Pick any line to see why it is the way it is: the commit, the pull request and issue it came from, and what the agent was thinking.
| The artifacts service is services/artifacts, the Worker g1t-artifacts, bound as ARTIFACTS by the API, the site and the agents; its live rooms move to it with a Durable Object transfer from g1t-docs-service, and its database, bucket, indexes and queue keep their names. The git store's binding and settings are GITSTORE, its ops scripts gitstore-*, and workflow run artifacts keep their compatible API under run_artifacts modules. The deploy tool puts a Worker that has never deployed before the Workers in its stage that bind to it, and the deploy guide gives the cutover runbook. | 1 | import assert from "node:assert/strict"; |
| 2 | import { test } from "node:test"; | |
| 3 | ||
| Chat, artifacts and notifications no longer serve g1t's own agents. Direct messages and conversation invites take people only, and a space or folio is shared with people and teams. Chat stops waking agents, drops the RPCs agents posted, read, searched and handed off through, and stops answering buttons on agent cards; old cards keep their links. An agent's old messages still show, under its saved name or as "A deleted agent". Artifacts drops the folio and docs RPCs agents read and edited pages with, and an old agent member of a space can still be removed. Notifications drop "an agent is waiting on you". A deployment no longer trusts a pull request with secrets just because g1t's agent opened it, and the sign-up card no longer promises a team of agents. | 4 | import { atLeast, leavesNoManager, readableByWorkspace, roleOf, type Person, type SpaceRules } from "./access.ts"; |
| The artifacts service is services/artifacts, the Worker g1t-artifacts, bound as ARTIFACTS by the API, the site and the agents; its live rooms move to it with a Durable Object transfer from g1t-docs-service, and its database, bucket, indexes and queue keep their names. The git store's binding and settings are GITSTORE, its ops scripts gitstore-*, and workflow run artifacts keep their compatible API under run_artifacts modules. The deploy tool puts a Worker that has never deployed before the Workers in its stage that bind to it, and the deploy guide gives the cutover runbook. | 5 | |
| 6 | const ana: Person = { user_id: "u1", owner: false, teams: new Set(["web"]) }; | |
| 7 | const bo: Person = { user_id: "u2", owner: false, teams: new Set() }; | |
| 8 | const owner: Person = { user_id: "u9", owner: true, teams: new Set() }; | |
| 9 | ||
| 10 | const workspace: SpaceRules = { kind: "workspace", team: null, default_role: "edit", members: [] }; | |
| 11 | const team: SpaceRules = { kind: "team", team: "web", default_role: "comment", members: [] }; | |
| 12 | const secret: SpaceRules = { kind: "private", team: null, default_role: null, members: [{ principal: "user:u1", role: "manage" }] }; | |
| 13 | ||
| 14 | test("workspace spaces give every member their base role", () => { | |
| 15 | assert.equal(roleOf(workspace, ana), "edit"); | |
| 16 | assert.equal(roleOf(workspace, bo), "edit"); | |
| 17 | }); | |
| 18 | ||
| 19 | test("team spaces give the team's members their base role, and nobody else anything", () => { | |
| 20 | assert.equal(roleOf(team, ana), "comment"); | |
| 21 | assert.equal(roleOf(team, bo), null); | |
| 22 | }); | |
| 23 | ||
| 24 | test("a listing raises a role but never lowers it", () => { | |
| 25 | const raised: SpaceRules = { ...team, members: [{ principal: "user:u1", role: "manage" }, { principal: "user:u2", role: "view" }] }; | |
| 26 | assert.equal(roleOf(raised, ana), "manage"); | |
| 27 | assert.equal(roleOf(raised, bo), "view"); | |
| 28 | const lowered: SpaceRules = { ...workspace, members: [{ principal: "user:u2", role: "view" }] }; | |
| 29 | assert.equal(roleOf(lowered, bo), "edit"); | |
| 30 | }); | |
| 31 | ||
| 32 | test("a team listed on a space reaches its members", () => { | |
| 33 | const listed: SpaceRules = { ...secret, members: [{ principal: "team:WEB", role: "edit" }] }; | |
| 34 | assert.equal(roleOf(listed, ana), "edit"); | |
| 35 | assert.equal(roleOf(listed, bo), null); | |
| 36 | }); | |
| 37 | ||
| 38 | test("owners manage workspace and team spaces, but a private space is its members' alone", () => { | |
| 39 | assert.equal(roleOf(team, owner), "manage"); | |
| 40 | assert.equal(roleOf(secret, owner), null); | |
| 41 | assert.equal(roleOf(secret, ana), "manage"); | |
| 42 | }); | |
| 43 | ||
| Chat, artifacts and notifications no longer serve g1t's own agents. Direct messages and conversation invites take people only, and a space or folio is shared with people and teams. Chat stops waking agents, drops the RPCs agents posted, read, searched and handed off through, and stops answering buttons on agent cards; old cards keep their links. An agent's old messages still show, under its saved name or as "A deleted agent". Artifacts drops the folio and docs RPCs agents read and edited pages with, and an old agent member of a space can still be removed. Notifications drop "an agent is waiting on you". A deployment no longer trusts a pull request with secrets just because g1t's agent opened it, and the sign-up card no longer promises a team of agents. | 44 | test("a space is readable by the whole workspace only when it is open with a base role", () => { |
| The artifacts service is services/artifacts, the Worker g1t-artifacts, bound as ARTIFACTS by the API, the site and the agents; its live rooms move to it with a Durable Object transfer from g1t-docs-service, and its database, bucket, indexes and queue keep their names. The git store's binding and settings are GITSTORE, its ops scripts gitstore-*, and workflow run artifacts keep their compatible API under run_artifacts modules. The deploy tool puts a Worker that has never deployed before the Workers in its stage that bind to it, and the deploy guide gives the cutover runbook. | 45 | assert.equal(readableByWorkspace(workspace), true); |
| 46 | assert.equal(readableByWorkspace(team), false); | |
| 47 | assert.equal(readableByWorkspace({ ...workspace, default_role: null }), false); | |
| 48 | }); | |
| 49 | ||
| 50 | test("roles order view < comment < edit < manage", () => { | |
| 51 | assert.equal(atLeast("comment", "view"), true); | |
| 52 | assert.equal(atLeast("comment", "edit"), false); | |
| 53 | assert.equal(atLeast(null, "view"), false); | |
| 54 | }); | |
| 55 | ||
| 56 | test("a private space keeps someone who can manage it", () => { | |
| 57 | const members = [ | |
| 58 | { principal: "user:u1", role: "manage" as const }, | |
| 59 | { principal: "user:u2", role: "edit" as const }, | |
| 60 | ]; | |
| 61 | assert.equal(leavesNoManager("private", members, "user:u1", null), true); | |
| 62 | assert.equal(leavesNoManager("private", members, "user:u1", "edit"), true); | |
| 63 | assert.equal(leavesNoManager("private", members, "user:u2", null), false); | |
| 64 | assert.equal(leavesNoManager("workspace", members, "user:u1", null), false); | |
| 65 | }); |
