test(plugin-auth): grant fixtures carry the name the platform stores; unnamed-grant guard pins

Hand-declared grant objects in the guard suites declare the permission_set
column and their seeded grants carry the name every platform writer
stores. The unnamed-grant pins bypass the guard to clear a name, which the
guard itself refuses as a revocation of the sole administrator's standing.

Claude-Session: https://claude.ai/code/session_01WkL6Eijt432S1Y7ekb6ovQ
Co-authored-by: Claude <noreply@anthropic.com>

Author: claude

packages/plugins/plugin-auth/src/auth-plugin.test.ts

@@ -1319,7 +1319,7 @@ describe('AuthPlugin', () => {
       const tables: Record<string, any[]> = {
         sys_permission_set: [{ id: 'ps_admin', name: 'admin_full_access' }],
         sys_user_permission_set: [
-          { id: 'ups1', user_id: 'u1', permission_set_id: 'ps_admin', organization_id: null },
+          { id: 'ups1', user_id: 'u1', permission_set_id: 'ps_admin', permission_set: 'admin_full_access', organization_id: null },
         ],
         sys_member: [],
         sys_organization: [],
@@ -1572,7 +1572,7 @@ describe('AuthPlugin', () => {
       const tables: Record<string, any[]> = {
         sys_permission_set: [{ id: 'ps_admin', name: 'admin_full_access' }],
         sys_user_permission_set: [
-          { id: 'ups1', user_id: 'admin', permission_set_id: 'ps_admin', organization_id: null },
+          { id: 'ups1', user_id: 'admin', permission_set_id: 'ps_admin', permission_set: 'admin_full_access', organization_id: null },
         ],
         // The platform admin already exists; the default-org bootstrap binds it
         // as `owner` on kernel:ready. A member-less seeded user is added later.
@@ -1710,7 +1710,7 @@ describe('AuthPlugin', () => {
 
       // The admin's grant lands: the bootstrap creates the organization, and
       // that moment runs the pass — no restart, no app:seeded.
-      ql.tables.sys_user_permission_set.push({ id: 'ups1', user_id: 'admin', permission_set_id: 'ps_admin', organization_id: null });
+      ql.tables.sys_user_permission_set.push({ id: 'ups1', user_id: 'admin', permission_set_id: 'ps_admin', permission_set: 'admin_full_access', organization_id: null });
       await fireBootstrapWrite({ object: 'sys_user_permission_set', operation: 'insert' });
       await vi.waitFor(() => {
         expect(ql.tables.sys_member.find((m: any) => m.user_id === 'early_u5')).toMatchObject({ role: 'member' });

packages/plugins/plugin-auth/src/ensure-default-organization.test.ts

@@ -76,7 +76,7 @@ function makeQl(seed: Partial<Record<string, Row[]>> = {}) {
   const tables: Record<string, Row[]> = {
     sys_permission_set: [{ id: 'ps_admin', name: 'admin_full_access' }],
     sys_user_permission_set: [
-      { id: 'ups1', user_id: 'u1', permission_set_id: 'ps_admin', organization_id: null },
+      { id: 'ups1', user_id: 'u1', permission_set_id: 'ps_admin', permission_set: 'admin_full_access', organization_id: null },
     ],
     sys_member: [],
     sys_organization: [],
@@ -135,8 +135,8 @@ describe('ensureDefaultOrganization (plugin-auth home)', () => {
   it('picks the OLDEST cross-tenant admin grant', async () => {
     const ql = makeQl({
       sys_user_permission_set: [
-        { id: 'b', user_id: 'u_newer', permission_set_id: 'ps_admin', organization_id: null, created_at: '2026-01-02T00:00:00Z' },
-        { id: 'a', user_id: 'u_older', permission_set_id: 'ps_admin', organization_id: null, created_at: '2026-01-01T00:00:00Z' },
+        { id: 'b', user_id: 'u_newer', permission_set_id: 'ps_admin', permission_set: 'admin_full_access', organization_id: null, created_at: '2026-01-02T00:00:00Z' },
+        { id: 'a', user_id: 'u_older', permission_set_id: 'ps_admin', permission_set: 'admin_full_access', organization_id: null, created_at: '2026-01-01T00:00:00Z' },
       ],
     });
     await ensureDefaultOrganization(ql);

