permdock 0.1.0 → 0.3.0

package/dist/testing/index.js

@@ -1,21 +1,24 @@
-import { g as listPermissions, n as definePermissions, y as resource } from "../permissions-DC7GROPA.js";
-import { r as principal } from "../refs-ChLSxbST.js";
-import { a as definePolicy, d as role, m as memoryLimitStore, t as allow } from "../policy-ANp36PnI.js";
-import { m as memoryRoleSource, u as snapshotFor } from "../src-CTNT-PBW.js";
-import { i as normalizeMemberships, u as scopeList } from "../scopes-cKVp_WTw.js";
-import { o as parseCredential, s as memoryRevocationFeed } from "../credential-B_rkUNlY.js";
-import { n as parseSnapshot } from "../snapshot-DE8dE_hz.js";
-import { i as parsePolicyDocument, r as mergeHostedGrants } from "../hosted-BwKQ1BTA.js";
-import { _ as approvalPoliciesFor, d as membershipsClaim, p as validateCustomRole, t as createPermDock } from "../permdock-yoZ7EjxX.js";
+import { _ as listPermissions, b as resource, n as definePermissions } from "../permissions-DVoF6dMt.js";
+import { r as principal } from "../refs-KYb4ntaz.js";
+import { _ as memoryLimitStore, a as definePolicy, m as role, t as allow } from "../policy-xyWg7QdR.js";
+import { _ as memoryRoleSource, u as snapshotFor } from "../src-BDwEZWrZ.js";
+import { t as memoryRevocationFeed } from "../revocations-Bhr0aMIC.js";
+import { a as normalizeMemberships, d as scopeList } from "../scopes-CVdPrWN-.js";
+import { n as parseSnapshot, p as evaluateCondition } from "../snapshot-Enxd0n-s.js";
+import { i as parsePolicyDocument, r as mergeHostedGrants } from "../hosted-DJQw46hn.js";
+import { E as approvalPoliciesFor, b as validateCustomRole, t as createPermDock, v as membershipsClaim } from "../permdock-CbgvLnuo.js";
 import { t as byCodePoint } from "../compare-pfyVnBjE.js";
-import { n as fromSnapshot } from "../from-snapshot-BMGnhmgv.js";
-import { h as APPROVAL_HEADER, o as resolveApproval, p as memoryApprovalStore } from "../helpers-DnSOrhB9.js";
-import { a as parseApiKey } from "../credentials-BgRX3WEg.js";
-import { S as sha256Hex, n as directoryMembershipSource, r as scimHandler } from "../scim-9NFa0XVZ.js";
+import { n as fromSnapshot } from "../from-snapshot-CTLijvdm.js";
+import { o as parseCredential } from "../credential-8P81ff4u.js";
+import { o as problemFromDecision } from "../problem-B43ztKIm.js";
+import { l as APPROVAL_HEADER, r as memoryApprovalStore } from "../store-DMAWwAJV.js";
+import { o as resolveApproval } from "../helpers-H_KARDVC.js";
+import { a as parseApiKey } from "../server-DlZ28Oz5.js";
+import { S as sha256Hex, n as directoryMembershipSource, r as scimHandler } from "../scim-BFGBBAqR.js";
 import { t as supabaseMembershipsBudget } from "../budget-NbEtbJC_.js";
-import { r as quoteSqlIdent, t as SQL_IDENT } from "../sql-Bll1d7y0.js";
-import { i as saasPermissions } from "../permissions-CofRqesP.js";
-import { C as saasOrg, E as saasSeed, S as saasMemberships, a as saasProject, g as verifySaasSession, h as signSaasToken, k as saasPolicy, t as saasDoc, w as saasPrincipal, x as saasCustomRoles } from "../saas-BRrZzJkM.js";
+import { a as quoteSqlTable, r as quoteSqlIdent, t as SQL_IDENT } from "../sql-xdg5f4Fi.js";
+import { i as saasPermissions } from "../permissions-RJrovw98.js";
+import { C as saasOrg, E as saasSeed, S as saasMemberships, a as saasProject, g as verifySaasSession, h as signSaasToken, k as saasPolicy, t as saasDoc, w as saasPrincipal, x as saasCustomRoles } from "../saas-DhpJjnBA.js";
 import { afterAll, beforeAll, describe, expect, expectTypeOf, it, vi } from "vitest";
 //#region src/testing/describe-policy.ts
 function isOutcomeCell(value) {
@@ -139,7 +142,7 @@ function subjectSettings(dialect, subject, gucPrefix, tenantClaim, roleClaim, cu
 * a base table whose restricted columns are revoked does not reject it.
