typeof(player) == "Instance" and player:IsA("Player"), "Bad player")
+	assert((typeof(player) == "Instance" and player:IsA("Player")) or PlayerMock.isMock(player), "Bad player")
 
 	return self:IsPermissionLevel(player, PermissionLevel.CREATOR)
 end
@@ -151,7 +152,7 @@ end
 	@return boolean
 ]=]
 function BasePermissionProvider.IsAdmin(self: BasePermissionProvider, player: Player): boolean
-	assert(typeof(player) == "Instance" and player:IsA("Player"), "Bad player")
+	assert((typeof(player) == "Instance" and player:IsA("Player")) or PlayerMock.isMock(player), "Bad player")
 
 	return self:IsPermissionLevel(player, PermissionLevel.ADMIN)
 end

package/src/Server/Providers/BasePermissionProvider.spec.lua

@@ -0,0 +1,136 @@
+--!strict
+--[[
+	@class BasePermissionProvider.spec.lua
+]]
+
+local require = require(script.Parent.loader).load(script)
+
+local BasePermissionProvider = require("BasePermissionProvider")
+local Jest = require("Jest")
+local Maid = require("Maid")
+local PermissionLevel = require("PermissionLevel")
+local PermissionProviderUtils = require("PermissionProviderUtils")
+local PlayerMock = require("PlayerMock")
+local Promise = require("Promise")
+
+local describe = Jest.Globals.describe
+local expect = Jest.Globals.expect
+local it = Jest.Globals.it
+
+local function createStubProvider(maid: Maid.Maid, promiseFactory: () -> any)
+	local StubPermissionProvider = setmetatable({}, BasePermissionProvider)
+	StubPermissionProvider.ClassName = "StubPermissionProvider"
+	StubPermissionProvider.__index = StubPermissionProvider
+
+	local queriedLevels = {}
+
+	function StubPermissionProvider.PromiseIsPermissionLevel(_self: any, _player: any, permissionLevel: any)
+		table.insert(queriedLevels, permissionLevel)
+		return promiseFactory()
+	end
+
+	local config = PermissionProviderUtils.createSingleUserConfig({ userId = 12345 })
+	local provider = maid:Add(setmetatable(BasePermissionProvider.new(config) :: any, StubPermissionProvider))
+
+	return provider, queriedLevels
+end
+
+describe("BasePermissionProvider.new", function()
+	it("should reject a nil config", function()
+		expect(function()
+			BasePermissionProvider.new(nil :: any)
+		end).toThrow("Bad config")
+	end)
+
+	it("should reject a config without a remote function name", function()
+		expect(function()
+			BasePermissionProvider.new({} :: any)
+		end).toThrow("remoteFunctionName")
+	end)
+end)
+
+describe("BasePermissionProvider.PromiseIsPermissionLevel", function()
+	it("should error as not implemented on the base class", function()
+		local maid = Maid.new()
+		local provider =
+			maid:Add(BasePermissionProvider.new(PermissionProviderUtils.createSingleUserConfig({ userId = 12345 })))
+		local player = maid:Add(PlayerMock.new({ UserId = 12345 }))
+
+		expect(function()
+			provider:PromiseIsPermissionLevel(player, PermissionLevel.ADMIN)
+		end).toThrow("Not implemented")
+
+		maid:DoCleaning()
+	end)
+
+	it("should reject a non-player value", function()
+		local maid = Maid.new()
+		local provider =
+			maid:Add(BasePermissionProvider.new(PermissionProviderUtils.createSingleUserConfig({ userId = 12345 })))
+
+		expect(function()
+			provider:PromiseIsPermissionLevel(nil :: any, PermissionLevel.ADMIN)
+		end).toThrow("Bad player")
+
+		maid:DoCleaning()
+	end)
+end)
+
+describe("BasePermissionProvider.IsPermissionLevel", function()
+	it("should return false while the underlying promise is pending", function()
+		local maid = Maid.new()
+		local provider = createStubProvider(maid, function()
+			return maid:Add(Promise.new())
+		end)
+		local player = maid:Add(PlayerMock.new({ UserId = 12345 }))
+
+		expect(provider:IsPermissionLevel(player, PermissionLevel.ADMIN)).toEqual(false)
+
+		maid:DoCleaning()
+	end)
+
+	it("should return the resolved value when the promise settles synchronously", function()
+		local maid = Maid.new()
+		local provider = createStubProvider(maid, function()
+			return Promise.resolved(true)
+		end)
+		local player = maid:Add(PlayerMock.new({ UserId = 12345 }))
+
+		expect(provider:IsPermissionLevel(player, PermissionLevel.ADMIN)).toEqual(true)
+		expect(provider:IsCreator(player)).toEqual(true)
+		expect(provider:IsAdmin(player)).toEqual(true)
+
+		maid:DoCleaning()
+	end)
+
+	it("should return false when the underlying promise rejects", function()
+		local maid = Maid.new()
+		local provider = createStubProvider(maid, function()
+			local promise = Promise.rejected("simulated failure")
+			promise:Catch(function() end)
+			return promise
+		end)
+		local player = maid:Add(PlayerMock.new({ UserId = 12345 }))
+
+		expect(provider:IsPermissionLevel(player, PermissionLevel.ADMIN)).toEqual(false)
+
+		maid:DoCleaning()
+	end)
+end)
+
+describe("BasePermissionProvider promise wrappers", function()
+	it("should route PromiseIsAdmin and PromiseIsCreator through the matching level", function()
+		local maid = Maid.new()
+		local provider, queriedLevels = createStubProvider(maid, function()
+			return Promise.resolved(true)
+		end)
+		local player = maid:Add(PlayerMock.new({ UserId = 12345 }))
+
+		provider:PromiseIsAdmin(player)
+		provider:PromiseIsCreator(player)
+
+		expect(queriedLevels).toEqual({ PermissionLevel.ADMIN, PermissionLevel.CREATOR } :: { string })
+
+		maid:DoCleaning()
+	end)
+end)