packages/plugins/plugin-auth/src/grant-readers-unnamed-grant.test.ts

@@ -39,6 +39,14 @@ import { ensureDefaultOrganization } from './ensure-default-organization.js';
 
 const SYS = { context: { isSystem: true } } as any;
 const NAME_HOOKS = 'plugin-security:grant-permission-set-name';
+const GUARD_PACKAGE = 'test.grant-readers-unnamed';
+
+function registerGuard(engine: ObjectQL): void {
+  registerLastAdminGuard(engine as unknown as LastAdminGuardEngine, {
+    packageId: GUARD_PACKAGE,
+    logger: { info: () => undefined, warn: () => undefined },
+  });
+}
 
 const engines: ObjectQL[] = [];
 afterEach(async () => {
@@ -51,8 +59,6 @@ afterEach(async () => {
 
 interface Rig {
   engine: ObjectQL;
-  /** Re-bind the plugin's name hooks after `unname` (a fresh start of the plugin's hook half). */
-  plugin: SecurityPlugin;
 }
 
 /** `single` posture; the first user is promoted to platform administrator — the sole administrator. */
@@ -101,10 +107,7 @@ async function soleGrantAnchoredAdmin(): Promise<Rig> {
   await engine.syncSchemas();
   await plugin.start(ctx);
   vi.spyOn((engine as any).logger, 'warn').mockImplementation(() => undefined);
-  registerLastAdminGuard(engine as unknown as LastAdminGuardEngine, {
-    packageId: 'test.grant-readers-unnamed',
-    logger: { info: () => undefined, warn: () => undefined },
-  });
+  registerGuard(engine);
   for (const [id, createdAt] of [['usr_admin', '2025-01-01T00:00:00.000Z'], ['usr_member', '2025-03-01T00:00:00.000Z']]) {
     await engine.insert(
       'sys_user', { id, email: `${id}@un.example`, name: id, created_at: createdAt, email_verified: true, banned: false }, SYS,
@@ -115,15 +118,23 @@ async function soleGrantAnchoredAdmin(): Promise<Rig> {
   }
   const boot = await bootstrapPlatformAdmin(engine, (manifest.permissions ?? []) as any[]);
   expect(boot).toMatchObject({ adminPromoted: true });
-  return { engine, plugin };
+  return { engine };
 }
 
 const adminGrant = async (engine: ObjectQL): Promise<any> =>
   ((await engine.find('sys_user_permission_set', { where: { user_id: 'usr_admin' }, ...SYS })) as any[])[0];
 
+/**
+ * The state the backfill leaves on a grant it has not named. Written past both
+ * hooks that would refuse it: the name hooks, and the guard itself — clearing
+ * the sole administrator's grant name takes the standing away, which the guard
+ * refuses like any other revocation. The guard is bound again afterwards.
+ */
 async function unnameAdminGrant(engine: ObjectQL): Promise<void> {
   (engine as any).unregisterHooksByPackage(NAME_HOOKS);
+  (engine as any).unregisterHooksByPackage(GUARD_PACKAGE);
   await engine.update('sys_user_permission_set', { permission_set: null }, { where: { user_id: 'usr_admin' }, multi: true, ...SYS });
+  registerGuard(engine);
   expect((await adminGrant(engine)).permission_set ?? null).toBeNull();
 }
 
@@ -144,6 +155,14 @@ describe('[ADR-0131 D4] a grant that names nothing — the last-administrator gu
     await expect(ban(engine, 'usr_member')).rejects.toMatchObject({ code: 'PERMISSION_DENIED', status: 403 });
   });
 