 */
 function statementSql(action, table, keyOnly) {
-	const quoted = quoteSqlIdent(table);
+	const quoted = quoteSqlTable(table);
 	const id = quoteSqlIdent("id");
 	const back = keyOnly ? id : "*";
 	switch (action) {
@@ -163,11 +166,11 @@ function isRead(action) {
 async function viewColumns(query, table, key) {
 	const id = quoteSqlIdent("id");
 	await query("savepoint permdock_fields");
-	const view = await query(`select * from ${quoteSqlIdent(`${table}_visible`)} where ${id} = $1`, [key]);
+	const view = await query(`select * from ${quoteSqlTable(`${table}_visible`)} where ${id} = $1`, [key]);
 	if (view.code === void 0) return valued(view.rows[0]);
 	await query("rollback to savepoint permdock_fields");
 	if (view.code !== "42P01") return view.code;
-	const base = await query(`select * from ${quoteSqlIdent(table)} where ${id} = $1`, [key]);
+	const base = await query(`select * from ${quoteSqlTable(table)} where ${id} = $1`, [key]);
 	return base.code ?? valued(base.rows[0]);
 }
 function dbOutcome(result) {
@@ -616,6 +619,63 @@ function testClientStore(name, createStore) {
 			await settle();
 			expect(net.calls).toHaveLength(2);
 		});
+		it("answers a row edited in place once the task that read it ends", async () => {
+			const net = recorder(unreachable);
+			const store = createStore({
+				snapshot: snapshotOf("bob", "acme"),
+				tenant: "acme",
+				fetch: net.fetch
+			});
+			const row = {
+				...acmeProject,
+				ownerId: "bob"
+			};
+			expect(store.get().status(p.project.update, row)).toBe("ready");
+			expect(store.get().can(p.project.update, row)).toBe(true);
+			row.ownerId = "alice";
+			await settle();
+			expect(store.get().can(p.project.update, row)).toBe(false);
+		});
+		it("answers a check on a row that throws as denied, without throwing", () => {
+			const net = recorder(unreachable);
+			const store = createStore({
+				snapshot: snapshotOf("bob", "acme"),
+				tenant: "acme",
+				fetch: net.fetch
+			});
+			const hostile = new Proxy({}, { get() {
+				throw new Error("hostile row");
+			} });
+			expect(store.get().status(p.project.update, hostile)).not.toBe("pending");
+			expect(store.get().can(p.project.update, hostile)).toBe(false);
+		});
+		it("notifies every subscriber of a logout when one of them throws", () => {
+			const reported = vi.fn();
+			vi.stubGlobal("reportError", reported);
+			try {
+				const net = recorder(unreachable);
+				const store = createStore({
+					snapshot: snapshotOf("bob", "acme"),
+					tenant: "acme",
+					fetch: net.fetch
+				});
+				let after = 0;
+				const offThrowing = store.get().subscribe(() => {
+					throw new Error("subscriber failed");
+				});
+				const offCounting = store.get().subscribe(() => {
+					after += 1;
+				});
+				store.get().clear();
+				expect(after).toBe(1);
+				expect(reported).toHaveBeenCalled();
+				expect(store.get().can(p.project.read, acmeProject)).toBe(false);
+				offThrowing();
+				offCounting();
+			} finally {
+				vi.unstubAllGlobals();
+			}
+		});
 		it("does not notify subscribers synchronously from a status read", () => {
 			const net = recorder(() => json({ evaluations: [] }));
 			const store = createStore({
@@ -684,7 +744,7 @@ async function* ticks(org, signal) {
 function demotionKey(user, org) {
 	return JSON.stringify([user, org]);
 }
-function createDomain() {
+function createDomain$1() {
 	const demoted = /* @__PURE__ */ new Set();
 	const principalOf = (sub, path) => {
 		const principal = saasPrincipal(sub, orgOf(path));
@@ -927,7 +987,7 @@ function testHttpAdapter(options) {
 		it.skipIf(reason !== void 0)(reason === void 0 ? title : `${title} (${reason})`, run, timeout);
