@sanity-labs/client-fake-for-test 0.13.0 → 0.15.0

package/dist/index.d.cts

@@ -841,6 +841,12 @@ export declare type ReleaseType = "asap" | "scheduled" | "undecided";
 export declare interface ResourceAccess {
   roles?: NonNullable<CurrentUser["roles"]>;
   permissions?: string[];
+  /**
+   * The user's attributes in the organization, as an administrator or SAML
+   * sync set them; read on `"organization:<id>"` entries only. Served by
+   * `GET /organizations/<id>/users/me/attributes`.
+   */
+  attributes?: UserAttribute[];
 }
 
 /** Resource types `@sanity/client`'s `resource` config can name (the ones staging probed). */
@@ -1183,8 +1189,8 @@ export declare interface TestClientAccessControl {
    */
   aclPath?: string;
   /**
-   * Access API entries, keyed `"<access type>:<id>"` — `"project:<projectId>"`,
-   * `"media-library:<id>"`, `"canvas:<id>"`, `"dashboard:<id>"`. See {@link ResourceAccess}.
+   * Access API entries, keyed `"<access type>:<id>"` — `"organization:<id>"`,
+   * `"project:<projectId>"`, `"media-library:<id>"`, `"canvas:<id>"`, `"dashboard:<id>"`. See {@link ResourceAccess}.
    */
   access?: Record<string, ResourceAccess>;
 }
@@ -1225,10 +1231,10 @@ export declare interface TestClientIdentity {
   /** Grants served at the ACL path and enforced on reads/writes. */
   grants: Grant[];
   /**
-   * Access API entries, keyed `"<access type>:<id>"` (`"media-library:<id>"`,
-   * `"canvas:<id>"`, `"dashboard:<id>"`, `"project:<projectId>"`). On a
-   * non-dataset resource, an entry with `roles` makes the identity a member
-   * there. Project membership needs no entry: every identity is a member of
+   * Access API entries, keyed `"<access type>:<id>"` (`"organization:<id>"`,
+   * `"media-library:<id>"`, `"canvas:<id>"`, `"dashboard:<id>"`,
+   * `"project:<projectId>"`). On a non-project resource, an entry with
+   * `roles` makes the identity a member there. Project membership needs no entry: every identity is a member of
    * every project with its project-scoped roles.
    */
   access?: Record<string, ResourceAccess>;
@@ -1365,6 +1371,29 @@ declare interface UnsupportedEntry {
   workaround: string;
 }
 
+/**
+ * One user attribute: its key, its type, and its value from each source.
+ * The served row adds `activeSource` and `activeValue`: the Sanity value
+ * when there is one, else the SAML value.
+ */
+export declare interface UserAttribute {
+  key: string;
+  type: string;
+  values: {
+    saml?: UserAttributeValue;
+    sanity?: UserAttributeValue;
+  };
+}
+
+/** A value a user attribute can hold. */
+export declare type UserAttributeValue =
+  | string
+  | number
+  | boolean
+  | string[]
+  | number[]
+  | boolean[];
+
 export declare type VersionAction =
   | {
       actionType: "sanity.action.document.version.create";

package/dist/index.d.ts

@@ -841,6 +841,12 @@ export declare type ReleaseType = "asap" | "scheduled" | "undecided";
 export declare interface ResourceAccess {
   roles?: NonNullable<CurrentUser["roles"]>;
   permissions?: string[];
+  /**
+   * The user's attributes in the organization, as an administrator or SAML
+   * sync set them; read on `"organization:<id>"` entries only. Served by
+   * `GET /organizations/<id>/users/me/attributes`.
+   */
+  attributes?: UserAttribute[];
 }
 
 /** Resource types `@sanity/client`'s `resource` config can name (the ones staging probed). */
@@ -1183,8 +1189,8 @@ export declare interface TestClientAccessControl {
    */
   aclPath?: string;
   /**
-   * Access API entries, keyed `"<access type>:<id>"` — `"project:<projectId>"`,
-   * `"media-library:<id>"`, `"canvas:<id>"`, `"dashboard:<id>"`. See {@link ResourceAccess}.
