Skip to content

Commit 7f9500a

Browse files
committed
test(plugin-security): the backfill pins read through typed engine query options
Ten read sites erased their options bag to any; the query-options erasure ratchet counted them (test surface 236 to 246). Typed against the engine's own find / findOne signature now, and the count is back at 236. Claude-Session: https://claude.ai/code/session_01WMQprn46CND82KmY8sZWBu Co-authored-by: Claude <noreply@anthropic.com>
1 parent 788d6e2 commit 7f9500a

1 file changed

Lines changed: 10 additions & 10 deletions

File tree

‎packages/plugins/plugin-security/src/grant-permission-set-name-backfill.test.ts‎

Lines changed: 10 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -212,7 +212,7 @@ async function insertUnnamedGrants(engine: Engine, rows: Array<Record<string, un
212212
async function clearAllNames(engine: Engine): Promise<void> {
213213
unregisterGrantPermissionSetNameHooks(engine);
214214
try {
215-
const rows = (await engine.find('sys_user_permission_set', { fields: ['id'], context: SYS } as any)) as any[];
215+
const rows = (await engine.find('sys_user_permission_set', { fields: ['id'], context: SYS })) as any[];
216216
for (const row of rows) {
217217
await engine.update('sys_user_permission_set', { id: row.id, permission_set: null }, { context: SYS } as any);
218218
}
@@ -226,19 +226,19 @@ async function grants(engine: Engine): Promise<Array<Record<string, any>>> {
226226
fields: ['id', 'user_id', 'permission_set_id', 'permission_set', 'organization_id'],
227227
orderBy: [{ field: 'id', order: 'asc' }],
228228
context: SYS,
229-
} as any)) as any[];
229+
})) as any[];
230230
return rows;
231231
}
232232

233233
async function grant(engine: Engine, id: string): Promise<Record<string, any> | null> {
234-
return (await engine.findOne('sys_user_permission_set', { where: { id }, context: SYS } as any)) as any;
234+
return (await engine.findOne('sys_user_permission_set', { where: { id }, context: SYS })) as any;
235235
}
236236

237237
async function ledgerRows(engine: Engine): Promise<Array<Record<string, any>>> {
238238
return (await engine.find(DATA_MIGRATION_FLAG_OBJECT, {
239239
where: { id: GRANT_SET_NAME_BACKFILL_MIGRATION_ID },
240240
context: SYS,
241-
} as any)) as any[];
241+
})) as any[];
242242
}
243243

244244
/** Every string a logger mock was handed — message and meta — for disclosure checks. */
@@ -272,7 +272,7 @@ async function seedPrincipals(world: World, posture: Posture): Promise<void> {
272272

273273
if (posture === 'isolated') {
274274
for (const name of ['organization_admin', 'organization_admin_no_bypass', 'viewer_readonly']) {
275-
const [bucket] = (await engine.find('sys_permission_set', { where: { name }, context: SYS } as any)) as any[];
275+
const [bucket] = (await engine.find('sys_permission_set', { where: { name }, context: SYS })) as any[];
276276
const { id: _id, created_at: _c, updated_at: _u, ...rest } = bucket;
277277
await insertSet(engine, { ...rest, id: `ps_${name}_${ORG}`, organization_id: ORG }, ORG);
278278
}
@@ -288,7 +288,7 @@ async function seedPrincipals(world: World, posture: Posture): Promise<void> {
288288
const [viewer] = (await engine.find('sys_permission_set', {
289289
where: { name: 'viewer_readonly', ...(posture === 'isolated' ? { organization_id: ORG } : {}) },
290290
context: SYS,
291-
} as any)) as any[];
291+
})) as any[];
292292
await engine.insert(
293293
'sys_user_permission_set',
294294
{ user_id: 'usr_member', permission_set_id: viewer.id },
@@ -339,7 +339,7 @@ describe('[ADR-0131 D4] grant name backfill — every name agrees with the id an
339339
// the shape grants written before the per-organization catalog carry.
340340
const [bucketViewer] = (await engine.find('sys_permission_set', {
341341
where: { name: 'viewer_readonly', organization_id: null }, context: SYS,
342-
} as any)) as any[];
342+
})) as any[];
343343
await insertUnnamedGrants(engine, [
344344
{ id: 'g_bucket', user_id: 'usr_orgadmin', permission_set_id: bucketViewer.id, organization_id: ORG },
345345
]);
@@ -354,7 +354,7 @@ describe('[ADR-0131 D4] grant name backfill — every name agrees with the id an
354354
expect(outcome.backfill?.named.length).toBe(before.length);
355355

356356
for (const g of await grants(engine)) {
357-
const [set] = (await engine.find('sys_permission_set', { where: { id: g.permission_set_id }, context: SYS } as any)) as any[];
357+
const [set] = (await engine.find('sys_permission_set', { where: { id: g.permission_set_id }, context: SYS })) as any[];
358358
expect(g.permission_set, g.id).toBe(set.name);
359359
const entry = await catalog.resolve('permission', g.permission_set);
360360
expect(entry?.name, g.id).toBe(g.permission_set);
@@ -472,7 +472,7 @@ describe('[ADR-0131 D4] grant name backfill — a name never crosses organizatio
472472
await insertSet(engine, { id: 'ps_own', name: OWN_SET.name, label: 'Reviewer' }, ORG);
473473
const [bucketViewer] = (await engine.find('sys_permission_set', {
474474
where: { name: 'viewer_readonly', organization_id: null }, context: SYS,
475-
} as any)) as any[];
475+
})) as any[];
476476
await insertUnnamedGrants(engine, [
477477
// The organization's grant on the other organization's set.
478478
{ id: 'g_cross', user_id: 'usr_member', permission_set_id: 'ps_other', organization_id: ORG },
@@ -569,7 +569,7 @@ describe('[ADR-0131 D4] grant name backfill — the write path', () => {
569569
});
570570
expect(outcome.status).toBe('ran');
571571
for (const g of await grants(world.engine)) {
572-
const [set] = (await world.engine.find('sys_permission_set', { where: { id: g.permission_set_id }, context: SYS } as any)) as any[];
572+
const [set] = (await world.engine.find('sys_permission_set', { where: { id: g.permission_set_id }, context: SYS })) as any[];
573573
expect(g.permission_set, g.id).toBe(set.name);
574574
}
575575
});

0 commit comments

Comments
 (0)