Add permission-scoped MCP, readiness checks, and management UI improvements

2026-09-11 18:12:48 -04:00
parent 32e56b1c34
commit 815640d919
40 changed files with 845 additions and 57 deletions
@@ -0,0 +1,17 @@
+import { expect, test } from "bun:test";
+import { withPermissionCeiling } from "./permission-ceiling";
+import { hasPlatformPermission, resolveEventAccess } from "./roles";
+
+test("assistant ceilings hide private photos even from owner tokens", () => {
+  withPermissionCeiling(["photos.read"], () => {
+    expect(resolveEventAccess({ membershipRole: "owner", platformRole: null })!.permissions).toEqual(["photos.read"]);
+    expect(hasPlatformPermission("super_admin", "platform.users.manage")).toBe(false);
+  });
+  expect(resolveEventAccess({ membershipRole: "owner", platformRole: null })!.permissions).toContain("photos.private.read");
+});
+test("concurrent requests cannot share permission ceilings", async () => {
+  await Promise.all([
+    withPermissionCeiling(["photos.read"], async () => { await Promise.resolve(); expect(resolveEventAccess({ membershipRole: "owner", platformRole: null })!.permissions).toEqual(["photos.read"]); }),
+    withPermissionCeiling(["notes.read"], async () => { await Promise.resolve(); expect(resolveEventAccess({ membershipRole: "owner", platformRole: null })!.permissions).toEqual(["notes.read"]); }),
+  ]);
+});