test(service-storage): pin the #24366 fake engine to the engine contract; docs: storage refuses a gated session

The new pin's fake engine opens findOne with assertEngineFindOnePredicate and
update with assertEngineUpdateDispatch, as check:engine-double-contract
requires, and the pinned ledger records it. The authentication docs now say
that the storage routes refuse a gated session whatever else the request
carries.

Claude-Session: https://claude.ai/code/session_01Nk17Z26X5DB59iQztDBADH
Co-authored-by: Claude <noreply@anthropic.com>

Author: claude

content/docs/permissions/authentication.mdx

@@ -610,9 +610,11 @@ often before the account-level lock engages.
 > enrollment is refused with the same `403 MFA_REQUIRED` and message on every
 > face that admits keys. `PASSWORD_EXPIRED` and `PASSWORD_RESET_REQUIRED` hold
 > *password sign-in* only, so the owner's API keys keep working. The refusal is
-> not a revocation: the same key works again the moment its owner enrolls. A
-> request is judged by the credential that admitted it, so a session cookie
-> sent beside an API key never answers for the key. The auth endpoints (sign-in, change-password, two-factor enrollment
+> not a revocation: the same key works again the moment its owner enrolls. By
+> default a request is judged by the credential that admitted it, so a session
+> cookie sent beside an API key never answers for the key. The storage routes
+> are the exception: there a gated session is refused whatever else the
+> request carries. The auth endpoints (sign-in, change-password, two-factor enrollment
 > and sign-out among them) and a short allow-list kept with that decision
 > (health and discovery among them) still pass, so the user can remediate. Platform administration is not part of that exemption: the
 > platform-admin actions refuse a gated session with the same `403`, a platform

packages/services/service-storage/src/storage-routes.family-gate-credential.pin.test.ts

@@ -38,6 +38,7 @@ import { promises as fs } from 'node:fs';
 import { join } from 'node:path';
 import { tmpdir } from 'node:os';
 import { ObjectKernel, hashApiKey } from '@objectstack/core';
+import { assertEngineFindOnePredicate, assertEngineUpdateDispatch } from '@objectstack/objectql';
 import type { IHttpRequest, IHttpResponse, RouteHandler } from '@objectstack/spec/contracts';
 import { LocalStorageAdapter } from './local-storage-adapter.js';
 import { mountStorageRoutes } from './mount-storage-routes.js';
@@ -115,10 +116,14 @@ function services(sessionReads: { n: number }) {
       return typeof q?.limit === 'number' ? rows.slice(0, q.limit) : rows;
     },
     async findOne(object: string, q: any = {}) {
+      assertEngineFindOnePredicate(object, q);
       return (tables[object] ?? []).find((row) => matches(row, q?.where)) ?? null;
     },
     async insert(_object: string, row: any) { return row; },
-    async update(_object: string, row: any) { return row; },
+    async update(_object: string, patch: any, q: any = {}) {
+      assertEngineUpdateDispatch(patch, q);
+      return patch;
+    },
   };
   const sessions: Record<string, Gate | undefined> = { [HELD_USER]: PASSWORD_EXPIRED, [OK_USER]: undefined };
   return {

scripts/engine-double-contract.pinned.json

@@ -4591,6 +4591,16 @@
       "verb": "update",
       "pinned": 1
     },
+    {
+      "file": "packages/services/service-storage/src/storage-routes.family-gate-credential.pin.test.ts",
+      "verb": "findOne",
+      "pinned": 1
+    },
+    {
+      "file": "packages/services/service-storage/src/storage-routes.family-gate-credential.pin.test.ts",
+      "verb": "update",
+      "pinned": 1
+    },
     {
       "file": "packages/services/service-storage/src/storage-routes.metadata-outage.test.ts",
       "verb": "delete",