+   * Access API entries, keyed `"<access type>:<id>"` — `"organization:<id>"`,
+   * `"project:<projectId>"`, `"media-library:<id>"`, `"canvas:<id>"`, `"dashboard:<id>"`. See {@link ResourceAccess}.
    */
   access?: Record<string, ResourceAccess>;
 }
@@ -1225,10 +1231,10 @@ export declare interface TestClientIdentity {
   /** Grants served at the ACL path and enforced on reads/writes. */
   grants: Grant[];
   /**
-   * Access API entries, keyed `"<access type>:<id>"` (`"media-library:<id>"`,
-   * `"canvas:<id>"`, `"dashboard:<id>"`, `"project:<projectId>"`). On a
-   * non-dataset resource, an entry with `roles` makes the identity a member
-   * there. Project membership needs no entry: every identity is a member of
+   * Access API entries, keyed `"<access type>:<id>"` (`"organization:<id>"`,
+   * `"media-library:<id>"`, `"canvas:<id>"`, `"dashboard:<id>"`,
+   * `"project:<projectId>"`). On a non-project resource, an entry with
+   * `roles` makes the identity a member there. Project membership needs no entry: every identity is a member of
    * every project with its project-scoped roles.
    */
   access?: Record<string, ResourceAccess>;
@@ -1365,6 +1371,29 @@ declare interface UnsupportedEntry {
   workaround: string;
 }
 
+/**
+ * One user attribute: its key, its type, and its value from each source.
+ * The served row adds `activeSource` and `activeValue`: the Sanity value
+ * when there is one, else the SAML value.
+ */
+export declare interface UserAttribute {
+  key: string;
+  type: string;
+  values: {
+    saml?: UserAttributeValue;
+    sanity?: UserAttributeValue;
+  };
+}
+
+/** A value a user attribute can hold. */
+export declare type UserAttributeValue =
+  | string
+  | number
+  | boolean
+  | string[]
+  | number[]
+  | boolean[];
+
 export declare type VersionAction =
   | {
       actionType: "sanity.action.document.version.create";

package/dist/index.js

@@ -102,7 +102,7 @@ function accessApiError(args) {
     ...request,
     statusCode,
     statusMessage,
-    body: { statusCode, message }
+    body: { statusCode, error: statusMessage, message }
   });
 }
 const noPermission = (request) => accessApiError({
@@ -185,14 +185,7 @@ const RESOURCE_CAPABILITIES = {
     history: "served",
     actions: "served",
     refusedActions: {},
-    access: {
-      type: "project",
-      id: (id) => datasetParts(id).projectId,
-      roles: "served",
-      users: "served",
-      // Every registered identity is a member of every project, with its project roles.
-      memberRoles: ({ identity, id }) => (identity.usersByProject?.[id] ?? identity.user).roles ?? []
-    }
+    access: { type: "project", id: (id) => datasetParts(id).projectId }
   },
   "media-library": {
     label: (id) => `media library "${id}"`,
@@ -204,15 +197,7 @@ const RESOURCE_CAPABILITIES = {
     history: "served",
     actions: "served",
     refusedActions: { "sanity.action.release.create": releaseLimitExceeded },
-    access: {
-      type: "media-library",
-      id: (id) => id,
-      // Unproven on staging (no token held roles read): refused like a missing permission.
-      roles: noPermission,
-      users: "served",
-      unknownId: notFound("Media library"),
-      memberRoles: accessEntryRoles("media-library")
-    }
+    access: { type: "media-library", id: (id) => id }
   },
   canvas: {
     label: (id) => `canvas "${id}"`,
@@ -224,15 +209,7 @@ const RESOURCE_CAPABILITIES = {
     history: "served",
     actions: notMounted,
     refusedActions: {},
-    access: {
-      type: "canvas",
-      id: (id) => id,
-      // Unproven on staging (no canvas roles/members permission exists to grant).
