caps and delete

backend/tests/auth_flow.rs

@@ -5,13 +5,15 @@ use axum::http::{header::SET_COOKIE, StatusCode};
 use chrono::{Duration as ChronoDuration, Utc};
 use common::{acquire_db_lock, body_to_vec, TestApp};
 use diesel::prelude::*;
+use papercrate::auth::capability_sets::{ensure_capability_set, owner_capabilities};
+use papercrate::auth::jwt::{AccessTokenContext, PrincipalKind};
 use papercrate::auth::passkeys::{
     PasskeyLoginFinishPayload, PasskeyLoginStartPayload, PasskeyRegistrationFinishPayload,
     RegistrationChallengeResponse,
 };
 use papercrate::models::{NewUserMembership, NewUserSession, TenantStatus, UserPasskey};
 use papercrate::openapi::schemas::PasskeySummary;
-use papercrate::schema::{tenants, user_memberships, user_sessions, users};
+use papercrate::schema::{capability_sets, tenants, user_memberships, user_sessions, users};
 use rand::rngs::OsRng;
 use rand::RngCore;
 use serde::Deserialize;
@@ -522,10 +524,16 @@ async fn login_returns_tenant_selection_when_multiple_memberships() -> Result<()
             ))
             .execute(conn)?;
 
+        let owner_capability_set_id =
+            ensure_capability_set(conn, secondary_id, owner_capabilities())
+                .map_err(|err| anyhow!("failed to ensure owner capability set: {:?}", err))?
+                .id;
+
         let membership = NewUserMembership {
             id: Uuid::new_v4(),
             user_id,
             tenant_id: secondary_id,
+            capability_set_id: Some(owner_capability_set_id),
         };
 
         diesel::insert_into(user_memberships::table)
@@ -592,10 +600,28 @@ async fn login_with_session(
         let tenant: papercrate::models::Tenant =
             tenants::table.find(membership.tenant_id).first(conn)?;
 
+        let capability_set_id = membership
+            .capability_set_id
+            .ok_or_else(|| anyhow!("membership missing capability set"))?;
+
+        let cap_version = capability_sets::table
+            .find(capability_set_id)
+            .select(capability_sets::cap_version)
+            .first::<i32>(conn)?;
+
         let now = Utc::now();
+        let session_id = Uuid::new_v4();
         let access_token = state
             .jwt
-            .generate_token(user.id, tenant.id, &user.username)
+            .generate_token(AccessTokenContext {
+                user_id: user.id,
+                tenant_id: tenant.id,
+                username: user.username.clone(),
+                principal_kind: PrincipalKind::UserSession,
+                principal_id: session_id,
+                capability_set_id,
+                cap_version,
+            })
             .map_err(|err| anyhow!(err))?;
 
         let session_value = generate_session_token();
@@ -603,7 +629,7 @@ async fn login_with_session(
         let refresh_expires_at = now + ChronoDuration::days(state.config.refresh_token_expiry_days);
 
         let new_session = NewUserSession {
-            id: Uuid::new_v4(),
+            id: session_id,
             user_id: user.id,
             token_hash: session_hash,
             issued_at: now.naive_utc(),