Marc-André Bombeck 0da9040f2c test: enforce sharing client step-up ...

Freezes the authority split the third level ships with. A token exercises a
MANAGE grant, and a Guardian's authority over a managed profile, exactly as a
browser does — proved at the resolver, where neither had a Bearer case before.
A token cannot offer MANAGE and cannot create a managed profile at all, because
both gates resolve through the session cookie; the second had no test until now,
and it runs against a real database with a wildcard token to make the width of
the permission irrelevant.

The claim set is held together by a map naming, per claim, the file and the test
title that proves it, so removing any one of them fails rather than quietly
narrowing what a native client may do.

The fence's client-facing half is frozen beside it: the account payload publishes
the record context on a cookie session and null on a token, and the published
contract says so under the same header names the server matches on.

2026-08-07 05:11:02 +02:00

..

fixtures/v137

test: cover sharing accessibility states

2026-08-06 23:46:43 +02:00

integration

test: enforce sharing client step-up

2026-08-07 05:11:02 +02:00