-      roles: noPermission,
-      users: noPermission,
-      unknownId: notFound("Canvas"),
-      memberRoles: accessEntryRoles("canvas")
-    }
+    access: { type: "canvas", id: (id) => id }
   },
   dashboard: {
     label: (id) => `dashboard "${id}"`,
@@ -244,19 +221,11 @@ const RESOURCE_CAPABILITIES = {
     history: notMounted,
     actions: notMounted,
     refusedActions: {},
-    access: {
-      type: "dashboard",
-      id: (id) => id,
-      // Unproven on staging, as for canvas.
-      roles: noPermission,
-      users: noPermission,
-      unknownId: notFound("Dashboard"),
-      memberRoles: accessEntryRoles("dashboard")
-    }
+    access: { type: "dashboard", id: (id) => id }
   }
 };
 function capabilitiesOf(type) {
-  const row = RESOURCE_CAPABILITIES[type];
+  const row = Object.hasOwn(RESOURCE_CAPABILITIES, type) ? RESOURCE_CAPABILITIES[type] : void 0;
   if (row === void 0)
     throw fakeError(
       `Unsupported resource type ${JSON.stringify(type)}. The fake serves ${Object.keys(RESOURCE_CAPABILITIES).map((t) => `"${t}"`).join(", ")}.`
@@ -278,9 +247,77 @@ function matchResourcePath(path) {
       return { resource: { type, id: match.id }, rest: match.rest };
   }
 }
-function capabilitiesForAccessType(type) {
-  for (const [resourceType, row] of Object.entries(RESOURCE_CAPABILITIES))
-    if (row.access.type === type) return { resourceType, row };
+function accessResourceOf(resource) {
+  const { access } = capabilitiesOf(resource.type);
+  return { type: access.type, id: access.id(resource.id) };
+}
+function holdsResource(type) {
+  return (registry, id) => registry.resources().some((resource) => {
+    const access = accessResourceOf(resource);
+    return access.type === type && access.id === id;
+  });
+}
+const ACCESS_CAPABILITIES = {
+  organization: {
+    // Proven on staging, but outside what the fake serves: refused like a missing permission.
+    roles: noPermission,
+    users: "served",
+    user: "served",
+    // Granted by the built-in organization `member` role.
+    usersPermission: "sanity.organization.members.read",
+    unknown: {
+      holds: (registry, id) => id === registry.organizationId,
+      refusal: notFound("Organization")
+    },
+    memberRoles: accessEntryRoles("organization"),
+    // Every resource of the family belongs to its organization (see `organizationId`).
+    owns: (registry) => {
+      const byKey = /* @__PURE__ */ new Map();
+      for (const resource of registry.resources()) {
+        const access = accessResourceOf(resource);
+        byKey.set(accessKey(access.type, access.id), access);
+      }
+      return [...byKey.values()];
+    }
+  },
+  project: {
+    roles: "served",
+    users: "served",
+    // Single-user reads are served only where the fake checks members read (the
+    // organization); elsewhere they refuse rather than answer unchecked.
+    user: noPermission,
+    // Every registered identity is a member of every project, with its project roles.
+    memberRoles: ({ identity, id }) => (identity.usersByProject?.[id] ?? identity.user).roles ?? []
+  },
+  "media-library": {
+    // Staging refuses it only because no probe token held roles read.
+    roles: "served",
+    rolesPermission: "sanity.media-library.roles.read",
+    users: "served",
+    // Unproven on staging (only the listing was probed); refused as on `project`.
+    user: noPermission,
+    unknown: { holds: holdsResource("media-library"), refusal: notFound("Media library") },
+    memberRoles: accessEntryRoles("media-library")
+  },
+  canvas: {
+    // Unproven on staging (no canvas roles/members permission exists to grant).
+    roles: noPermission,
+    users: noPermission,
+    user: noPermission,
+    unknown: { holds: holdsResource("canvas"), refusal: notFound("Canvas") },
+    memberRoles: accessEntryRoles("canvas")
+  },
+  dashboard: {
+    // Unproven on staging, as for canvas.
