simple-module-sharing 0.0.41__tar.gz → 0.0.42__tar.gz

{simple_module_sharing-0.0.41 → simple_module_sharing-0.0.42}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: simple_module_sharing
-Version: 0.0.41
+Version: 0.0.42
 Summary: Generic resource shares (owner / shared-with-user) for simple_module resource-scoped access
 Project-URL: Homepage, https://github.com/antosubash/simple_module_python
 Project-URL: Repository, https://github.com/antosubash/simple_module_python
@@ -11,10 +11,10 @@ License-Expression: MIT
 License-File: LICENSE
 Keywords: access-control,permissions,sharing,simple-module
 Requires-Python: >=3.12
-Requires-Dist: simple-module-core==0.0.41
-Requires-Dist: simple-module-db==0.0.41
-Requires-Dist: simple-module-hosting==0.0.41
-Requires-Dist: simple-module-inertia==0.0.41
+Requires-Dist: simple-module-core==0.0.42
+Requires-Dist: simple-module-db==0.0.42
+Requires-Dist: simple-module-hosting==0.0.42
+Requires-Dist: simple-module-inertia==0.0.42
 Description-Content-Type: text/markdown
 
 # simple_module_sharing

{simple_module_sharing-0.0.41 → simple_module_sharing-0.0.42}/package.json

@@ -1,13 +1,13 @@
 {
   "name": "@simple-module-py/sharing",
-  "version": "0.0.41",
+  "version": "0.0.42",
   "private": true,
   "description": "Frontend assets for the Sharing module",
   "peerDependencies": {
+    "@inertiajs/react": "^3.9.1",
+    "@simple-module-py/ui": "*",
     "react": "^19.0.0",
-    "react-dom": "^19.0.0",
-    "@inertiajs/react": "^3.7.0",
-    "@simple-module-py/ui": "*"
+    "react-dom": "^19.3.1"
   },
   "devDependencies": {
     "@simple-module-py/tsconfig": "*"

{simple_module_sharing-0.0.41 → simple_module_sharing-0.0.42}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "simple_module_sharing"
-version = "0.0.41"
+version = "0.0.42"
 description = "Generic resource shares (owner / shared-with-user) for simple_module resource-scoped access"
 readme = "README.md"
 license = "MIT"
@@ -9,10 +9,10 @@ requires-python = ">=3.12"
 authors = [{ name = "Anto Subash", email = "antosubash@live.com" }]
 keywords = ["simple-module", "sharing", "permissions", "access-control"]
 dependencies = [
-    "simple_module_core==0.0.41",
-    "simple_module_db==0.0.41",
-    "simple_module_hosting==0.0.41",
-    "simple_module_inertia==0.0.41",
+    "simple_module_core==0.0.42",
+    "simple_module_db==0.0.42",
+    "simple_module_hosting==0.0.42",
+    "simple_module_inertia==0.0.42",
 ]
 
 [project.entry-points.simple_module]

{simple_module_sharing-0.0.41 → simple_module_sharing-0.0.42}/sharing/contracts/__init__.py

@@ -1,5 +1,6 @@
 """Sharing contracts — public interface for other modules."""
 
+from sharing.contracts.cleanup import forget_resource
 from sharing.contracts.schemas import ShareGrant, ShareOut
 
-__all__ = ["ShareGrant", "ShareOut"]
+__all__ = ["ShareGrant", "ShareOut", "forget_resource"]

simple_module_sharing-0.0.42/sharing/contracts/cleanup.py

@@ -0,0 +1,25 @@
+"""Transactional cleanup for modules that own shared resources (#683)."""
+
+from collections.abc import Iterable
+
+from sqlalchemy.ext.asyncio import AsyncSession
+from sqlmodel import col, delete
+
+from sharing.models import ResourceShare
+
+
+async def forget_resource(
+    db: AsyncSession, resource_type: str, resource_id: str | Iterable[str]
+) -> None:
+    """Delete shares for canonical resource ids in the caller's tenant/transaction.
+
+    For resource owners only: no permission or resource-existence check is made.
+    The caller must bind the owning tenant and commit or roll back its session.
+    """
+    ids = [resource_id] if isinstance(resource_id, str) else list(resource_id)
+    await db.execute(
+        delete(ResourceShare).where(
+            col(ResourceShare.resource_type) == resource_type,
+            col(ResourceShare.resource_id).in_(ids),
+        )
+    )

