feat(mindspace): enforce PostgreSQL user data delivery

2026-07-13 15:29:29 +08:00
parent b33c943b69
commit a6620fb719
57 changed files with 2779 additions and 164 deletions
@@ -164,6 +164,16 @@ test('clampUserCapabilities blocks extension_admin even when stored as true', ()
  assert.equal(clamped.shell, true);
 });

+test('clampUserCapabilities blocks Apps for regular H5 users even when granted by role', () => {
+  const clamped = clampUserCapabilities({
+    ...DEFAULT_USER_CAPABILITIES,
+    apps: true,
+  });
+  assert.equal(clamped.apps, false);
+  const policy = buildAgentExtensionPolicy(clamped);
+  assert.equal(policy.extensionOverrides.some((ext) => ext.name === 'apps'), false);
+});
+
 test('catalog keys are unique', () => {
  const keys = CAPABILITY_CATALOG.map((item) => item.key);
  assert.equal(keys.length, new Set(keys).size);