 	};
 	describe(`${options.name}: real-life HTTP scenarios`, () => {
-		const domain = createDomain();
+		const domain = createDomain$1();
 		const tokens = /* @__PURE__ */ new Map();
 		let mounted;
 		beforeAll(async () => {
@@ -1096,14 +1156,24 @@ function testHttpAdapter(options) {
 				}
 			})).status).toBe(403);
 		});
-		scenario("assert", "maps assert inside a handler to a 403 Problem", async () => {
+		scenario("assert", "maps assert inside a handler to the Problem protect sends", async () => {
 			const denied = await send("bob", {
 				op: "project.delete",
 				org: "acme",
 				id: "p2"
 			});
 			expect(denied.status).toBe(403);
-			expect(field(denied.body, "type")).toBe("https://permdock.dev/problems/denied");
+			expect(field(denied.body, "type")).toBe("https://permdock.com/problems/denied");
+			const bob = await createPermDock(saasPolicy, saasPrincipal("bob", "acme"), { tenant: "acme" });
+			const permission = saasPolicy.permissions.project.delete;
+			const fromProtect = await readResult(problemFromDecision(bob.decide(permission, project$1("p2")), permission, bob.subject));
+			expect(denied.status).toBe(fromProtect.status);
+			for (const key of [
+				"type",
+				"title",
+				"permission",
+				"denials"
+			]) expect(field(denied.body, key)).toEqual(field(fromProtect.body, key));
 			expect((await send("bob", {
 				op: "project.delete",
 				org: "acme",
@@ -1121,7 +1191,7 @@ function testHttpAdapter(options) {
 				org: "acme"
 			});
 			expect(asked.status).toBe(403);
-			expect(field(asked.body, "type")).toBe("https://permdock.dev/problems/approval-required");
+			expect(field(asked.body, "type")).toBe("https://permdock.com/problems/approval-required");
 			const token = field(asked.body, "token");
 			expect(typeof token).toBe("string");
 			await resolveApproval(domain.store, String(token), {
@@ -1230,7 +1300,7 @@ function testHttpAdapter(options) {
 				});
 				const end = await untilEnd(stream);
 				expect(end.problem).toMatchObject({
-					type: "https://permdock.dev/problems/unauthenticated",
+					type: "https://permdock.com/problems/unauthenticated",
 					status: 401,
 					detail: "session-revoked"
 				});
@@ -1252,7 +1322,7 @@ function testHttpAdapter(options) {
 				});
 				const end = await untilEnd(stream);
 				expect(end.problem).toMatchObject({
-					type: "https://permdock.dev/problems/denied",
+					type: "https://permdock.com/problems/denied",
 					status: 403
 				});
 				expect(end.ended).toBe(true);
@@ -1290,7 +1360,7 @@ function testHttpAdapter(options) {
 				expect((await stream.next())?.event).toBe("message");
 				const end = await untilEnd(stream);
 				expect(end.problem).toMatchObject({
-					type: "https://permdock.dev/problems/unauthenticated",
+					type: "https://permdock.com/problems/unauthenticated",
 					detail: "expired"
 				});
 				expect(end.ended).toBe(true);
@@ -1301,6 +1371,148 @@ function testHttpAdapter(options) {
 	});
 }
 //#endregion
+//#region src/testing/agent-adapter.ts
+/** The user whose subject resolver throws. */
+const AGENT_THROWING_USER = "throws";
+/** The project id whose loader throws. */
+const AGENT_THROWING_ROW = "throws";
+const SCENARIOS = [
+	{
+		name: "granted",
+		title: "grants a member reading a project in their org",
+		call: {
+			user: "alice",
+			org: "acme",
+			tool: "project_read",
+			args: { id: "p1" }
+		},
+		expected: "granted"
+	},
+	{
+		name: "denied",
+		title: "denies a user with no membership",
+		call: {
+			user: "mallory",
+			org: "acme",
+			tool: "project_read",
+			args: { id: "p1" }
+		},
+		expected: "denied"
+	},
