- |
- dashboard_view
- |
-
- {{
- t(
- 'openregister',
- 'Access organisation dashboard and analytics',
- )
- }}
- |
-
-
@@ -594,10 +526,13 @@ import { navigationStore, organisationStore } from '../../store/store.js'
"
inputLabel="Selected Special Rights Llm Use"
:options="
- filteredAvailableGroups
+ specialRightOptions
"
label="name"
trackBy="id"
+ :disabled="
+ !canEditSpecialRights
+ "
:multiple="true"
:placeholder="
t(
@@ -752,9 +687,7 @@ export default {
loadingGroups: false,
groupSearchDebounce: null,
selectedSpecialRights: {
- object_publish: [],
agent_use: [],
- dashboard_view: [],
llm_use: [],
},
@@ -773,6 +706,37 @@ export default {
},
computed: {
+ /**
+ * Whether the signed-in user may change this organisation's special rights.
+ *
+ * An administrator or the organisation's owner may; so may whoever creates
+ * a new organisation, who becomes its owner. The server refuses anybody
+ * else with a 403, so this only spares them a save that cannot succeed.
+ *
+ * @return {boolean}
+ * @spec openspec/changes/enforce-organisation-special-rights/specs/organisation-special-rights/spec.md
+ */
+ canEditSpecialRights() {
+ if (!this.organisationItem.uuid) {
+ return true
+ }
+ const user = getNextcloudUser()
+ if (!user) {
+ return false
+ }
+ return user.isAdmin === true || user.uid === this.organisationItem.owner
+ },
+
+ /**
+ * The choices under a special right: every signed-in user, then the groups.
+ *
+ * @return {Array}
+ * @spec openspec/changes/enforce-organisation-special-rights/specs/organisation-special-rights/spec.md
+ */
+ specialRightOptions() {
+ return [this.everyoneOption(), ...this.filteredAvailableGroups]
+ },
+
/**
* @spec exclude Computed byte-to-MB conversion of the storage quota for display; UI presentation helper.
*/
@@ -1395,10 +1359,20 @@ export default {
}
},
+ /**
+ * The entry `*`, which gives a special right to every signed-in user.
+ *
+ * @return {{id: string, name: string}}
+ * @spec openspec/changes/enforce-organisation-special-rights/specs/organisation-special-rights/spec.md
+ */
+ everyoneOption() {
+ return { id: '*', name: t('openregister', 'Everyone') }
+ },
+
/**
* Update special right
*
- * @param {string} right - The special right (object_publish, agent_use, dashboard_view, llm_use)
+ * @param {string} right - The special right (agent_use, llm_use)
* @param {Array} groups - Array of group objects with {id, name}
* @return {void}
* @spec exclude Reactive setter writing a special-right's group IDs to the local authorization model; UI form plumbing.
@@ -1427,18 +1401,16 @@ export default {
*/
initializeSpecialRights() {
const auth = this.organisationItem.authorization || {}
- const specialRightKeys = [
- 'object_publish',
- 'agent_use',
- 'dashboard_view',
- 'llm_use',
- ]
+ const specialRightKeys = ['agent_use', 'llm_use']
specialRightKeys.forEach((right) => {
if (auth[right] && Array.isArray(auth[right])) {
// Map group IDs to group objects
this.selectedSpecialRights[right] = auth[right]
.map((groupId) => {
+ if (groupId === '*') {
+ return this.everyoneOption()
+ }
const group = this.availableGroups.find(
(g) => g.id === groupId,
)
diff --git a/tests/Unit/Controller/ChatStreamControllerTest.php b/tests/Unit/Controller/ChatStreamControllerTest.php
index 6d8b5f18b1..252cb4f54a 100644
--- a/tests/Unit/Controller/ChatStreamControllerTest.php
+++ b/tests/Unit/Controller/ChatStreamControllerTest.php
@@ -30,6 +30,7 @@
use OCA\OpenRegister\Controller\ChatStreamController;
use OCA\OpenRegister\Db\AgentMapper;
+use OCA\OpenRegister\Db\Conversation;
use OCA\OpenRegister\Db\ConversationMapper;
use OCA\OpenRegister\Service\ChatService;
use OCP\IDBConnection;
@@ -81,6 +82,46 @@ protected function emitSseHeaders(): void {
}//end emitSseHeaders()
}//end class
+/**
+ * A php:// stream that serves one request body, so stream() reads a message.
+ */
+class ChatStreamBodyStream {
+
+ /**
+ * @var string
+ */
+ public static string $body = '';
+
+ /**
+ * @var int
+ */
+ private int $pos = 0;
+
+ /**
+ * @var resource|null
+ */
+ public $context;
+
+ public function stream_open(string $path, string $mode, int $options, ?string &$openedPath): bool {
+ $this->pos = 0;
+ return true;
+ }
+
+ public function stream_read(int $count): string {
+ $chunk = substr(self::$body, $this->pos, $count);
+ $this->pos += strlen($chunk);
+ return $chunk;
+ }
+
+ public function stream_eof(): bool {
+ return $this->pos >= strlen(self::$body);
+ }
+
+ public function stream_stat(): array {
+ return [];
+ }
+}//end class
+
class ChatStreamControllerTest extends TestCase {
/**
@@ -227,4 +268,40 @@ public function testNoTokenEventsOnEarlyExitPaths(): void {
);
$this->assertCount(0, $tokenFrames, 'tokens must never be emitted on the unauthenticated path');
}//end testNoTokenEventsOnEarlyExitPaths()
+
+ /**
+ * Decision 239: a caller without llm_use or agent_use gets a `forbidden`
+ * frame naming the right, and the model is never called. The SSE headers
+ * are already sent, so the refusal is a frame, as for a conversation that
+ * is not the caller's.
+ */
+ public function testAMissingSpecialRightEmitsForbiddenBeforeTheModelIsCalled(): void {
+ $user = $this->createMock(IUser::class);
+ $user->method('getUID')->willReturn('alice');
+ $this->userSession->method('getUser')->willReturn($user);
+
+ $conversation = new Conversation();
+ $conversation->setUserId('alice');
+ $conversation->setUuid('conv-1');
+ $this->conversationMapper->method('findByUuid')->willReturn($conversation);
+
+ $this->chatService->expects($this->once())->method('missingRight')
+ ->with($conversation, null, 'alice')
+ ->willReturn('llm_use');
+ $this->chatService->expects($this->never())->method('processMessage');
+
+ stream_wrapper_unregister('php');
+ stream_wrapper_register('php', ChatStreamBodyStream::class);
+ ChatStreamBodyStream::$body = json_encode(['message' => 'Hello', 'conversationUuid' => 'conv-1']);
+ try {
+ $controller = $this->makeController();
+ $this->runStream($controller);
+ } finally {
+ stream_wrapper_restore('php');
+ }
+
+ $this->assertSame('error', $controller->capturedEvents[0]['type']);
+ $this->assertSame('forbidden', $controller->capturedEvents[0]['payload']['code']);
+ $this->assertSame('llm_use', $controller->capturedEvents[0]['payload']['right']);
+ }//end testAMissingSpecialRightEmitsForbiddenBeforeTheModelIsCalled()
}//end class
diff --git a/tests/Unit/Controller/McpAgentLimitsTest.php b/tests/Unit/Controller/McpAgentLimitsTest.php
index a3867b59f9..9ce3f99ec9 100644
--- a/tests/Unit/Controller/McpAgentLimitsTest.php
+++ b/tests/Unit/Controller/McpAgentLimitsTest.php
@@ -27,15 +27,21 @@
use OCA\OpenRegister\Controller\McpServerController;
use OCA\OpenRegister\Db\Agent;
use OCA\OpenRegister\Db\AgentMapper;
+use OCA\OpenRegister\Db\Organisation;
+use OCA\OpenRegister\Db\OrganisationMapper;
+use OCA\OpenRegister\Db\RegisterMapper;
+use OCA\OpenRegister\Db\SchemaMapper;
use OCA\OpenRegister\Mcp\IMcpToolProvider;
use OCA\OpenRegister\Service\Capability\ToolGrantResolver;
use OCA\OpenRegister\Service\Mcp\McpAgentScope;
use OCA\OpenRegister\Service\Mcp\McpProtocolService;
use OCA\OpenRegister\Service\Mcp\McpResourcesService;
use OCA\OpenRegister\Service\Mcp\McpToolsService;
+use OCA\OpenRegister\Service\Rbac\OrganisationSpecialRights;
use OCP\AppFramework\Db\DoesNotExistException;
use OCP\ICache;
use OCP\ICacheFactory;
+use OCP\IGroupManager;
use OCP\IRequest;
use OCP\IUser;
use OCP\IUserSession;
@@ -142,6 +148,18 @@ class McpAgentLimitsTest extends TestCase {
private ?McpServerController $controller = null;
+ /**
+ * What organisation `org-1`, which every agent belongs to, stores under agent_use; null leaves the key out.
