test(core): prove Views cannot grant access

webui/tests/module-capabilities.test.ts

@@ -1,4 +1,5 @@
 import type {
+  AuthInfo,
   DashboardWidgetsUiCapability,
   OrganizationFunctionActionContext,
   OrganizationFunctionActionContribution,
@@ -17,7 +18,7 @@ import {
   visibleRoutesForProjection
 } from "../src/platform/views";
 import { groupNavigationItems } from "../src/platform/productAreas";
-import { scopeGrants } from "../src/utils/permissions";
+import { hasAnyScope, scopeGrants } from "../src/utils/permissions";
 
 function assert(condition: unknown, message: string): void {
   if (!condition) throw new Error(message);
@@ -194,7 +195,7 @@ assert(
 
 const viewAwareFiles: PlatformWebModule = {
   ...files,
-  navItems: [{ to: "/files", label: "Files", order: 20 }],
+  navItems: [{ to: "/files", label: "Files", order: 20, anyOf: ["files:file:read"] }],
   viewSurfaces: [
     {
       id: "files.settings.connectors",
@@ -265,6 +266,28 @@ assert(
   visibleRoutesForProjection([viewAwareFiles], filesView).length === 1,
   "selected routes should remain in the effective route list"
 );
+const unauthorizedFilesUser = {
+  user: { id: "user-1", account_id: "account-1", email: "viewer@example.test" },
+  tenant: { id: "tenant-1", slug: "test", name: "Test" },
+  scopes: [],
+  roles: [],
+  groups: [],
+  principal: {
+    account_id: "account-1",
+    tenant_id: "tenant-1",
+    scopes: [],
+    group_ids: [],
+    auth_method: "session"
+  },
+  profile_loaded: true,
+  roles_loaded: true,
+  groups_loaded: true
+} satisfies AuthInfo;
+assert(
+  isViewSurfaceVisible(filesView, "files.nav.files", viewCatalogue) &&
+    !hasAnyScope(unauthorizedFilesUser, ["files:file:read"]),
+  "View visibility must not add the Access permission required by a module"
+);
 
 const missingParentView = {
   ...filesView,