+    roles: noPermission,
+    users: noPermission,
+    user: noPermission,
+    unknown: { holds: holdsResource("dashboard"), refusal: notFound("Dashboard") },
+    memberRoles: accessEntryRoles("dashboard")
+  }
+};
+function accessCapabilitiesOf(type) {
+  return Object.hasOwn(ACCESS_CAPABILITIES, type) ? ACCESS_CAPABILITIES[type] : void 0;
 }
 function dataUrl(args) {
   const { resource, dataset, operation, path } = args;
@@ -294,12 +331,21 @@ function dataUrl(args) {
   const base = `/${operation}/${dataset}`;
   return `/data${path !== void 0 ? `${base}/${path}` : base}`.replace(/\/($|\?)/, "$1");
 }
-const ACCESS_PATH = /^\/access\/([^/]+)\/([^/]+)(\/.*)?$/, DATA_HISTORY_PATH = /^\/data\/history\/([^/]+)(\/.*)$/;
+const ACCESS_PATH = /^\/access\/([^/]+)\/([^/]+)(\/.*)?$/, ACCESS_USER_PATH = /^\/users\/([^/]+)$/, ACCESS_ROLE_PATH = /^\/roles\/([^/]+)$/, MY_ATTRIBUTES_PATH = /^\/organizations\/([^/]+)\/users\/me\/attributes$/, DATA_HISTORY_PATH = /^\/data\/history\/([^/]+)(\/.*)$/;
 function page(data) {
   return { data, nextCursor: null };
 }
+function usersPage(data) {
+  return { ...page(data), totalCount: data.length };
+}
+const UNMODELLED_PROFILE = { provider: "sanity", createdAt: (/* @__PURE__ */ new Date(0)).toISOString() };
 async function servePlatformRequest(ctx, url) {
-  const queryStart = url.indexOf("?"), path = queryStart === -1 ? url : url.slice(0, queryStart), query = new URLSearchParams(queryStart === -1 ? "" : url.slice(queryStart + 1)), request = { method: "GET", path }, access = path.match(ACCESS_PATH);
+  const queryStart = url.indexOf("?"), path = queryStart === -1 ? url : url.slice(0, queryStart), query = new URLSearchParams(queryStart === -1 ? "" : url.slice(queryStart + 1)), request = { method: "GET", path }, myAttributes = path.match(MY_ATTRIBUTES_PATH);
+  if (myAttributes !== null) {
+    const organizationId = decodeURIComponent(myAttributes[1]);
+    return serveMyAttributes({ ctx, request, organizationId, query });
+  }
+  const access = path.match(ACCESS_PATH);
   if (access !== null) {
     const [, type, id, rest2] = access;
     return serveAccess({ ctx, request, type, id: decodeURIComponent(id), rest: rest2 ?? "", query });
@@ -367,20 +413,46 @@ async function readHistory(args) {
     };
 }
 function serveAccess(args) {
-  const { ctx, request, type, id, rest, query } = args, found = capabilitiesForAccessType(type);
-  if (found === void 0) throw invalidAccessType(request, type);
-  const accessType = found.row.access.type, { unknownId } = found.row.access;
-  if (unknownId !== void 0 && rest !== "/user-permissions/me/check" && !ctx.exists({ type: found.resourceType, id }))
-    throw unknownId(request);
-  const permissions = ctx.actorAccess()?.[accessKey(accessType, id)]?.permissions ?? [];
+  const { ctx, request, type, id, rest, query } = args, row = accessCapabilitiesOf(type);
+  if (row === void 0) throw invalidAccessType(request, type);
+  const resource = { type, id }, registry = {
+    organizationId: ctx.organizationId,
+    resources: ctx.resources
+  }, permissions = ctx.actorAccess()?.[accessKey(resource.type, id)]?.permissions ?? [];
+  if (rest === "/user-permissions/me/check") {
+    const requested = query.getAll("permissions").flatMap((value) => value.split(","));
+    return {
+      value: { data: Object.fromEntries(requested.map((p) => [p, permissions.includes(p)])) }
+    };
+  }
+  if (row.unknown !== void 0 && !row.unknown.holds(registry, id))
+    throw row.unknown.refusal(request);
+  const gated = (capability, permission, serve) => serveCapability(capability, request, () => {
+    if (permission !== void 0 && !permissions.includes(permission))
+      throw noPermission(request);
+    return serve();
+  }), users = (capability, serve) => gated(capability, row.usersPermission, serve), roles = () => rolesOn({ resource, identities: ctx.identities() }), user = rest.match(ACCESS_USER_PATH);
+  if (user !== null)
+    return users(row.user, () => {
+      const sanityUserId = decodeURIComponent(user[1]), record = usersOn({ resource, registry, identities: ctx.identities() }).find(
+        (candidate) => candidate.sanityUserId === sanityUserId
+      );
+      if (record === void 0) throw notFound("User")(request);