package/src/Server/Providers/CreatorPermissionProvider.lua

@@ -14,6 +14,7 @@ local BasePermissionProvider = require("BasePermissionProvider")
 local PermissionLevel = require("PermissionLevel")
 local PermissionProviderConstants = require("PermissionProviderConstants")
 local PermissionProviderUtils = require("PermissionProviderUtils")
+local PlayerMock = require("PlayerMock")
 local Promise = require("Promise")
 
 local CreatorPermissionProvider = setmetatable({}, BasePermissionProvider)
@@ -56,11 +57,14 @@ function CreatorPermissionProvider.PromiseIsPermissionLevel(
 	player: Player,
 	permissionLevel: PermissionLevel.PermissionLevel
 ): Promise.Promise<boolean>
-	assert(typeof(player) == "Instance" and player:IsA("Player"), "Bad player")
+	assert((typeof(player) == "Instance" and player:IsA("Player")) or PlayerMock.isMock(player), "Bad player")
 	assert(PermissionLevel:IsValue(permissionLevel))
 
 	if permissionLevel == PermissionLevel.ADMIN or permissionLevel == PermissionLevel.CREATOR then
-		return Promise.resolved(player.UserId == self._userId or RunService:IsStudio())
+		return Promise.resolved(
+			(if PlayerMock.isMock(player) then PlayerMock.read(player, "UserId") else player.UserId) == self._userId
+				or RunService:IsStudio()
+		)
 	else
 		error("Unknown permissionLevel")
 	end