+	{
+		name: "cross-tenant",
+		title: "denies a row from another org",
+		call: {
+			user: "alice",
+			org: "acme",
+			tool: "project_read",
+			args: { id: "g1" }
+		},
+		expected: "denied"
+	},
+	{
+		name: "anonymous",
+		title: "denies a call with no user",
+		call: {
+			user: null,
+			org: "acme",
+			tool: "project_read",
+			args: { id: "p1" }
+		},
+		expected: "denied"
+	},
+	{
+		name: "subject-throws",
+		title: "denies when the subject resolver throws",
+		call: {
+			user: AGENT_THROWING_USER,
+			org: "acme",
+			tool: "project_read",
+			args: { id: "p1" }
+		},
+		expected: "denied"
+	},
+	{
+		name: "loader-throws",
+		title: "denies when the row loader throws",
+		call: {
+			user: "alice",
+			org: "acme",
+			tool: "project_read",
+			args: { id: AGENT_THROWING_ROW }
+		},
+		expected: "denied"
+	},
+	{
+		name: "missing-row",
+		title: "denies when the row does not exist",
+		call: {
+			user: "alice",
+			org: "acme",
+			tool: "project_read",
+			args: { id: "missing" }
+		},
+		expected: "denied"
+	},
+	{
+		name: "approval-required",
+		title: "asks for approval before revoking every API key",
+		call: {
+			user: "alice",
+			org: "acme",
+			tool: "api_keys_revoke_all",
+			args: {}
+		},
+		expected: "approval-required"
+	}
+];
+function loadProject(args) {
+	const id = typeof args === "object" && args !== null ? args.id : void 0;
+	if (id === "throws") throw new Error("project store unavailable");
+	return saasSeed.projects.find((row) => row.id === id) ?? null;
+}
+function createDomain() {
+	return {
+		policy: saasPolicy,
+		subject: (user, org) => {
+			if (user === "throws") throw new Error("session store unavailable");
+			return user === null ? null : saasPrincipal(user, org);
+		},
+		tools: {
+			project_read: {
+				permission: saasPermissions.project.read,
+				data: loadProject
+			},
+			api_keys_revoke_all: { permission: saasPermissions.apiKey.revokeAll }
+		},
+		customRoles: memoryRoleSource(saasCustomRoles),
+		store: memoryApprovalStore()
+	};
+}
+/**
+* Runs the same tool calls through an agent adapter: a grant, the denials an
+* attacker or an outage produces, and an approval. Every failure denies.
+*/
+function testAgentAdapter(options) {
+	describe(`${options.name}: agent adapter scenarios`, () => {
+		const domain = createDomain();
+		let mounted;
+		beforeAll(async () => {
+			mounted = await options.mount(domain);
+		});
+		afterAll(async () => {
+			await mounted.close?.();
+		});
+		const outcomeOf = (call) => mounted.call(call);
+		for (const scenario of SCENARIOS) {
+			const reason = options.skip?.[scenario.name];
+			it.skipIf(reason !== void 0)(reason === void 0 ? scenario.title : `${scenario.title} (${reason})`, async () => {
+				expect(await outcomeOf(scenario.call)).toBe(scenario.expected);
+			});
+		}
+	});
+}
+//#endregion
 //#region src/testing/authzen.ts
 function sortKey(value) {
 	return JSON.stringify(Object.fromEntries(Object.entries(value).toSorted(([a], [b]) => byCodePoint(a, b))));
@@ -1592,11 +1804,12 @@ function testSubjectResolver(resolver, options) {
 	});
 }
 function testMembershipSource(source, options) {
+	const query = options.tenant === void 0 ? {} : { tenant: options.tenant };
 	it("returns well-formed memberships and fails closed on throw", async () => {
 		for (const principal of options.principals) {
 			let memberships = [];
 			try {
-				memberships = await source.membershipsFor(principal, {});
+				memberships = await source.membershipsFor(principal, query);
 			} catch {
 				memberships = [];
 			}
@@ -1618,7 +1831,7 @@ function testMembershipSource(source, options) {
