MechaCat02 2445074c87 test(cli): pin the group-create RBAC denial as HTTP 403 ...

`creating_a_group_requires_group_admin_on_the_parent` asserted only that the
member's apply exited non-zero — so it would pass even with the GroupAdmin check
removed, because the apply would still fail for an unrelated reason (a 404 on the
attach-point lookup, a credential error, a 500). It now asserts the stderr carries
`HTTP 403` — specifically the authz denial — matching the rest of the RBAC suite.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

2026-07-15 19:38:51 +02:00

..

common

test/docs(ownership): §7 apply_ownership journey + design/CLAUDE updates

2026-07-06 20:49:31 +02:00

fixtures

test(secrets): group-secret inheritance + masked-read journeys

2026-06-24 22:09:14 +02:00

admins.rs

fix(audit-2026-06-11/H2): reject inline CLI secrets; true no-echo prompt

2026-06-12 18:34:45 +02:00

api_keys.rs

test(cli): focused journey suite + cover new commands + tighten asserts

2026-05-29 23:34:03 +02:00

apply_ownership.rs

fix(apply): preserve project name on a name-less re-apply

2026-07-07 07:37:25 +02:00

apply.rs

test(cli): journey for declarative app-var reconciliation

2026-06-25 08:06:44 +02:00

apps.rs

test(cli): focused journey suite + cover new commands + tighten asserts

2026-05-29 23:34:03 +02:00

auth.rs

test(cli): focused journey suite + cover new commands + tighten asserts

2026-05-29 23:34:03 +02:00

cli.rs

feat(interceptors): §9.4 service interceptors — thin KV allow/deny slice

2026-07-13 20:44:50 +02:00

collections.rs

feat(cli): add pic docs/dead-letters ls group read mirrors

2026-07-13 20:00:37 +02:00

config.rs

feat(cli): pic config --effective (masked secret resolution)

2026-06-23 20:54:46 +02:00

dead_letters.rs

fix(review): close 5 follow-up gaps from Stage 6 audit re-review

2026-06-11 17:20:34 +02:00

email_queue.rs

fix(project-tool): address review findings on the apply foundation

2026-06-22 21:18:51 +02:00

enabled.rs

fix(enabled): close disabled-script execution on the async paths (review)

2026-06-23 21:59:50 +02:00

env_approval.rs

fix(security): server-authoritative approval gate + auth/session/file hardening

2026-07-11 23:47:35 +02:00

env_overlay.rs

feat(cli): env-scoped overlays — --env merges picloud.<env>.toml

2026-06-23 20:58:04 +02:00

extension_points.rs

test(cli): extension-point journeys + node-key manifest fix + docs (§5.5 C5)

2026-06-29 20:53:18 +02:00

group_create.rs

test(cli): pin the group-create RBAC denial as HTTP 403

2026-07-15 19:38:51 +02:00

group_modules.rs

fix(modules): validate group module create per kind (Phase 4b review)

2026-06-29 19:32:34 +02:00

group_routes.rs

feat(cli): pic routes ls --group + group-route journey + docs (§11 tail R5)

2026-06-30 22:03:59 +02:00

group_scripts.rs

fix(apply): resolve inherited-bound triggers in diff, state-token, and prune

2026-06-25 21:11:59 +02:00

group_secrets.rs

test(secrets): group-secret inheritance + masked-read journeys

2026-06-24 22:09:14 +02:00

group_triggers.rs

feat(cli): pic triggers ls --group + group-template journeys + docs (§11 tail T4)

2026-06-30 21:02:03 +02:00

groups.rs

feat(cli): pic groups (tree/create/rename/reparent/rm/members)

2026-06-24 20:15:33 +02:00

init.rs

fix(project-tool): address independent review of init + staleness

2026-06-22 22:07:31 +02:00

interceptors.rs

fix(interceptors): harden the §9.4 slice — seal, fail-closed, re-entrancy, shared coverage

2026-07-13 21:20:20 +02:00

invoke.rs

test(cli): focused journey suite + cover new commands + tighten asserts

2026-05-29 23:34:03 +02:00

logs.rs

test(cli): refresh stale deploy + logs journey assertions

2026-06-24 22:37:36 +02:00

output.rs

test(cli): focused journey suite + cover new commands + tighten asserts

2026-05-29 23:34:03 +02:00

plan.rs

feat: declarative project-tool foundation (pull/plan/apply/prune)

2026-06-20 21:52:21 +02:00

prune.rs

fix(project-tool): address review findings on the apply foundation

2026-06-22 21:18:51 +02:00

pull.rs

feat: declarative project-tool foundation (pull/plan/apply/prune)

2026-06-20 21:52:21 +02:00

roles.rs

test(cli): refresh stale deploy + logs journey assertions

2026-06-24 22:37:36 +02:00

routes.rs

feat(cli): add pic routes + pic admins subcommands

2026-06-10 21:35:09 +02:00

scripts.rs

test(cli): refresh stale deploy + logs journey assertions

2026-06-24 22:37:36 +02:00

sealed.rs

feat(sealed): sealed journey + docs (§11 tail M5)

2026-07-01 19:42:18 +02:00

secrets.rs

test(secrets): group-secret inheritance + masked-read journeys

2026-06-24 22:09:14 +02:00

shared_queues.rs

test/docs(shared-queues): journey + docs (D3.3)

2026-07-02 22:35:40 +02:00

shared_topics.rs

test/docs(shared-topics): dispatch test + journey + docs (D2)

2026-07-02 21:54:32 +02:00

shared_triggers.rs

feat(shared-triggers): visibility + tests + docs (M2.5)

2026-07-01 21:05:30 +02:00

staleness.rs

feat(project-tool): bound-plan staleness check (content fingerprint)

2026-06-22 21:48:27 +02:00

stateful_templates.rs

feat(triggers): show a materialized column in pic triggers ls --app (D1)

2026-07-02 21:30:32 +02:00

structural_divergence.rs

style(test): rustfmt the structural-divergence journey

2026-07-07 20:28:37 +02:00

suppress.rs

feat(suppress): group-suppress warnings + ls + journey + docs (M1.5)

2026-07-01 20:16:22 +02:00

tree.rs

test(cli): project-tree journeys + Phase 5 docs

2026-06-25 22:43:20 +02:00

triggers.rs

feat(triggers): show a materialized column in pic triggers ls --app (D1)

2026-07-02 21:30:32 +02:00

vars.rs

feat(vars): admin CRUD API + pic vars CLI

2026-06-24 21:11:46 +02:00

workflows.rs

fix(workflows): close review gaps — pull round-trip, dup-names, reclaim budget

2026-07-12 18:56:44 +02:00