test(contact+calendar): cover grants tests

tests/api/calendar.hurl

@@ -41,6 +41,7 @@ Content-Type: application/json
 HTTP 200
 [Captures]
 alice_token: jsonpath "$.access_token"
+alice_user_id: jsonpath "$.user.id"
 
 
 # ─────────────────────────────────────────────────────────────
@@ -202,6 +203,37 @@ HTTP 207
 body contains "{{calendar_id}}"
 
 
+# ─────────────────────────────────────────────────────────────
+# Step 8b – Unified list-on-resource: Alice queries
+# `GET /api/grants?resource_type=calendar&resource_id=…`. The
+# handler requires `Share` on the resource (Alice's Owner grant
+# satisfies it) and returns the raw `role_grants` rows including
+# the Owner self-grant. Confirms `ResourceTypeDto::Calendar` is
+# admitted at the query-string boundary.
+# ─────────────────────────────────────────────────────────────
+GET {{base_url}}/api/grants?resource_type=calendar&resource_id={{calendar_id}}
+Authorization: Bearer {{alice_token}}
+
+HTTP 200
+[Asserts]
+jsonpath "$[*].subject.id" contains "{{bob_user_id}}"
+jsonpath "$[*].subject.id" contains "{{alice_user_id}}"
+jsonpath "$[?(@.subject.id == '{{bob_user_id}}')].role" == "viewer"
+jsonpath "$[?(@.subject.id == '{{alice_user_id}}')].role" == "owner"
+jsonpath "$[?(@.subject.id == '{{bob_user_id}}')].resource.type" == "calendar"
+
+
+# ─────────────────────────────────────────────────────────────
+# Step 8c – Viewer Bob is denied on the unified list endpoint —
+# `Share` is required, Viewer's bundle excludes it → 404
+# anti-enum shape (same treatment as any other resource type).
+# ─────────────────────────────────────────────────────────────
+GET {{base_url}}/api/grants?resource_type=calendar&resource_id={{calendar_id}}
+Authorization: Bearer {{bob_token}}
+
+HTTP 404
+
+
 # ─────────────────────────────────────────────────────────────
 # Step 9 – Alice revokes the grant. `DELETE /api/grants/{id}`
 # maps to a single `role_grants` row delete.

tests/api/contacts.hurl

@@ -24,6 +24,7 @@ Content-Type: application/json
 HTTP 200
 [Captures]
 token: jsonpath "$.access_token"
+admin_user_id: jsonpath "$.user.id"
 [Asserts]
 jsonpath "$.access_token" isString
 jsonpath "$.token_type" == "Bearer"
@@ -425,6 +426,32 @@ Content-Type: application/json
 HTTP 404
 
 
+# Step 21b — Unified list-on-resource: Alice queries
+# `GET /api/grants?resource_type=address_book&resource_id=…`.
+# `Share` is required (Alice's Owner grant satisfies it) and the
+# response includes the Owner self-grant that the per-domain
+# UI hides. Confirms `ResourceTypeDto::AddressBook` is admitted
+# at the query-string boundary.
+GET {{base_url}}/api/grants?resource_type=address_book&resource_id={{share_book_id}}
+Authorization: Bearer {{token}}
+
+HTTP 200
+[Asserts]
+jsonpath "$[*].subject.id" contains "{{bob_user_id}}"
+jsonpath "$[*].subject.id" contains "{{admin_user_id}}"
+jsonpath "$[?(@.subject.id == '{{bob_user_id}}')].role" == "viewer"
+jsonpath "$[?(@.subject.id == '{{admin_user_id}}')].role" == "owner"
+jsonpath "$[?(@.subject.id == '{{bob_user_id}}')].resource.type" == "address_book"
+
+
+# Step 21c — Viewer Bob is denied on the unified list endpoint —
+# `Share` isn't in the Viewer bundle → 404 anti-enum shape.
+GET {{base_url}}/api/grants?resource_type=address_book&resource_id={{share_book_id}}
+Authorization: Bearer {{bob_token}}
+
+HTTP 404
+
+
 # Step 22 — Alice revokes the grant.
 DELETE {{base_url}}/api/grants/{{share_grant_id}}
 Authorization: Bearer {{token}}