@sanity-labs/client-fake-for-test 0.13.0 → 0.15.0

package/README.md

@@ -198,10 +198,15 @@ await canvas.releases.create({ releaseId: "r1" }); // 404 Cannot POST /canvases/
 | ACL `<data base>/acl` | ✅ | ✅ | ✅ | 404 `Cannot GET …` |
 | Access API `…/user-permissions/me`, `…/me/check` | ✅ | ✅ | ✅ | ✅ |
 | Access API `…/users` | ✅ | ✅ | 403 | 403 |
-| Access API `…/roles` | ✅ | 403 | 403 | 403 |
+| Access API `…/users/<sanityUserId>` (served on `organization`, below) | 403 | 403 | 403 | 403 |
+| Access API `…/roles`, `…/roles/<roleName>` | ✅ | ✅ with `sanity.media-library.roles.read`, else 403 | 403 | 403 |
 | Org lookup | `/projects/<projectId>` | `GET /media-libraries/<id>` | `GET /canvases/<id>` | `GET /dashboards/<id>` |
 
-- **Access API.** Paths are `/access/<type>/<id>/…` with type `project`, `media-library`, `canvas` or `dashboard`. An identity's `access` entries, keyed `"<type>:<id>"`, hold its `roles` there (non-dataset membership) and the `permissions` the `user-permissions` endpoints report. Every identity is a project member with its project roles. Listings come back on one page (`nextCursor: null`). An unknown type answers 400 `Invalid resource type <type>`. An id the registry does not hold (never seeded, written or addressed) answers 404 `Media library not found` / `Canvas not found` / `Dashboard not found`, except `…/me/check`, which answers `false` as staging does. The 403 cells were not proven on staging (no token could list them), so they answer the way the platform refuses a missing permission: `{ statusCode: 403, message: "You do not have permission to access this resource" }`.
+- **Access API.** Paths are `/access/<type>/<id>/…` with type `organization`, `project`, `media-library`, `canvas` or `dashboard`. An identity's `access` entries, keyed `"<type>:<id>"`, hold its `roles` there (membership) and the `permissions` the `user-permissions` endpoints report. Every identity is a project member with its project roles. A user row is `{ sanityUserId, profile: { id, displayName, email, provider, createdAt }, memberships: [{ resourceType, resourceId, roleNames }] }`; the fake does not model `provider` or `createdAt`, so they are always `"sanity"` and the epoch, and `email` is `""` where the identity seeds none. Listings come back on one page (`nextCursor: null`); users listings add `totalCount`. `includeImpliedRoles` is accepted and ignored: rows carry the seeded roles only, so seed an implied role explicitly when a test needs it. An unknown type answers 400 `Invalid resource type <type>`. An id the registry does not hold (never seeded, written or addressed) answers 404 `Media library not found` / `Canvas not found` / `Dashboard not found`, except `…/me/check`, which answers `false` as staging does. `…/users/<sanityUserId>` is served only on the organization, where the fake checks members read; elsewhere it answers 403 (the reference requires `sanity.<type>.members.read` for it; no type's single-user read was probed on staging, only the media-library listing). The other 403 cells were not proven on staging (no token could list them), so they answer the way the platform refuses a missing permission: `{ statusCode: 403, error: "Forbidden", message: "You do not have permission to access this resource" }`.
+- **Members.** Every member listing (`/projects/<projectId>`, `…/users`, `…/roles`) sees the registered identities plus, on a handle created with inline `accessControl`, that handle's own actor. Inline config belongs to its handle: a token sibling does not see it.
+- **Roles.** `…/roles` answers `{ data: [role], nextCursor: null }` and `…/roles/<roleName>` one role (404 `Role not found` for a name no member holds). A role is `{ name, title, description?, resourceType, resourceId, appliesToUsers, appliesToRobots, permissions }`, collected from the roles the members hold on the resource. The fake does not model role definitions, so `title` is the name where the seed gives none, both `appliesTo…` flags are `true` and `permissions` is `[]`. A media library serves its roles only to an actor whose `"media-library:<id>"` entry holds `sanity.media-library.roles.read` in `permissions`, else 403, as the reference requires.
