@substrat-run/contract-tests 0.178.0 → 0.179.0

package/dist/scope-host-suite.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"scope-host-suite.d.ts","sourceRoot":"","sources":["../src/scope-host-suite.ts"],"names":[],"mappings":"AAEA,OAAO,EAuBL,KAAK,SAAS,EAyBf,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAsBL,KAAK,SAAS,EAEf,MAAM,sBAAsB,CAAC;AAe9B,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,SAAS,CAAC;IAChB;;;;;OAKG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CAC1B;AAED,oGAAoG;AACpG,wBAAgB,+BAA+B,CAC7C,WAAW,EAAE,MAAM,EACnB,WAAW,EAAE,MAAM,OAAO,CAAC,gBAAgB,GAAG;IAC5C,iBAAiB,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;CAChF,CAAC,GACD,IAAI,CA+GN;AAuCD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,eAAO,MAAM,aAAa,MACrB,OAAO,CAAC,OAAO,CAAC,QACb,SAAS,YACL,MAAM,KACf,OAAO,CAAC,IAAI,CAOd,CAAC;AAEF,iFAAiF;AACjF,MAAM,WAAW,qBAAqB;IACpC;;;;;;OAMG;IACH,2BAA2B,CAAC,EAAE,OAAO,CAAC;CACvC;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CACpC,WAAW,EAAE,MAAM,EACnB,WAAW,EAAE,MAAM,OAAO,CAAC,gBAAgB,CAAC,EAC5C,IAAI,GAAE,qBAA0B,GAC/B,IAAI,CAq5YN"}
+{"version":3,"file":"scope-host-suite.d.ts","sourceRoot":"","sources":["../src/scope-host-suite.ts"],"names":[],"mappings":"AAEA,OAAO,EAuBL,KAAK,SAAS,EAyBf,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAsBL,KAAK,SAAS,EAEf,MAAM,sBAAsB,CAAC;AAe9B,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,SAAS,CAAC;IAChB;;;;;OAKG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CAC1B;AAED,oGAAoG;AACpG,wBAAgB,+BAA+B,CAC7C,WAAW,EAAE,MAAM,EACnB,WAAW,EAAE,MAAM,OAAO,CAAC,gBAAgB,GAAG;IAC5C,iBAAiB,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;CAChF,CAAC,GACD,IAAI,CA+GN;AAuCD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,eAAO,MAAM,aAAa,MACrB,OAAO,CAAC,OAAO,CAAC,QACb,SAAS,YACL,MAAM,KACf,OAAO,CAAC,IAAI,CAOd,CAAC;AAEF,iFAAiF;AACjF,MAAM,WAAW,qBAAqB;IACpC;;;;;;OAMG;IACH,2BAA2B,CAAC,EAAE,OAAO,CAAC;CACvC;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CACpC,WAAW,EAAE,MAAM,EACnB,WAAW,EAAE,MAAM,OAAO,CAAC,gBAAgB,CAAC,EAC5C,IAAI,GAAE,qBAA0B,GAC/B,IAAI,CAo7YN"}

package/dist/scope-host-suite.js

@@ -1556,6 +1556,36 @@ export function scopeHostContractSuite(adapterName, makeFixture, opts = {}) {
             const provisioned = (await host.admin.auditLog(staff, { tenantId: t })).find((r) => r.action === 'provisionScope' && r.scopeId === sc);
             expect(provisioned?.onBehalfOf).toEqual({ principal: person, tenantId: t });
         });
+        it('an attributed host names the person on its access rows too, co-located and delegated (#2860)', async () => {
+            const t = tenantId.parse(ulid());
+            await host.admin.createTenant(staff, { id: t, slug: 'access-attribution', name: 'Access attribution' });
+            await host.admin.registerIdentityPool(staff, { provider: 'oidc:access-attribution', topology: 'central', tenantId: null });
+            const person = principalId.parse(ulid());
+            const impersonator = platformActorId.parse(ulid());
+            // Impersonated, so the K-42 stamp is held to the round trip too, as the admin log's twin is.
+            const onBehalfOf = { principal: person, tenantId: t, impersonation: { session: 'imp-2860', by: impersonator } };
+            const sc = scopeId.parse(ulid());
+            const delegated = { method: 'readScopeTable', tenantId: t, scopeId: sc, params: null, resultCount: 0 };
+            const viewed = host.attributed(onBehalfOf).admin;
+            await viewed.getTenant(staff, t);
+            await viewed.recordDelegatedRead(staff, delegated);
+            // The one access row the control plane writes on the host's behalf rather than through
+            // its own `recordAccess` (the hosted directory's identity read).
+            await viewed.listIdentityMemberships(staff, 'oidc:access-attribution', `ext-${t}`);
+            await host.admin.getTenant(staff, t);
+            await host.admin.recordDelegatedRead(staff, delegated);
+            const rows = (await host.admin.accessLog(staff, { tenantId: t }))
+                .filter((r) => r.method === 'getTenant' || r.method === 'readScopeTable');
+            expect(rows.map((r) => [r.method, r.onBehalfOf ?? null])).toEqual([
+                ['getTenant', onBehalfOf],
+                ['readScopeTable', onBehalfOf],
+                ['getTenant', null],
+                ['readScopeTable', null],
+            ]);
+            const memberships = (await host.admin.accessLog(staff, { method: 'listIdentityMemberships' }))
+                .filter((r) => r.method === 'listIdentityMemberships' && r.onBehalfOf?.principal === person);
+            expect(memberships.map((r) => r.onBehalfOf)).toEqual([onBehalfOf]);
+        });
         it('isolates scope storage: a write in one scope is invisible in another', async () => {
             const stub1 = await host.getScope(alice, t1, s1);
             const stub2 = await host.getScope(alice, t2, s2);