{simple_module_sharing-0.0.41 → simple_module_sharing-0.0.42}/sharing/policy.py

@@ -14,7 +14,7 @@
 from __future__ import annotations
 
 import uuid
-from collections.abc import Callable
+from collections.abc import Callable, Mapping
 from datetime import UTC, datetime
 from typing import Any
 
@@ -26,9 +26,16 @@ from sharing.constants import ROLE_IMPLIES, SUBJECT_USER
 from sharing.models import ResourceShare
 
 
-def roles_granting(action: str) -> tuple[str, ...]:
+def resolve_roles(roles: Mapping[str, tuple[str, ...]] | None) -> Mapping[str, tuple[str, ...]]:
+    """*roles* as declared on a resource type; ``None`` means the default view/edit roles."""
+    return ROLE_IMPLIES if roles is None else roles
+
+
+def roles_granting(
+    action: str, *, roles: Mapping[str, tuple[str, ...]] | None = None
+) -> tuple[str, ...]:
     """Every share role that implies *action*."""
-    return tuple(role for role, implied in ROLE_IMPLIES.items() if action in implied)
+    return tuple(role for role, implied in resolve_roles(roles).items() if action in implied)
 
 
 def _is_uuid(column: Any) -> bool:
@@ -72,18 +79,20 @@ def active_share_clause(now: datetime | None = None) -> Any:
 
 
 def share_exists_for(
-    resource_type: str, id_col: Any
+    resource_type: str, id_col: Any, *, roles: Mapping[str, tuple[str, ...]] | None = None
 ) -> Callable[[ResourcePrincipal, str], Any | None]:
     """A ``share_exists`` factory for ``OwnedResourcePolicy``.
 
     Correlated on *id_col*; tenant scoping comes from the share table's
-    ``MultiTenantMixin`` filter, and expired shares never match.
+    ``MultiTenantMixin`` filter, and expired shares never match. *roles* is the
+    type's ``ResourceType.share_roles`` (``None``: the default view/edit roles);
+    pass the same mapping to both so SQL access and grant validation agree.
     """
     key = id_text(id_col)
 
     def share_exists(principal: ResourcePrincipal, action: str) -> Any | None:
-        roles = roles_granting(action)
-        if not roles or principal.user_id is None:
+        granting_roles = roles_granting(action, roles=roles)
+        if not granting_roles or principal.user_id is None:
             return None
         return exists(
             select(ResourceShare.id).where(
@@ -91,7 +100,7 @@ def share_exists_for(
                 ResourceShare.resource_id == key,
                 ResourceShare.subject_type == SUBJECT_USER,
                 ResourceShare.subject_id == principal.user_id,
-                ResourceShare.role.in_(roles),
+                ResourceShare.role.in_(granting_roles),
                 active_share_clause(),
             )
         )
@@ -103,6 +112,7 @@ __all__ = [
     "active_share_clause",
     "canonical_id",
     "id_text",
+    "resolve_roles",
     "roles_granting",
     "row_id",
     "share_exists_for",

{simple_module_sharing-0.0.41 → simple_module_sharing-0.0.42}/sharing/service.py

@@ -39,7 +39,7 @@ from sharing.constants import (
 )
 from sharing.contracts.schemas import ShareGrant
 from sharing.models import ResourceShare
-from sharing.policy import row_id
+from sharing.policy import resolve_roles, row_id
 
 
 class SharingError(Exception):
@@ -89,7 +89,7 @@ class SharingService:
 
     async def grant(self, principal: ResourcePrincipal, data: ShareGrant) -> ResourceShare:
         resource_type = self._type(data.resource_type)
-        if data.role not in resource_type.shareable_actions:
+        if data.role not in resolve_roles(resource_type.share_roles):
             raise SharingError(422, ERR_BAD_ROLE)
         if data.expires_at is not None and _aware(data.expires_at) <= utcnow():
             raise SharingError(422, ERR_EXPIRED)