+- **Organization.** `/access/organization/<organizationId>/users` and `…/users/<sanityUserId>` (one row, or 404 `User not found` for a non-member) serve the members of the client's `organizationId`: identities with roles in their `"organization:<id>"` entry. Each row lists the organization membership, then the member's roles on every resource the client holds (its libraries, canvases, dashboards and projects), as the platform's organization row does. Like the platform, it needs `sanity.organization.members.read` in the actor's `"organization:<id>"` `permissions` (the built-in `member` role grants it), else 403. Another organization id answers 404 `Organization not found`; `…/roles` answers 403.
+- **User attributes.** `GET /organizations/<organizationId>/users/me/attributes` answers the caller's own attributes there: `{ sanityUserId, organizationId, attributes: [{ type, key, values: { saml?, sanity? }, activeSource, activeValue }] }`, ordered by key. Seed them as `attributes: [{ key, type, values }]` on the identity's `"organization:<id>"` entry; the Sanity value takes precedence over the SAML one for `activeSource` and `activeValue`, as on the platform. No permission is needed. `limit` (default 50) and `cursor` (the last key of the previous page) page the list. A member with no seeded attributes gets `attributes: []`; a caller without roles in the organization gets 404 `User not found`, and another organization id 404 `Organization not found`.
 - **History.** Every committed write since the client was created is recorded per resource, authored by the acting identity; seeded documents can be read at their seeded `_rev`. A handle answers for its own resource, and hides documents its grants cannot read, as reads do (a transaction that also touched such a document is served without it). Events model `createLiveDocument` / `updateLiveDocument` only.
 - **Org lookup.** `createTestClient({ organizationId })` names the organization every resource of the client belongs to.
 - **Identity.** `@sanity/client` sends a `resource` client's requests to the global host, so `/users/me` answers `globalUser`.

package/dist/index.cjs

@@ -104,7 +104,7 @@ function accessApiError(args) {
     ...request,
     statusCode,
     statusMessage,
-    body: { statusCode, message }
+    body: { statusCode, error: statusMessage, message }
   });
 }
 const noPermission = (request) => accessApiError({
@@ -187,14 +187,7 @@ const RESOURCE_CAPABILITIES = {
     history: "served",
     actions: "served",
     refusedActions: {},
-    access: {
-      type: "project",
-      id: (id) => datasetParts(id).projectId,
-      roles: "served",
-      users: "served",
-      // Every registered identity is a member of every project, with its project roles.
-      memberRoles: ({ identity, id }) => (identity.usersByProject?.[id] ?? identity.user).roles ?? []
-    }
+    access: { type: "project", id: (id) => datasetParts(id).projectId }
   },
   "media-library": {
     label: (id) => `media library "${id}"`,
@@ -206,15 +199,7 @@ const RESOURCE_CAPABILITIES = {
     history: "served",
     actions: "served",
     refusedActions: { "sanity.action.release.create": releaseLimitExceeded },
-    access: {
-      type: "media-library",
-      id: (id) => id,
-      // Unproven on staging (no token held roles read): refused like a missing permission.
-      roles: noPermission,
-      users: "served",
-      unknownId: notFound("Media library"),
-      memberRoles: accessEntryRoles("media-library")
-    }
+    access: { type: "media-library", id: (id) => id }
   },
   canvas: {
     label: (id) => `canvas "${id}"`,
@@ -226,15 +211,7 @@ const RESOURCE_CAPABILITIES = {
     history: "served",
     actions: notMounted,
     refusedActions: {},
-    access: {
-      type: "canvas",
-      id: (id) => id,
-      // Unproven on staging (no canvas roles/members permission exists to grant).