+      return { value: record };
+    });
+  const role = rest.match(ACCESS_ROLE_PATH);
+  if (role !== null)
+    return gated(row.roles, row.rolesPermission, () => {
+      const name = decodeURIComponent(role[1]), record = roles().find((candidate) => candidate.name === name);
+      if (record === void 0) throw notFound("Role")(request);
+      return { value: record };
+    });
   switch (rest) {
     case "/roles":
-      return serveCapability(found.row.access.roles, request, () => ({
-        value: page(rolesOn({ row: found.row, id, identities: ctx.identities() }))
-      }));
+      return gated(row.roles, row.rolesPermission, () => ({ value: page(roles()) }));
     case "/users":
-      return serveCapability(found.row.access.users, request, () => ({
-        value: page(usersOn({ row: found.row, id, identities: ctx.identities() }))
+      return users(row.users, () => ({
+        value: usersPage(usersOn({ resource, registry, identities: ctx.identities() }))
       }));
     case "/user-permissions/me":
       return {
@@ -389,63 +461,102 @@ function serveAccess(args) {
             const dot = permission.lastIndexOf(".");
             return {
               type: permission.slice(0, dot),
-              resourceType: accessType,
+              resourceType: resource.type,
               resourceId: id,
               action: permission.slice(dot + 1)
             };
           })
         )
       };
-    case "/user-permissions/me/check": {
-      const requested = query.getAll("permissions").flatMap((value) => value.split(","));
-      return {
-        value: {
-          data: Object.fromEntries(requested.map((p) => [p, permissions.includes(p)]))
-        }
-      };
-    }
     default:
       return;
   }
 }
+const UNMODELLED_ROLE = { appliesToUsers: !0, appliesToRobots: !0 };
 function rolesOn(args) {
-  const byName = /* @__PURE__ */ new Map();
-  for (const identity of args.identities)
-    for (const role of args.row.access.memberRoles({ identity, id: args.id }) ?? [])
+  const { resource } = args, byName = /* @__PURE__ */ new Map();
+  for (const identity of args.identities) {
+    const roles = ACCESS_CAPABILITIES[resource.type].memberRoles({ identity, id: resource.id });
+    for (const role of roles ?? [])
       byName.set(role.name, {
         name: role.name,
-        ...role.title !== void 0 ? { title: role.title } : {},
-        ...role.description !== void 0 ? { description: role.description } : {}
+        title: role.title ?? role.name,
+        ...role.description !== void 0 ? { description: role.description } : {},
+        resourceType: resource.type,
+        resourceId: resource.id,
+        ...UNMODELLED_ROLE,
+        permissions: []
       });
+  }
   return [...byName.values()].toSorted((a, b) => a.name.localeCompare(b.name));
 }
+function membershipOn(identity, resource) {
+  const roles = ACCESS_CAPABILITIES[resource.type].memberRoles({ identity, id: resource.id });
+  if (roles !== void 0)
+    return {
+      resourceType: resource.type,
+      resourceId: resource.id,
+      roleNames: roles.map((role) => role.name).toSorted()
+    };
+}
 function usersOn(args) {
-  const { row, id, identities } = args, bySanityUserId = /* @__PURE__ */ new Map();
+  const { resource, registry, identities } = args, owned = ACCESS_CAPABILITIES[resource.type].owns?.(registry) ?? [], bySanityUserId = /* @__PURE__ */ new Map();
   for (const identity of identities) {
-    const roles = row.access.memberRoles({ identity, id });
-    if (roles === void 0) continue;
+    const own = membershipOn(identity, resource);
+    if (own === void 0) continue;
     const user = identity.globalUser ?? identity.user, record = {
       sanityUserId: user.id,
       profile: {
+        id: user.id,
         displayName: user.name ?? user.id,
-        ...user.email !== void 0 ? { email: user.email } : {}
+        email: user.email ?? "",
+        ...UNMODELLED_PROFILE
       },
       memberships: [
-        {
-          resourceType: row.access.type,
-          resourceId: id,
-          roleNames: roles.map((role) => role.name).toSorted()
-        }
+        own,
+        // A user is part of a resource only through a role on it.