+  it('clearing the sole administrator’s grant name is refused — the name is what the standing rides on', async () => {
+    const { engine } = await soleGrantAnchoredAdmin();
+    const grant = await adminGrant(engine);
+    await expect(engine.update('sys_user_permission_set', { id: grant.id, permission_set: null }, SYS))
+      .rejects.toMatchObject({ code: 'PERMISSION_DENIED', status: 403 });
+    expect((await adminGrant(engine)).permission_set).toBe('admin_full_access');
+  });
+
   it('re-pointing the sole administrator’s grant by id is read as taking the standing away', async () => {
     const { engine } = await soleGrantAnchoredAdmin();
     const grant = await adminGrant(engine);

packages/plugins/plugin-auth/src/last-admin-guard.config-anchor.test.ts

@@ -112,6 +112,8 @@ const sysUserPermissionSet = {
     id: { name: 'id', type: 'text' as const, primaryKey: true },
     user_id: { name: 'user_id', type: 'text' as const },
     permission_set_id: { name: 'permission_set_id', type: 'text' as const },
+    // [ADR-0131 D4] The grant's set BY NAME — the column the guard reads.
+    permission_set: { name: 'permission_set', type: 'text' as const },
     organization_id: { name: 'organization_id', type: 'text' as const },
     valid_from: { name: 'valid_from', type: 'datetime' as const },
     valid_until: { name: 'valid_until', type: 'datetime' as const },
@@ -236,7 +238,7 @@ describe('[#11663 L2] the enumeration counts CONFIG-derived administrators', ()
     await engine.insert('sys_permission_set', { id: 'ps_a', name: ADMIN_FULL_ACCESS, active: true }, SYSTEM);
     await engine.insert(
       'sys_user_permission_set',
-      { id: 'ups_1', user_id: 'usr_grant', permission_set_id: 'ps_a' },
+      { id: 'ups_1', user_id: 'usr_grant', permission_set_id: 'ps_a', permission_set: ADMIN_FULL_ACCESS },
       SYSTEM,
     );
 
@@ -311,7 +313,7 @@ describe('[#11663 L2] the FIFTH write shape is judged', () => {
     await engine.insert('sys_permission_set', { id: 'ps_a', name: ADMIN_FULL_ACCESS, active: true }, SYSTEM);
     await engine.insert(
       'sys_user_permission_set',
-      { id: 'ups_1', user_id: 'usr_owner', permission_set_id: 'ps_a' },
+      { id: 'ups_1', user_id: 'usr_owner', permission_set_id: 'ps_a', permission_set: ADMIN_FULL_ACCESS },
       SYSTEM,
     );
 
@@ -403,7 +405,7 @@ describe('[#11663 L5] under a WALLED posture the legacy grant is not an administ
     await engine.insert('sys_permission_set', { id: 'ps_a', name: ADMIN_FULL_ACCESS, active: true }, SYSTEM);
     await engine.insert(
       'sys_user_permission_set',
-      { id: 'ups_1', user_id: 'usr_legacy', permission_set_id: 'ps_a' },
+      { id: 'ups_1', user_id: 'usr_legacy', permission_set_id: 'ps_a', permission_set: ADMIN_FULL_ACCESS },
       SYSTEM,
     );
     return engine;
@@ -455,7 +457,7 @@ describe('[#11663 L5] under a WALLED posture the legacy grant is not an administ
     await engine.insert('sys_permission_set', { id: 'ps_a', name: ADMIN_FULL_ACCESS, active: true }, SYSTEM);
     await engine.insert(
       'sys_user_permission_set',
-      { id: 'ups_1', user_id: 'usr_legacy', permission_set_id: 'ps_a' },
+      { id: 'ups_1', user_id: 'usr_legacy', permission_set_id: 'ps_a', permission_set: ADMIN_FULL_ACCESS },
       SYSTEM,
     );
 
