@substrat-run/contract-tests 0.168.0 → 0.169.0

package/dist/scope-host-suite.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"scope-host-suite.d.ts","sourceRoot":"","sources":["../src/scope-host-suite.ts"],"names":[],"mappings":"AAEA,OAAO,EAuBL,KAAK,SAAS,EAuBf,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAsBL,KAAK,SAAS,EACf,MAAM,sBAAsB,CAAC;AAe9B,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,SAAS,CAAC;IAChB;;;;;OAKG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CAC1B;AAED,oGAAoG;AACpG,wBAAgB,+BAA+B,CAC7C,WAAW,EAAE,MAAM,EACnB,WAAW,EAAE,MAAM,OAAO,CAAC,gBAAgB,GAAG;IAC5C,iBAAiB,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;CAChF,CAAC,GACD,IAAI,CA+GN;AAuCD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,eAAO,MAAM,aAAa,MACrB,OAAO,CAAC,OAAO,CAAC,QACb,SAAS,YACL,MAAM,KACf,OAAO,CAAC,IAAI,CAOd,CAAC;AAEF,iFAAiF;AACjF,MAAM,WAAW,qBAAqB;IACpC;;;;;;OAMG;IACH,2BAA2B,CAAC,EAAE,OAAO,CAAC;CACvC;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CACpC,WAAW,EAAE,MAAM,EACnB,WAAW,EAAE,MAAM,OAAO,CAAC,gBAAgB,CAAC,EAC5C,IAAI,GAAE,qBAA0B,GAC/B,IAAI,CA0wYN"}
+{"version":3,"file":"scope-host-suite.d.ts","sourceRoot":"","sources":["../src/scope-host-suite.ts"],"names":[],"mappings":"AAEA,OAAO,EAuBL,KAAK,SAAS,EAuBf,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAsBL,KAAK,SAAS,EACf,MAAM,sBAAsB,CAAC;AAe9B,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,SAAS,CAAC;IAChB;;;;;OAKG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CAC1B;AAED,oGAAoG;AACpG,wBAAgB,+BAA+B,CAC7C,WAAW,EAAE,MAAM,EACnB,WAAW,EAAE,MAAM,OAAO,CAAC,gBAAgB,GAAG;IAC5C,iBAAiB,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;CAChF,CAAC,GACD,IAAI,CA+GN;AAuCD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,eAAO,MAAM,aAAa,MACrB,OAAO,CAAC,OAAO,CAAC,QACb,SAAS,YACL,MAAM,KACf,OAAO,CAAC,IAAI,CAOd,CAAC;AAEF,iFAAiF;AACjF,MAAM,WAAW,qBAAqB;IACpC;;;;;;OAMG;IACH,2BAA2B,CAAC,EAAE,OAAO,CAAC;CACvC;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CACpC,WAAW,EAAE,MAAM,EACnB,WAAW,EAAE,MAAM,OAAO,CAAC,gBAAgB,CAAC,EAC5C,IAAI,GAAE,qBAA0B,GAC/B,IAAI,CAu0YN"}