simple_module_sharing-0.0.42/tests/test_sharing_custom_roles.py

@@ -0,0 +1,235 @@
+"""Per-type role registration, SQL access and delegated sharing (#707)."""
+
+from __future__ import annotations
+
+import uuid
+from datetime import timedelta
+
+import pytest
+from _sharing_support import FakeDirectory, SharingTestNote, create_note_table
+from sharing.constants import ROLE_MAX
+from sharing.contracts.schemas import ShareGrant
+from sharing.policy import roles_granting, share_exists_for
+from sharing.service import SharingError, SharingService
+from simple_module_core.datetimes import utcnow
+from simple_module_core.resources import (
+    ACTION_EDIT,
+    ACTION_SHARE,
+    ACTION_VIEW,
+    ResourcePrincipal,
+    ResourceType,
+    ResourceTypeError,
+    ResourceTypeRegistry,
+)
+from simple_module_db.resource_policy import OwnedResourcePolicy, select_by_id
+from simple_module_db.tenancy import tenant_context
+from sqlmodel import select
+
+TYPE = "sharing_test.custom"
+OWNER, MANAGER, READER, OTHER = (str(uuid.UUID(int=n)) for n in (11, 12, 13, 14))
+ROLES = {
+    "validator": (ACTION_VIEW, "validate"),
+    "manager": (ACTION_VIEW, ACTION_SHARE),
+    "reviewer": (ACTION_VIEW, ACTION_EDIT, "review"),
+}
+
+
+def declaration(**kwargs):
+    policy = OwnedResourcePolicy(
+        SharingTestNote.owner_id,
+        bypass_perm=None,
+        share_exists=share_exists_for(TYPE, SharingTestNote.id, roles=kwargs.get("share_roles")),
+    )
+    return ResourceType(TYPE, policy, select_by_id(SharingTestNote), **kwargs)
+
+
+@pytest.mark.parametrize("actions", [(), (ACTION_EDIT,), (ACTION_SHARE,), ("validate",)])
+def test_registration_rejects_roles_without_view(actions):
+    resource = declaration(share_roles={"broken": actions})
+    with pytest.raises(ResourceTypeError, match="view"):
+        ResourceTypeRegistry().register(resource)
+
+
+@pytest.mark.parametrize(
+    ("action", "expected"),
+    [
+        (ACTION_VIEW, ("validator", "manager", "reviewer")),
+        (ACTION_SHARE, ("manager",)),
+        ("validate", ("validator",)),
+        (ACTION_EDIT, ("reviewer",)),
+        ("delete", ()),
+    ],
+)
+def test_roles_granting_uses_declared_mapping(action, expected):
+    assert roles_granting(action, roles=ROLES) == expected
+
+
+def test_empty_roles_do_not_fall_back_to_defaults():
+    assert roles_granting(ACTION_VIEW, roles={}) == ()
+    assert (
+        share_exists_for(TYPE, SharingTestNote.id, roles={})(
+            ResourcePrincipal(MANAGER), ACTION_VIEW
+        )
+        is None
+    )
+    ResourceTypeRegistry().register(declaration(share_roles={}))
+
+
+def test_default_roles_remain_view_and_edit():
+    assert roles_granting(ACTION_VIEW) == ("view", "edit")
+    assert roles_granting(ACTION_EDIT) == ("edit",)
+    assert roles_granting(ACTION_SHARE) == ()
+
+
+@pytest.mark.parametrize("subset", [(ACTION_VIEW,), (ACTION_EDIT,), ()])
+def test_legacy_subsets_warn_and_translate_to_roles(subset):
+    with pytest.warns(DeprecationWarning, match="shareable_actions.*0.1.0"):
+        resource = declaration(shareable_actions=subset)
+    ResourceTypeRegistry().register(resource)
+    assert tuple(resource.share_roles) == subset
+    if ACTION_EDIT in subset:
+        assert resource.share_roles[ACTION_EDIT] == (ACTION_VIEW, ACTION_EDIT)
+
+
+@pytest.fixture
+async def custom_env(db_session, request):
+    await create_note_table(await db_session.connection())
+    note = SharingTestNote(owner_id=uuid.UUID(OWNER), title="custom")
+    db_session.add(note)
+    await db_session.flush()
+    resource = declaration(share_roles=getattr(request, "param", ROLES))
+    registry = ResourceTypeRegistry()
+    registry.register(resource)
+    service = SharingService(db_session, registry, FakeDirectory(OWNER, MANAGER, READER, OTHER))
+    return service, note, resource
+
+
+def grant_data(note, subject=MANAGER, role="manager"):
+    return ShareGrant(resource_type=TYPE, resource_id=str(note.id), subject_id=subject, role=role)
+
+
+async def visible(service, resource, user, action):
+    stmt = resource.policy.filter(ResourcePrincipal(user), action, select(SharingTestNote))
+    return [row.title for row in (await service.db.execute(stmt)).scalars()]
+
+
+@pytest.mark.parametrize(
+    ("role", "action", "allowed"),
+    [
+        ("validator", "validate", True),
+        ("validator", ACTION_EDIT, False),
+        ("reviewer", "review", True),
+        ("reviewer", "validate", False),
+        ("manager", ACTION_SHARE, True),
+        ("manager", ACTION_EDIT, False),
+    ],
+)
+async def test_registered_roles_and_sql_agree(custom_env, role, action, allowed):
+    service, note, resource = custom_env
+    with tenant_context("t1"):
+        await service.grant(ResourcePrincipal(OWNER), grant_data(note, role=role))
+        assert await visible(service, resource, MANAGER, ACTION_VIEW) == ["custom"]