package/src/Server/Providers/CreatorPermissionProvider.spec.lua

@@ -0,0 +1,130 @@
+--!strict
+--[[
+	Coverage for CreatorPermissionProvider: a single configured userId is both admin and creator,
+	everyone else is neither. Players are stood in by PlayerMock, whose seeded UserId the provider
+	reads through PlayerMock.read.
+
+	The negative cases assume RunService:IsStudio() == false (true in the cloud test runner); in
+	Studio the provider grants everyone permission.
+
+	@class CreatorPermissionProvider.spec.lua
+]]
+
+local require = require(script.Parent.loader).load(script)
+
+local CreatorPermissionProvider = require("CreatorPermissionProvider")
+local Jest = require("Jest")
+local Maid = require("Maid")
+local PermissionLevel = require("PermissionLevel")
+local PermissionProviderUtils = require("PermissionProviderUtils")
+local PlayerMock = require("PlayerMock")
+local PromiseTestUtils = require("PromiseTestUtils")
+
+local describe = Jest.Globals.describe
+local expect = Jest.Globals.expect
+local it = Jest.Globals.it
+
+local CREATOR_USER_ID = 12345
+
+local function setup()
+	local maid = Maid.new()
+	local provider = maid:Add(CreatorPermissionProvider.new(PermissionProviderUtils.createSingleUserConfig({
+		userId = CREATOR_USER_ID,
+	})))
+
+	return {
+		provider = provider,
+		fakePlayer = function(userId: number): Player
+			return maid:Add(PlayerMock.new({ UserId = userId }))
+		end,
+		awaitBool = function(promise: any): boolean
+			expect(PromiseTestUtils.awaitSettled(promise, 5)).toEqual(true)
+			local ok, value = promise:Yield()
+			expect(ok).toEqual(true)
+			return value
+		end,
+		destroy = function(_self)
+			maid:DoCleaning()
+		end,
+	}
+end
+
+describe("CreatorPermissionProvider.new", function()
+	it("should reject a group rank config", function()
+		expect(function()
+			CreatorPermissionProvider.new(PermissionProviderUtils.createGroupRankConfig({
+				groupId = 12345,
+				minAdminRequiredRank = 250,
+				minCreatorRequiredRank = 254,
+			}) :: any)
+		end).toThrow("Bad configType")
+	end)
+end)
+
+describe("CreatorPermissionProvider.PromiseIsPermissionLevel", function()
+	it("should treat the configured user as an admin", function()
+		local controller = setup()
+		local player = controller.fakePlayer(CREATOR_USER_ID)
+
+		expect(controller.awaitBool(controller.provider:PromiseIsAdmin(player))).toEqual(true)
+
+		controller:destroy()
+	end)
+
+	it("should treat the configured user as a creator", function()
+		local controller = setup()
+		local player = controller.fakePlayer(CREATOR_USER_ID)
+
+		expect(controller.awaitBool(controller.provider:PromiseIsCreator(player))).toEqual(true)
+
+		controller:destroy()
+	end)
+
+	it("should deny another user admin permission", function()
+		local controller = setup()
+		local player = controller.fakePlayer(CREATOR_USER_ID + 1)
+
+		expect(controller.awaitBool(controller.provider:PromiseIsAdmin(player))).toEqual(false)
+
+		controller:destroy()
+	end)
+
+	it("should deny another user creator permission", function()
+		local controller = setup()
+		local player = controller.fakePlayer(CREATOR_USER_ID + 1)
+
+		expect(controller.awaitBool(controller.provider:PromiseIsCreator(player))).toEqual(false)
+
+		controller:destroy()
+	end)
+
+	it("should resolve synchronously for the IsAdmin wrapper", function()
+		local controller = setup()
+		local player = controller.fakePlayer(CREATOR_USER_ID)
+
+		expect(controller.provider:IsAdmin(player)).toEqual(true)
+
+		controller:destroy()
+	end)
+
+	it("should reject a non-player value", function()
+		local controller = setup()
+
+		expect(function()
+			controller.provider:PromiseIsPermissionLevel(nil :: any, PermissionLevel.ADMIN)
+		end).toThrow("Bad player")
+
+		controller:destroy()
+	end)
+
+	it("should reject an invalid permission level", function()
+		local controller = setup()
+		local player = controller.fakePlayer(CREATOR_USER_ID)
+
+		expect(function()
+			controller.provider:PromiseIsPermissionLevel(player, "not-a-level" :: any)
+		end).toThrow()
+
+		controller:destroy()
+	end)
+end)