 		for (const principal of options.principals) {
 			let memberships = [];
 			try {
-				memberships = await source.membershipsFor(principal, {});
+				memberships = await source.membershipsFor(principal, query);
 			} catch {
 				continue;
 			}
@@ -1726,6 +1939,22 @@ function testRelationSource(source, options) {
 			expect(linked.ancestors.map((ancestor) => ancestor.id)).toEqual([id]);
 		}
 	});
+	it("reads each object's row as an object, or null when there is none", async () => {
+		if (source.row === void 0) return;
+		const read = (query) => source.row?.(query);
+		for (const object of options.objects) {
+			const row = await read({
+				resource: object.resource,
+				id: object.id
+			});
+			expect(row === null || row === void 0 || typeof row === "object" && !Array.isArray(row)).toBe(true);
+		}
+		const missing = await read({
+			resource: options.objects[0]?.resource ?? "",
+			id: "permdock-missing-object"
+		});
+		expect(missing ?? null).toBeNull();
+	});
 	it("answers an unknown object with nothing instead of throwing", async () => {
 		const first = options.objects[0];
 		if (first === void 0) return;
@@ -1767,6 +1996,11 @@ function testRoleSource(source, options) {
 			for (const name of assignable) expect(declared).toContain(name);
 		}
 	});
+	const every = options.every;
+	if (every !== void 0) it("returns every custom role of the tenant, held or not", async () => {
+		const roles = await source.rolesFor(options.tenant, { held: [] });
+		expect([...new Set(roles.map((role) => role.name))].toSorted()).toEqual([...new Set(every)].toSorted());
+	});
 }
 function testLimitStore(store) {
 	it("counts down synchronously and fails closed when exhausted", async () => {
@@ -2320,6 +2554,44 @@ function testApprovalStore(store, options = {}) {
 		expect(second.resolvedBy).toBe("u_10");
 		expect(await store.consume("quorum-token")).not.toBeNull();
 	});
+	it("resolves a vouched verdict at once, records its rule, and still refuses the requester", async () => {
+		await store.create({
+			...sampleApproval("vouched-token"),
+			approvers: {
+				by: admin,
+				quorum: 2
+			}
+		});
+		await expect(Promise.resolve().then(() => store.resolve("vouched-token", {
+			status: "approved",
+			by: {
+				principal: {
+					id: "u_1",
+					roles: []
+				},
+				context: {}
+			},
+			vouched: "app-rule"
+		}))).rejects.toThrow(/principal/u);
+		const resolved = await store.resolve("vouched-token", {
+			status: "approved",
+			by: {
+				principal: {
+					id: "u_outsider",
+					roles: []
+				},
+				context: {}
+			},
+			vouched: "app-rule"
+		});
+		expect(resolved.status).toBe("approved");
+		expect(resolved.vouched).toBe("app-rule");
+		expect(resolved.approvals).toEqual([{
+			by: "u_outsider",
+			at: expect.any(String),
+			vouched: "app-rule"
+		}]);
+	});
 	it("lets one rejection end a quorum request", async () => {
 		await store.create({
 			...sampleApproval("veto-token"),
@@ -2629,7 +2901,176 @@ function testTokenSigner(signer, options) {
 		}
 	});
 }
+const WHERE_ROWS = [
+	{
+		id: "r1",
+		authorId: "u1",
+		score: 5,
+		title: "Plan 100%",
+		archived: false,
+		note: null
+	},
+	{
+		id: "r2",
+		authorId: "u2",
+		score: 10,
+		title: "plan_b",
+		archived: true,
+		note: "kept"
+	},
+	{
+		id: "r3",
+		authorId: null,
+		score: null,
+		title: null,
+		archived: null,
+		note: null
+	}
+];
+const WHERE_CASES = [
+	["eq", {
+		op: "eq",
+		field: "authorId",
+		value: "u1"
+	}],
+	["ne", {
+		op: "ne",
+		field: "authorId",
+		value: "u1"
+	}],
+	["eq on a boolean", {
+		op: "eq",
+		field: "archived",
+		value: false
+	}],
+	["gt", {
+		op: "gt",
+		field: "score",