+ *
+ * @var list|null
+ */
+ private ?array $agentUse = null;
+
+ /**
+ * Whether alice is an administrator.
+ */
+ private bool $aliceIsAdmin = false;
+
protected function setUp(): void {
parent::setUp();
stream_wrapper_unregister('php');
@@ -204,6 +222,29 @@ static function (string $prefix = '') use (&$caches): ICache {
$logger = new NullLogger();
$tools = new McpToolsService([$provider], $logger);
+
+ // The real reader of special rights (decision 239), over one organisation.
+ $organisations = $this->createMock(OrganisationMapper::class);
+ $organisations->method('findByUuid')->willReturnCallback(function (string $uuid): Organisation {
+ $organisation = new Organisation();
+ $organisation->setUuid($uuid);
+ $authorization = ['object' => ['read' => []]];
+ if ($this->agentUse !== null) {
+ $authorization[OrganisationSpecialRights::AGENT_USE] = $this->agentUse;
+ }
+ $organisation->setAuthorization($authorization);
+ return $organisation;
+ });
+ $groupManager = $this->createMock(IGroupManager::class);
+ $groupManager->method('isAdmin')->willReturnCallback(fn (string $uid): bool => $uid === 'alice' && $this->aliceIsAdmin);
+ $groupManager->method('isInGroup')->willReturnCallback(static fn (string $uid, string $group): bool => $group === 'staff');
+ $specialRights = new OrganisationSpecialRights(
+ $organisations,
+ $this->createMock(RegisterMapper::class),
+ $this->createMock(SchemaMapper::class),
+ $logger,
+ $groupManager
+ );
$this->controller = new McpServerController(
'openregister',
$request,
@@ -212,7 +253,7 @@ static function (string $prefix = '') use (&$caches): ICache {
$this->createMock(McpResourcesService::class),
$logger,
$this->aliceSession(),
- new McpAgentScope($agentMapper, new ToolGrantResolver(), $tools, $cacheFactory, $logger),
+ new McpAgentScope($agentMapper, new ToolGrantResolver(), $tools, $cacheFactory, $logger, $specialRights),
);
}
@@ -241,6 +282,7 @@ private function agent(string $uuid, array $tools, bool $private = false, bool $
$agent->setIsPrivate($private);
$agent->setOwner('bob');
$agent->setActive($active);
+ $agent->setOrganisation('org-1');
$this->agents[$uuid] = $agent;
}
@@ -321,6 +363,51 @@ public function testAnUnknownOrInaccessibleAgentIsRefusedAtInitialize(): void {
}
}
+ public function testAUserWithoutAgentUseIsRefusedAtInitialize(): void {
+ $this->agent('a1', ['openregister.objects.search']);
+ $this->agentUse = ['ai-users'];
+
+ $out = $this->rpc('initialize', ['agent' => 'a1']);
+
+ $this->assertArrayHasKey('error', $out);
+ $this->assertStringContainsString('agent_use', $out['error']['message']);
+ $this->assertSame('', $this->headers['Mcp-Session-Id'], 'a refused agent yields no session');
+ }
+
+ public function testAHolderOfAgentUseActsAsTheAgent(): void {
+ $this->agent('a1', ['openregister.objects.search']);
+ $this->agentUse = ['staff'];
+ $this->rpc('initialize', ['agent' => 'a1']);
+
+ $out = $this->rpc('tools/call', ['name' => 'openregister.objects.search', 'arguments' => []]);
+
+ $this->assertArrayHasKey('result', $out);
+ $this->assertSame(['openregister.objects.search'], $this->ran);
+ }
+
+ public function testAnAdministratorActsAsTheAgentWithoutBeingListed(): void {
+ $this->agent('a1', ['openregister.objects.search']);
+ $this->agentUse = [];
+ $this->aliceIsAdmin = true;
+ $this->rpc('initialize', ['agent' => 'a1']);
+
+ $out = $this->rpc('tools/call', ['name' => 'openregister.objects.search', 'arguments' => []]);
+
+ $this->assertArrayHasKey('result', $out);
+ }
+
+ public function testNarrowingAgentUseAppliesToAnOpenSession(): void {
+ $this->agent('a1', ['openregister.objects.search']);
+ $this->agentUse = ['*'];
+ $this->rpc('initialize', ['agent' => 'a1']);
+ $this->agentUse = ['ai-users'];
+
+ $out = $this->rpc('tools/call', ['name' => 'openregister.objects.search', 'arguments' => []]);
+
+ $this->assertArrayHasKey('error', $out);
+ $this->assertSame([], $this->ran);
+ }
+
public function testASessionWithoutAnAgentKeepsTheUserRights(): void {
$this->rpc('initialize', []);
diff --git a/tests/Unit/Controller/OrganisationGrantManageGuardTest.php b/tests/Unit/Controller/OrganisationGrantManageGuardTest.php
index 093edbc62a..afdb8e47d3 100644
--- a/tests/Unit/Controller/OrganisationGrantManageGuardTest.php
+++ b/tests/Unit/Controller/OrganisationGrantManageGuardTest.php
@@ -105,7 +105,7 @@ public static function changes(): array {
return [
'adding their own group' => [['grant_manage' => ['records-service', 'my-team']]],
'taking it away' => [['grant_manage' => []]],
- 'leaving the key out, which would drop it' => [['object_publish' => ['editors']]],
+ 'leaving the key out, which would drop it' => [['object_publish' => []]],
'widening a narrowed entry' => [['grant_manage' => [['group' => 'records-service']]]],
];
}//end changes()
@@ -113,13 +113,17 @@ public static function changes(): array {
public function testAMemberStillEditsTheRestOfTheBlock(): void {
$this->organisationService->method('isOrganisationAdmin')->willReturn(false);
$this->request->method('getParams')->willReturn(
- ['authorization' => ['grant_manage' => ['records-service'], 'object_publish' => ['editors']]]
+ ['authorization' => [
+ 'grant_manage' => ['records-service'],
+ 'object_publish' => [],
+ 'object' => ['read' => ['editors']],
+ ]]
);
$response = $this->controller->update('org-1');
$this->assertNotSame(403, $response->getStatus());
- $this->assertSame(['editors'], $this->organisation->getAuthorization()['object_publish']);
+ $this->assertSame(['read' => ['editors']], $this->organisation->getAuthorization()['object']);
}//end testAMemberStillEditsTheRestOfTheBlock()
public function testTheOwnerOrAnAdministratorChangesWhoHoldsTheRight(): void {
diff --git a/tests/Unit/Controller/OrganisationSpecialRightsEditTest.php b/tests/Unit/Controller/OrganisationSpecialRightsEditTest.php
new file mode 100644
index 0000000000..58d14ef8e5
--- /dev/null
+++ b/tests/Unit/Controller/OrganisationSpecialRightsEditTest.php
@@ -0,0 +1,209 @@
+
+ * @copyright 2026 Conduction B.V.