package/src/Server/Providers/GroupPermissionProvider.lua

@@ -15,6 +15,7 @@ local GroupUtils = require("GroupUtils")
 local PermissionLevel = require("PermissionLevel")
 local PermissionProviderConstants = require("PermissionProviderConstants")
 local PermissionProviderUtils = require("PermissionProviderUtils")
+local PlayerMock = require("PlayerMock")
 local Promise = require("Promise")
 
 local GroupPermissionProvider = setmetatable({}, BasePermissionProvider)
@@ -62,7 +63,7 @@ function GroupPermissionProvider.Start(self: GroupPermissionProvider)
 	getmetatable(GroupPermissionProvider).Start(self)
 
 	self._maid:GiveTask(Players.PlayerRemoving:Connect(function(player: Player)
-		local userId = player.UserId
+		local userId = if PlayerMock.isMock(player) then PlayerMock.read(player, "UserId") else player.UserId
 
 		self._adminsCache[userId] = nil
 		self._creatorCache[userId] = nil
@@ -97,7 +98,7 @@ function GroupPermissionProvider.PromiseIsPermissionLevel(
 	player: Player,
 	permissionLevel: PermissionLevel.PermissionLevel
 ): Promise.Promise<boolean>
-	assert(typeof(player) == "Instance" and player:IsA("Player"), "Bad player")
+	assert((typeof(player) == "Instance" and player:IsA("Player")) or PlayerMock.isMock(player), "Bad player")
 	assert(PermissionLevel:IsValue(permissionLevel))
 
 	if permissionLevel == PermissionLevel.ADMIN then
@@ -113,10 +114,11 @@ function GroupPermissionProvider._promiseIsCreator(
 	self: GroupPermissionProvider,
 	player: Player
 ): Promise.Promise<boolean>
-	assert(typeof(player) == "Instance" and player:IsA("Player"), "Bad player")
+	assert((typeof(player) == "Instance" and player:IsA("Player")) or PlayerMock.isMock(player), "Bad player")
 	assert(player:IsDescendantOf(game), "Bad player")
 
-	if self._creatorCache[player.UserId] then
+	local userId = if PlayerMock.isMock(player) then PlayerMock.read(player, "UserId") else player.UserId
+	if self._creatorCache[userId] then
 		return Promise.resolved(true)
 	end
 
@@ -131,12 +133,13 @@ function GroupPermissionProvider._promiseIsAdmin(
 ): Promise.Promise<boolean>
 	assert(player:IsDescendantOf(game))
 
+	local userId = if PlayerMock.isMock(player) then PlayerMock.read(player, "UserId") else player.UserId
 	-- really not saving much time.
-	if self._creatorCache[player.UserId] then
+	if self._creatorCache[userId] then
 		return Promise.resolved(true)
 	end
 
-	if self._adminsCache[player.UserId] then
+	if self._adminsCache[userId] then
 		return Promise.resolved(true)
 	end
 
@@ -148,13 +151,14 @@ end
 function GroupPermissionProvider._handlePlayer(self: GroupPermissionProvider, player: Player): ()
 	assert(player, "Bad player")
 
+	local userId = if PlayerMock.isMock(player) then PlayerMock.read(player, "UserId") else player.UserId
 	self:_promiseRankInGroup(player):Then(function(rank)
 		if rank >= self._config.minAdminRequiredRank then
-			self._adminsCache[player.UserId] = true
+			self._adminsCache[userId] = true
 		end
 
 		if rank >= self._config.minCreatorRequiredRank then
-			self._creatorCache[player.UserId] = true
+			self._creatorCache[userId] = true
 		end
 	end)
 end
@@ -165,12 +169,13 @@ function GroupPermissionProvider._promiseRankInGroup(
 ): Promise.Promise<number>
 	assert(typeof(player) == "Instance", "Bad player")
 
-	if self._promiseRankPromisesCache[player.UserId] then
-		return self._promiseRankPromisesCache[player.UserId]
+	local userId = if PlayerMock.isMock(player) then PlayerMock.read(player, "UserId") else player.UserId
+	if self._promiseRankPromisesCache[userId] then
+		return self._promiseRankPromisesCache[userId]
 	end
 
