test(plugin-security): give each subject state its own it in the delegated-answer posture pin - #31707

Requested by Steve · project thread

Fixes #31663

The card's preferred fix: the one it that looped every subject state through every door is split into one it per state, the same way in all three postures. Claim 6727396721 (domain:server#1, card-thread session_01ADHkmSaqpcZzCHVZRYpzpW).

Clause-②: no — measured: test-only diff; no source file, request shape or answer changes, so nothing accepted on base is refused on head and nothing refused is accepted.
Metadata-protocol: none

skip-changeset: the diff is one test file under src/ that the package does not ship (plugin-security's files[] publishes dist, README.md, CHANGELOG.md; the built dist/ holds zero hits for this test's title text, against a positive control, DelegationScopeViolationError, in 2 built files), so nothing any released package publishes changes.

维护者速读

• 改了什么：plugin-security 的一个权限测试原来把 4 种"目标用户状态"放在同一个用例里依次跑完，现在每种状态是自己的用例；参照答案（"不存在的用户 id"的答案）在 beforeAll 里只算一次，其余 3 种状态逐一与它比相等。三种租户姿态都同样改。
• 为什么改：4 次完整启动共用默认 5 秒超时，main 上 529e535 那次 CI 分片负载高时超时了一次。拆开后每个用例只启动一次，有自己的 5 秒预算，失败时也能直接看出是哪种状态。
• 风险与回滚：只改测试文件，不改任何产品代码；断言一条没减，跨状态相等仍然保留。回滚即 revert 本 PR。
• 先看：packages/plugins/plugin-security/src/delegated-admin-own-name-set.posture.test.ts 第 878 行起的新 describe。
• 两分钟验证：pnpm --filter @objectstack/plugin-security exec vitest run src/delegated-admin-own-name-set.posture.test.ts —— 预期 202 passed(main 上 193)。
• 需要你做的：无，席位落地。

What changes

• packages/plugins/plugin-security/src/delegated-admin-own-name-set.posture.test.ts — in the describe "a delegated answer about a user the caller cannot read does not depend on that user's existence or memberships", the it "the 4 states get, at every door, the answer the id naming no user gets" becomes a describe of that same title, per posture:
  • beforeAll asks every door once for the reference state, an id naming no user (one rig).
  • it "an id naming no user: the write gate's scope violation, and each explain door's refusal …" holds the reference answer's assertions, unchanged: 403 DELEGATION_SCOPE_VIOLATION at the four write shapes, 403 PERMISSION_DENIED at both explain doors, and the two details pins.
  • it.each over the other three states: each boots its own rig and asserts toEqual(reference). That is the cross-state equality, kept as its own assertion per state, with the state as the failure label.
  • beforeAll joins the vitest import.
• Nothing else. No global testTimeout, no per-test timeout, no skip, no assertion removed or loosened. The forced test edit is this restructuring itself; no other test moved.

Tests

Test count of the file: 106 → 115 on the first head (+3 per posture = 4 states − 1). After merging origin/main (b126c1306, which brought #31634's two describes into this file): 193 on main → 202 on head 8c1ef9f0, the same +9. The whole plugin-security suite on 8c1ef9f0: 1280 files, 6079 tests: 6034 passed, 45 skipped, 0 failed.

Slowest case, 20 consecutive runs of the file each side (vitest run --maxWorkers=3 --sequence.concurrent=false; 3 is CI's VITEST_MAX_WORKERS on the 4-core runner, read from scripts/vitest-worker-cap.mjs), under os-verify-lock, on a 4-core shared container:

On the merged head 8c1ef9f0, 20/20 more runs green, 202/202 each; the slowest split state's p99 is 252 / 268 / 254 ms (group / isolated / single), and the slowest test in the file is the untouched ground truth it at 685 ms.

Slowest case on c2516ef6: 298 ms, posture group, state "a user whose business unit is outside the scope". The reference it itself takes 2–4 ms (the boot is in the beforeAll). In the full-suite run under the package's own load, the slowest split case was 242 ms. 20/20 runs green on base and 20/20 on head.

Reading: on this box the old it used about a fifth of its 5 s budget; CI's timeout came from shard load (Test Core 8/8 runs several packages at once), which this box does not reproduce. After the split each it carries one rig, about a quarter of the old work, against the same 5 s budget.

Acceptance notes

• The ground truth: the delegate reads the subject exactly in the states where it is a user the delegate may read it in the same describe also loops (five rigs, read door only): p99 705–782 ms on base, 737–760 ms on head over the same 20 runs. It is lighter than the split loop was (one read per state, not six doors) and outside this card's Fix; noted, not changed.

Verification

Merge of origin/main (8c1ef9f0). main moved 19 commits; #31634 (18cdcb20) edited this file. The only conflict was the vitest import line (both sides added beforeAll); it resolves to main's line, describe, it, expect, afterEach, beforeAll, afterAll, vi. #31634's tests are kept byte-for-byte: git diff origin/main on the file is exactly this PR's split (+28 / -15). Its describes do not carry the card's shape (their per-state refusals already share one beforeAll rig per state), so nothing of theirs was split. On 8c1ef9f0: 20 × the file under the lock, VERDICT command-exit 0; whole suite as above; typecheck VERDICT command-exit 0; eslint exit 0; dispatch-gates --commands the same 53, all exit 0, --ran 53 derived, 53 run, 0 NOT-MEASURED, 0 UNRUN. CI on 8c1ef9f0: every check suite completed with no failure.

Round 1, all on head c2516ef6, after its last commit:

Generated by Claude Code