+ * @license EUPL-1.2 https://joinup.ec.europa.eu/collection/eupl/eupl-text-eupl-12
+ *
+ * SPDX-FileCopyrightText: 2026 Conduction B.V.
+ * SPDX-License-Identifier: EUPL-1.2
+ *
+ * @link https://conduction.nl
+ */
+
+declare(strict_types=1);
+
+namespace OCA\OpenRegister\Tests\Unit\Controller;
+
+use OCA\OpenRegister\Controller\OrganisationController;
+use OCA\OpenRegister\Db\Organisation;
+use OCA\OpenRegister\Db\OrganisationMapper;
+use OCA\OpenRegister\Db\TenantUsageMapper;
+use OCA\OpenRegister\Service\OrganisationService;
+use OCA\OpenRegister\Service\TenantLifecycleService;
+use OCP\AppFramework\Controller;
+use OCP\AppFramework\OCSController;
+use OCP\IGroupManager;
+use OCP\IRequest;
+use OCP\IUserSession;
+use PHPUnit\Framework\MockObject\MockObject;
+use PHPUnit\Framework\TestCase;
+use Psr\Log\NullLogger;
+
+/**
+ * @covers \OCA\OpenRegister\Controller\OrganisationController
+ * @uses \OCA\OpenRegister\Db\Organisation
+ *
+ * @spec openspec/changes/enforce-organisation-special-rights/specs/organisation-special-rights/spec.md
+ */
+class OrganisationSpecialRightsEditTest extends TestCase {
+
+ private IRequest&MockObject $request;
+
+ private OrganisationService&MockObject $organisationService;
+
+ private OrganisationMapper&MockObject $organisationMapper;
+
+ private Organisation $organisation;
+
+ private OrganisationController $controller;
+
+ /**
+ * The stored block every test starts from, with the retired `object_publish`
+ * and `dashboard_view` still in it, as an organisation saved before
+ * decisions 247 and 248 has.
+ *
+ * @var array
+ */
+ private const STORED = [
+ 'object' => ['create' => [], 'read' => ['staff'], 'update' => [], 'delete' => []],
+ 'object_publish' => ['*'],
+ 'agent_use' => ['admin', '*'],
+ 'dashboard_view' => ['*'],
+ 'llm_use' => ['ai-users'],
+ 'grant_manage' => [],
+ ];
+
+ protected function setUp(): void {
+ parent::setUp();
+
+ $this->request = $this->createMock(IRequest::class);
+ $this->organisationService = $this->createMock(OrganisationService::class);
+ $this->organisationService->method('hasAccessToOrganisation')->willReturn(true);
+ $this->organisationMapper = $this->createMock(OrganisationMapper::class);
+
+ $this->organisation = new Organisation();
+ $this->organisation->setUuid('org-1');
+ $this->organisation->setName('Gemeente');
+ $this->organisation->setOwner('owner');
+ $this->organisation->setAuthorization(self::STORED);
+ $this->organisationMapper->method('findByUuid')->willReturn($this->organisation);
+ $this->organisationMapper->method('update')->willReturnArgument(0);
+
+ $this->controller = new OrganisationController(
+ 'openregister',
+ $this->request,
+ $this->organisationService,
+ $this->organisationMapper,
+ new NullLogger(),
+ $this->createMock(TenantLifecycleService::class),
+ $this->createMock(TenantUsageMapper::class),
+ $this->createMock(IUserSession::class),
+ $this->createMock(IGroupManager::class)
+ );
+ }//end setUp()
+
+ /**
+ * The stored block with one key replaced.
+ *
+ * @param string $key The key.
+ * @param mixed $value The new value.
+ *
+ * @return array The block.
+ */
+ private static function storedWith(string $key, mixed $value): array {
+ $block = self::STORED;
+ $block[$key] = $value;
+
+ return $block;
+ }//end storedWith()
+
+ /**
+ * @return array, 1: string}>
+ */
+ public static function changes(): array {
+ $withoutLlm = self::STORED;
+ unset($withoutLlm['llm_use']);
+
+ return [
+ 'narrowing agent_use' => [self::storedWith('agent_use', ['admin']), 'agent_use'],
+ 'opening llm_use to everyone' => [self::storedWith('llm_use', ['ai-users', '*']), 'llm_use'],
+ 'leaving llm_use out, which reopens it' => [$withoutLlm, 'llm_use'],
+ 'giving grant_manage' => [self::storedWith('grant_manage', ['my-team']), 'grant_manage'],
+ ];
+ }//end changes()
+
+ /**
+ * @dataProvider changes
+ *
+ * @param array $authorization The block a member sends.
+ * @param string $right The right it changes.
+ */
+ public function testAMemberIsRefusedWith403(array $authorization, string $right): void {
+ $this->organisationService->method('isOrganisationAdmin')->willReturn(false);
+ $this->request->method('getParams')->willReturn(['authorization' => $authorization]);
+ $this->organisationMapper->expects($this->never())->method('update');
+
+ $response = $this->controller->update('org-1');
+
+ $this->assertSame(403, $response->getStatus());
+ $this->assertSame([$right], $response->getData()['rights']);
+ $this->assertSame(self::STORED, $this->organisation->getAuthorization());
+ }//end testAMemberIsRefusedWith403()
+
+ /**
+ * @dataProvider changes
+ *
+ * @param array $authorization The block the owner or an administrator sends.
+ */
+ public function testTheOwnerOrAnAdministratorChangesIt(array $authorization): void {
+ $this->organisationService->method('isOrganisationAdmin')->with('org-1')->willReturn(true);
+ $this->request->method('getParams')->willReturn(['authorization' => $authorization]);
+
+ $response = $this->controller->update('org-1');
+
+ $this->assertNotSame(403, $response->getStatus());
+ $this->assertSame($authorization, $this->organisation->getAuthorization());
+ }//end testTheOwnerOrAnAdministratorChangesIt()
+
+ public function testAMemberStillEditsTheCrudListsAndTheName(): void {
+ $this->organisationService->method('isOrganisationAdmin')->willReturn(false);
+ $block = self::storedWith('object', ['create' => ['staff'], 'read' => ['staff'], 'update' => [], 'delete' => []]);
+ $this->request->method('getParams')->willReturn(['name' => 'Gemeente Zuid', 'authorization' => $block]);
+
+ $response = $this->controller->update('org-1');
+
+ $this->assertSame(200, $response->getStatus());
+ $this->assertSame(['staff'], $this->organisation->getAuthorization()['object']['create']);
+ $this->assertSame('Gemeente Zuid', $this->organisation->getName());
+ }//end testAMemberStillEditsTheCrudListsAndTheName()
+
+ public function testTheRetiredRightsAreNotSpecialRightsAnyMore(): void {
+ $this->organisationService->method('isOrganisationAdmin')->willReturn(false);
+ $block = self::STORED;
+ unset($block['object_publish'], $block['dashboard_view']);
+ $this->request->method('getParams')->willReturn(['authorization' => $block]);
+
+ $response = $this->controller->update('org-1');
+
+ $this->assertSame(200, $response->getStatus());
+ }//end testTheRetiredRightsAreNotSpecialRightsAnyMore()
+
+ public function testLeavingOutAKeyTheOrganisationNeverSetIsNoChange(): void {
+ $this->organisation->setAuthorization(['object' => ['read' => ['staff']]]);
+ $this->organisationService->method('isOrganisationAdmin')->willReturn(false);
+ $this->request->method('getParams')->willReturn(
+ ['authorization' => ['object' => ['read' => ['staff', 'guests']], 'agent_use' => ['*']]]
+ );
+
+ $response = $this->controller->update('org-1');
+
+ $this->assertSame(200, $response->getStatus());
+ }//end testLeavingOutAKeyTheOrganisationNeverSetIsNoChange()
+
+ public function testTheEndpointIsAPlainControllerSoThe403ReachesTheCaller(): void {
+ $this->assertTrue(is_subclass_of(OrganisationController::class, Controller::class));
+ $this->assertFalse(is_subclass_of(OrganisationController::class, OCSController::class));
+ }//end testTheEndpointIsAPlainControllerSoThe403ReachesTheCaller()
+}//end class
diff --git a/tests/Unit/Db/OrganisationTest.php b/tests/Unit/Db/OrganisationTest.php
index ee987cfddc..bb596f6301 100644
--- a/tests/Unit/Db/OrganisationTest.php
+++ b/tests/Unit/Db/OrganisationTest.php
@@ -409,10 +409,11 @@ public function testGetAuthorizationDefault(): void {
$this->assertArrayHasKey('agent', $auth);
$this->assertArrayHasKey('configuration', $auth);
$this->assertArrayHasKey('application', $auth);
- $this->assertArrayHasKey('object_publish', $auth);
$this->assertArrayHasKey('agent_use', $auth);
- $this->assertArrayHasKey('dashboard_view', $auth);
$this->assertArrayHasKey('llm_use', $auth);
+ // Retired, never enforced (decisions 247, 248): not written into a new block.
