own-list-isolation.test.ts

apps/dashboard/test/own-list-isolation.test.ts

1. /**
2. * The private list cannot reach anything shared, because nothing shared can see
3. * it.
4. *
5. * Every other guarantee in this feature is a runtime one: a scoping clause, an
6. * ownership check, a per-viewer stamp. This file asserts the structural one,
7. * which is the only kind that holds against a change nobody reviewed carefully:
8. * the modules that build the company surfaces, the history rows and the
9. * briefing payload do not import the list, so there is no code path along which
10. * a line could travel to `/payload.json` (which `seesLeadership` may fetch), to
11. * `briefings.json` (which is pushed), or to `analysis/brief.py` (the one place
12. * a model is called).
13. *
14. * The same shape as onboarding-export.test.ts's guard, and for the same reason
15. * recorded there: whoever is next asked to "surface what people are carrying"
16. * will reach for `readOwnList` long before they reach for a comment.
17. */
19. import { readFile } from 'node:fs/promises'
20. import { fileURLToPath } from 'node:url'
21. import { describe, expect, it } from 'vitest'
22. import { FIXTURE_SNAPSHOT } from '../src/fixtures.js'
23. import { headline } from '../src/collect.js'
24. import { buildViewModel } from '../src/view-model.js'
25. import { buildBriefingPayload } from '../src/briefing-payload.js'
26. import { viewerFor } from '../src/viewer.js'
28. const DAY = '2026-08-12'
30. /** The modules that produce anything a second person can read. */
31. const SHARED = [
32. 'collect.ts',
33. 'view-model.ts',
34. 'history.ts',
35. 'briefing-payload.ts',
36. 'variants.ts',
37. ]
39. describe('nothing shared can see the private list', () => {
40. for (const file of SHARED) {
41. it(`${file} does not import it`, async () => {
42. const src = await readFile(fileURLToPath(new URL(`../src/${file}`, import.meta.url)), 'utf8')
43. const imports = [...src.matchAll(/^import[\s\S]*?from '([^']+)'/gm)].map((m) => m[1]!)
44. expect(
45. imports.filter((i) => i.includes('own-list')),
46. `${file} must not import the private list; it feeds a surface other people read`,
47. ).toEqual([])
48. })
49. }
51. it('surfaces.ts sees ONLY the placeholder and the grant, never the store', async () => {
52. // It has to see something: it emits the marker. What it must not be able to
53. // reach is anything that returns a line.
54. const src = await readFile(fileURLToPath(new URL('../src/surfaces.ts', import.meta.url)), 'utf8')
55. expect(src).toContain('ownListPlaceholder')
56. expect(src).not.toContain('readOwnList')
57. expect(src).not.toContain('ownListBlock')
58. })
60. it('the briefing payload contains no field belonging to the list', () => {
61. // Asserted on the built payload as well as on the imports, because the
62. // import check would not catch a field copied in by hand.
63. const payload = JSON.stringify(buildBriefingPayload(FIXTURE_SNAPSHOT))
64. for (const marker of ['own_item', 'ownList', 'own-list', 'linkKey', 'doneAt']) {
65. expect(payload).not.toContain(marker)
66. }
67. })
69. it('the view model a viewer’s page is built from has no list on it', () => {
70. const vm = buildViewModel(
71. FIXTURE_SNAPSHOT,
72. headline(FIXTURE_SNAPSHOT),
73. [],
74. DAY,
75. viewerFor('hello@meridiandisplay.example'),
76. )
77. const json = JSON.stringify(vm)
78. expect(json).not.toContain('own_item')
79. expect(json).not.toContain('ownList')
80. })
81. })