-      roles: noPermission,
-      users: noPermission,
-      unknownId: notFound("Canvas"),
-      memberRoles: accessEntryRoles("canvas")
-    }
+    access: { type: "canvas", id: (id) => id }
   },
   dashboard: {
     label: (id) => `dashboard "${id}"`,
@@ -246,19 +223,11 @@ const RESOURCE_CAPABILITIES = {
     history: notMounted,
     actions: notMounted,
     refusedActions: {},
-    access: {
-      type: "dashboard",
-      id: (id) => id,
-      // Unproven on staging, as for canvas.
-      roles: noPermission,
-      users: noPermission,
-      unknownId: notFound("Dashboard"),
-      memberRoles: accessEntryRoles("dashboard")
-    }
+    access: { type: "dashboard", id: (id) => id }
   }
 };
 function capabilitiesOf(type) {
-  const row = RESOURCE_CAPABILITIES[type];
+  const row = Object.hasOwn(RESOURCE_CAPABILITIES, type) ? RESOURCE_CAPABILITIES[type] : void 0;
   if (row === void 0)
     throw fakeError(
       `Unsupported resource type ${JSON.stringify(type)}. The fake serves ${Object.keys(RESOURCE_CAPABILITIES).map((t) => `"${t}"`).join(", ")}.`
@@ -280,9 +249,77 @@ function matchResourcePath(path) {
       return { resource: { type, id: match.id }, rest: match.rest };
   }
 }
-function capabilitiesForAccessType(type) {
-  for (const [resourceType, row] of Object.entries(RESOURCE_CAPABILITIES))
-    if (row.access.type === type) return { resourceType, row };
+function accessResourceOf(resource) {
+  const { access } = capabilitiesOf(resource.type);
+  return { type: access.type, id: access.id(resource.id) };
+}
+function holdsResource(type) {
+  return (registry, id) => registry.resources().some((resource) => {
+    const access = accessResourceOf(resource);
+    return access.type === type && access.id === id;
+  });
+}
+const ACCESS_CAPABILITIES = {
+  organization: {
+    // Proven on staging, but outside what the fake serves: refused like a missing permission.
+    roles: noPermission,
+    users: "served",
+    user: "served",
+    // Granted by the built-in organization `member` role.
+    usersPermission: "sanity.organization.members.read",
+    unknown: {
+      holds: (registry, id) => id === registry.organizationId,
+      refusal: notFound("Organization")
+    },
+    memberRoles: accessEntryRoles("organization"),
+    // Every resource of the family belongs to its organization (see `organizationId`).
+    owns: (registry) => {
+      const byKey = /* @__PURE__ */ new Map();
+      for (const resource of registry.resources()) {
+        const access = accessResourceOf(resource);
+        byKey.set(accessKey(access.type, access.id), access);
+      }
+      return [...byKey.values()];
+    }
+  },
+  project: {
+    roles: "served",
+    users: "served",
+    // Single-user reads are served only where the fake checks members read (the
+    // organization); elsewhere they refuse rather than answer unchecked.
+    user: noPermission,
+    // Every registered identity is a member of every project, with its project roles.
+    memberRoles: ({ identity, id }) => (identity.usersByProject?.[id] ?? identity.user).roles ?? []
+  },
+  "media-library": {
+    // Staging refuses it only because no probe token held roles read.
+    roles: "served",
+    rolesPermission: "sanity.media-library.roles.read",
+    users: "served",
+    // Unproven on staging (only the listing was probed); refused as on `project`.
+    user: noPermission,
+    unknown: { holds: holdsResource("media-library"), refusal: notFound("Media library") },
+    memberRoles: accessEntryRoles("media-library")
+  },
+  canvas: {
+    // Unproven on staging (no canvas roles/members permission exists to grant).
+    roles: noPermission,
+    users: noPermission,
+    user: noPermission,
+    unknown: { holds: holdsResource("canvas"), refusal: notFound("Canvas") },
+    memberRoles: accessEntryRoles("canvas")
+  },
+  dashboard: {
+    // Unproven on staging, as for canvas.