+        assert await visible(service, resource, MANAGER, action) == (["custom"] if allowed else [])
+        assert await visible(service, resource, OTHER, ACTION_VIEW) == []
+
+
+async def test_manager_lists_grants_any_role_and_revokes(custom_env):
+    service, note, _ = custom_env
+    with tenant_context("t1"):
+        manager = await service.grant(ResourcePrincipal(OWNER), grant_data(note))
+        who = ResourcePrincipal(MANAGER)
+        assert [s.id for s in await service.for_resource(who, TYPE, str(note.id))] == [manager.id]
+        for role in ROLES:
+            granted = await service.grant(who, grant_data(note, READER, role))
+            assert granted.role == role
+        await service.revoke(who, granted.id)
+        assert [s.id for s in await service.for_resource(who, TYPE, str(note.id))] == [manager.id]
+
+
+@pytest.mark.parametrize("operation", ["grant", "list", "revoke"])
+async def test_non_manager_cannot_manage_other_shares(custom_env, operation):
+    service, note, _ = custom_env
+    with tenant_context("t1"):
+        await service.grant(ResourcePrincipal(OWNER), grant_data(note, role="reviewer"))
+        target = await service.grant(
+            ResourcePrincipal(OWNER), grant_data(note, READER, "validator")
+        )
+        who = ResourcePrincipal(MANAGER)
+        with pytest.raises(SharingError) as exc:
+            if operation == "grant":
+                await service.grant(who, grant_data(note, OTHER))
+            elif operation == "list":
+                await service.for_resource(who, TYPE, str(note.id))
+            else:
+                await service.revoke(who, target.id)
+        assert exc.value.status_code == 403
+
+
+@pytest.mark.parametrize("role", [ACTION_VIEW, ACTION_EDIT, "validate", "unknown"])
+async def test_grant_accepts_only_declared_role_keys(custom_env, role):
+    service, note, _ = custom_env
+    with tenant_context("t1"), pytest.raises(SharingError) as exc:
+        await service.grant(ResourcePrincipal(OWNER), grant_data(note, role=role))
+    assert exc.value.status_code == 422
+
+
+async def test_custom_roles_expire_and_remain_tenant_scoped(custom_env):
+    service, note, resource = custom_env
+    who = ResourcePrincipal(MANAGER)
+    with tenant_context("t1"):
+        share = await service.grant(ResourcePrincipal(OWNER), grant_data(note))
+    with tenant_context("t2"), pytest.raises(SharingError) as exc:
+        await service.for_resource(who, TYPE, str(note.id))
+    assert exc.value.status_code == 404
+    with tenant_context("t1"):
+        share.expires_at = utcnow() - timedelta(seconds=1)
+        await service.db.flush()
+        assert await visible(service, resource, MANAGER, ACTION_VIEW) == []
+        with pytest.raises(SharingError) as exc:
+            await service.for_resource(who, TYPE, str(note.id))
+        assert exc.value.status_code == 404
+
+
+@pytest.mark.parametrize("custom_env", [{}], indirect=True)
+async def test_empty_mapping_refuses_default_grants(custom_env):
+    service, note, _ = custom_env
+    with tenant_context("t1"), pytest.raises(SharingError) as exc:
+        await service.grant(ResourcePrincipal(OWNER), grant_data(note, role=ACTION_VIEW))
+    assert exc.value.status_code == 422
+
+
+@pytest.mark.parametrize("subset", [(ACTION_VIEW,), (ACTION_EDIT,), ()])
+async def test_legacy_subset_still_controls_grants(custom_env, subset):
+    service, note, _ = custom_env
+    with pytest.warns(DeprecationWarning):
+        resource = declaration(shareable_actions=subset)
+    registry = ResourceTypeRegistry()
+    registry.register(resource)
+    service.registry = registry
+    with tenant_context("t1"):
+        for role in (ACTION_VIEW, ACTION_EDIT):
+            if role in subset:
+                share = await service.grant(ResourcePrincipal(OWNER), grant_data(note, role=role))
+                assert share.role == role
+            else:
+                with pytest.raises(SharingError) as exc:
+                    await service.grant(ResourcePrincipal(OWNER), grant_data(note, role=role))
+                assert exc.value.status_code == 422
+
+
+def test_explicit_roles_take_precedence_over_legacy_subset():
+    with pytest.warns(DeprecationWarning):
+        resource = declaration(share_roles=ROLES, shareable_actions=(ACTION_VIEW,))
+    assert resource.share_roles == ROLES
+
+
+@pytest.mark.parametrize("role", ["Manager", "x" * 33, "has-dash", "", "manager\n"])
+def test_role_ids_must_fit_the_share_column(role):
+    # A role the 32-character ``role`` column can't store would only fail at grant time.
+    with pytest.raises(ResourceTypeError, match="lowercase identifier"):
+        ResourceTypeRegistry().register(declaration(share_roles={role: (ACTION_VIEW,)}))
+
+
+def test_core_role_pattern_matches_share_column_width():
+    # ``simple_module_core.resources._ROLE_ID`` hard-codes the width (core can't import sharing).
+    assert ROLE_MAX == 32