+ $this->assertArrayNotHasKey('object_publish', $auth);
+ $this->assertArrayNotHasKey('dashboard_view', $auth);
// Each entity type should have CRUD
foreach (['register', 'schema', 'object', 'view', 'agent', 'configuration', 'application'] as $entity) {
@@ -426,11 +427,10 @@ public function testGetAuthorizationDefault(): void {
$this->assertSame([], $auth[$entity]['delete']);
}
- // Special permissions
- $this->assertSame([], $auth['object_publish']);
- $this->assertSame([], $auth['agent_use']);
- $this->assertSame([], $auth['dashboard_view']);
- $this->assertSame([], $auth['llm_use']);
+ // Special rights: open to every signed-in user until narrowed, except grant_manage (decision 239).
+ $this->assertSame(['*'], $auth['agent_use']);
+ $this->assertSame(['*'], $auth['llm_use']);
+ $this->assertSame([], $auth['grant_manage']);
}
public function testSetAuthorizationArray(): void {
diff --git a/tests/Unit/Repair/OpenSpecialRightsToEveryoneTest.php b/tests/Unit/Repair/OpenSpecialRightsToEveryoneTest.php
new file mode 100644
index 0000000000..698be9bc40
--- /dev/null
+++ b/tests/Unit/Repair/OpenSpecialRightsToEveryoneTest.php
@@ -0,0 +1,194 @@
+
+ * @copyright 2026 Conduction B.V.
+ * @license EUPL-1.2 https://joinup.ec.europa.eu/collection/eupl/eupl-text-eupl-12
+ *
+ * SPDX-FileCopyrightText: 2026 Conduction B.V.
+ * SPDX-License-Identifier: EUPL-1.2
+ *
+ * @link https://conduction.nl
+ */
+
+declare(strict_types=1);
+
+namespace OCA\OpenRegister\Tests\Unit\Repair;
+
+use OCA\OpenRegister\Db\Organisation;
+use OCA\OpenRegister\Db\OrganisationMapper;
+use OCA\OpenRegister\Db\RegisterMapper;
+use OCA\OpenRegister\Db\SchemaMapper;
+use OCA\OpenRegister\Repair\OpenSpecialRightsToEveryone;
+use OCA\OpenRegister\Service\Rbac\OrganisationSpecialRights;
+use OCP\IAppConfig;
+use OCP\IGroupManager;
+use OCP\Migration\IOutput;
+use OCP\Migration\IRepairStep;
+use PHPUnit\Framework\MockObject\MockObject;
+use PHPUnit\Framework\TestCase;
+use Psr\Log\NullLogger;
+use RuntimeException;
+
+/**
+ * @covers \OCA\OpenRegister\Repair\OpenSpecialRightsToEveryone
+ * @uses \OCA\OpenRegister\Service\Rbac\OrganisationSpecialRights
+ * @uses \OCA\OpenRegister\Db\Organisation
+ *
+ * @spec openspec/changes/enforce-organisation-special-rights/specs/organisation-special-rights/spec.md
+ */
+class OpenSpecialRightsToEveryoneTest extends TestCase {
+
+ /**
+ * Organisations by uuid, as stored.
+ *
+ * @var array
+ */
+ private array $stored = [];
+
+ /**
+ * App config values set during the test.
+ *
+ * @var array
+ */
+ private array $config = [];
+
+ private OrganisationMapper&MockObject $organisations;
+
+ private OrganisationSpecialRights $rights;
+
+ protected function setUp(): void {
+ parent::setUp();
+
+ foreach ([
+ 'new' => ['object_publish' => [], 'agent_use' => [], 'dashboard_view' => [], 'llm_use' => [], 'grant_manage' => []],
+ 'backfilled' => ['object_publish' => ['admin'], 'agent_use' => ['admin'], 'dashboard_view' => ['admin'], 'llm_use' => ['admin']],
+ 'narrowed' => ['agent_use' => ['ai-users'], 'llm_use' => ['ai-users'], 'grant_manage' => ['records-service']],
+ ] as $uuid => $block) {
+ $organisation = new Organisation();
+ $organisation->setUuid($uuid);
+ $organisation->setAuthorization($block);
+ $this->stored[$uuid] = $organisation;
+ }
+
+ $this->organisations = $this->createMock(OrganisationMapper::class);
+ $this->organisations->method('findAll')->willReturnCallback(fn (): array => array_values($this->stored));
+ $this->organisations->method('findByUuid')->willReturnCallback(fn (string $uuid): Organisation => $this->stored[$uuid]);
+ $this->organisations->method('update')->willReturnArgument(0);
+
+ $groupManager = $this->createMock(IGroupManager::class);
+ $groupManager->method('isAdmin')->willReturn(false);
+ $groupManager->method('isInGroup')->willReturnCallback(static fn (string $uid, string $group): bool => $group === 'staff');
+
+ $this->rights = new OrganisationSpecialRights(
+ $this->organisations,
+ $this->createMock(RegisterMapper::class),
+ $this->createMock(SchemaMapper::class),
+ new NullLogger(),
+ $groupManager
+ );
+ }//end setUp()
+
+ /**
+ * The class info.xml names, built with its constructor's dependencies.
+ *
+ * @return IRepairStep The step.
+ */
+ private function registeredStep(): IRepairStep {
+ // Read the file with PHP, not libxml: under Nextcloud the libxml external
+ // entity loader refuses file paths, and simplexml_load_file() answers false.
+ $info = simplexml_load_string((string)file_get_contents(dirname(__DIR__, 3) . '/appinfo/info.xml'));
+ $this->assertNotFalse($info);
+
+ $registered = array_map('strval', $info->xpath('//repair-steps/post-migration/step'));
+ $name = OpenSpecialRightsToEveryone::class;
+ $this->assertContains($name, $registered, 'info.xml must run the step on upgrade');
+ $this->assertNotContains($name, array_map('strval', $info->xpath('//repair-steps/install/step')), 'a fresh install already defaults to *');
+
+ $appConfig = $this->createMock(IAppConfig::class);
+ $appConfig->method('getValueBool')->willReturnCallback(
+ fn (string $app, string $key, bool $default = false): bool => $this->config[$key] ?? $default
+ );
+ $appConfig->method('setValueBool')->willReturnCallback(
+ function (string $app, string $key, bool $value): bool {
+ $this->config[$key] = $value;
+ return true;
+ }
+ );
+
+ $step = new $name($this->rights, $appConfig, new NullLogger());
+ $this->assertInstanceOf(IRepairStep::class, $step);
+
+ return $step;
+ }//end registeredStep()
+
+ public function testBeforeTheStepTheStoredListsWouldRefuseAnOrdinaryUser(): void {
+ // The control: without the step, enforcing the lists as stored refuses.