@@ -476,7 +478,7 @@ describe('[#11663 L5] under a WALLED posture the legacy grant is not an administ
     await engine.insert('sys_permission_set', { id: 'ps_a', name: ADMIN_FULL_ACCESS, active: true }, SYSTEM);
     await engine.insert(
       'sys_user_permission_set',
-      { id: 'ups_1', user_id: 'usr_legacy', permission_set_id: 'ps_a' },
+      { id: 'ups_1', user_id: 'usr_legacy', permission_set_id: 'ps_a', permission_set: ADMIN_FULL_ACCESS },
       SYSTEM,
     );
 
@@ -518,7 +520,7 @@ describe('[#11663 L5] under a WALLED posture the legacy grant is not an administ
     await engine.insert('sys_permission_set', { id: 'ps_a', name: ADMIN_FULL_ACCESS, active: false }, SYSTEM);
     await engine.insert(
       'sys_user_permission_set',
-      { id: 'ups_1', user_id: 'usr_legacy', permission_set_id: 'ps_a' },
+      { id: 'ups_1', user_id: 'usr_legacy', permission_set_id: 'ps_a', permission_set: ADMIN_FULL_ACCESS },
       SYSTEM,
     );
 
@@ -537,7 +539,7 @@ describe('[#11663 L5] under a WALLED posture the legacy grant is not an administ
     await engine.insert('sys_permission_set', { id: 'ps_a', name: ADMIN_FULL_ACCESS, active: false }, SYSTEM);
     await engine.insert(
       'sys_user_permission_set',
-      { id: 'ups_1', user_id: 'usr_legacy', permission_set_id: 'ps_a' },
+      { id: 'ups_1', user_id: 'usr_legacy', permission_set_id: 'ps_a', permission_set: ADMIN_FULL_ACCESS },
       SYSTEM,
     );
 

packages/plugins/plugin-auth/src/last-admin-guard.re-pricing.test.ts

@@ -87,6 +87,8 @@ const sysUserPermissionSet = {
     id: { name: 'id', type: 'text' as const, primaryKey: true },
     user_id: { name: 'user_id', type: 'text' as const },
     permission_set_id: { name: 'permission_set_id', type: 'text' as const },
+    // [ADR-0131 D4] The grant's set BY NAME — the column the guard reads.
+    permission_set: { name: 'permission_set', type: 'text' as const },
     organization_id: { name: 'organization_id', type: 'text' as const },
     valid_from: { name: 'valid_from', type: 'datetime' as const },
     valid_until: { name: 'valid_until', type: 'datetime' as const },
@@ -174,7 +176,7 @@ async function seedGrantAdmin(engine: ObjectQL, userId = 'usr_grant'): Promise<v
   await engine.insert('sys_permission_set', { id: 'ps_admin', name: ADMIN_FULL_ACCESS, active: true }, SYSTEM);
   await engine.insert(
     'sys_user_permission_set',
-    { id: 'ups_admin', user_id: userId, permission_set_id: 'ps_admin' },
+    { id: 'ups_admin', user_id: userId, permission_set_id: 'ps_admin', permission_set: ADMIN_FULL_ACCESS },
     SYSTEM,
   );
 }

packages/plugins/plugin-auth/src/last-admin-guard.test.ts

@@ -140,6 +140,8 @@ const sysUserPermissionSet = {
     id: { name: 'id', type: 'text' as const, primaryKey: true },
     user_id: { name: 'user_id', type: 'text' as const },
     permission_set_id: { name: 'permission_set_id', type: 'text' as const },
+    // [ADR-0131 D4] The grant's set BY NAME — the column the guard reads.
+    permission_set: { name: 'permission_set', type: 'text' as const },
     organization_id: { name: 'organization_id', type: 'text' as const },
     valid_from: { name: 'valid_from', type: 'datetime' as const },
     valid_until: { name: 'valid_until', type: 'datetime' as const },
@@ -150,6 +152,17 @@ const SYSTEM = { context: { isSystem: true } } as const;
 const ORG = 'org_1';
 const PS_ADMIN = 'ps_admin_full_access';
 