+    roles: noPermission,
+    users: noPermission,
+    user: noPermission,
+    unknown: { holds: holdsResource("dashboard"), refusal: notFound("Dashboard") },
+    memberRoles: accessEntryRoles("dashboard")
+  }
+};
+function accessCapabilitiesOf(type) {
+  return Object.hasOwn(ACCESS_CAPABILITIES, type) ? ACCESS_CAPABILITIES[type] : void 0;
 }
 function dataUrl(args) {
   const { resource, dataset, operation, path } = args;
@@ -296,12 +333,21 @@ function dataUrl(args) {
   const base = `/${operation}/${dataset}`;
   return `/data${path !== void 0 ? `${base}/${path}` : base}`.replace(/\/($|\?)/, "$1");
 }
-const ACCESS_PATH = /^\/access\/([^/]+)\/([^/]+)(\/.*)?$/, DATA_HISTORY_PATH = /^\/data\/history\/([^/]+)(\/.*)$/;
+const ACCESS_PATH = /^\/access\/([^/]+)\/([^/]+)(\/.*)?$/, ACCESS_USER_PATH = /^\/users\/([^/]+)$/, ACCESS_ROLE_PATH = /^\/roles\/([^/]+)$/, MY_ATTRIBUTES_PATH = /^\/organizations\/([^/]+)\/users\/me\/attributes$/, DATA_HISTORY_PATH = /^\/data\/history\/([^/]+)(\/.*)$/;
 function page(data) {
   return { data, nextCursor: null };
 }
+function usersPage(data) {
+  return { ...page(data), totalCount: data.length };
+}
+const UNMODELLED_PROFILE = { provider: "sanity", createdAt: (/* @__PURE__ */ new Date(0)).toISOString() };
 async function servePlatformRequest(ctx, url) {
-  const queryStart = url.indexOf("?"), path = queryStart === -1 ? url : url.slice(0, queryStart), query = new URLSearchParams(queryStart === -1 ? "" : url.slice(queryStart + 1)), request = { method: "GET", path }, access = path.match(ACCESS_PATH);
+  const queryStart = url.indexOf("?"), path = queryStart === -1 ? url : url.slice(0, queryStart), query = new URLSearchParams(queryStart === -1 ? "" : url.slice(queryStart + 1)), request = { method: "GET", path }, myAttributes = path.match(MY_ATTRIBUTES_PATH);
+  if (myAttributes !== null) {
+    const organizationId = decodeURIComponent(myAttributes[1]);
+    return serveMyAttributes({ ctx, request, organizationId, query });
+  }
+  const access = path.match(ACCESS_PATH);
   if (access !== null) {
     const [, type, id, rest2] = access;
     return serveAccess({ ctx, request, type, id: decodeURIComponent(id), rest: rest2 ?? "", query });
@@ -369,20 +415,46 @@ async function readHistory(args) {
     };
 }
 function serveAccess(args) {
-  const { ctx, request, type, id, rest, query } = args, found = capabilitiesForAccessType(type);
-  if (found === void 0) throw invalidAccessType(request, type);
-  const accessType = found.row.access.type, { unknownId } = found.row.access;
-  if (unknownId !== void 0 && rest !== "/user-permissions/me/check" && !ctx.exists({ type: found.resourceType, id }))
-    throw unknownId(request);
-  const permissions = ctx.actorAccess()?.[accessKey(accessType, id)]?.permissions ?? [];
+  const { ctx, request, type, id, rest, query } = args, row = accessCapabilitiesOf(type);
+  if (row === void 0) throw invalidAccessType(request, type);
+  const resource = { type, id }, registry = {
+    organizationId: ctx.organizationId,
+    resources: ctx.resources
+  }, permissions = ctx.actorAccess()?.[accessKey(resource.type, id)]?.permissions ?? [];
+  if (rest === "/user-permissions/me/check") {
+    const requested = query.getAll("permissions").flatMap((value) => value.split(","));
+    return {
+      value: { data: Object.fromEntries(requested.map((p) => [p, permissions.includes(p)])) }
+    };
+  }
+  if (row.unknown !== void 0 && !row.unknown.holds(registry, id))
+    throw row.unknown.refusal(request);
+  const gated = (capability, permission, serve) => serveCapability(capability, request, () => {
+    if (permission !== void 0 && !permissions.includes(permission))
+      throw noPermission(request);
+    return serve();
+  }), users = (capability, serve) => gated(capability, row.usersPermission, serve), roles = () => rolesOn({ resource, identities: ctx.identities() }), user = rest.match(ACCESS_USER_PATH);
+  if (user !== null)
+    return users(row.user, () => {
+      const sanityUserId = decodeURIComponent(user[1]), record = usersOn({ resource, registry, identities: ctx.identities() }).find(
+        (candidate) => candidate.sanityUserId === sanityUserId
+      );
+      if (record === void 0) throw notFound("User")(request);