+		value: 5
+	}],
+	["gte", {
+		op: "gte",
+		field: "score",
+		value: 5
+	}],
+	["lt", {
+		op: "lt",
+		field: "score",
+		value: 10
+	}],
+	["lte", {
+		op: "lte",
+		field: "score",
+		value: 10
+	}],
+	["contains a literal %", {
+		op: "contains",
+		field: "title",
+		value: "100%"
+	}],
+	["contains a literal _", {
+		op: "contains",
+		field: "title",
+		value: "n_b"
+	}],
+	["in", {
+		op: "in",
+		field: "authorId",
+		value: ["u1", "u2"]
+	}],
+	["notIn", {
+		op: "notIn",
+		field: "authorId",
+		value: ["u1"]
+	}],
+	["isNull", {
+		op: "isNull",
+		field: "note",
+		value: true
+	}],
+	["is not null", {
+		op: "isNull",
+		field: "note",
+		value: false
+	}],
+	["and", {
+		op: "and",
+		conditions: [{
+			op: "eq",
+			field: "authorId",
+			value: "u1"
+		}, {
+			op: "lt",
+			field: "score",
+			value: 10
+		}]
+	}],
+	["or", {
+		op: "or",
+		conditions: [{
+			op: "eq",
+			field: "authorId",
+			value: "u1"
+		}, {
+			op: "eq",
+			field: "archived",
+			value: true
+		}]
+	}],
+	["not over a NULL field", {
+		op: "not",
+		condition: {
+			op: "eq",
+			field: "authorId",
+			value: "u1"
+		}
+	}],
+	["not over and", {
+		op: "not",
+		condition: {
+			op: "and",
+			conditions: [{
+				op: "eq",
+				field: "authorId",
+				value: "u2"
+			}, {
+				op: "gt",
+				field: "score",
+				value: 5
+			}]
+		}
+	}],
+	["and of nothing", {
+		op: "and",
+		conditions: []
+	}],
+	["not of the empty allow set", {
+		op: "not",
+		condition: {
+			op: "or",
+			conditions: []
+		}
+	}]
+];
+const WHERE_SUBJECT = {
+	principal: null,
+	context: {}
+};
+/**
+* `matches` answers whether the compiled output selects `row`, for example
+* by running it against a table holding only that row. With it, every case
+* must select the rows the in-memory evaluator keeps, including rows whose
+* fields are NULL.
+*/
 function testWhereCompiler(compiler, options) {
+	const { matches } = options;
+	it.skipIf(matches === void 0).each(WHERE_CASES)("selects the rows the evaluator keeps: %s", async (_name, condition) => {
+		if (matches === void 0) return;
+		const compiled = compiler(condition, options.target);
+		const selected = [];
+		for (const row of WHERE_ROWS) if (await matches(compiled, row)) selected.push(row["id"]);
+		expect(selected).toEqual(WHERE_ROWS.filter((row) => evaluateCondition(condition, row, WHERE_SUBJECT)).map((row) => row["id"]));
+	});
 	it("fails closed on an empty allow set", () => {
 		const compiled = compiler({
 			op: "or",
@@ -2815,7 +3256,7 @@ const supabaseClaimFixtures = {
 			}]
 		}
 	},
-	betterSupabase: {
+	tenantPlans: {
 		claims: {
 			...base,
 			user_role: null,
@@ -2923,11 +3364,7 @@ const supabaseClaimFixtures = {
 				id: "5f0e4d3c-2b1a-4098-8776-655443322110",
 				kind: "oauth-client"
 			},
-			delegation: { scopes: [
-				"openid",
-				"email",
-				"posts:read"
-			] }
+			delegation: { scopes: ["posts:read"] }
 		}
 	},
 	actChain: {
@@ -3061,14 +3498,25 @@ const supabaseClaimFixtures = {
 		}
 	}
 };
+const supabaseClaimVectors = {
+	feature: "auth.session.get_claims",
+	cases: Object.entries(supabaseClaimFixtures).map(([name, fixture]) => ({
+		name,
+		input: {
+			claims: fixture.claims,
+			...fixture.options === void 0 ? {} : { options: fixture.options }
+		},
+		expected: fixture.expect
+	}))
+};
 /**
 * The `permdock supabase inspect --json` manifest for a policy with one
 * `tenant` scope, the default `supabase.hook` and a `features` claim from
-* `better_supabase.feature_claims`. A package that reads the manifest tests its
+* `public.feature_claims`. A package that reads the manifest tests its
 * parser against this value.
