Permissions cut across every M2–M5 feature; this pack pins the security-relevant
subject × surface combinations so a weakened guard is caught.
- `apps/web/e2e/permission-matrix.spec.ts`: an API-level (the UI adds nothing
over the resolved status code) parameterized suite over the subjects — site
admin, pond admin/owner, editor, the same editor label-restricted by a
`secret`-label deny, reader, public (anonymous), and the foreign user (new
`fixture-outsider`, a member of nothing) — across the surfaces: page read,
edit (collab-token `rw`/`ro`), sidebar list, search, versions, media, and the
public HTML endpoint. It enforces the 404-vs-403 policy: an unauthorized read
is 404 (existence hidden), an unauthorized write on something readable is 403.
- wired into the pipeline as its own CI step; documented in
`apps/web/e2e/README.md` (with the subject/surface list) so later features
extend the matrix rather than writing bespoke permission tests.
- seeded-regression check (acceptance criterion): temporarily forcing the
collab-token to always `rw` (ignoring write permission) makes the pack go red
on the "reader gets `ro`" and public/foreign cells — verified locally, then
reverted. Runs in ~1 s (well under the 10-minute budget).
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EwZ4jR4KFAPvpjWevfUGX1
