Claude Fable 5
0c6494f209
All checks were successful
CD / Build and push images (push) Successful in 2m54s
CI / Lint, typecheck, test (push) Successful in 2m25s
CI / Auth e2e pack (push) Successful in 2m58s
CI / Build container images (push) Has been skipped
CD / Deploy to Test (push) Successful in 9s
CD / Smoke tests against Test (push) Successful in 1m12s
CD / Promote to Int (push) Successful in 12s
Every route now declares its access rule explicitly and is enforced through the shared resolution algorithm (permissions.md): - PermissionGuard + decorators (@RequiresPondRole, @RequiresPagePermission, @RequiresAttachmentPermission, @AuthenticatedOnly) applied to every route; a route-enumeration test proves full coverage alongside @Public()/Site-Admin-guarded routes. - 404/403 policy (documented in README conventions): denied reads answer 404 (existence hiding), denied writes on readable things answer 403; trash views need write capability (ADR 0013). - PermissionService resolves page/pond questions via the shared resolver, with an in-process pond-context cache (grants + label parents) that is invalidated on every grant/label-tree change and TTL-bounded as a multi-process safety net. Grant changes also fire pond_access_changed for collab revalidation (#39/#53). - shared: pond-scope resolution (hasPondRole, canSeePond) next to the page resolver; grant wire schemas + GrantView. - Owner Pond-Admin grants: migration backfill for all existing ponds, created transactionally with every new pond (shared + personal + seed). - Grant CRUD under /ponds/:id/grants (pond_admin-gated) with structural and referential validation, last-admin protection, audit logs. - InterimAccessService deleted; page lists, search, backlinks, phantom links, and trash listings are filtered per page through the resolver; collab tokens are now truly ro for readers. - Fixture-matrix e2e (reader/editor/pond admin/foreign, label-deny, authenticated-subject, revoke-then-immediate-deny cache test). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01PGdhRiwU1WRL4XxJfZYipY
43 lines
1.3 KiB
TypeScript
43 lines
1.3 KiB
TypeScript
import { PrismaClient } from '@prisma/client';
|
|
|
|
/** True when database-backed tests can run (see vitest.global-setup.ts). */
|
|
export const hasTestDb = Boolean(process.env.TEST_DATABASE_URL);
|
|
|
|
/** Prisma client bound to the test database. Callers own the lifecycle. */
|
|
export function createTestPrisma(): PrismaClient {
|
|
if (!process.env.TEST_DATABASE_URL) {
|
|
throw new Error('TEST_DATABASE_URL is not set — guard the suite with hasTestDb');
|
|
}
|
|
return new PrismaClient({ datasourceUrl: process.env.TEST_DATABASE_URL });
|
|
}
|
|
|
|
/** Unique suffix so suites never collide on unique columns. */
|
|
export function uniqueSuffix(): string {
|
|
return Math.random().toString(36).slice(2, 10);
|
|
}
|
|
|
|
/**
|
|
* The owner's Pond Admin grant for a pond created directly through Prisma.
|
|
* Production paths create it with the pond (PondsService, issue #52);
|
|
* fixtures that bypass the service need it too, or the owner cannot see
|
|
* their own pond under the grant-based resolution.
|
|
*/
|
|
export async function grantOwnerAdmin(
|
|
prisma: PrismaClient,
|
|
pondId: string,
|
|
ownerId: string,
|
|
): Promise<void> {
|
|
await prisma.roleGrant.create({
|
|
data: {
|
|
pondId,
|
|
subjectType: 'USER',
|
|
subjectId: ownerId,
|
|
role: 'POND_ADMIN',
|
|
scopeType: 'POND',
|
|
scopeId: null,
|
|
effect: 'ALLOW',
|
|
createdBy: ownerId,
|
|
},
|
|
});
|
|
}
|