Repository navigation
test(verify): hold adapters to one permission guard behavior - #353
Merged
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Conformance for fells-code/seamless-auth-server#218, fells-code/seamless-auth-go#29, fells-code/seamless-auth-python#32 and fells-code/seamless-auth-rust#33. Part of v0.23 Wave 3.
What
verify/harness/adapter/permissionGuards.spec.ts: 12 cases under a new pending contract,permission-guards. Covers 401 and the 403 body, any-of and all-of, exact matching, a role being taken away, bearer, organization scope bound to the route, removal from an organization reaching the guard at the next token, and the live read when a token carriespermissions_omittedverify/harness/lib/permissionFlows.ts: idempotent setup through the admin API/api/permissionsroutes in the Express and Fastify reference apps, added only when the installed adapter exportsrequirePermission, because a released-mode run installs a published package that may predate itverify/CONFORMANCE.md: the routes and the behaviorThe cases are skipped unless a run opts in, because they need API #576 and #577. No adapter CI opts in yet. CI builds the API from
main, so each adapter can setSEAMLESS_VERIFY_CONTRACTSonce those merge and its guard is on its default branch.Testing
Run locally against the API worktree on
feat/organization-roles-in-token, withSEAMLESS_VERIFY_CONTRACTS=permission-guards,content-type-gate, using each adapter's PR branch:--local --no-react, including the API specs)Released mode with no opt-in: 24 skipped, and the reference apps start without the guard.
Not run: the browser layers (
--no-react). This does not cover a recovery session or a failed live read end to end; those are in each adapter's unit tests. Express ran on port 3100 through a compose override, because port 3000 was taken on this machine.For review
Members in these specs are added with
scopes: ['organization:read'], because a member without it cannot switch to the organization (requireOrganizationAccessin the API answers 404). That is the API's behavior, reviewed and kept as is, and it is documented indocs/admin-operations.mdon API #577.