+ foreach (array_keys($this->stored) as $uuid) {
+ $this->assertFalse($this->rights->mayUse(OrganisationSpecialRights::LLM_USE, 'bob', $uuid), $uuid);
+ }
+ }//end testBeforeTheStepTheStoredListsWouldRefuseAnOrdinaryUser()
+
+ public function testAfterTheUpgradeEveryUserWhoCouldChatStillCan(): void {
+ $this->registeredStep()->run($this->createMock(IOutput::class));
+
+ foreach (array_keys($this->stored) as $uuid) {
+ $this->assertTrue($this->rights->mayUse(OrganisationSpecialRights::LLM_USE, 'bob', $uuid), $uuid);
+ $this->assertTrue($this->rights->mayUse(OrganisationSpecialRights::AGENT_USE, 'bob', $uuid), $uuid);
+ }
+
+ $this->assertSame(['ai-users', '*'], $this->stored['narrowed']->getAuthorization()['llm_use'], 'groups are kept');
+ // The retired rights (decisions 247, 248) are left exactly as stored, and not added where absent.
+ $this->assertSame([], $this->stored['new']->getAuthorization()['object_publish']);
+ $this->assertSame(['admin'], $this->stored['backfilled']->getAuthorization()['dashboard_view']);
+ $this->assertArrayNotHasKey('object_publish', $this->stored['narrowed']->getAuthorization());
+ $this->assertSame(['records-service'], $this->stored['narrowed']->getAuthorization()['grant_manage'], 'grant_manage is never opened');
+ $this->assertSame([], $this->stored['new']->getAuthorization()['grant_manage']);
+ $this->assertTrue($this->config[OpenSpecialRightsToEveryone::DONE_KEY]);
+ }//end testAfterTheUpgradeEveryUserWhoCouldChatStillCan()
+
+ public function testALaterUpgradeDoesNotReopenARightAnAdministratorNarrowed(): void {
+ $step = $this->registeredStep();
+ $step->run($this->createMock(IOutput::class));
+
+ $block = $this->stored['narrowed']->getAuthorization();
+ $block['llm_use'] = ['ai-users'];
+ $this->stored['narrowed']->setAuthorization($block);
+
+ $this->organisations->expects($this->never())->method('update');
+ $step->run($this->createMock(IOutput::class));
+
+ $this->assertFalse($this->rights->mayUse(OrganisationSpecialRights::LLM_USE, 'bob', 'narrowed'));
+ }//end testALaterUpgradeDoesNotReopenARightAnAdministratorNarrowed()
+
+ public function testAFailureDoesNotAbortTheUpgradeAndIsFinishedNextTime(): void {
+ $organisations = $this->createMock(OrganisationMapper::class);
+ $organisations->method('findAll')->willThrowException(new RuntimeException('database away'));
+ $failing = new OrganisationSpecialRights(
+ $organisations,
+ $this->createMock(RegisterMapper::class),
+ $this->createMock(SchemaMapper::class),
+ new NullLogger(),
+ $this->createMock(IGroupManager::class)
+ );
+ $appConfig = $this->createMock(IAppConfig::class);
+ $appConfig->method('getValueBool')->willReturn(false);
+ $appConfig->expects($this->never())->method('setValueBool');
+ $output = $this->createMock(IOutput::class);
+ $output->expects($this->once())->method('warning');
+
+ (new OpenSpecialRightsToEveryone($failing, $appConfig, new NullLogger()))->run($output);
+ }//end testAFailureDoesNotAbortTheUpgradeAndIsFinishedNextTime()
+}//end class
diff --git a/tests/Unit/Service/ChatServiceTest.php b/tests/Unit/Service/ChatServiceTest.php
index 696097d548..3550cc2d00 100644
--- a/tests/Unit/Service/ChatServiceTest.php
+++ b/tests/Unit/Service/ChatServiceTest.php
@@ -15,6 +15,7 @@
use OCA\OpenRegister\Service\Chat\StreamYieldChannel;
use OCA\OpenRegister\Service\Chat\ToolManagementHandler;
use OCA\OpenRegister\Service\ChatService;
+use OCA\OpenRegister\Service\Rbac\OrganisationSpecialRights;
use PHPUnit\Framework\MockObject\MockObject;
use PHPUnit\Framework\TestCase;
use Psr\Log\LoggerInterface;
@@ -88,10 +89,21 @@ protected function setUp(): void {
$this->conversationHandler,
$this->historyHandler,
$this->toolHandler,
- $this->logger
+ $this->logger,
+ $this->allRights()
);
}
+ /**
+ * A reader of special rights that lets everybody use everything; ChatSpecialRightsTest covers refusals.
+ */
+ private function allRights(): OrganisationSpecialRights {
+ $rights = $this->createMock(OrganisationSpecialRights::class);
+ $rights->method('mayUse')->willReturn(true);
+
+ return $rights;
+ }
+
// --- processMessage ---
public function testProcessMessageSuccess(): void {
diff --git a/tests/Unit/Service/ChatSpecialRightsTest.php b/tests/Unit/Service/ChatSpecialRightsTest.php
new file mode 100644
index 0000000000..8d7563e625
--- /dev/null
+++ b/tests/Unit/Service/ChatSpecialRightsTest.php
@@ -0,0 +1,284 @@
+
+ * @copyright 2026 Conduction B.V.
+ * @license EUPL-1.2 https://joinup.ec.europa.eu/collection/eupl/eupl-text-eupl-12
+ *
+ * SPDX-FileCopyrightText: 2026 Conduction B.V.
+ * SPDX-License-Identifier: EUPL-1.2
+ *
+ * @link https://conduction.nl
+ */
+
+declare(strict_types=1);
+
+namespace OCA\OpenRegister\Tests\Unit\Service;
+
+use OCA\OpenRegister\Controller\ChatController;
+use OCA\OpenRegister\Db\Agent;
+use OCA\OpenRegister\Db\AgentMapper;
+use OCA\OpenRegister\Db\Conversation;
+use OCA\OpenRegister\Db\ConversationMapper;
+use OCA\OpenRegister\Db\FeedbackMapper;
+use OCA\OpenRegister\Db\Message;
+use OCA\OpenRegister\Db\MessageMapper;
+use OCA\OpenRegister\Db\Organisation;
+use OCA\OpenRegister\Db\OrganisationMapper;
+use OCA\OpenRegister\Db\RegisterMapper;
+use OCA\OpenRegister\Db\SchemaMapper;
+use OCA\OpenRegister\Service\Chat\ContextRetrievalHandler;
+use OCA\OpenRegister\Service\Chat\ConversationManagementHandler;
+use OCA\OpenRegister\Service\Chat\MessageHistoryHandler;
+use OCA\OpenRegister\Service\Chat\ResponseGenerationHandler;
+use OCA\OpenRegister\Service\Chat\ToolManagementHandler;
+use OCA\OpenRegister\Service\ChatService;
+use OCA\OpenRegister\Service\OrganisationService;
+use OCA\OpenRegister\Service\Rbac\OrganisationSpecialRights;
+use OCP\AppFramework\Controller;
+use OCP\AppFramework\OCSController;
+use OCP\IDBConnection;
+use OCP\IGroupManager;
+use OCP\IL10N;
+use OCP\IRequest;
+use PHPUnit\Framework\MockObject\MockObject;
+use PHPUnit\Framework\TestCase;
+use Psr\Log\NullLogger;
+
+/**
+ * @covers \OCA\OpenRegister\Service\ChatService
+ * @covers \OCA\OpenRegister\Controller\ChatController
+ * @uses \OCA\OpenRegister\Service\Rbac\OrganisationSpecialRights
+ * @uses \OCA\OpenRegister\Db\Organisation
+ * @uses \OCA\OpenRegister\Db\Conversation
+ * @uses \OCA\OpenRegister\Db\Agent
+ * @uses \OCA\OpenRegister\Db\Message
+ *
+ * @spec openspec/changes/enforce-organisation-special-rights/specs/organisation-special-rights/spec.md
+ */
+class ChatSpecialRightsTest extends TestCase {
+
+ /**
+ * Authorization blocks per organisation uuid.