{simple_module_sharing-0.0.41 → simple_module_sharing-0.0.42}/tests/test_sharing_http.py

@@ -6,7 +6,11 @@ import uuid
 
 import pytest
 from _sharing_support import NOTE_TYPE, SharingTestNote, create_note_table, register_note_type
+from sharing.constants import PERM_SHARE
+from sharing.policy import share_exists_for
+from simple_module_core.resources import ACTION_SHARE, ACTION_VIEW, ResourceType
 from simple_module_core.tenancy import TenantRole
+from simple_module_db.resource_policy import OwnedResourcePolicy, select_by_id
 from simple_module_test.tenant_client import session_client
 
 SHARES = "/api/sharing/shares"
@@ -101,3 +105,47 @@ async def test_admin_page_lists_tenant_shares(note_app, tenant_client):
             assert revoked.status_code == 303
         # A plain tenant owner holds sharing.share but not the admin page.
         assert (await owner.client.get("/admin/sharing/")).status_code == 403
+
+
+async def test_custom_manager_uses_api_but_still_needs_permission(app, tenant_client, monkeypatch):
+    roles = {"manager": (ACTION_VIEW, ACTION_SHARE), "reviewer": (ACTION_VIEW, "review")}
+    policy = OwnedResourcePolicy(
+        SharingTestNote.owner_id,
+        bypass_perm=None,
+        share_exists=share_exists_for(NOTE_TYPE, SharingTestNote.id, roles=roles),
+    )
+    app.state.sm.resource_types.register(
+        ResourceType(NOTE_TYPE, policy, select_by_id(SharingTestNote), share_roles=roles)
+    )
+    async with app.state.sm.db.engine.begin() as conn:
+        await create_note_table(conn)
+    async with (
+        tenant_client() as owner,
+        tenant_client(tenant_id=owner.tenant_id) as manager,
+        tenant_client(tenant_id=owner.tenant_id) as reader,
+    ):
+        note_id = await _note(app, owner.user_id)
+        response = await owner.client.post(
+            SHARES, json=_body(note_id, manager.user_id, role="manager")
+        )
+        assert response.status_code == 201, response.text
+        query = {"resource_type": NOTE_TYPE, "resource_id": note_id}
+        assert (await manager.client.get(SHARES, params=query)).status_code == 200
+        response = await manager.client.post(
+            SHARES, json=_body(note_id, reader.user_id, role="reviewer")
+        )
+        assert response.status_code == 201, response.text
+        share_id = response.json()["id"]
+        assert (await manager.client.delete(f"{SHARES}/{share_id}")).status_code == 204
+        # Removing the API permission must refuse even an active resource manager.
+        registry = app.state.sm.permissions
+        denied_map = {
+            role: [key for key in keys if key != PERM_SHARE]
+            for role, keys in registry.role_map.items()
+        }
+        monkeypatch.setattr(type(registry), "role_map", property(lambda self: denied_map))
+        assert (await manager.client.get(SHARES, params=query)).status_code == 403
+        assert (
+            await manager.client.post(SHARES, json=_body(note_id, reader.user_id, role="manager"))
+        ).status_code == 403
+        assert (await manager.client.delete(f"{SHARES}/{share_id}")).status_code == 403

