test(plugin-auth): the grant-reader suites write the legacy platform-bucket rows they read

The plugin-auth twins of the plugin-security grant-reader suites read the
organization-less `sys_permission_set` rows the platform-admin bootstrap
seeded (organization_admin to clone per organization; viewer_readonly to
point a legacy id at). Once the boot writes no such row, those reads come
back empty. Each suite now models the existing database it describes and
writes the rows itself, before the bootstrap, through a plugin-auth copy of
the plugin-security testkit: same shape, organization-less, idempotent.

Co-Authored-By: Claude <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_013XKtmoR5QCUSTMjiQ3os49

Author: claude

packages/plugins/plugin-auth/src/__tests__/legacy-catalog-rows.testkit.ts

@@ -0,0 +1,61 @@
+// Copyright (c) 2026 ObjectStack. Licensed under the Apache-2.0 license.
+
+/**
+ * Test scaffolding: the organization-less `sys_permission_set` rows an EARLIER
+ * release's platform-admin bootstrap seeded for the platform's default sets
+ * (the "platform bucket").
+ *
+ * [C3 stage 6b-2] No boot writes these rows any more (ADR-0131 D3: the sets are
+ * served from the security catalog, and a grant names its set). A suite that
+ * models an EXISTING database — a grant written before the name column, whose
+ * `permission_set_id` points at one of these rows; an organization's copy cloned
+ * from the bucket — writes them itself, here, in the shape the retired seeder
+ * wrote: `managed_by: 'platform'`, active, the set's facets as JSON columns.
+ * Idempotent: a name that already has an organization-less row is left alone.
+ *
+ * The plugin-auth copy of plugin-security's testkit of the same name, in the
+ * same shape: a test-only helper is not exported across the package boundary.
+ */
+
+import type { PermissionSet } from '@objectstack/spec/security';
+
+const SYS = { isSystem: true } as const;
+
+/** The legacy row id for a default set — stable, so a fixture can point a grant at it. */
+export function legacyBucketRowId(name: string): string {
+  return `ps_bucket_${name}`;
+}
+
+/** Write the legacy platform-bucket row for each set; returns `name → id`. */
+export async function seedLegacyPlatformBucket(
+  engine: { find: (...args: any[]) => Promise<any>; insert: (...args: any[]) => Promise<any> },
+  sets: readonly PermissionSet[],
+): Promise<Record<string, string>> {
+  const ids: Record<string, string> = {};
+  for (const ps of sets) {
+    if (!ps.name) continue;
+    const existing = ((await engine.find('sys_permission_set', { where: { name: ps.name }, context: SYS })) ?? []) as any[];
+    const own = existing.find((r) => !r.organization_id);
+    if (own?.id) {
+      ids[ps.name] = String(own.id);
+      continue;
+    }
+    const id = legacyBucketRowId(ps.name);
+    await engine.insert('sys_permission_set', {
+      id,
+      name: ps.name,
+      label: ps.label ?? ps.name,
+      description: (ps as any).description ?? null,
+      object_permissions: JSON.stringify(ps.objects ?? {}),
+      field_permissions: JSON.stringify(ps.fields ?? {}),
+      system_permissions: JSON.stringify(ps.systemPermissions ?? []),
+      row_level_security: JSON.stringify(ps.rowLevelSecurity ?? []),
+      tab_permissions: JSON.stringify(ps.tabPermissions ?? {}),
+      admin_scope: (ps as any).adminScope ? JSON.stringify((ps as any).adminScope) : null,
+      active: true,
+      managed_by: 'platform',
+    }, { context: SYS });
+    ids[ps.name] = id;
+  }
+  return ids;
+}

packages/plugins/plugin-auth/src/grant-readers-by-name.golden.test.ts

@@ -40,6 +40,7 @@ import { SysMetadataActivation } from '@objectstack/platform-objects/system';
 
 import { registerLastAdminGuard, type LastAdminGuardEngine } from './last-admin-guard.js';
 import { ensureDefaultOrganization } from './ensure-default-organization.js';
+import { seedLegacyPlatformBucket } from './__tests__/legacy-catalog-rows.testkit.js';
 
 const SYS = { isSystem: true } as const;
 const POSTURE_ENV = 'OS_TENANCY_POSTURE';
@@ -153,6 +154,8 @@ async function standingByReader(posture: Posture): Promise<Record<string, unknow
   await user('usr_member', 'member@gra.example', '2025-03-01T00:00:00.000Z');
   await user('usr_agent', 'agent@gra.example', '2025-04-01T00:00:00.000Z');
 
+  // An existing database: the platform-bucket rows an earlier release seeded.
+  await seedLegacyPlatformBucket(engine, bootstrapSets);
   const boot = await bootstrapPlatformAdmin(engine, bootstrapSets);
   expect(boot.adminPromoted).toBe(posture === 'single');
   if (walled) {

packages/plugins/plugin-auth/src/grant-readers-unnamed-grant.test.ts

@@ -36,6 +36,7 @@ import { SysUser, SysAccount, SysMember, SysOrganization } from '@objectstack/pl
 
 import { registerLastAdminGuard, type LastAdminGuardEngine } from './last-admin-guard.js';
 import { ensureDefaultOrganization } from './ensure-default-organization.js';
+import { seedLegacyPlatformBucket } from './__tests__/legacy-catalog-rows.testkit.js';
 
 const SYS = { context: { isSystem: true } } as any;
 const GUARD_PACKAGE = 'test.grant-readers-unnamed';
@@ -122,6 +123,8 @@ async function soleGrantAnchoredAdmin(): Promise<Rig> {
       'sys_account', { id: `acc_${id}`, user_id: id, account_id: `${id}@un.example`, provider_id: 'credential' }, SYS,
     );
   }
+  // An existing database: the platform-bucket rows an earlier release seeded.
+  await seedLegacyPlatformBucket(engine, (manifest.permissions ?? []) as any[]);
   const boot = await bootstrapPlatformAdmin(engine, (manifest.permissions ?? []) as any[]);
   expect(boot).toMatchObject({ adminPromoted: true });
   return { engine };