+ *
+ * @var array>
+ */
+ private array $blocks = [];
+
+ /**
+ * Group ids per user.
+ *
+ * @var array>
+ */
+ private array $groups = ['alice' => ['ai-users'], 'bob' => ['staff'], 'admin' => ['admin']];
+
+ private ConversationMapper&MockObject $conversations;
+
+ private AgentMapper&MockObject $agents;
+
+ private ResponseGenerationHandler&MockObject $model;
+
+ private MessageHistoryHandler&MockObject $history;
+
+ private ?Agent $agent = null;
+
+ private Conversation $conversation;
+
+ protected function setUp(): void {
+ parent::setUp();
+
+ $this->conversation = new Conversation();
+ $this->conversation->setId(1);
+ $this->conversation->setUuid('conv-1');
+ $this->conversation->setTitle('Existing');
+ $this->conversation->setOrganisation('org-chat');
+
+ $this->conversations = $this->createMock(ConversationMapper::class);
+ $this->conversations->method('find')->willReturnCallback(fn (): Conversation => $this->conversation);
+ $this->conversations->method('findByUuid')->willReturnCallback(fn (): Conversation => $this->conversation);
+
+ $this->agents = $this->createMock(AgentMapper::class);
+ $this->agents->method('find')->willReturnCallback(fn (): ?Agent => $this->agent);
+
+ $this->model = $this->createMock(ResponseGenerationHandler::class);
+ $this->history = $this->createMock(MessageHistoryHandler::class);
+ $this->history->method('buildMessageHistory')->willReturn([]);
+ $stored = new Message();
+ $stored->setId(9);
+ $this->history->method('storeMessage')->willReturn($stored);
+ }//end setUp()
+
+ /**
+ * ChatController::sendMessage() as user `$userId`, through the real ChatService and reader.
+ *
+ * @param string $userId The caller.
+ *
+ * @return array{0: int, 1: array} The status and the body the caller gets.
+ */
+ private function send(string $userId): array {
+ $this->conversation->setUserId($userId);
+
+ $organisations = $this->createMock(OrganisationMapper::class);
+ $organisations->method('findByUuid')->willReturnCallback(function (string $uuid): Organisation {
+ $organisation = new Organisation();
+ $organisation->setUuid($uuid);
+ $organisation->setAuthorization($this->blocks[$uuid] ?? []);
+ return $organisation;
+ });
+ $groupManager = $this->createMock(IGroupManager::class);
+ $groupManager->method('isAdmin')->willReturnCallback(static fn (string $uid): bool => $uid === 'admin');
+ $groupManager->method('isInGroup')->willReturnCallback(
+ fn (string $uid, string $group): bool => in_array($group, $this->groups[$uid] ?? [], true)
+ );
+ $rights = new OrganisationSpecialRights(
+ $organisations,
+ $this->createMock(RegisterMapper::class),
+ $this->createMock(SchemaMapper::class),
+ new NullLogger(),
+ $groupManager
+ );
+
+ $context = $this->createMock(ContextRetrievalHandler::class);
+ $context->method('retrieveContext')->willReturn(['text' => '', 'sources' => []]);
+ $messages = $this->createMock(MessageMapper::class);
+ $messages->method('countByConversation')->willReturn(5);
+
+ $service = new ChatService(
+ $this->conversations,
+ $messages,
+ $this->agents,
+ $context,
+ $this->model,
+ $this->createMock(ConversationManagementHandler::class),
+ $this->history,
+ $this->createMock(ToolManagementHandler::class),
+ new NullLogger(),
+ $rights
+ );
+
+ $request = $this->createMock(IRequest::class);
+ $request->method('getParam')->willReturnCallback(
+ static fn (string $key): mixed => ['conversation' => 'conv-1', 'message' => 'Hello'][$key] ?? null
+ );
+ $l10n = $this->createMock(IL10N::class);
+ $l10n->method('t')->willReturnArgument(0);
+
+ $controller = new ChatController(
+ 'openregister',
+ $request,
+ $service,
+ $this->conversations,
+ $messages,
+ $this->createMock(FeedbackMapper::class),
+ $this->agents,
+ $this->createMock(OrganisationService::class),
+ $this->createMock(IDBConnection::class),
+ new NullLogger(),
+ $l10n,
+ $userId
+ );
+
+ $response = $controller->sendMessage();
+
+ return [$response->getStatus(), $response->getData()];
+ }//end send()
+
+ /**
+ * An agent of organisation `org-agent`.
+ *
+ * @return void
+ */
+ private function withAgent(): void {
+ $this->agent = new Agent();
+ $this->agent->setId(5);
+ $this->agent->setOrganisation('org-agent');
+ $this->conversation->setAgentId(5);
+ }//end withAgent()
+
+ public function testTheEndpointIsAPlainControllerSoA403ReachesTheCaller(): void {
+ // OCSMiddleware rewrites the status of an OCSController's response to 200;
+ // it leaves an ordinary Controller's status as it is.
+ $this->assertTrue(is_subclass_of(ChatController::class, Controller::class));
+ $this->assertFalse(is_subclass_of(ChatController::class, OCSController::class));
+ }//end testTheEndpointIsAPlainControllerSoA403ReachesTheCaller()
+
+ public function testAHolderOfLlmUseGetsAnAnswer(): void {
+ $this->blocks['org-chat'] = [OrganisationSpecialRights::LLM_USE => ['ai-users']];
+ $this->model->expects($this->once())->method('generateResponse')->willReturn('Hi');
+
+ [$status, $body] = $this->send('alice');
+
+ $this->assertSame(200, $status);
+ $this->assertSame('Hi', $body['message']);
+ }//end testAHolderOfLlmUseGetsAnAnswer()
+
+ public function testANonHolderOfLlmUseIsRefusedWith403AndNoModelIsCalled(): void {
+ $this->blocks['org-chat'] = [OrganisationSpecialRights::LLM_USE => ['ai-users']];
+ $this->model->expects($this->never())->method('generateResponse');
+ $this->history->expects($this->never())->method('storeMessage');
+
+ [$status, $body] = $this->send('bob');
+
+ $this->assertSame(403, $status);
+ $this->assertStringContainsString('llm_use', $body['message']);
+ }//end testANonHolderOfLlmUseIsRefusedWith403AndNoModelIsCalled()
+
+ public function testAnAdministratorIsNotRefused(): void {
+ $this->blocks['org-chat'] = [OrganisationSpecialRights::LLM_USE => []];
+ $this->withAgent();
+ $this->blocks['org-agent'] = [OrganisationSpecialRights::AGENT_USE => []];
+ $this->model->expects($this->once())->method('generateResponse')->willReturn('Hi');
+
+ [$status] = $this->send('admin');
+
+ $this->assertSame(200, $status);
+ }//end testAnAdministratorIsNotRefused()
+
+ public function testAgentUseIsReadFromTheAgentsOrganisation(): void {
+ $this->blocks['org-chat'] = [OrganisationSpecialRights::LLM_USE => ['*']];
+ $this->withAgent();
+ $this->blocks['org-agent'] = [OrganisationSpecialRights::AGENT_USE => ['ai-users']];
+ $this->model->expects($this->once())->method('generateResponse')->willReturn('Hi');
+
+ [$holder] = $this->send('alice');
+
+ $this->assertSame(200, $holder);
+ }//end testAgentUseIsReadFromTheAgentsOrganisation()
+
+ public function testANonHolderOfAgentUseIsRefusedWith403(): void {
+ $this->blocks['org-chat'] = [OrganisationSpecialRights::LLM_USE => ['*']];
+ $this->withAgent();
+ $this->blocks['org-agent'] = [OrganisationSpecialRights::AGENT_USE => ['ai-users']];
+ $this->model->expects($this->never())->method('generateResponse');
+
+ [$status, $body] = $this->send('bob');
+
+ $this->assertSame(403, $status);
+ $this->assertStringContainsString('agent_use', $body['message']);
+ }//end testANonHolderOfAgentUseIsRefusedWith403()
+
+ public function testAnOrganisationAfterTheUpgradeRefusesNobody(): void {
+ // What OpenSpecialRightsToEveryone leaves behind: `*` beside the backfilled admin group.
