From f6f28b08395bc1c2f0fe0024e7eadfcb5e6fdc24 Mon Sep 17 00:00:00 2001 From: Claude Date: Tue, 13 Oct 2026 04:17:12 +0000 Subject: [PATCH] test(dogfood): the inbound-mail pool suite reads its fixture sets from the security catalog Since D (#22900) no boot writes a sys_permission_set row for a set declared through defaultPermissionSets (ADR-0131 D3), so this suite's grant helper, which asserted the seeded row, failed on main's full battery. It now asserts the set the security catalog serves by name (catalogPermissionSet, the fixture helper T2 added); the grant row it writes is unchanged. Claude-Session: https://claude.ai/code/session_01ADzJtzYTLUfgrRZHxkagkX Co-Authored-By: Claude --- .../test/mail-message-pool-read-gate.dogfood.test.ts | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/packages/qa/dogfood/test/mail-message-pool-read-gate.dogfood.test.ts b/packages/qa/dogfood/test/mail-message-pool-read-gate.dogfood.test.ts index 0c9642cea00..adb8b0fa730 100644 --- a/packages/qa/dogfood/test/mail-message-pool-read-gate.dogfood.test.ts +++ b/packages/qa/dogfood/test/mail-message-pool-read-gate.dogfood.test.ts @@ -38,6 +38,7 @@ import { ADMIN_FULL_ACCESS_CAPABILITIES } from '@objectstack/spec'; import { PermissionSetSchema, PLATFORM_CAPABILITIES } from '@objectstack/spec/security'; import { bootShowcase } from './showcase-boot.js'; import { assertArmed, armedWhen } from './armed.js'; +import { catalogPermissionSet } from './catalog-permission-set.js'; /** The capability under test, as `PLATFORM_CAPABILITIES` declares it. */ const CAP = 'manage_mailboxes'; @@ -107,8 +108,10 @@ describe('[#22870] the inbound-mail pool is restricted to mailbox owners and adm const userIdOf = async (email: string) => String((await atRest('sys_user', { email }))[0]?.id ?? ''); uid.admin = await userIdOf('admin@objectos.ai'); const grant = async (who: Who, setName: string) => { - const [set] = await atRest('sys_permission_set', { name: setName }); - expect(set?.id, `fixture permission set ${setName} seeded`).toBeTruthy(); + // [ADR-0131 D3] A set is served by name from the security catalog; no + // boot writes a `sys_permission_set` row for it. + const set = await catalogPermissionSet(ql, setName); + expect(set, `fixture permission set ${setName} served by the security catalog`).toBeTruthy(); await ql.insert('sys_user_permission_set', { user_id: uid[who], permission_set: set.name }, { context: { ...SYS } }); }; for (const who of ['reader', 'owner', 'holder', 'outsider'] as const) {