+        ...owned.flatMap((child) => {
+          const membership = membershipOn(identity, child);
+          return membership === void 0 || membership.roleNames.length === 0 ? [] : [membership];
+        })
       ]
     }, existing = bySanityUserId.get(record.sanityUserId);
     if (existing !== void 0 && JSON.stringify(existing) !== JSON.stringify(record))
       throw fakeError(
-        `request(): two registered identities resolve to user "${record.sanityUserId}" on ${row.access.type} "${id}" with different records. Fix the identity registrations so duplicate ids carry identical records.`
+        `request(): two identities (registered, or the handle's inline accessControl) resolve to user "${record.sanityUserId}" on ${resource.type} "${resource.id}" with different records. Fix the identities so duplicate ids carry identical records.`
       );
     bySanityUserId.set(record.sanityUserId, record);
   }
   return [...bySanityUserId.values()];
 }
+const DEFAULT_ATTRIBUTES_LIMIT = 50;
+function serveMyAttributes(args) {
+  const { ctx, request, organizationId, query } = args, organization = ACCESS_CAPABILITIES.organization, registry = { organizationId: ctx.organizationId, resources: ctx.resources };
+  if (organization.unknown !== void 0 && !organization.unknown.holds(registry, organizationId))
+    throw organization.unknown.refusal(request);
+  const entry = ctx.actorAccess()?.[accessKey("organization", organizationId)];
+  if (entry?.roles === void 0) throw notFound("User")(request);
+  const limit = attributesLimit(query), cursor = query.get("cursor"), attributes = (entry.attributes ?? []).map(attributeRecord).toSorted((a, b) => a.key < b.key ? -1 : a.key > b.key ? 1 : 0).filter((attribute) => cursor === null || attribute.key > cursor).slice(0, limit);
+  return { value: { sanityUserId: ctx.actorUser().id, organizationId, attributes } };
+}
+function attributesLimit(query) {
+  const raw = query.get("limit");
+  if (raw === null) return DEFAULT_ATTRIBUTES_LIMIT;
+  const limit = Number(raw);
+  if (!Number.isInteger(limit) || limit < 1)
+    throw fakeError(
+      `request(): users/me/attributes got limit=${JSON.stringify(raw)}; the fake serves positive integer limits only (the platform's answer to others is not simulated).`
+    );
+  return limit;
+}
+function attributeRecord(attribute) {
+  const { key, type, values } = attribute, activeSource = values.sanity !== void 0 ? "sanity" : "saml", activeValue = values[activeSource];
+  if (activeValue === void 0)
+    throw fakeError(
+      `request(): user attribute "${key}" is seeded with no value; give it a \`saml\` or \`sanity\` value.`
+    );
+  return { type, key, values: { ...values }, activeSource, activeValue };
+}
 class WriteAccessDeniedError extends Error {
   documentId;
   permission;
@@ -517,7 +628,7 @@ function consistentProjectRecords(args) {
     const existing = byId.get(record.id);
     if (existing !== void 0 && JSON.stringify(existing) !== JSON.stringify(record))
       throw fakeError(
-        `request(): two registered identities resolve to project user "${record.id}" in project "${args.projectId}" with different records. The project records cannot be served unambiguously \u2014 fix the identity registrations so duplicate ids carry identical records.`
+        `request(): two identities (registered, or the handle's inline accessControl) resolve to project user "${record.id}" in project "${args.projectId}" with different records. The project records cannot be served unambiguously \u2014 fix the identities so duplicate ids carry identical records.`
       );
     byId.set(record.id, record);
   }
@@ -602,7 +713,7 @@ function makeRequestImpl(ctx) {
