test(app-showcase): ADR-0090 configuration-surface test round — positions UI, mapping, developer authoring chain#2915
Merged
Conversation
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
github-actions
Bot
added
documentation
… UI, position→permission-set mapping, developer authoring chain Second round of ADR-0090 permission-model testing covering the configuration surfaces (checklist sections N/O/P): - N: admin configures positions via Setup UI (list, create form, related lists, non-admin denial, built-in anchor delete protection) — 6 cases - O: position→permission-set mapping end-to-end (bind via junction, assign holder, live grant/revoke observed from the assignee's session) — 9 cases - P: developer authoring chain (definePermissionSet → build → boot reprojection, FLS end-to-end with visual proof, access-matrix snapshot gate, package-set 403 write-through, runtime-set lifecycle, seed idempotency) — 7 cases New e2e/permission-model-admin.spec.ts (14 tests, all green; full permission suite 25/25) + 11 evidence screenshots + report §4 configuration-surface details and two new observations (cookie-less FLS render fail-open, lookup column shows target API name).
os-zhuang
added a commit
that referenced
this pull request
Jul 16, 2026
…hen + role-gated option (#2559) (#3006) Adds `showcase_cascade`, a served fixture that exercises the B3 server-side option-value enforcement (objectql `evaluateOptionVisibility`, #2915 / #1583): - country → province cascade — `province` declares `dependsOn: ['country']` and each option gates itself with a `visibleWhen` CEL predicate. The client narrows the offered set; the rule-validator rejects an out-of-set submit (`{ field, code: 'invalid_option' }`). - a role-gated `tier.restricted` option (`'admin' in current_user.positions`), enforced server-side the same way. `public_read_write` (no permission set → absent from the ADR-0090 access-matrix), wired into the Showcase app's Data Model nav. Verified live against a fresh backend: POST /api/v1/data/showcase_cascade rejects country=us+province=zj (400 invalid_option) and accepts country=cn+province=zj (201); GET /api/v1/meta/object/showcase_cascade serves the per-option visibleWhen to the client. Drives objectui e2e/live/cascading-options.spec.ts. Claude-Session: https://claude.ai/code/session_01S91NyYJURiQTKmF9q3AXxg Co-authored-by: Claude <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Second round of ADR-0090 permission-model testing (follow-up to #2910), covering the configuration surfaces the first round didn't touch:
everyone) delete protection. (checklist section N, 6 cases)definePermissionSet→objectstack build→ boot reprojection; FLS change verified end-to-end with before/after screenshots; access-matrix snapshot gate (drift fails the build with a precise message,--update-access-matrixregenerates); package-set edits via env gate rejected with 403 (ADR-0086/0094); runtime-set full lifecycle; seed idempotency. (section P, 7 cases)What's in this PR
e2e/permission-model-admin.spec.ts— new spec, 14 tests, all green (full permission suite now 25/25)playwright.permission.config.ts/playwright.config.ts— glob widened topermission-model*.spec.tsdocs/test/permission-model-test-checklist.md— sections N/O/P addeddocs/test/permission-model-test-report.md— §4 configuration-surface details, §5 two new observations, §6 screenshot indexdocs/test/screenshots/Notable observations (documented in the report)
name(API name), e.g.showcase_auditorinstead of its display label.Destructive cases (P3 source edit + rebuild, P4 matrix drift) are documented as manual-replay steps in the report rather than committed as spec code.
Test plan
PERM_BASE_URL=http://localhost:3777 pnpm exec playwright test --config playwright.permission.config.ts— 25/25 passedsrc/security/permission-sets.ts,access-matrix.jsonmatch main)