@@ -655,3 +655,69 @@ describe('[#11663 L5] standing across postures — three arms invariant, the leg
655655 expect ( seen [ 3 ] ) . toBe ( 'MEMBER|' ) ;
656656 } ) ;
657657} ) ;
658+
659+ /**
660+ * [ADR-0131 D5] The `single` promotion's grant row is OWNED BY THE DEFAULT
661+ * ORGANIZATION (#11979, maintainer ruling A on #18707), so the anchor reads that
662+ * row — one derivation site, the posture its parameter. Before this, the anchor
663+ * read the organization-less row only, so a promoted rig whose grant D10's
664+ * ceremony (or the promotion itself) had given the Default Organization resolved
665+ * a zero-admin deployment.
666+ */
667+ describe ( '[ADR-0131 D5] under `single` the Default Organization\'s admin_full_access grant is the anchor' , ( ) => {
668+ const ownedBy = ( organizationId : string , organizations : Array < Record < string , unknown > > ) => ( {
669+ ...legacyTables ( ) ,
670+ sys_organization : organizations ,
671+ sys_user_permission_set : [
672+ { id : 'ups_1' , user_id : 'usr_1' , permission_set : ADMIN_FULL_ACCESS , organization_id : organizationId } ,
673+ ] ,
674+ } ) ;
675+ const DEFAULT_ONLY = [ { id : 'org_default' , slug : 'default' } ] ;
676+
677+ it ( '⭐ confers PLATFORM_ADMIN with no config at all — in the Default Organization and with no active organization' , async ( ) => {
678+ for ( const tenantId of [ 'org_default' , undefined ] ) {
679+ const grants = await resolveUserAuthzGrants ( makeQl ( ownedBy ( 'org_default' , DEFAULT_ONLY ) ) , 'usr_1' , { nowMs : NOW , tenantId } ) ;
680+ expect ( grants . posture , String ( tenantId ) ) . toBe ( 'PLATFORM_ADMIN' ) ;
681+ expect ( grants . positions [ 0 ] ) . toBe ( 'platform_admin' ) ;
682+ // The anchoring grant applies wherever the principal acts, as the
683+ // organization-less row it replaces did: the set comes with the standing.
684+ expect ( grants . permissions ) . toContain ( ADMIN_FULL_ACCESS ) ;
685+ }
686+ } ) ;
687+
688+ it ( 'the sole organization is the Default Organization whatever its slug — the boot invariant\'s definition' , async ( ) => {
689+ const grants = await resolveUserAuthzGrants (
690+ makeQl ( ownedBy ( 'org_only' , [ { id : 'org_only' , slug : 'acme' } ] ) ) , 'usr_1' , { nowMs : NOW , tenantId : 'org_only' } ,
691+ ) ;
692+ expect ( grants . posture ) . toBe ( 'PLATFORM_ADMIN' ) ;
693+ } ) ;
694+
695+ it ( '⛔ another organization\'s grant of the set confers the set in that organization, never standing' , async ( ) => {
696+ const orgs = [ { id : 'org_default' , slug : 'default' } , { id : 'org_b' , slug : 'b' } ] ;
697+ const grants = await resolveUserAuthzGrants ( makeQl ( ownedBy ( 'org_b' , orgs ) ) , 'usr_1' , { nowMs : NOW , tenantId : 'org_b' } ) ;
698+ expect ( grants . permissions ) . toContain ( ADMIN_FULL_ACCESS ) ;
699+ expect ( grants . posture ) . toBe ( 'MEMBER' ) ;
700+ expect ( grants . positions ) . not . toContain ( 'platform_admin' ) ;
701+ } ) ;
702+
703+ it ( '⛔ several organizations and none of them `default` name no Default Organization, so nothing anchors' , async ( ) => {
704+ const orgs = [ { id : 'org_a' , slug : 'a' } , { id : 'org_b' , slug : 'b' } ] ;
705+ const grants = await resolveUserAuthzGrants ( makeQl ( ownedBy ( 'org_a' , orgs ) ) , 'usr_1' , { nowMs : NOW , tenantId : 'org_a' } ) ;
706+ expect ( grants . posture ) . toBe ( 'MEMBER' ) ;
707+ } ) ;
708+
709+ it ( '⛔ a WALLED rig derives nothing from the Default Organization\'s grant either, and does not ask which one it is' , async ( ) => {
710+ requestPosture ( 'isolated' ) ;
711+ const ql = makeQl ( ownedBy ( 'org_default' , DEFAULT_ONLY ) ) ;
712+ const grants = await resolveUserAuthzGrants ( ql , 'usr_1' , { nowMs : NOW , tenantId : 'org_default' } ) ;
713+ expect ( grants . posture ) . toBe ( 'MEMBER' ) ;
714+ expect ( ql . calls . map ( ( c ) => c . object ) ) . not . toContain ( 'sys_organization' ) ;
715+ } ) ;
716+
717+ it ( 'the organization-less row a pre-D5 promotion wrote still anchors, and asks no organization read' , async ( ) => {
718+ const ql = makeQl ( { ...legacyTables ( ) , sys_organization : DEFAULT_ONLY } ) ;
719+ const grants = await resolveUserAuthzGrants ( ql , 'usr_1' , { nowMs : NOW } ) ;
720+ expect ( grants . posture ) . toBe ( 'PLATFORM_ADMIN' ) ;
721+ expect ( ql . calls . map ( ( c ) => c . object ) ) . not . toContain ( 'sys_organization' ) ;
722+ } ) ;
723+ } ) ;
0 commit comments