feat(security): isolate bounded work and support required auth actions

webui/tests/module-capabilities.test.ts

@@ -1,5 +1,6 @@
 import type {
   AuthInfo,
+  AuthActionUiCapability,
   DashboardWidgetsUiCapability,
   OrganizationFunctionActionContext,
   OrganizationFunctionActionContribution,
@@ -80,6 +81,19 @@ for (const testCase of cases) {
 assert(uiCapability("files.fileExplorer", [access, files]) === filesCapability, "files capability should return the module-provided object");
 assert(uiCapability("mail.profiles", [access, mail]) === mailCapability, "mail capability should return the module-provided object");
 
+const authActionCapability: AuthActionUiCapability = {
+  actions: ["change_password"], RequiredAction: () => null, LoginHelp: () => null
+};
+const publicAuthModule: PlatformWebModule = {
+  id: "access", label: "Access", version: "test",
+  publicRoutes: [{ path: "/password-recovery", render: () => null }],
+  uiCapabilities: { "auth.actions": authActionCapability }
+};
+assert(uiCapability<AuthActionUiCapability>("auth.actions", [publicAuthModule]) === authActionCapability,
+  "required authentication actions can resolve from the public catalogue without normal scopes");
+assert(uiCapability<AuthActionUiCapability>("auth.actions", []) === null,
+  "core-only compositions have no authentication action implementation");
+
 const configurableDashboardWidgets: DashboardWidgetsUiCapability = {
   widgets: [
     {