 */
 const supabaseHookManifestFixture = {
-	$schema: "https://permdock.dev/schemas/supabase-manifest-v1.json",
+	$schema: "https://permdock.com/schemas/supabase-manifest-v1.json",
 	version: 1,
 	hook: {
 		schema: "permdock",
@@ -3122,7 +3570,7 @@ const supabaseHookManifestFixture = {
 		},
 		{
 			name: "features",
-			source: "better_supabase.feature_claims",
+			source: "public.feature_claims",
 			budget: false
 		}
 	],
@@ -3177,6 +3625,12 @@ const supabaseHookManifestFixture = {
 				args: "p_user uuid",
 				returns: "setof uuid",
 				execute: ["supabase_auth_admin"]
+			},
+			{
+				name: "permdock_user_id",
+				args: "",
+				returns: "uuid",
+				execute: ["authenticated"]
 			}
 		],
 		memberships: [{
@@ -3191,7 +3645,13 @@ const supabaseHookManifestFixture = {
 				"scope_id",
 				"role"
 			]
-		}]
+		}],
+		customRoles: false,
+		roles: {
+			table: "permdock.user_roles",
+			user: { column: "user_id" },
+			role: { column: "role" }
+		}
 	},
 	decidingColumns: [
 		"public.memberships.role",
@@ -3202,7 +3662,11 @@ const supabaseHookManifestFixture = {
 	markers: {
 		hook: "v1",
 		grants: "v1"
+	},
+	requires: {
+		matrix: "capability-matrix-v1.12.0",
+		capabilities: ["auth.session.get_claims"]
 	}
 };
 //#endregion
-export { authzenTodoData, authzenTodoPermissions, authzenTodoPolicy, authzenTodoUsers, authzenTodoVectors, describePolicy, expectTypeOf, jwtFixtureAudience, jwtFixtureIssuer, jwtFixtureJwks, jwtFixtureTokens, ormParity, rlsParity, snapshotFixture, supabaseClaimFixtures, supabaseHookManifestFixture, supabaseMembershipsBudget, testApprovalPolicySource, testApprovalStore, testAuthZen, testClientParity, testClientStore, testCredentialVerifier, testDecisionSink, testDirectoryStore, testEntitlementSource, testHttpAdapter, testLimitStore, testMembershipSource, testPolicySource, testRelationSource, testReplayStore, testRevocationFeed, testRoleSource, testSettingsSource, testSnapshotSource, testSubjectResolver, testTokenSigner, testTokenVerifier, testWhereCompiler };
+export { AGENT_THROWING_ROW, AGENT_THROWING_USER, authzenTodoData, authzenTodoPermissions, authzenTodoPolicy, authzenTodoUsers, authzenTodoVectors, describePolicy, expectTypeOf, jwtFixtureAudience, jwtFixtureIssuer, jwtFixtureJwks, jwtFixtureTokens, ormParity, rlsParity, snapshotFixture, supabaseClaimFixtures, supabaseClaimVectors, supabaseHookManifestFixture, supabaseMembershipsBudget, testAgentAdapter, testApprovalPolicySource, testApprovalStore, testAuthZen, testClientParity, testClientStore, testCredentialVerifier, testDecisionSink, testDirectoryStore, testEntitlementSource, testHttpAdapter, testLimitStore, testMembershipSource, testPolicySource, testRelationSource, testReplayStore, testRevocationFeed, testRoleSource, testSettingsSource, testSnapshotSource, testSubjectResolver, testTokenSigner, testTokenVerifier, testWhereCompiler };