Skip to main content
Event authorization changes are complete when the same caller receives consistent access from the server decision, response disclosure, client controls, mutations, and cache updates. Run the whole acceptance set before reviewing a frozen commit.

​
Run the acceptance set

Install the root, api-events, and web locked dependencies using the repository’s pinned npm version. From the repository root:
The runner generates the API client and executes the explicit suite manifest in scripts/testing/event-authz-suites.json. It exits unsuccessfully if any package fails. Keep the manifest current when adding a permission-sensitive workflow; it complements the full package checks. Run the database cases against an isolated, migrated PostgreSQL database:
The database set covers assignment and outbox persistence, invitation state, event ties, ledger transitions, and My Gigs visibility. It also runs the integration coverage guard so a new database helper cannot silently lose test coverage. It does not replace HTTP or device testing.

​
Fixed policy matrix

The shared cases in scripts/testing/eventAuthzAcceptanceCases.ts pass the real server decision through the web response schema and mobile response mapper. Both clients are also given a stale local owner role so a server denial cannot silently regain authority in a client fallback.

​
Complete workflow checks

  • Exercise reads and writes through their real operation and serializer. Draft offer list, detail, no-op update, decline, and admin-decline responses must use the authenticated viewer’s disclosure. Check parent fees, day fees, recipient overrides, and effective fees, including enrichment failures. Preserve self-only and full-disclosure controls and existing published/eventless offer behavior.
  • Keep compensation editing distinct from paying people. Exercise invite/payable updates, payment confirmation, and denied payout controls with explicit capabilities.
  • Create an invitation and its promised payable in one database transaction. Verify rollback after either write, safe retries for an existing invitation (repair from its stored fee even when the request changes the amount), fresh creation with a distinct payable override, concurrent creation, and invitation deletion during fee updates. Lock ordering must match event-date changes. A failed sibling item must not undo a successful item in the same bulk request.
  • Preserve self-only compensation for unlinked email invitations in single responses, lists, and declined-invitation lookback. Resolve the caller’s persisted, unambiguous email once per batch. An email must never override another linked user or a financial disclosure denial.
  • Render the mobile team, payment, and invitation callers with stale owner roles. Present server denials must win; staffing, financial viewing, financial editing, and external invitations remain separate controls.
  • Grant Tasks and Run of Show independently, render their actual editors, and preserve unsaved content when a collapsible section closes.
  • Add an assignee, persist a role, remove the person, and apply the refreshed cache. The removed picker row must stay removed. Verify current-viewer revocation evicts inaccessible event data and removes grants. With a retained creator, crew, or invitation viewing tie, self-downgrades must remove revoked grants from detail and list caches even when revalidation fails; preserve organization grants, server denials, and failed-write rollback.
  • Verify list filters distinguish a known empty assignment roster from an omitted or redacted roster. Include paging and invalidation after assignment changes.
  • Keep the complete event Activity feed restricted to organization Owners and Admins in the API, mobile tab visibility, and direct tab rendering. Lead retains its empty planning sections without receiving organization-wide layout or audit grants. Include stale roles, omitted capability fields, legacy creator fallback, cached audit rows after permission revocation, and session switches while audit requests are offline or still in flight.
  • Update fees as a FINANCES-only assignee through the bulk HTTP precheck and operation. Preserve invitation response, delivery metadata, position, and call order; avoid roster changes and invitation notifications, and keep declined payables voided. Staffing managers retain their existing invitation-update behavior. Verify currency and payment terms follow the same full, own-invitation, and hidden disclosure rules as fees.
  • Exercise immediate and scheduled assignment delivery for blank titles using the event-type/default display title. Revoke some or all roles before a retry and after broker publication; remove and reassign the same role; deactivate the member or delete the event. Old notices must not regain revoked roles, and retry must preserve only the original roles that are still held. Verify this through real assignment/outbox persistence, the drain, and the device-delivery processor.
  • Fail broker publication, repeat the durable outbox item, and then recover the broker. Fallback and broker delivery must share the notification deduplication claim. If the claim store fails, best-effort callers must not send without a claim or leak an unhandled rejection; durable callers must retain retry behavior.

​
Review readiness

  1. Run the acceptance set and isolated database set.
  2. Run the required API and web checks and mobile format, app type-check, lint, unit tests, and Knip checks. Resolve failures introduced by the PR or its merge with the base branch.
  3. Review one final candidate for surviving bypasses and legitimate-workflow regressions. Verify any concrete findings before changing code.
  4. Record the reviewed commit, checks, and remaining device or HTTP validation limits in the PR. Run a device smoke test when a current build and test session are available; a queued build is not a passing device test.