From 2445074c8705df8b8af3553858847b2b3136717f Mon Sep 17 00:00:00 2001 From: MechaCat02 Date: Wed, 15 Jul 2026 19:38:51 +0200 Subject: [PATCH] test(cli): pin the group-create RBAC denial as HTTP 403 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit `creating_a_group_requires_group_admin_on_the_parent` asserted only that the member's apply exited non-zero — so it would pass even with the GroupAdmin check removed, because the apply would still fail for an unrelated reason (a 404 on the attach-point lookup, a credential error, a 500). It now asserts the stderr carries `HTTP 403` — specifically the authz denial — matching the rest of the RBAC suite. Co-Authored-By: Claude Opus 4.8 (1M context) --- crates/picloud-cli/tests/group_create.rs | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/crates/picloud-cli/tests/group_create.rs b/crates/picloud-cli/tests/group_create.rs index 36fa7b9..04ef8c3 100644 --- a/crates/picloud-cli/tests/group_create.rs +++ b/crates/picloud-cli/tests/group_create.rs @@ -174,6 +174,15 @@ fn creating_a_group_requires_group_admin_on_the_parent() { !out.status.success(), "an editor without group-admin must not create a group" ); + // Pin the REASON, not just "it failed". Without this the test passes even if + // the GroupAdmin check is removed — the member's apply would still exit + // non-zero for an unrelated reason (a 404 on the attach-point lookup, a + // credential error, a 500). `HTTP 403` is specifically the authz denial. + let stderr = String::from_utf8_lossy(&out.stderr); + assert!( + stderr.contains("HTTP 403"), + "the failure must be an authz denial (HTTP 403), not an incidental error:\n{stderr}" + ); // The group was NOT created (the tx rolled back). let ls = String::from_utf8(