test(plugin-security): spy on the real engine instead of a literal double; bound the bootstrap double's find

Claude-Session: https://claude.ai/code/session_01WkL6Eijt432S1Y7ekb6ovQ
Co-authored-by: Claude <noreply@anthropic.com>

Author: claude

packages/plugins/plugin-security/src/bootstrap-platform-admin-refused-existence-read.test.ts

@@ -14,29 +14,30 @@
  *
  * The double below has no `update` or `delete` member — the seed pass without
  * `resync` calls neither — so it is not an engine double those dispatch
- * contracts govern. Its `find` either answers from its rows or throws, which
- * are exactly the two inputs the pass must tell apart.
+ * contracts govern. Its `find` answers from its rows, bounded by the caller's
+ * `limit`; the refused read is a spy laid over it, so the two inputs the pass
+ * must tell apart — an answer, and a throw — come from one table.
  */
 
-import { describe, it, expect } from 'vitest';
+import { describe, it, expect, afterEach, vi } from 'vitest';
 import { bootstrapPlatformAdmin } from './bootstrap-platform-admin.js';
 
-function makeQl(opts: { refuseReads: boolean; rows?: any[] }) {
-  const rows: any[] = (opts.rows ?? []).map((r) => ({ ...r }));
+afterEach(() => { vi.restoreAllMocks(); });
+
+function makeQl(seedRows: any[] = []) {
+  const rows: any[] = seedRows.map((r) => ({ ...r }));
   const inserted: any[] = [];
   return {
     rows,
     inserted,
     async find(object: string, q: any) {
-      if (object === 'sys_permission_set' && opts.refuseReads) {
-        throw new Error('fake outage: sys_permission_set read refused');
-      }
       if (object !== 'sys_permission_set') return [];
       const where = q?.where ?? {};
-      return rows.filter((r) => Object.entries(where).every(([k, v]) => {
+      const matched = rows.filter((r) => Object.entries(where).every(([k, v]) => {
         if (k.startsWith('$')) throw new Error(`fake driver: unsupported operator ${k}`);
         return r[k] === v;
       }));
+      return typeof q?.limit === 'number' ? matched.slice(0, q.limit) : matched;
     },
     async insert(object: string, data: any) {
       if (object !== 'sys_permission_set') return null;
@@ -47,6 +48,15 @@ function makeQl(opts: { refuseReads: boolean; rows?: any[] }) {
   };
 }
 
+/** Every `sys_permission_set` read now throws; every other read still answers. */
+function refuseSetReads(ql: ReturnType<typeof makeQl>): void {
+  const answer = ql.find.bind(ql);
+  vi.spyOn(ql, 'find').mockImplementation(async (object: string, q: any) => {
+    if (object === 'sys_permission_set') throw new Error('fake outage: sys_permission_set read refused');
+    return answer(object, q);
+  });
+}
+
 const set = (name: string) => ({ name, label: name, objects: {}, systemPermissions: [] }) as any;
 
 function capture() {
@@ -56,7 +66,8 @@ function capture() {
 
 describe('#22169 — bootstrapPlatformAdmin declines the insert when its existence read was refused', () => {
   it('a refused read inserts NOTHING, and says so once for the whole pass', async () => {
-    const ql = makeQl({ refuseReads: true, rows: [{ id: 'ps_existing', name: 'admin_full_access' }] });
+    const ql = makeQl([{ id: 'ps_existing', name: 'admin_full_access' }]);
+    refuseSetReads(ql);
     const { warns, logger } = capture();
 
     const r = await bootstrapPlatformAdmin(ql, [set('admin_full_access'), set('member_default'), set('viewer_readonly')], { logger });
@@ -73,7 +84,7 @@ describe('#22169 — bootstrapPlatformAdmin declines the insert when its existen
   });
 
   it('control: an EMPTY answer is still "absent" — a fresh install seeds every default set', async () => {
-    const ql = makeQl({ refuseReads: false });
+    const ql = makeQl();
     const { warns, logger } = capture();
 
     const r = await bootstrapPlatformAdmin(ql, [set('admin_full_access'), set('member_default')], { logger });
@@ -84,7 +95,7 @@ describe('#22169 — bootstrapPlatformAdmin declines the insert when its existen
   });
 
   it('control: an existing row is found and left alone — no insert, no unreadable line', async () => {
-    const ql = makeQl({ refuseReads: false, rows: [{ id: 'ps_existing', name: 'member_default' }] });
+    const ql = makeQl([{ id: 'ps_existing', name: 'member_default' }]);
     const { warns, logger } = capture();
 
     await bootstrapPlatformAdmin(ql, [set('member_default')], { logger });

packages/plugins/plugin-security/src/permission-set-projection-heal-by-id.test.ts

