From c499f136fd33bc346969ce60de0b6455ea3fbbc2 Mon Sep 17 00:00:00 2001 From: Ajay Ghanwat Date: Tue, 4 Aug 2026 17:41:11 +0530 Subject: [PATCH] docs: fix self-contradictory audit test in the Task 6 plan snippet The 'denials are audited' test assigned role editor, which holds post:*, so decide(post:delete) was legitimately an ALLOW under the wildcard rule the same task specifies. The test then asserted one audited denial and got zero. Switched to moderator (post:comment:*), which genuinely lacks post:delete. Caught by the Task 6 implementer running the transcribed test against the transcribed implementation. Plan-origin defect, fixed under standing authority. Co-Authored-By: Claude Opus 5 --- docs/plans/2026-08-04-authz-permissions-implementation.md | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/docs/plans/2026-08-04-authz-permissions-implementation.md b/docs/plans/2026-08-04-authz-permissions-implementation.md index 00fee161..5f2ae3b4 100644 --- a/docs/plans/2026-08-04-authz-permissions-implementation.md +++ b/docs/plans/2026-08-04-authz-permissions-implementation.md @@ -1329,7 +1329,9 @@ describe("createAuthzResolver.decide", () => { test("denials are audited and allows are not, by default", async () => { const { store, audit, resolver } = make(); - await store.assignRole("u1", "editor"); + // moderator, NOT editor: editor holds "post:*", which legitimately grants + // post:delete, so that call would be an allow and nothing would be audited. + await store.assignRole("u1", "moderator"); await resolver.decide({ subject: { id: "u1" }, permission: "post:delete" }); await resolver.decide({ subject: { id: "u1" }, permission: "post:read" }); expect(audit.events).toHaveLength(1);