From 5a1139b9253bc40aa334084d9f70b2826e867194 Mon Sep 17 00:00:00 2001 From: antoinetoussaint-byte <312536060+antoinetoussaint-byte@users.noreply.github.com> Date: Sun, 25 Oct 2026 21:56:52 -0400 Subject: [PATCH 1/2] test: a new grant leaves existing capabilities valid (spec review r98) f1: the revoke case issues two capabilities, grants the holder a new role and an unrelated person a role, and requires both capabilities to still check. f2: gofmt the Go owner target. Co-Authored-By: Claude Opus 5.5 --- .../go/workcontext/owner_target_test.go | 1 - libraries/conformance/go/solution_principal.go | 10 ++++++++++ 2 files changed, 10 insertions(+), 1 deletion(-) diff --git a/libraries/authority-client/go/workcontext/owner_target_test.go b/libraries/authority-client/go/workcontext/owner_target_test.go index b18a69ed..d027b6c2 100644 --- a/libraries/authority-client/go/workcontext/owner_target_test.go +++ b/libraries/authority-client/go/workcontext/owner_target_test.go @@ -118,4 +118,3 @@ func TestScopesKeepTheirResourceOwner(t *testing.T) { } } } - diff --git a/libraries/conformance/go/solution_principal.go b/libraries/conformance/go/solution_principal.go index ad6b7642..a6e47215 100644 --- a/libraries/conformance/go/solution_principal.go +++ b/libraries/conformance/go/solution_principal.go @@ -462,6 +462,16 @@ func RunSolutionPrincipalTarget(t *testing.T, conn grpc.ClientConnInterface, des sp.grant(t, A, "author", sp.person(t, f.Editor)) before := sp.must(t)(sp.through(t, f.Viewer, A, "store")) unrelated := sp.must(t)(sp.through(t, f.Editor, A, "store")) + // A new grant, to the holder or to anyone else, leaves both valid. + sp.grant(t, A, "author", sp.person(t, f.Viewer)) + sp.grant(t, A, "viewer", sp.person(t, f.Member)) + for _, capability := range []protoreflect.Message{before, unrelated} { + if err := sp.check(capability); err != nil { + t.Fatalf("a new grant invalidated an existing capability: %v", err) + } + } + sp.revoke(t, A, "author", sp.person(t, f.Viewer)) + sp.revoke(t, A, "viewer", sp.person(t, f.Member)) if !slices.Contains(sp.roleGrants(t, f.Admin, f.Organization, A), "viewer person "+sp.personID(t, f.Viewer)) { t.Fatalf("ListRoleGrants does not show the grant: %v", sp.roleGrants(t, f.Admin, f.Organization, A)) } From df3ded26bb1cd79e2b4dfd6d31e88ca66f550df0 Mon Sep 17 00:00:00 2001 From: antoinetoussaint-byte <312536060+antoinetoussaint-byte@users.noreply.github.com> Date: Sun, 25 Oct 2026 22:26:47 -0400 Subject: [PATCH 2/2] test: the last-grant revoke kills a capability that was live (spec review r108) The Viewer's author revoke ran before the viewer revoke, so the 'revoked' check passed even when the last-grant revoke invalidated nothing. Reissue the capability after the two new revokes, so the last-grant revoke must invalidate a live one. Every other revoke check already holds a capability issued just before its own revoke. Co-Authored-By: Claude Opus 5.5 --- libraries/conformance/go/solution_principal.go | 2 ++ 1 file changed, 2 insertions(+) diff --git a/libraries/conformance/go/solution_principal.go b/libraries/conformance/go/solution_principal.go index a6e47215..8d1cef33 100644 --- a/libraries/conformance/go/solution_principal.go +++ b/libraries/conformance/go/solution_principal.go @@ -472,6 +472,8 @@ func RunSolutionPrincipalTarget(t *testing.T, conn grpc.ClientConnInterface, des } sp.revoke(t, A, "author", sp.person(t, f.Viewer)) sp.revoke(t, A, "viewer", sp.person(t, f.Member)) + // Reissued, so the last-grant revoke below must kill a live capability. + before = sp.must(t)(sp.through(t, f.Viewer, A, "store")) if !slices.Contains(sp.roleGrants(t, f.Admin, f.Organization, A), "viewer person "+sp.personID(t, f.Viewer)) { t.Fatalf("ListRoleGrants does not show the grant: %v", sp.roleGrants(t, f.Admin, f.Organization, A)) }