Marc-André Bombeck 81e5c7464b test(sharing): point the refusal arm at a route that can never be delegable ...

`GET /api/measurements` was the resolver test's example of a route refusing
under a switch. It is delegable now, so that arm was asserting the opposite
of what ships and went red on the migration — which is the arm doing its job,
not a defect in it.

Split in two. The measurements route keeps both of its real claims: unchanged
un-switched, and the owner's rows and not the delegate's once switched. The
refusal moves to `GET /api/share-links`, which is non-delegable permanently
and by design — a delegate who could mint a clinician link would hold a door
that survives the owner revoking their access. A route that can never join
the frozen list cannot break this arm the same way twice.

2026-08-02 17:36:44 +02:00

..

integration

test(sharing): point the refusal arm at a route that can never be delegable

2026-08-02 17:36:44 +02:00