feat(device-core): add control resource ledger

2026-08-10 19:05:48 +03:00
parent 422ddb020f
commit 43dc9b1f45
15 changed files with 2214 additions and 0 deletions
@@ -138,6 +138,28 @@ test("matching group grants combine bounded operator and engineer capabilities",
  assert.equal(access.capabilities.includes("access.manage"), false);
 });

+test("configuration mutation belongs to engineer and admin, not operator", () => {
+  const engineer = resolveProjectAccess({
+    actor: actor({ groupRefs: ["group:engineers"] }),
+    grants: [grant({
+      principalKind: "group",
+      principalRef: "group:engineers",
+      projectRole: "engineer",
+    })],
+  });
+  const operator = resolveProjectAccess({
+    actor: actor({ groupRefs: ["group:operators"] }),
+    grants: [grant({
+        principalKind: "group",
+        principalRef: "group:operators",
+        projectRole: "operator",
+    })],
+  });
+
+  assert.equal(engineer.capabilities.includes("configuration.manage"), true);
+  assert.equal(operator.capabilities.includes("configuration.manage"), false);
+});
+
 test("Hub ceiling and explicit deny prevent privilege escalation", () => {
  const ownerGrant = grant({
    grantRef: "grant:owner",