-	self._promiseRankPromisesCache[player.UserId] = GroupUtils.promiseRankInGroup(player, self._config.groupId)
-	return self._promiseRankPromisesCache[player.UserId]
+	self._promiseRankPromisesCache[userId] = GroupUtils.promiseRankInGroup(player, self._config.groupId)
+	return self._promiseRankPromisesCache[userId]
 end
 
 return GroupPermissionProvider

package/src/Server/Providers/GroupPermissionProvider.spec.lua

@@ -0,0 +1,180 @@
+--!strict
+--[[
+	Coverage for GroupPermissionProvider using PlayerMock players. Group membership is injected
+	via GroupTestUtils.assignGroupInfo (defaulting to non-member, rank 0 — a mock is in no real
+	group), intercepted at the GroupService engine calls, so permission outcomes flow through
+	GroupUtils' real parsing and the provider's real threshold logic deterministically — no group
+	API call and no Studio dependence.
+
+	@class GroupPermissionProvider.spec.lua
+]]
+
+local require = require(script.Parent.loader).load(script)
+
+local Workspace = game:GetService("Workspace")
+
+local GroupPermissionProvider = require("GroupPermissionProvider")
+local GroupTestUtils = require("GroupTestUtils")
+local Jest = require("Jest")
+local Maid = require("Maid")
+local PermissionLevel = require("PermissionLevel")
+local PermissionProviderUtils = require("PermissionProviderUtils")
+local PlayerMock = require("PlayerMock")
+local PromiseTestUtils = require("PromiseTestUtils")
+
+local describe = Jest.Globals.describe
+local expect = Jest.Globals.expect
+local it = Jest.Globals.it
+
+local remoteNameCounter = 0
+
+local function setup(options: { minAdminRequiredRank: number, minCreatorRequiredRank: number })
+	local maid = Maid.new()
+
+	-- Unique remote function name so providers from separate tests never share the global remote.
+	remoteNameCounter += 1
+	local provider = maid:Add(GroupPermissionProvider.new(PermissionProviderUtils.createGroupRankConfig({
+		groupId = 12345,
+		minAdminRequiredRank = options.minAdminRequiredRank,
+		minCreatorRequiredRank = options.minCreatorRequiredRank,
+		remoteFunctionName = string.format("GroupPermissionProviderSpecRemote%d", remoteNameCounter),
+	})))
+
+	return {
+		provider = provider,
+		fakePlayer = function(userId: number): Player
+			local player = maid:Add(PlayerMock.new({ UserId = userId }))
+			player.Parent = Workspace
+			return player
+		end,
+		awaitBool = function(promise: any): boolean
+			expect(PromiseTestUtils.awaitSettled(promise, 5)).toEqual(true)
+			local ok, value = promise:Yield()
+			expect(ok).toEqual(true)
+			return value
+		end,
+		destroy = function(_self)
+			maid:DoCleaning()
+		end,
+	}
+end
+
+describe("GroupPermissionProvider.new", function()
+	it("should reject a single user config", function()
+		expect(function()
+			GroupPermissionProvider.new(PermissionProviderUtils.createSingleUserConfig({
+				userId = 12345,
+			}) :: any)
+		end).toThrow("Bad configType")
+	end)
+end)
+
+describe("GroupPermissionProvider.PromiseIsPermissionLevel", function()
+	it("should grant both levels when the rank thresholds are met", function()
+		local controller = setup({ minAdminRequiredRank = 0, minCreatorRequiredRank = 0 })
+		local player = controller.fakePlayer(111)
+
+		expect(controller.awaitBool(controller.provider:PromiseIsAdmin(player))).toEqual(true)
+		expect(controller.awaitBool(controller.provider:PromiseIsCreator(player))).toEqual(true)
+
+		controller:destroy()
+	end)
+
+	it("should deny both levels when the rank thresholds are not met", function()
+		local controller = setup({ minAdminRequiredRank = 100, minCreatorRequiredRank = 200 })