+      return { value: record };
+    });
+  const role = rest.match(ACCESS_ROLE_PATH);
+  if (role !== null)
+    return gated(row.roles, row.rolesPermission, () => {
+      const name = decodeURIComponent(role[1]), record = roles().find((candidate) => candidate.name === name);
+      if (record === void 0) throw notFound("Role")(request);
+      return { value: record };
+    });
   switch (rest) {
     case "/roles":
-      return serveCapability(found.row.access.roles, request, () => ({
-        value: page(rolesOn({ row: found.row, id, identities: ctx.identities() }))
-      }));
+      return gated(row.roles, row.rolesPermission, () => ({ value: page(roles()) }));
     case "/users":
-      return serveCapability(found.row.access.users, request, () => ({
-        value: page(usersOn({ row: found.row, id, identities: ctx.identities() }))
+      return users(row.users, () => ({
+        value: usersPage(usersOn({ resource, registry, identities: ctx.identities() }))
       }));
     case "/user-permissions/me":
       return {
@@ -391,63 +463,102 @@ function serveAccess(args) {
             const dot = permission.lastIndexOf(".");
             return {
               type: permission.slice(0, dot),
-              resourceType: accessType,
+              resourceType: resource.type,
               resourceId: id,
               action: permission.slice(dot + 1)
             };
           })
         )
       };
-    case "/user-permissions/me/check": {
-      const requested = query.getAll("permissions").flatMap((value) => value.split(","));
-      return {
-        value: {
-          data: Object.fromEntries(requested.map((p) => [p, permissions.includes(p)]))
-        }
-      };
-    }
     default:
       return;
   }
 }
+const UNMODELLED_ROLE = { appliesToUsers: !0, appliesToRobots: !0 };
 function rolesOn(args) {
-  const byName = /* @__PURE__ */ new Map();
-  for (const identity of args.identities)
-    for (const role of args.row.access.memberRoles({ identity, id: args.id }) ?? [])
+  const { resource } = args, byName = /* @__PURE__ */ new Map();
+  for (const identity of args.identities) {
+    const roles = ACCESS_CAPABILITIES[resource.type].memberRoles({ identity, id: resource.id });
+    for (const role of roles ?? [])
       byName.set(role.name, {
         name: role.name,
-        ...role.title !== void 0 ? { title: role.title } : {},
-        ...role.description !== void 0 ? { description: role.description } : {}
+        title: role.title ?? role.name,
+        ...role.description !== void 0 ? { description: role.description } : {},
+        resourceType: resource.type,
+        resourceId: resource.id,
+        ...UNMODELLED_ROLE,
+        permissions: []
       });
+  }
   return [...byName.values()].toSorted((a, b) => a.name.localeCompare(b.name));
 }
+function membershipOn(identity, resource) {
+  const roles = ACCESS_CAPABILITIES[resource.type].memberRoles({ identity, id: resource.id });
+  if (roles !== void 0)
+    return {
+      resourceType: resource.type,
+      resourceId: resource.id,
+      roleNames: roles.map((role) => role.name).toSorted()
+    };
+}
 function usersOn(args) {
-  const { row, id, identities } = args, bySanityUserId = /* @__PURE__ */ new Map();
+  const { resource, registry, identities } = args, owned = ACCESS_CAPABILITIES[resource.type].owns?.(registry) ?? [], bySanityUserId = /* @__PURE__ */ new Map();
   for (const identity of identities) {
-    const roles = row.access.memberRoles({ identity, id });
-    if (roles === void 0) continue;
+    const own = membershipOn(identity, resource);
+    if (own === void 0) continue;
     const user = identity.globalUser ?? identity.user, record = {
       sanityUserId: user.id,
       profile: {
+        id: user.id,
         displayName: user.name ?? user.id,
-        ...user.email !== void 0 ? { email: user.email } : {}
+        email: user.email ?? "",
+        ...UNMODELLED_PROFILE
       },
       memberships: [
-        {
-          resourceType: row.access.type,
-          resourceId: id,
-          roleNames: roles.map((role) => role.name).toSorted()
-        }
+        own,
+        // A user is part of a resource only through a role on it.