simple_module_sharing-0.0.42/tests/test_sharing_resource_cleanup.py

@@ -0,0 +1,75 @@
+"""Resource owners can remove shares transactionally in the bound tenant (#683)."""
+
+import pytest
+from sharing import contracts
+from sharing.models import ResourceShare
+from simple_module_db import TenantIsolationError, all_tenants, tenant_context
+from sqlmodel import select
+
+
+async def _seed(db):
+    for tenant in ("acme", "other"):
+        with tenant_context(tenant):
+            for kind, resource in (
+                ("test.note", "note"),
+                ("test.note", "next"),
+                ("test.other", "note"),
+            ):
+                for subject in ("reader", "editor"):
+                    db.add(
+                        ResourceShare(
+                            resource_type=kind,
+                            resource_id=resource,
+                            subject_id=subject,
+                            role="view",
+                            granted_by="owner",
+                        )
+                    )
+            await db.flush()
+    await db.commit()
+
+
+@pytest.mark.parametrize("resource_ids", ["note", ["note", "next"], []])
+async def test_forget_resource_is_scoped_idempotent_and_transactional(db_session, resource_ids):
+    forget = contracts.forget_resource
+    await _seed(db_session)
+    ids = resource_ids if isinstance(resource_ids, str) else list(resource_ids)
+    count = 2 if ids == "note" else 2 * len(ids)
+    with tenant_context("acme"):
+        await forget(db_session, "test.note", ids)
+    with all_tenants():
+        assert len((await db_session.execute(select(ResourceShare))).scalars().all()) == 12 - count
+    await db_session.rollback()
+    with all_tenants():
+        assert len((await db_session.execute(select(ResourceShare))).scalars().all()) == 12
+    with tenant_context("acme"):
+        await forget(db_session, "test.note", ids)
+        await forget(db_session, "test.note", ids)
+    await db_session.commit()
+    with all_tenants():
+        rows = (await db_session.execute(select(ResourceShare))).scalars().all()
+    assert len(rows) == 12 - count
+    assert sum(row.tenant_id == "other" for row in rows) == 6
+    assert sum(row.resource_type == "test.other" for row in rows) == 4
+    removed = {ids} if isinstance(ids, str) else set(ids)
+    assert not any(
+        row.tenant_id == "acme" and row.resource_type == "test.note" and row.resource_id in removed
+        for row in rows
+    )
+
+
+async def test_forget_resource_fails_closed_without_tenant(db_state, db_session):
+    db_state.tenant_strict = True
+    with pytest.raises(TenantIsolationError):
+        await contracts.forget_resource(db_session, "test.note", "note")
+
+
+async def test_forget_resource_accepts_one_shot_iterables(db_session):
+    await _seed(db_session)
+    with tenant_context("acme"):
+        await contracts.forget_resource(db_session, "test.note", iter(["note", "next"]))
+        rows = (await db_session.execute(select(ResourceShare))).scalars().all()
+    assert [(row.resource_type, row.resource_id) for row in rows] == [
+        ("test.other", "note"),
+        ("test.other", "note"),
+    ]

{simple_module_sharing-0.0.41 → simple_module_sharing-0.0.42}/tests-js/sharing_Admin.test.tsx

@@ -40,6 +40,11 @@ const props: ComponentProps<typeof Admin> = {
 afterEach(() => vi.clearAllMocks());
 
 describe('sharing Admin', () => {
+  it('shows custom role ids unchanged', () => {
+    render(<Admin {...props} shares={[{ ...props.shares[0], role: 'collection_manager' }]} />);
+    expect(screen.getByText('collection_manager')).toBeInTheDocument();
+  });
+
   it('renders labels and hides revoke from read-only viewers', () => {
     render(<Admin {...props} can_revoke={false} />);
     expect(screen.getByText('Friend')).toBeInTheDocument();