     const served = path === void 0 ? void 0 : await servePlatformRequest(platform, path);
     if (served !== void 0) return served.value;
     throw fakeError(
-      `request(): no handler for path "${path}". With access control configured, the fake serves "/users/me", the handle's ACL ("<data base>/acl"), "/projects/<projectId>" (members), "/projects/<projectId>/users/<ids>", the History API (client.getDataUrl("history", \u2026)), resource lookup ("/media-libraries/<id>", "/canvases/<id>", "/dashboards/<id>") and the Access API ("/access/<type>/<id>/roles | users | user-permissions/me[/check]"). For any other endpoint, register a stub (client.stub("request", fn)) or intercept the HTTP call with a tool like MSW.`
+      `request(): no handler for path "${path}". With access control configured, the fake serves "/users/me", the handle's ACL ("<data base>/acl"), "/projects/<projectId>" (members), "/projects/<projectId>/users/<ids>", the History API (client.getDataUrl("history", \u2026)), resource lookup ("/media-libraries/<id>", "/canvases/<id>", "/dashboards/<id>") and the Access API ("/access/<type>/<id>/roles[/<name>] | users[/<id>] | user-permissions/me[/check]") and the caller's attributes ("/organizations/<id>/users/me/attributes"). For any other endpoint, register a stub (client.stub("request", fn)) or intercept the HTTP call with a tool like MSW.`
     );
   };
 }
@@ -1665,7 +1776,17 @@ function makeHandle(handleArgs) {
     if (access === void 0)
       throw fakeError("this handle has no acting identity (no token or accessControl bound).");
     return access;
-  }, capabilities = capabilitiesOf(target.type), targetLabel = capabilities.label(target.id), { store, history } = ensureEntry(registry, target), concurrentEditKey = (id) => registryKey(target) + " " + id, actorId = () => {
+  }, members = () => [
+    ...backend.identities.values(),
+    ...token === void 0 && accessControl !== void 0 ? [
+      {
+        user: accessControl.currentUser,
+        ...accessControl.globalUser !== void 0 ? { globalUser: accessControl.globalUser } : {},
+        grants: accessControl.grants,
+        ...accessControl.access !== void 0 ? { access: accessControl.access } : {}
+      }
+    ] : []
+  ], capabilities = capabilitiesOf(target.type), targetLabel = capabilities.label(target.id), { store, history } = ensureEntry(registry, target), concurrentEditKey = (id) => registryKey(target) + " " + id, actorId = () => {
     const access = activeAccess();
     if (access !== void 0)
       return capabilities.identity === "global" ? (access.globalUser ?? access.currentUser).id : access.currentUser.id;
@@ -2021,7 +2142,7 @@ function makeHandle(handleArgs) {
         // client to the global API host.
         useProjectHostname: useProjectHostname && resource === void 0,
         organizationId: backend.organizationId,
-        listIdentities: () => [...backend.identities.values()],
+        listIdentities: members,
         platform: {
           projectId,
           organizationId: backend.organizationId,
@@ -2031,9 +2152,13 @@ function makeHandle(handleArgs) {
             history,
             canRead
           } : void 0,
+          actorUser: () => {
+            const access = requireActiveAccess();
+            return access.globalUser ?? access.currentUser;
+          },
           actorAccess: () => requireActiveAccess().access,
-          identities: () => [...backend.identities.values()],
-          exists: (asked) => registry.has(registryKey(asked))
+          identities: members,
+          resources: () => [...registry.values()].map((entry) => entry.resource)
         }
       })
     } : {},