+        ...owned.flatMap((child) => {
+          const membership = membershipOn(identity, child);
+          return membership === void 0 || membership.roleNames.length === 0 ? [] : [membership];
+        })
       ]
     }, existing = bySanityUserId.get(record.sanityUserId);
     if (existing !== void 0 && JSON.stringify(existing) !== JSON.stringify(record))
       throw fakeError(
-        `request(): two registered identities resolve to user "${record.sanityUserId}" on ${row.access.type} "${id}" with different records. Fix the identity registrations so duplicate ids carry identical records.`
+        `request(): two identities (registered, or the handle's inline accessControl) resolve to user "${record.sanityUserId}" on ${resource.type} "${resource.id}" with different records. Fix the identities so duplicate ids carry identical records.`
       );
     bySanityUserId.set(record.sanityUserId, record);
   }
   return [...bySanityUserId.values()];
 }
+const DEFAULT_ATTRIBUTES_LIMIT = 50;
+function serveMyAttributes(args) {
+  const { ctx, request, organizationId, query } = args, organization = ACCESS_CAPABILITIES.organization, registry = { organizationId: ctx.organizationId, resources: ctx.resources };
+  if (organization.unknown !== void 0 && !organization.unknown.holds(registry, organizationId))
+    throw organization.unknown.refusal(request);
+  const entry = ctx.actorAccess()?.[accessKey("organization", organizationId)];
+  if (entry?.roles === void 0) throw notFound("User")(request);
+  const limit = attributesLimit(query), cursor = query.get("cursor"), attributes = (entry.attributes ?? []).map(attributeRecord).toSorted((a, b) => a.key < b.key ? -1 : a.key > b.key ? 1 : 0).filter((attribute) => cursor === null || attribute.key > cursor).slice(0, limit);
+  return { value: { sanityUserId: ctx.actorUser().id, organizationId, attributes } };
+}
+function attributesLimit(query) {
+  const raw = query.get("limit");
+  if (raw === null) return DEFAULT_ATTRIBUTES_LIMIT;
+  const limit = Number(raw);
+  if (!Number.isInteger(limit) || limit < 1)
+    throw fakeError(
+      `request(): users/me/attributes got limit=${JSON.stringify(raw)}; the fake serves positive integer limits only (the platform's answer to others is not simulated).`
+    );
+  return limit;
+}
+function attributeRecord(attribute) {
+  const { key, type, values } = attribute, activeSource = values.sanity !== void 0 ? "sanity" : "saml", activeValue = values[activeSource];
+  if (activeValue === void 0)
+    throw fakeError(
+      `request(): user attribute "${key}" is seeded with no value; give it a \`saml\` or \`sanity\` value.`
+    );
+  return { type, key, values: { ...values }, activeSource, activeValue };
+}
 class WriteAccessDeniedError extends Error {
   documentId;
   permission;
@@ -519,7 +630,7 @@ function consistentProjectRecords(args) {
     const existing = byId.get(record.id);
     if (existing !== void 0 && JSON.stringify(existing) !== JSON.stringify(record))
       throw fakeError(
-        `request(): two registered identities resolve to project user "${record.id}" in project "${args.projectId}" with different records. The project records cannot be served unambiguously \u2014 fix the identity registrations so duplicate ids carry identical records.`
+        `request(): two identities (registered, or the handle's inline accessControl) resolve to project user "${record.id}" in project "${args.projectId}" with different records. The project records cannot be served unambiguously \u2014 fix the identities so duplicate ids carry identical records.`
       );
     byId.set(record.id, record);
   }
@@ -604,7 +715,7 @@ function makeRequestImpl(ctx) {