@@ -27,16 +27,15 @@
  * the only shape that can hold duplicates, and a table that already holds them
  * can never build the index again.
  *
- * The engine is OBSERVED, never replaced: every verb forwards to it, and the
- * dispatch-shaped verbs open with the producer's own predicates
- * (`check:engine-double-contract`). The protocol is a counting stub — what is
- * pinned about it is whether it is CALLED, which a stub answers exactly.
+ * The engine is SPIED, never replaced: each spied verb counts and then runs
+ * the real method, so no double stands between the heal and the engine's own
+ * dispatch contract. The protocol is a counting stub — what is pinned about it
+ * is whether it is CALLED, which a stub answers exactly.
  */
 
-import { describe, it, expect, afterEach } from 'vitest';
+import { describe, it, expect, afterEach, vi } from 'vitest';
 import { ObjectQL } from '@objectstack/objectql';
 import { SqlDriver } from '@objectstack/driver-sql';
-import { assertEngineFindOnePredicate, assertEngineUpdateDispatch } from '@objectstack/metadata-core';
 
 import { SysPermissionSet } from './objects/sys-permission-set.object.js';
 import {
@@ -81,6 +80,7 @@ const driftedRow = (id: string, name: string) => ({
 
 const engines: ObjectQL[] = [];
 afterEach(async () => {
+  vi.restoreAllMocks();
   while (engines.length) {
     try { await engines.pop()?.destroy(); } catch { /* noop */ }
   }
@@ -111,33 +111,43 @@ async function boot(declaredNames: string[], rows: Array<Record<string, any>>):
   return engine;
 }
 
-/** The real engine with its verbs counted; `refuseNameReads` makes every by-name read of the table throw. */
+/**
+ * The real engine with its verbs SPIED — every call still runs the real method,
+ * so the engine's own dispatch contract answers it; the spies only count and,
+ * when `refuseNameReads` is set, make a by-name read of the table throw.
+ *
+ * `withRegistry: false` hands the heal the same engine with `registry` hidden,
+ * the shape of a kernel whose SchemaRegistry is not readable — the one shape
+ * whose trust rule still reads the layered item.
+ */
 function observe(engine: any, opts: { withRegistry?: boolean } = {}) {
-  const log = { updatedIds: [] as string[], inserts: 0, nameReads: 0 };
+  const log = { updatedIds: [] as string[], inserts: 0 };
   const state = { refuseNameReads: false };
-  const ql: any = {
-    ...(opts.withRegistry === false ? {} : { registry: engine.registry }),
-    find: async (o: string, q?: any, opt?: any) => {
-      if (o === 'sys_permission_set' && q?.where && typeof q.where === 'object' && 'name' in q.where) {
-        log.nameReads += 1;
-        if (state.refuseNameReads) throw new Error('fake outage: the by-name read was refused');
-      }
-      return engine.find(o, q, opt);
-    },
-    findOne: (o: string, q?: any, opt?: any) => {
-      assertEngineFindOnePredicate(o, q);
-      return engine.findOne(o, q, opt);
-    },
-    insert: async (o: string, d: any, opt?: any) => {
-      if (o === 'sys_permission_set') log.inserts += 1;
-      return engine.insert(o, d, opt);
-    },
-    update: async (o: string, d: any, opt?: any) => {
-      assertEngineUpdateDispatch(d, opt);
-      if (o === 'sys_permission_set') log.updatedIds.push(String(d?.id));
-      return engine.update(o, d, opt);
-    },
-  };
+  const realFind = engine.find.bind(engine);
+  const realInsert = engine.insert.bind(engine);
+  const realUpdate = engine.update.bind(engine);
+  vi.spyOn(engine, 'find').mockImplementation(async (o: any, q?: any, opt?: any) => {
+    const byName = o === 'sys_permission_set' && q?.where && typeof q.where === 'object' && 'name' in q.where;
+    if (byName && state.refuseNameReads) throw new Error('fake outage: the by-name read was refused');
+    return realFind(o, q, opt);
+  });
+  vi.spyOn(engine, 'insert').mockImplementation(async (o: any, d: any, opt?: any) => {
+    if (o === 'sys_permission_set') log.inserts += 1;
+    return realInsert(o, d, opt);
+  });
+  vi.spyOn(engine, 'update').mockImplementation(async (o: any, d: any, opt?: any) => {
+    if (o === 'sys_permission_set') log.updatedIds.push(String(d?.id));
+    return realUpdate(o, d, opt);
+  });
+  const ql = opts.withRegistry === false
+    ? new Proxy(engine, {
+      get(target, prop) {
+        if (prop === 'registry') return undefined;
+        const value = Reflect.get(target, prop, target);
+        return typeof value === 'function' ? value.bind(target) : value;
+      },
+    })
+    : engine;
   return { ql, log, state };
 }