+/**
+ * [ADR-0131 D4] The name each fixture set id stands for. Every platform grant
+ * writer stores it beside the id, so a seeded grant carries it too; `ps_gone`
+ * is a set that was deleted after its grants were named.
+ */
+const SET_NAME_OF: Record<string, string> = {
+  [PS_ADMIN]: ADMIN_FULL_ACCESS,
+  ps_member: 'member_default',
+  ps_gone: 'retired_set',
+};
+
 /** Every ban a real deprovision performs is a system-context write. */
 async function ban(engine: ObjectQL, id: string): Promise<unknown> {
   return engine.update('sys_user', { id, banned: true }, SYSTEM);
@@ -280,11 +293,9 @@ async function seedUser(
     );
   }
   if (extra.platformAdmin || extra.grant) {
-    await engine.insert(
-      'sys_user_permission_set',
-      { id: `ups_${id}`, user_id: id, permission_set_id: PS_ADMIN, ...(extra.grant ?? {}) },
-      SYSTEM,
-    );
+    const grant: Record<string, unknown> = { id: `ups_${id}`, user_id: id, permission_set_id: PS_ADMIN, ...(extra.grant ?? {}) };
+    if (!('permission_set' in grant)) grant.permission_set = SET_NAME_OF[String(grant.permission_set_id)];
+    await engine.insert('sys_user_permission_set', grant, SYSTEM);
   }
 }
 
@@ -1916,9 +1927,9 @@ describe('[#6084] a zero-administrator reading is no longer automatically the bo
     await expect(ban(engine, 'usr_platform')).rejects.toThrow(/recognises NO administrator/);
     await expect(ban(engine, 'usr_platform')).rejects.toThrow(/not the bootstrap window/i);
     // Holder and target are both quoted, so an operator can go find the row.
+    // [ADR-0131 D4] The target is the set the grant NAMES — its reference.
     await expect(ban(engine, 'usr_platform')).rejects.toThrow(/'usr_platform'/);
-    await expect(ban(engine, 'usr_platform')).rejects.toThrow(new RegExp(PS_ADMIN));
-    await expect(ban(engine, 'usr_platform')).rejects.toThrow(new RegExp(ADMIN_FULL_ACCESS));
+    await expect(ban(engine, 'usr_platform')).rejects.toThrow(`'usr_platform' → '${ADMIN_FULL_ACCESS}'`);
     await expect(ban(engine, 'usr_platform')).rejects.toThrow(/ADR-0135 D5\.2/);
   });
 

packages/plugins/plugin-auth/src/scim-deactivation-reconcile-user.test.ts

@@ -124,6 +124,8 @@ const sysUserPermissionSet = {
     id: { name: 'id', type: 'text' as const, primaryKey: true },
     user_id: { name: 'user_id', type: 'text' as const },
     permission_set_id: { name: 'permission_set_id', type: 'text' as const },
+    // [ADR-0131 D4] The grant's set BY NAME — the column the guard reads.
+    permission_set: { name: 'permission_set', type: 'text' as const },
     organization_id: { name: 'organization_id', type: 'text' as const },
     valid_from: { name: 'valid_from', type: 'datetime' as const },
     valid_until: { name: 'valid_until', type: 'datetime' as const },
@@ -349,7 +351,7 @@ async function makePlatformAdmin(h: Harness, userId: string): Promise<void> {
   }
   await h.engine.insert(
     'sys_user_permission_set',
-    { id: `ups_${userId}`, user_id: userId, permission_set_id: PS_ADMIN },
+    { id: `ups_${userId}`, user_id: userId, permission_set_id: PS_ADMIN, permission_set: ADMIN_FULL_ACCESS },
     SYSTEM,
   );
 }