     const served = path === void 0 ? void 0 : await servePlatformRequest(platform, path);
     if (served !== void 0) return served.value;
     throw fakeError(
-      `request(): no handler for path "${path}". With access control configured, the fake serves "/users/me", the handle's ACL ("<data base>/acl"), "/projects/<projectId>" (members), "/projects/<projectId>/users/<ids>", the History API (client.getDataUrl("history", \u2026)), resource lookup ("/media-libraries/<id>", "/canvases/<id>", "/dashboards/<id>") and the Access API ("/access/<type>/<id>/roles | users | user-permissions/me[/check]"). For any other endpoint, register a stub (client.stub("request", fn)) or intercept the HTTP call with a tool like MSW.`
+      `request(): no handler for path "${path}". With access control configured, the fake serves "/users/me", the handle's ACL ("<data base>/acl"), "/projects/<projectId>" (members), "/projects/<projectId>/users/<ids>", the History API (client.getDataUrl("history", \u2026)), resource lookup ("/media-libraries/<id>", "/canvases/<id>", "/dashboards/<id>") and the Access API ("/access/<type>/<id>/roles[/<name>] | users[/<id>] | user-permissions/me[/check]") and the caller's attributes ("/organizations/<id>/users/me/attributes"). For any other endpoint, register a stub (client.stub("request", fn)) or intercept the HTTP call with a tool like MSW.`
     );
   };
 }
@@ -1667,7 +1778,17 @@ function makeHandle(handleArgs) {
     if (access === void 0)
       throw fakeError("this handle has no acting identity (no token or accessControl bound).");
     return access;
-  }, capabilities = capabilitiesOf(target.type), targetLabel = capabilities.label(target.id), { store, history } = ensureEntry(registry, target), concurrentEditKey = (id) => registryKey(target) + " " + id, actorId = () => {
+  }, members = () => [
+    ...backend.identities.values(),
+    ...token === void 0 && accessControl !== void 0 ? [
+      {
+        user: accessControl.currentUser,
+        ...accessControl.globalUser !== void 0 ? { globalUser: accessControl.globalUser } : {},
+        grants: accessControl.grants,
+        ...accessControl.access !== void 0 ? { access: accessControl.access } : {}
+      }
+    ] : []
+  ], capabilities = capabilitiesOf(target.type), targetLabel = capabilities.label(target.id), { store, history } = ensureEntry(registry, target), concurrentEditKey = (id) => registryKey(target) + " " + id, actorId = () => {
     const access = activeAccess();
     if (access !== void 0)
       return capabilities.identity === "global" ? (access.globalUser ?? access.currentUser).id : access.currentUser.id;
@@ -2023,7 +2144,7 @@ function makeHandle(handleArgs) {
         // client to the global API host.
         useProjectHostname: useProjectHostname && resource === void 0,
         organizationId: backend.organizationId,
-        listIdentities: () => [...backend.identities.values()],
+        listIdentities: members,
         platform: {
           projectId,
           organizationId: backend.organizationId,
@@ -2033,9 +2154,13 @@ function makeHandle(handleArgs) {
             history,
             canRead
           } : void 0,
+          actorUser: () => {
+            const access = requireActiveAccess();
+            return access.globalUser ?? access.currentUser;
+          },
           actorAccess: () => requireActiveAccess().access,
-          identities: () => [...backend.identities.values()],
-          exists: (asked) => registry.has(registryKey(asked))
+          identities: members,
+          resources: () => [...registry.values()].map((entry) => entry.resource)
         }
       })
     } : {},