package/dist/scope-host-suite.js

@@ -5046,6 +5046,24 @@ export function scopeHostContractSuite(adapterName, makeFixture, opts = {}) {
                 // An unknown account is simply not connected — the ordinary miss.
                 expect(await host.admin.openConnection(t1, 'multigit', 'github', 'nobody')).toBeUndefined();
             });
+            it("keys a scope's own connection apart from the tenant's and another scope's, on one account (#2732)", async () => {
+                const [a, b] = [scopeId.parse(ulid()), scopeId.parse(ulid())];
+                const connect = (token, ownerScopeId) => host.admin.createConnection(staff, {
+                    id: connectionId.parse(ulid()), tenantId: t1, vertical: 'owned', provider: 'planima', label: token,
+                    secret: { token }, ...(ownerScopeId ? { ownerScopeId } : {}),
+                });
+                await connect('tenant');
+                await connect('a', a);
+                await connect('b', b);
+                // Each owner still holds one live connection per account.
+                await expect(connect('a-again', a)).rejects.toThrow(/already has a live/);
+                await expect(connect('tenant-again')).rejects.toThrow(/already has a live/);
+                // A tenant-level read opens the tenant's alone; naming the owner opens that scope's.
+                expect((await host.admin.openConnection(t1, 'owned', 'planima'))?.secret).toEqual({ token: 'tenant' });
+                expect((await host.admin.openConnection(t1, 'owned', 'planima', undefined, a))?.secret).toEqual({ token: 'a' });
+                expect((await host.admin.listConnections(staff, { tenantId: t1, vertical: 'owned', ownerScopeId: b })).map((c) => c.label)).toEqual(['b']);
+                expect((await host.admin.listConnections(staff, { tenantId: t1, vertical: 'owned', ownerScopeId: null })).map((c) => c.label)).toEqual(['tenant']);
+            });
         });
         // -- connection grants: the directory record behind the tuple (#592) --------
         //
@@ -5210,6 +5228,38 @@ export function scopeHostContractSuite(adapterName, makeFixture, opts = {}) {
                 expect(byConnection.get(rconn)?.sort()).toEqual([INHERITED, SCOPED].sort());
             });
         });
+        // -- one key taken back on one scope, from a connection that stays live (#2732) --
+        describe('revokeFromConnection (#2732)', () => {
+            it('takes one key back on one scope, out of the gather too, keeps the rest, and audits only a change', async () => {
+                const vt = tenantId.parse(ulid());
+                const vs = scopeId.parse(ulid());
+                const vconn = connectionId.parse(ulid());
+                const LAND = permissionKey.parse('protocol:record-signature');
+                const KEEP = permissionKey.parse('protocol:attach');
+                await host.admin.createTenant(staff, { id: vt, slug: `tenant-${vt.toLowerCase()}`, name: 'Revoke' });
+                await host.provisionScope(staff, { tenantId: vt, scopeId: vs, vertical: 'signing' });
+                await host.admin.activateScope(staff, vt, vs);
+                await host.admin.createConnection(staff, {
+                    id: vconn, tenantId: vt, vertical: 'signing', provider: 'signer', label: 'Signer', secret: { accessToken: 'tok-revoke' },
+                });
+                for (const permission of [LAND, KEEP]) {
+                    await host.admin.grantToConnection(staff, { connectionId: vconn, permission, node: { tenantId: vt, scopeId: vs }, grantedBy: staff });
+                }
+                const revoke = () => host.admin.revokeFromConnection(staff, { connectionId: vconn, permission: LAND, node: { tenantId: vt, scopeId: vs } });
+                const audited = async () => (await host.admin.auditLog(staff, { tenantId: vt })).filter((e) => e.action === 'revokeFromConnection').length;
+                await revoke();
+                expect((await host.connectionGrantsInScope(vt, vs)).map((g) => g.permission)).toEqual([KEEP]);
+                // The gather provision and reconcile seat from: a revoked key is never delivered again.
+                expect((await host.admin.listConnectionGrants(staff, vt)).map((g) => g.permission)).toEqual([KEEP]);
+                // The connection itself is untouched.
+                expect((await host.admin.openConnection(vt, 'signing', 'signer'))?.id).toBe(vconn);
+                expect(await audited()).toBe(1);
+                await revoke();
+                expect(await audited()).toBe(1);
+                // A scope the tenant does not hold is not found, as it is for `grantToConnection`.
+                await expectRefusal(host.admin.revokeFromConnection(staff, { connectionId: vconn, permission: LAND, node: { tenantId: vt, scopeId: scopeId.parse(ulid()) } }), 'not_found');
+            });
+        });
         // -- connector state: a connector's own durable bookkeeping (#101 gap 3) ---
         describe('connector state', () => {
             it('round-trips arbitrary JSON keyed by (connection, key)', async () => {