[schmitch]

Fixes #785

What

With #780 merged, the e2e job on main gets past credforward and fails in group. cargo test stops after the first failing test binary, so these tests had not run on main since #734. A local run of every e2e test file on 8ced3fe found eight failures:

• group: prefer_hosted_shields_internal_id_from_selector_scoped_tokens.
• rbac, seven tests:
  • matrix_read_write_any_and_fail_closed
  • content_selector_filters_reads_and_package_mutations
  • fresh_install_defaults_closed_over_http
  • signed_in_user_gets_no_public_reach_when_anonymous_access_is_off
  • signed_in_user_reads_anonymous_readable_repos
  • nested_group_visibility_honors_privileges
  • cross_instance_cache_invalidation_on_grant_change

All eight have the cause of #748. TestServer::create_user invited its accounts with POST /admin/users and no role, which since #734 (#733) makes them readers: the built-in reader role, an unscoped read of every repository. The tests use these accounts as roleless. A reader's unscoped read lifts every selector-scoped or missing grant, because grants combine as a union (EffectiveSet::package_filter_for). The product behaves as #733 intends; the tests predate it.

create_user now invites Roles-only accounts ("role": "roles_only"), which hold the roles a test assigns and nothing else. A test-only change, so there is no changelog fragment.

Why it blocks 2.2.0

release.yml needs a CI run of the tagged commit that passed every job in REQUIRED_JOBS, e2e included.

Tests

Locally, with this change, every e2e file that calls create_user passes:

File	Result
rbac	12 passed (5 before)
group	4 passed (3 before)
auth	4 passed
client_logins	1 passed
credforward	17 passed
token_exchange	14 passed

The other 15 e2e files passed on 8ced3fe already and don't call create_user. cargo clippy -p forge-e2e --features forge-e2e --all-targets -- -D warnings and cargo fmt --check are clean.

---

Generated by Claude Code