WorkRoot/WRNexusJS
2
0
Fork 0
Code Issues Pull Requests Actions 27 Packages Projects Releases Wiki Activity

docs: fix self-contradictory audit test in the Task 6 plan snippet

Browse Source 
The 'denials are audited' test assigned role editor, which holds post:*, so
decide(post:delete) was legitimately an ALLOW under the wildcard rule the
same task specifies. The test then asserted one audited denial and got zero.
Switched to moderator (post:comment:*), which genuinely lacks post:delete.

Caught by the Task 6 implementer running the transcribed test against the
transcribed implementation. Plan-origin defect, fixed under standing
authority.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This commit is contained in:
Clintchiz
2026-08-04 17:41:11 +05:30
co-authored by Claude Opus 5
parent 6d8b6daba9
commit c499f136fd
1 changed files with 3 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/plans/2026-08-04-authz-permissions-implementation.md
+3 -1
View File
@@ -1329,7 +1329,9 @@ describe("createAuthzResolver.decide", () => {
test("denials are audited and allows are not, by default", async () => {
const { store, audit, resolver } = make();
await store.assignRole("u1", "editor");
// moderator, NOT editor: editor holds "post:*", which legitimately grants
// post:delete, so that call would be an allow and nothing would be audited.
await store.assignRole("u1", "moderator");
await resolver.decide({ subject: { id: "u1" }, permission: "post:delete" });
await resolver.decide({ subject: { id: "u1" }, permission: "post:read" });
expect(audit.events).toHaveLength(1);