From 30fd1ff53b783eed9f994fbac4c35a276d993921 Mon Sep 17 00:00:00 2001 From: Claude Opus 5 Date: Sat, 1 Aug 2026 08:25:51 +0200 Subject: [PATCH] #302: the permission matrix counts the start page MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Every pond created through the api now carries one, and the matrix pond is created that way. The start page is an ordinary page with no grant of its own, so it follows the pond-wide permissions: the three member subjects each see one more, the label-restricted editor too, and the outsider — who reaches only the explicitly public page — still sees one. The 429 in the same run was the login rate limit, reached through the retries of this failure rather than on its own. --- apps/web/e2e/permission-matrix.spec.ts | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-) diff --git a/apps/web/e2e/permission-matrix.spec.ts b/apps/web/e2e/permission-matrix.spec.ts index dea7c1e..b27f063 100644 --- a/apps/web/e2e/permission-matrix.spec.ts +++ b/apps/web/e2e/permission-matrix.spec.ts @@ -173,10 +173,14 @@ test('page read & edit — the 404-vs-403 policy holds per subject', async () => }); test('sidebar list is filtered to each subject’s visible pages', async () => { - expect(await listCount(f.admin.request, f.pondId)).toBe(3); - expect(await listCount(f.owner.request, f.pondId)).toBe(3); - expect(await listCount(f.reader.request, f.pondId)).toBe(3); - expect(await listCount(f.editor.request, f.pondId)).toBe(2); // secret hidden + // Three fixture pages plus the pond's own start page (issue #302), which + // every pond created through the api now carries. It is an ordinary page + // with no grant of its own, so it follows the pond-wide permissions: the + // outsider, who reaches only the explicitly public page, still sees one. + expect(await listCount(f.admin.request, f.pondId)).toBe(4); + expect(await listCount(f.owner.request, f.pondId)).toBe(4); + expect(await listCount(f.reader.request, f.pondId)).toBe(4); + expect(await listCount(f.editor.request, f.pondId)).toBe(3); // secret hidden expect(await listCount(f.outsider.request, f.pondId)).toBe(1); // only the public page // Anonymous cannot hit the authenticated list endpoint at all. expect(await listCount(f.anon, f.pondId)).toBe(401);