+ $this->blocks['org-chat'] = [OrganisationSpecialRights::LLM_USE => ['admin', '*']];
+ $this->withAgent();
+ $this->blocks['org-agent'] = [OrganisationSpecialRights::AGENT_USE => ['admin', '*']];
+ $this->groups['bob'] = [];
+ $this->model->expects($this->once())->method('generateResponse')->willReturn('Hi');
+
+ [$status] = $this->send('bob');
+
+ $this->assertSame(200, $status);
+ }//end testAnOrganisationAfterTheUpgradeRefusesNobody()
+}//end class
diff --git a/tests/Unit/Service/Rbac/GrantManageSpecialRightTest.php b/tests/Unit/Service/Rbac/GrantManageSpecialRightTest.php
index 1a4f67f398..0f1ac0cf58 100644
--- a/tests/Unit/Service/Rbac/GrantManageSpecialRightTest.php
+++ b/tests/Unit/Service/Rbac/GrantManageSpecialRightTest.php
@@ -129,7 +129,7 @@ static function (string|int $id): Schema {
}
);
- $specialRights = new OrganisationSpecialRights($organisations, $registers, $schemas, new NullLogger());
+ $specialRights = new OrganisationSpecialRights($organisations, $registers, $schemas, new NullLogger(), $this->createMock(IGroupManager::class));
$folder = $this->createMock(Folder::class);
$folder->method('getId')->willReturn(55);
diff --git a/tests/Unit/Service/Rbac/OrganisationSpecialRightsTest.php b/tests/Unit/Service/Rbac/OrganisationSpecialRightsTest.php
index b8c06d2361..d14329dbad 100644
--- a/tests/Unit/Service/Rbac/OrganisationSpecialRightsTest.php
+++ b/tests/Unit/Service/Rbac/OrganisationSpecialRightsTest.php
@@ -29,6 +29,7 @@
use OCA\OpenRegister\Db\SchemaMapper;
use OCA\OpenRegister\Service\Rbac\OrganisationSpecialRights;
use OCP\AppFramework\Db\DoesNotExistException;
+use OCP\IGroupManager;
use PHPUnit\Framework\MockObject\MockObject;
use PHPUnit\Framework\TestCase;
use Psr\Log\NullLogger;
@@ -69,7 +70,8 @@ protected function setUp(): void {
$this->organisations,
$this->registers,
$this->schemas,
- new NullLogger()
+ new NullLogger(),
+ $this->createMock(IGroupManager::class)
);
}//end setUp()
@@ -175,7 +177,7 @@ public function testAValueThatIsNotAListAdmitsNobody(): void {
public function testASchemaThatCannotBeLoadedAdmitsNobodyThroughANarrowedEntry(): void {
$schemas = $this->createMock(SchemaMapper::class);
$schemas->method('find')->willThrowException(new DoesNotExistException('gone'));
- $rights = new OrganisationSpecialRights($this->organisations, $this->registers, $schemas, new NullLogger());
+ $rights = new OrganisationSpecialRights($this->organisations, $this->registers, $schemas, new NullLogger(), $this->createMock(IGroupManager::class));
$this->organisationWith([['group' => 'svc', 'schemas' => ['reviewBatch']]]);
$this->assertFalse($rights->holdsOn(self::RIGHT, ['svc'], $this->record()));
diff --git a/tests/Unit/Service/Rbac/OrganisationSpecialRightsUseTest.php b/tests/Unit/Service/Rbac/OrganisationSpecialRightsUseTest.php
new file mode 100644
index 0000000000..86e3406bad
--- /dev/null
+++ b/tests/Unit/Service/Rbac/OrganisationSpecialRightsUseTest.php
@@ -0,0 +1,242 @@
+
+ * @copyright 2026 Conduction B.V.
+ * @license EUPL-1.2 https://joinup.ec.europa.eu/collection/eupl/eupl-text-eupl-12
+ *
+ * SPDX-FileCopyrightText: 2026 Conduction B.V.
+ * SPDX-License-Identifier: EUPL-1.2
+ *
+ * @link https://conduction.nl
+ */
+
+declare(strict_types=1);
+
+namespace OCA\OpenRegister\Tests\Unit\Service\Rbac;
+
+use InvalidArgumentException;
+use OCA\OpenRegister\Db\Organisation;
+use OCA\OpenRegister\Db\OrganisationMapper;
+use OCA\OpenRegister\Db\RegisterMapper;
+use OCA\OpenRegister\Db\SchemaMapper;
+use OCA\OpenRegister\Service\Rbac\OrganisationSpecialRights;
+use OCP\AppFramework\Db\DoesNotExistException;
+use OCP\IGroupManager;
+use PHPUnit\Framework\MockObject\MockObject;
+use PHPUnit\Framework\TestCase;
+use Psr\Log\NullLogger;
+
+/**
+ * @covers \OCA\OpenRegister\Service\Rbac\OrganisationSpecialRights
+ * @uses \OCA\OpenRegister\Db\Organisation
+ *
+ * @spec openspec/changes/enforce-organisation-special-rights/specs/organisation-special-rights/spec.md
+ */
+class OrganisationSpecialRightsUseTest extends TestCase {
+
+ private OrganisationMapper&MockObject $organisations;
+
+ private IGroupManager&MockObject $groupManager;
+
+ private OrganisationSpecialRights $rights;
+
+ protected function setUp(): void {
+ parent::setUp();
+
+ $this->organisations = $this->createMock(OrganisationMapper::class);
+ $this->groupManager = $this->createMock(IGroupManager::class);
+
+ $this->groupManager->method('isAdmin')->willReturnCallback(static fn (string $uid): bool => $uid === 'admin');
+ $this->groupManager->method('isInGroup')->willReturnCallback(
+ static fn (string $uid, string $group): bool => in_array($group, ['alice' => ['ai-users'], 'bob' => ['staff']][$uid] ?? [], true)
+ );
+
+ $this->rights = new OrganisationSpecialRights(
+ $this->organisations,
+ $this->createMock(RegisterMapper::class),
+ $this->createMock(SchemaMapper::class),
+ new NullLogger(),
+ $this->groupManager
+ );
+ }//end setUp()
+
+ /**
+ * Organisation `org-1` with one authorization block.
+ *
+ * @param array $authorization The stored block.
+ *
+ * @return Organisation The organisation.
