@saluzi/saluzi-edu 0.2.78 → 0.2.80

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@saluzi/saluzi-edu",
-  "version": "0.2.78",
+  "version": "0.2.80",
   "description": "Saluzi CLI - interactive AI coding assistant in the terminal",
   "license": "MIT",
   "type": "module",

package/packages/remote-control-server/src/__tests__/artifacts.test.ts

@@ -357,6 +357,51 @@ describe('artifacts routes', () => {
     expect(row?.session_id).toBeNull()
   })
 
+  test('v1 upload with session_id is visible to the session owner in the web gallery', async () => {
+    // The CLI artifact tool's contract (spawn-mode children send their
+    // --session-id argv value): a worker-authenticated upload attributed to
+    // a session must appear for that session's owner — in the session view
+    // AND the owner's default gallery scope. Without session attribution the
+    // row is creator-less and invisible to everyone except admins.
+    const session = storeCreateSession({ title: 'ai gen session' })
+    storeBindSession(session.id, user.id)
+
+    const res = await app.request('/v1/artifacts', {
+      method: 'POST',
+      headers: { ...AUTH_HEADERS, 'Content-Type': 'application/json' },
+      body: JSON.stringify({
+        html: '<p>dashboard</p>',
+        session_id: session.id,
+        title: 'AI Dashboard',
+      }),
+    })
+    expect(res.status).toBe(201)
+    const data = (await res.json()) as { id: string }
+
+    // Session-filtered gallery (embedded panel in session detail).
+    const sessionList = await app.request(
+      `/web/artifacts?session_id=${session.id}`,
+      { headers: { Authorization: issueBearer(user.id) } },
+    )
+    expect(sessionList.status).toBe(200)
+    const sessionRows = (await sessionList.json()) as Array<{ id: string }>
+    expect(sessionRows.map(r => r.id)).toContain(data.id)
+
+    // Owner's default gallery scope (standalone gallery, no team context).
+    const defaultList = await app.request('/web/artifacts', {
+      headers: { Authorization: issueBearer(user.id) },
+    })
+    const defaultRows = (await defaultList.json()) as Array<{ id: string }>
+    expect(defaultRows.map(r => r.id)).toContain(data.id)
+
+    // Strangers still see nothing (session is private to the owner).
+    const strangerList = await app.request('/web/artifacts', {
+      headers: { Authorization: issueBearer(stranger.id) },
+    })
+    const strangerRows = (await strangerList.json()) as Array<{ id: string }>
+    expect(strangerRows.map(r => r.id)).not.toContain(data.id)
+  })
+
   test('GET /web/artifacts requires auth', async () => {
     const res = await app.request('/web/artifacts')
     expect(res.status).toBe(401)