From d8835c5cdcdacea9570d6a5a9fdb9fd215b0b512 Mon Sep 17 00:00:00 2001 From: zzstoatzz Date: Thu, 3 Sep 2026 02:54:14 -0500 Subject: [PATCH] scopes: test that a permission-set expansion with collections grants space manage actions Co-Authored-By: Claude Fable 5.1 Claude-Session: https://claude.ai/code/session_01Th6389kN3H2AyUae7yEJAW --- src/internal/scopes.zig | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/src/internal/scopes.zig b/src/internal/scopes.zig index 3144484..b40d9a9 100644 --- a/src/internal/scopes.zig +++ b/src/internal/scopes.zig @@ -399,3 +399,13 @@ test "identity scopes constrain attribute" { try std.testing.expect(!identityAllows("identity:handle", .wildcard)); try std.testing.expect(identityAllows("identity:*", .wildcard)); } + +test "a permission-set expansion with collections grants space manage actions" { + const scope = "atproto space:tech.waow.lore.space?authority=*&skey=*&collection=tech.waow.lore.entry&collection=tech.waow.lore.registry&action=read&action=create&action=update&action=delete&manage=create&manage=update&manage=delete"; + const did = "did:plc:siv7zbedip4vcet4v67piibr"; + try std.testing.expect(spaceAllows(scope, .manage_update, "tech.waow.lore.space", did, "1d5d7c37", null)); + try std.testing.expect(spaceAllows(scope, .manage_create, "tech.waow.lore.space", did, "1d5d7c37", null)); + try std.testing.expect(spaceAllows(scope, .create, "tech.waow.lore.space", did, "1d5d7c37", "tech.waow.lore.entry")); + try std.testing.expect(!spaceAllows(scope, .create, "tech.waow.lore.space", did, "1d5d7c37", "tech.waow.other")); + try std.testing.expect(!spaceAllows(scope, .manage_update, "tech.waow.memory.space", did, "1d5d7c37", null)); +} -- 2.51.2