From b639b064f993aa0dbe3056b19d72035571a20630 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Marc-Andr=C3=A9=20Bombeck?= Date: Thu, 6 Aug 2026 02:42:01 +0200 Subject: [PATCH] test: register managed record settings routes - Freeze the guardian-only settings endpoints\n- Require an explicit purpose for both routes --- src/__tests__/sharing-surface-guard.test.ts | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-) diff --git a/src/__tests__/sharing-surface-guard.test.ts b/src/__tests__/sharing-surface-guard.test.ts index 2b86a2efe..0f9547c41 100644 --- a/src/__tests__/sharing-surface-guard.test.ts +++ b/src/__tests__/sharing-surface-guard.test.ts @@ -1745,7 +1745,12 @@ const DELEGABLE_MANAGE_ROUTES: Record = { * the auth layer, or "no module reaches it" would be true because the symbol * had been renamed rather than because no module reaches it. */ -const GUARDIAN_ROUTES: Record = {}; +const GUARDIAN_ROUTES: Record = { + "app/api/record-settings/route.ts": + "The managed record's settings descriptor; it is refused for an adult record even with MANAGE.", + "app/api/record-settings/integrations/route.ts": + "Verified integration connection status for the managed record, without any provider control surface.", +}; /** * Route modules that deliberately resolve the ACTOR and keep working under a @@ -1784,9 +1789,10 @@ const ACTOR_ROUTES: Record = { * number rather than one per list on purpose: filling either of the new * literals collides here by construction, so two people filling them at once * find out from the merge rather than from production. Import-status polling - * adds two record entries and two MANAGE entries: 190 → 194. + * adds two record entries and two MANAGE entries: 190 → 194. Managed-record + * settings add two guardian-only entries: 194 → 196. */ -const FROZEN_ENTRY_COUNT = 194; +const FROZEN_ENTRY_COUNT = 196; /** * The two surfaces that authenticate a Bearer token outside `requireAuth` —