From e0ed11936d4bc99a43f2b1442e1dfbdc959bd517 Mon Sep 17 00:00:00 2001 From: Claude Date: Mon, 2 Nov 2026 20:15:54 +0000 Subject: [PATCH] e2e: create the harness's test users as Roles only `TestServer::create_user` invited its accounts with `POST /admin/users` and no `role`, which since the built-in reader role (#733) makes them readers: an unscoped read of every repository, which lifts any selector-scoped or missing grant the tests give them. Seven rbac tests and a group test expected such a user to be refused and failed on main once credforward no longer stopped the e2e run before them. The harness's users are now Roles only, holding the roles a test assigns and nothing else. Fixes #785 Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_012e6DJb6V3DHD5wQrsYhKda --- crates/e2e/src/stack.rs | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/crates/e2e/src/stack.rs b/crates/e2e/src/stack.rs index d5d7a81c..f6a8daa4 100644 --- a/crates/e2e/src/stack.rs +++ b/crates/e2e/src/stack.rs @@ -981,13 +981,18 @@ impl TestServer { /// do (#322): the admin invites it and, with no email service /// configured, gets the invitation link; the user then chooses /// `password` (at least 12 characters) from it. Returns its numeric id. + /// + /// The account is Roles only (`"role": "roles_only"`): it holds the roles + /// a test assigns and nothing else. `POST /admin/users`' default, Reader, + /// would give it the built-in `reader` role, an unscoped read of every + /// repository that lifts any selector-scoped or missing grant (#785). pub async fn create_user(&self, username: &str, password: &str) -> i64 { let (u, p) = self.admin_basic(); let body: serde_json::Value = self .client() .post(format!("{}/admin/users", self.base_url)) .basic_auth(&u, Some(&p)) - .json(&serde_json::json!({"username": username})) + .json(&serde_json::json!({"username": username, "role": "roles_only"})) .send() .await .unwrap()