+ */
+ private function organisationWith(array $authorization): Organisation {
+ $organisation = new Organisation();
+ $organisation->setUuid('org-1');
+ $organisation->setAuthorization($authorization);
+ $this->organisations->method('findByUuid')->with('org-1')->willReturn($organisation);
+
+ return $organisation;
+ }//end organisationWith()
+
+ /**
+ * @return array
+ */
+ public static function rightsInUse(): array {
+ return [
+ 'agent_use' => [OrganisationSpecialRights::AGENT_USE],
+ 'llm_use' => [OrganisationSpecialRights::LLM_USE],
+ ];
+ }//end rightsInUse()
+
+ /**
+ * @dataProvider rightsInUse
+ */
+ public function testAHolderMay(string $right): void {
+ $this->organisationWith([$right => ['ai-users']]);
+
+ $this->assertTrue($this->rights->mayUse($right, 'alice', 'org-1'));
+ }//end testAHolderMay()
+
+ /**
+ * @dataProvider rightsInUse
+ */
+ public function testANonHolderMayNot(string $right): void {
+ $this->organisationWith([$right => ['ai-users']]);
+
+ $this->assertFalse($this->rights->mayUse($right, 'bob', 'org-1'));
+ $this->assertFalse($this->rights->mayUse($right, 'carol', 'org-1'), 'a user in no group');
+ }//end testANonHolderMayNot()
+
+ /**
+ * @dataProvider rightsInUse
+ */
+ public function testAnAdministratorMayWithoutBeingListed(string $right): void {
+ $this->organisationWith([$right => []]);
+
+ $this->assertTrue($this->rights->mayUse($right, 'admin', 'org-1'));
+ }//end testAnAdministratorMayWithoutBeingListed()
+
+ /**
+ * @dataProvider rightsInUse
+ */
+ public function testAnEmptyListAdmitsOnlyAdministrators(string $right): void {
+ $this->organisationWith([$right => []]);
+
+ $this->assertFalse($this->rights->mayUse($right, 'alice', 'org-1'));
+ }//end testAnEmptyListAdmitsOnlyAdministrators()
+
+ /**
+ * @dataProvider rightsInUse
+ */
+ public function testEveryoneAdmitsEverySignedInUserIncludingOneInNoGroup(string $right): void {
+ $this->organisationWith([$right => ['ai-users', '*']]);
+
+ $this->assertTrue($this->rights->mayUse($right, 'bob', 'org-1'));
+ $this->assertTrue($this->rights->mayUse($right, 'carol', 'org-1'));
+ $this->assertFalse($this->rights->mayUse($right, '', 'org-1'), 'nobody signed in');
+ }//end testEveryoneAdmitsEverySignedInUserIncludingOneInNoGroup()
+
+ /**
+ * @dataProvider rightsInUse
+ */
+ public function testAKeyTheOrganisationNeverSetIsNotNarrowed(string $right): void {
+ $this->organisationWith(['object' => ['read' => ['staff']]]);
+
+ $this->assertTrue($this->rights->mayUse($right, 'bob', 'org-1'));
+ }//end testAKeyTheOrganisationNeverSetIsNotNarrowed()
+
+ public function testAValueThatIsNotAListRefuses(): void {
+ $this->organisationWith([OrganisationSpecialRights::LLM_USE => 'ai-users']);
+
+ $this->assertFalse($this->rights->mayUse(OrganisationSpecialRights::LLM_USE, 'alice', 'org-1'));
+ }//end testAValueThatIsNotAListRefuses()
+
+ public function testANarrowedEntryIsNotAGroupForARightInUse(): void {
+ $this->organisationWith([OrganisationSpecialRights::AGENT_USE => [['group' => 'ai-users', 'register' => 'r']]]);
+
+ $this->assertFalse($this->rights->mayUse(OrganisationSpecialRights::AGENT_USE, 'alice', 'org-1'));
+ }//end testANarrowedEntryIsNotAGroupForARightInUse()
+
+ public function testNoOrganisationNamedReadsTheDefaultOrganisation(): void {
+ $this->organisationWith([OrganisationSpecialRights::LLM_USE => ['ai-users']]);
+ $this->organisations->method('getDefaultOrganisationFromConfig')->willReturn('org-1');
+
+ $this->assertTrue($this->rights->mayUse(OrganisationSpecialRights::LLM_USE, 'alice', null));
+ $this->assertFalse($this->rights->mayUse(OrganisationSpecialRights::LLM_USE, 'bob', ''));
+ }//end testNoOrganisationNamedReadsTheDefaultOrganisation()
+
+ public function testNoOrganisationAndNoDefaultLeavesTheRightUnnarrowed(): void {
+ $this->organisations->method('getDefaultOrganisationFromConfig')->willReturn(null);
+ $this->organisations->expects($this->never())->method('findByUuid');
+
+ $this->assertTrue($this->rights->mayUse(OrganisationSpecialRights::LLM_USE, 'bob', null));
+ }//end testNoOrganisationAndNoDefaultLeavesTheRightUnnarrowed()
+
+ public function testAnOrganisationThatCannotBeLoadedRefuses(): void {
+ $this->organisations->method('findByUuid')->willThrowException(new DoesNotExistException('gone'));
+
+ $this->assertFalse($this->rights->mayUse(OrganisationSpecialRights::LLM_USE, 'bob', 'org-gone'));
+ $this->assertTrue($this->rights->mayUse(OrganisationSpecialRights::LLM_USE, 'admin', 'org-gone'));
+ }//end testAnOrganisationThatCannotBeLoadedRefuses()
+
+ public function testGrantManageIsNeverAnsweredAsARightInUse(): void {
+ $this->organisationWith([OrganisationSpecialRights::GRANT_MANAGE => ['*', 'ai-users']]);
+
+ $this->assertFalse($this->rights->mayUse(OrganisationSpecialRights::GRANT_MANAGE, 'alice', 'org-1'));
+ $this->assertFalse($this->rights->mayUse(OrganisationSpecialRights::GRANT_MANAGE, 'admin', 'org-1'));
+ }//end testGrantManageIsNeverAnsweredAsARightInUse()
+
+ public function testARetiredRightStillStoredLoadsAndIsNotAnswered(): void {
+ $this->organisationWith(['object_publish' => ['*'], 'dashboard_view' => ['*'], OrganisationSpecialRights::LLM_USE => ['ai-users']]);
+
+ $this->assertTrue($this->rights->mayUse(OrganisationSpecialRights::LLM_USE, 'alice', 'org-1'));
+ $this->assertFalse($this->rights->mayUse('object_publish', 'alice', 'org-1'));
+ $this->assertFalse($this->rights->mayUse('dashboard_view', 'alice', 'org-1'));
+ }//end testARetiredRightStillStoredLoadsAndIsNotAnswered()
+
+ public function testANewOrganisationOpensTheRightsInUseAndNotGrantManage(): void {
+ $organisation = new Organisation();
+ $organisation->setUuid('org-1');
+ $this->organisations->method('findByUuid')->willReturn($organisation);
+
+ $this->assertTrue($this->rights->mayUse(OrganisationSpecialRights::AGENT_USE, 'carol', 'org-1'));
+ $this->assertTrue($this->rights->mayUse(OrganisationSpecialRights::LLM_USE, 'carol', 'org-1'));
+ $this->assertSame([], $organisation->getAuthorization()[OrganisationSpecialRights::GRANT_MANAGE]);
+ $this->assertArrayNotHasKey('object_publish', $organisation->getAuthorization());
+ $this->assertArrayNotHasKey('dashboard_view', $organisation->getAuthorization());
+ }//end testANewOrganisationOpensTheRightsInUseAndNotGrantManage()
+
+ public function testOpeningToEveryoneAddsTheWildcardAndKeepsTheGroups(): void {
+ $narrowed = new Organisation();
+ $narrowed->setUuid('org-1');
+ $narrowed->setAuthorization([OrganisationSpecialRights::LLM_USE => ['admin'], 'object' => ['read' => ['staff']]]);
+ $open = new Organisation();
+ $open->setUuid('org-2');
+ $open->setAuthorization([OrganisationSpecialRights::LLM_USE => ['*']]);
+
+ $this->organisations->method('findAll')->willReturn([$narrowed, $open]);
+ $this->organisations->expects($this->once())->method('update')->with($narrowed)->willReturnArgument(0);
+
+ $answer = $this->rights->openToEveryoneInEveryOrganisation(OrganisationSpecialRights::LLM_USE);
+
+ $this->assertSame(['organisations' => 2, 'changed' => 1], $answer);
+ $this->assertSame(['admin', '*'], $narrowed->getAuthorization()[OrganisationSpecialRights::LLM_USE]);
+ $this->assertSame(['read' => ['staff']], $narrowed->getAuthorization()['object']);
+ }//end testOpeningToEveryoneAddsTheWildcardAndKeepsTheGroups()
+
+ public function testGrantManageIsNeverOpenedToEveryone(): void {
+ $this->organisations->expects($this->never())->method('update');
+
+ $this->expectException(InvalidArgumentException::class);
+ $this->rights->openToEveryoneInEveryOrganisation(OrganisationSpecialRights::GRANT_MANAGE);
+ }//end testGrantManageIsNeverOpenedToEveryone()
+}//end class
|