From d96507660913827db8f12a2ed25939ae3b83d75e Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Marc-Andr=C3=A9=20Bombeck?= <mbombeck@gmail.com>
Date: Thu, 6 Aug 2026 02:27:27 +0200
Subject: [PATCH] test: cover settings classification

- Require a literal settings inventory\n- Limit Guardian configuration to the approved subset
---
 .../record-settings-contract.test.ts          | 21 +++++++++++++++++++
 1 file changed, 21 insertions(+)

diff --git a/src/__tests__/record-settings-contract.test.ts b/src/__tests__/record-settings-contract.test.ts
index 98ea53cb0..b2267601f 100644
--- a/src/__tests__/record-settings-contract.test.ts
+++ b/src/__tests__/record-settings-contract.test.ts
@@ -4,6 +4,11 @@ import {
   assertRecordSettingsAccess,
   type RecordSettingsAccess,
 } from "@/lib/record-settings/access";
+import {
+  classifySettingsDestination,
+  isGuardianSettingsWriteAllowed,
+  SETTINGS_DESTINATION_INVENTORY,
+} from "@/lib/record-settings/classification";
 import { toRecordSettingsDto } from "@/lib/record-settings/dto";
 import { recordSettingsKeys } from "@/lib/query-keys";
 
@@ -45,4 +50,20 @@ describe("record settings contract", () => {
       "Guardian configuration is unavailable for this record",
     );
   });
+
+  it("classifies every Settings destination and limits Guardian writes", () => {
+    expect(Object.keys(SETTINGS_DESTINATION_INVENTORY)).not.toHaveLength(0);
+    expect(classifySettingsDestination("integrations")).toMatchObject({
+      kind: "managed-guardian",
+      guardianWritable: false,
+    });
+    expect(classifySettingsDestination("ai").kind).toBe("unavailable");
+    expect(classifySettingsDestination("dashboard").kind).toBe(
+      "adult-shared-unavailable",
+    );
+    expect(isGuardianSettingsWriteAllowed("account")).toBe(true);
+    expect(isGuardianSettingsWriteAllowed("notifications")).toBe(true);
+    expect(isGuardianSettingsWriteAllowed("integrations")).toBe(false);
+    expect(isGuardianSettingsWriteAllowed("ai")).toBe(false);
+  });
 });