fix(authz): invalidate role cache on change

tests/api/drive_quota.hurl

@@ -348,8 +348,9 @@ HTTP 507
 # 11b — COPY same file into tight drive. Same refusal shape as MOVE
 #       — COPY creates a NEW file row that counts against
 #       `drives.used_bytes` even when blob dedup means no new bytes
-#       hit the store.
-POST {{base_url}}/api/files/copy
+#       hit the store. Batch endpoint lives under `/api/batch/…`,
+#       not `/api/files/…`.
+POST {{base_url}}/api/batch/files/copy
 Authorization: Bearer {{owner_token}}
 Content-Type: application/json
 {
@@ -357,13 +358,15 @@ Content-Type: application/json
   "target_folder_id": "{{tight_root_id}}"
 }
 
-# Batch endpoint returns 206 Partial when at least one item fails
-# with a per-item error. Per-item quota rejection is the wire
-# shape here — assert the 507 landed in the per-item results,
-# not on the envelope.
-HTTP 206
+# Batch envelope: 200 all-ok, 206 partial, 400 all-failed. Our
+# single-item batch has one quota-refused item → 400 with the
+# failure in the `.failed[]` array (per `BatchOperationResponse`).
+HTTP 400
 [Asserts]
-jsonpath "$.results[?(@.file_id=='{{big_file_id}}')].error" exists
+jsonpath "$.stats.failed"      == 1
+jsonpath "$.stats.successful"  == 0
+jsonpath "$.failed[0].id"      == "{{big_file_id}}"
+jsonpath "$.failed[0].error"   exists
 
 
 # 11c — Sanity: the file MOVE isn't universally broken. Targeting

tests/api/storage_cleanup_check.sh

@@ -150,9 +150,14 @@ while IFS= read -r drive_id; do
 
     while IFS= read -r file_id; do
         [[ -z "$file_id" ]] && continue
-        curl -sf -X DELETE -H "$AUTH" "$base_url/api/files/$file_id" >/dev/null
+        HTTP_STATUS=$(curl -s -H "$AUTH" -o /tmp/del.json -w '%{http_code}' \
+                          -X DELETE "$base_url/api/files/$file_id")
+        if [[ "$HTTP_STATUS" != "204" ]]; then
+            log "FILE DELETE FAILED: file=$file_id drive=$drive_id ($DRIVE_NAME) status=$HTTP_STATUS body=$(cat /tmp/del.json)"
+        fi
     done < <(echo "$CONTENTS" | jq -r '.items[] | select(.resource_type == "file") | .resource.id')
 
+
     # Empty the drive's per-drive trash so D3b's "drive must be empty"
     # guard passes on the delete. `/api/trash/drive/{id}` is the
     # Owner-only per-drive empty (admin is Owner now via the grant

tests/api/webdav_permissions.hurl

@@ -91,6 +91,7 @@ Content-Type: application/json
 HTTP 201
 [Captures]
 shared_drive_id: jsonpath "$.id"
+shared_root_id:  jsonpath "$.root_folder_id"
 
 
 # ─────────────────────────────────────────────────────────────