Skip to content

Commit 56c08cc

Browse files
ToolboxAidToolboxAid
committed
Add Publish contract tests and lifecycle validation boundaries - PR_26152_083-publish-contract-tests
1 parent 67356ca commit 56c08cc

5 files changed

Lines changed: 1054 additions & 0 deletions

File tree

‎docs/dev/reports/publish_contract_tests_validation.md‎

Lines changed: 62 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,62 @@
1+
# Publish Contract Tests Validation
2+
3+
PR: `PR_26152_083-publish-contract-tests`
4+
5+
## Scope
6+
7+
- Added `src/shared/contracts/publishContract.js`.
8+
- Added `tests/shared/PublishContract.test.mjs`.
9+
- Added `tests/fixtures/publish/publish-scenarios.json`.
10+
- Added `docs/dev/specs/PUBLISH_CONTRACT.md`.
11+
12+
No database, authentication, UI, CSS, HTML, runtime page, marketplace moderation, tool state storage, or samples changes were made.
13+
14+
## Contract Rules Validated
15+
16+
- Publish requires owner.
17+
- Publish requires project.
18+
- Publish requires source release.
19+
- Publish visibility must be valid.
20+
- Publish lifecycle status must be valid.
21+
- Publish cannot bypass ownership, visibility, or permissions.
22+
- Published Publish records are immutable unless policy allows edits.
23+
- Retired Publish records remain historically referenceable.
24+
- Publish records reject runtime state leakage.
25+
- Publish records reject auth state leakage.
26+
- Publish records reject marketplace moderation state leakage.
27+
- Publish records reject tool state leakage.
28+
29+
## Validation Commands
30+
31+
- `node --check src/shared/contracts/publishContract.js` - PASS
32+
- `node --check tests/shared/PublishContract.test.mjs` - PASS
33+
- `node tests/shared/PublishContract.test.mjs` - PASS
34+
- `node tests/shared/ReleaseContract.test.mjs` - PASS
35+
- `node tests/shared/GameManifestContract.test.mjs` - PASS
36+
- `node tests/shared/ProjectContract.test.mjs` - PASS
37+
- `node tests/shared/ProjectWorkspaceRuntimeContract.test.mjs` - PASS
38+
- `node tests/shared/ToolStateContract.test.mjs` - PASS
39+
- `node tests/shared/IdentityPermissionsContract.test.mjs` - PASS
40+
- `git diff --name-only -- '*.css' '*.html'` - PASS, no output
41+
- `rg -n "\s+$" src/shared/contracts/publishContract.js tests/shared/PublishContract.test.mjs tests/fixtures/publish/publish-scenarios.json docs/dev/specs/PUBLISH_CONTRACT.md` - PASS, no trailing whitespace
42+
- `git diff --cached --name-only` - PASS, no staged files
43+
44+
## Validation Lanes
45+
46+
- Lanes executed: contract validation for Publish, Release, Manifest, Project Type, Project Workspace, Project, Tool State, and Identity/Permissions.
47+
- Lanes skipped: runtime, integration, engine, samples, marketplace moderation, and recovery/UAT because this PR does not change runtime behavior, handoff contracts, engine surfaces, samples, moderation behavior, or recovery behavior.
48+
- Samples decision: SKIP because this PR is limited to contract/docs/test surfaces.
49+
- Playwright impacted: No. This PR is contract/docs/test only and does not change UI or browser runtime behavior.
50+
51+
## Expected PASS Behavior
52+
53+
- Valid Publish contract records are accepted.
54+
- Missing owner, missing project, missing source release, invalid source release, invalid visibility, invalid status, and missing published timestamp are rejected.
55+
- Publish records reject runtime, auth, marketplace moderation, and tool state leakage.
56+
- Publish access remains bound to Project and Identity/Permissions contracts.
57+
- Published Publish records cannot be edited unless policy allows edits.
58+
- Retired Publish records remain historically referenceable.
59+
60+
## Expected WARN Behavior
61+
62+
- No WARN behavior was observed in the targeted validation lane.

‎docs/dev/specs/PUBLISH_CONTRACT.md‎

Lines changed: 112 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,112 @@
1+
# Publish Contract
2+
3+
## Status
4+
5+
This is a contract planning document for GameFoundryStudio Publish behavior.
6+
7+
It defines required Publish contract rules before database, authentication, UI, runtime, publishing implementation, marketplace moderation, or storage implementation begins.
8+
9+
This document does not authorize runtime changes, database implementation, authentication implementation, page changes, CSS changes, HTML changes, JavaScript changes, or schema migrations.
10+
11+
## Publish Fields
12+
13+
Publish records define:
14+
15+
- `publishId`
16+
- `ownerId`
17+
- `projectId`
18+
- `sourceRelease`
19+
- `visibility`
20+
- `status`
21+
- `publishedAt`
22+
- `publishNotes`
23+
24+
## Required Rules
25+
26+
- Publish requires owner.
27+
- Publish requires project.
28+
- Publish requires source release.
29+
- Publish cannot bypass ownership, visibility, or permissions.
30+
- Publish visibility must be a valid Project visibility state.
31+
- Publish lifecycle status must be valid.
32+
- Published Publish records are immutable unless policy allows edits.
33+
- Retired Publish records remain historically referenceable.
34+
35+
## Source Release Reference
36+
37+
Publish source release references must identify:
38+
39+
- `releaseId`
40+
- positive `version`
41+
- optional `status`
42+
43+
When `status` is provided, the referenced Release must be `published` or `retired`.
44+
45+
Source release references point to the Release contract. They do not copy the full Release database record into the Publish contract.
46+
47+
## Lifecycle Status
48+
49+
Approved first-pass Publish statuses:
50+
51+
- `draft`
52+
- `ready`
53+
- `published`
54+
- `retired`
55+
- `cancelled`
56+
57+
Draft and ready Publish records may be edited according to Project permissions.
58+
59+
Published Publish records are immutable unless policy explicitly allows edits.
60+
61+
Retired Publish records remain historically referenceable and should not silently lose their source release, visibility, published timestamp, or publish notes.
62+
63+
Cancelled Publish records are immutable unless policy explicitly allows edits.
64+
65+
## No-Leakage Boundary
66+
67+
Publish records must not carry:
68+
69+
- runtime state
70+
- authentication state
71+
- marketplace moderation state
72+
- tool state data
73+
- Workspace or Project Workspace runtime fields
74+
- tool payload data
75+
- database-only ids beyond the contract-owned ids
76+
77+
Forbidden examples include:
78+
79+
- `workspaceState`
80+
- `authState`
81+
- `marketplaceModerationState`
82+
- `toolStateId`
83+
- `toolStates`
84+
- `payloadJson`
85+
86+
## Visibility And Permissions Boundary
87+
88+
Publish visibility uses the approved Project visibility states:
89+
90+
- `private`
91+
- `project`
92+
- `unlisted`
93+
- `public`
94+
95+
Publish visibility does not grant edit permission.
96+
97+
Publish access remains bound by Project ownership, Project visibility, Project permissions, Identity/Permissions rules, and explicit policy gates for editing published, retired, or cancelled records.
98+
99+
## Non-Goals
100+
101+
This document does not:
102+
103+
- define SQL schema
104+
- define API routes
105+
- implement publish persistence
106+
- implement authentication
107+
- implement authorization checks
108+
- implement marketplace moderation
109+
- implement Project Workspace storage
110+
- implement runtime publish loading
111+
- change runtime behavior
112+
- change CSS, HTML, JavaScript, TypeScript, or JSON files outside the contract/test scope

0 commit comments

Comments
 (0)