+		local player = controller.fakePlayer(111)
+
+		expect(controller.awaitBool(controller.provider:PromiseIsAdmin(player))).toEqual(false)
+		expect(controller.awaitBool(controller.provider:PromiseIsCreator(player))).toEqual(false)
+
+		controller:destroy()
+	end)
+
+	it("should grant admin but deny creator for a tiered config", function()
+		local controller = setup({ minAdminRequiredRank = 0, minCreatorRequiredRank = 1 })
+		local player = controller.fakePlayer(111)
+
+		expect(controller.awaitBool(controller.provider:PromiseIsAdmin(player))).toEqual(true)
+		expect(controller.awaitBool(controller.provider:PromiseIsCreator(player))).toEqual(false)
+
+		controller:destroy()
+	end)
+
+	it("should grant admin but deny creator from an injected group rank", function()
+		local controller = setup({ minAdminRequiredRank = 100, minCreatorRequiredRank = 200 })
+		local player = controller.fakePlayer(111)
+		GroupTestUtils.assignGroupInfo(player, 12345, { rank = 150, role = "Admin" })
+
+		expect(controller.awaitBool(controller.provider:PromiseIsAdmin(player))).toEqual(true)
+		expect(controller.awaitBool(controller.provider:PromiseIsCreator(player))).toEqual(false)
+
+		controller:destroy()
+	end)
+
+	it("should grant both levels from an injected group rank meeting both thresholds", function()
+		local controller = setup({ minAdminRequiredRank = 100, minCreatorRequiredRank = 200 })
+		local player = controller.fakePlayer(111)
+		GroupTestUtils.assignGroupInfo(player, 12345, { rank = 255, role = "Owner" })
+
+		expect(controller.awaitBool(controller.provider:PromiseIsAdmin(player))).toEqual(true)
+		expect(controller.awaitBool(controller.provider:PromiseIsCreator(player))).toEqual(true)
+
+		controller:destroy()
+	end)
+
+	it("should ignore a rank injected for a different group", function()
+		local controller = setup({ minAdminRequiredRank = 100, minCreatorRequiredRank = 200 })
+		local player = controller.fakePlayer(111)
+		GroupTestUtils.assignGroupInfo(player, 99999, { rank = 255, role = "Owner" })
+
+		expect(controller.awaitBool(controller.provider:PromiseIsAdmin(player))).toEqual(false)
+
+		controller:destroy()
+	end)
+
+	it("should reject a player outside the game hierarchy", function()
+		local controller = setup({ minAdminRequiredRank = 0, minCreatorRequiredRank = 0 })
+		local maid = Maid.new()
+		local unparented = maid:Add(PlayerMock.new({ UserId = 111 }))
+
+		expect(function()
+			controller.provider:PromiseIsPermissionLevel(unparented, PermissionLevel.CREATOR)
+		end).toThrow("Bad player")
+
+		maid:DoCleaning()
+		controller:destroy()
+	end)
+
+	it("should reject a non-player value", function()
+		local controller = setup({ minAdminRequiredRank = 0, minCreatorRequiredRank = 0 })
+
+		expect(function()
+			controller.provider:PromiseIsPermissionLevel(nil :: any, PermissionLevel.ADMIN)
+		end).toThrow("Bad player")
+
+		controller:destroy()
+	end)
+
+	it("should reject an invalid permission level", function()
+		local controller = setup({ minAdminRequiredRank = 0, minCreatorRequiredRank = 0 })
+		local player = controller.fakePlayer(111)
+
+		expect(function()
+			controller.provider:PromiseIsPermissionLevel(player, "not-a-level" :: any)
+		end).toThrow()
+
+		controller:destroy()
+	end)
+end)
+
+describe("GroupPermissionProvider.Start", function()
+	it("should start and clean up without error", function()
+		local controller = setup({ minAdminRequiredRank = 100, minCreatorRequiredRank = 200 })
+
+		expect(function()
+			controller.provider:Start()
+		end).never.toThrow()
+
+		controller:destroy()
+	end)
+end)