test(e2e): un-skip versionRouting 9.2; record the measured blockers on the RBAC suite

[rubenvdlinde]

Follow-up to #81 (the OpenRegister read grant), which is what made these assertions reachable.

9.2 — enabled, four scenarios replacing one that asserted almost nothing

Two things unblocked it:

1. Fixture users. globalSetup provisions rbac-owner/-editor/-viewer/-outsider and mints one storageState each, so no spec form-logs-in — four consecutive logins is exactly what trips Nextcloud's brute-force throttle. loginAs is gone from this file.
2. fix(rbac): grant authenticated read on every openbuild schema (#76) #81. Until every schema carried a read rule, non-admins saw zero objects. "Viewer gets 404" passed for the wrong reason, and no 200 assertion was reachable at all.

The old body could not fail meaningfully: it located the schema list with .ob-schema-list / [data-testid="schema-list"], neither of which exists in src/, so "must NOT be visible" held on any page — including a correct one — and it downgraded a missing not-found UI to a console.warn.

Now asserted:

scenario	assertion
viewer + staging	404, body pinned exactly, plus a regex proving the envelope names no authorisation reason
non-member + staging	byte-identical to the viewer's — and identical again to an unknown version slug. That indistinguishability is REQ-OBVR-003
editor + staging	200 with a manifest — the positive control
viewer UI	.openbuild-schema-list (the real selector) absent, no stack trace

The editor row matters most: without it, a broken fixture, a missing version chain and a blanket denial all look identical to a pass. Setup grants the roles via grantAppRoles(), which had been merged with no caller — so the control now exercises a genuine editor.

schema-access-scopes-rbac — stays skipped, with honest blockers

All three recorded blockers are resolved: the fixture users exist (and map naturally onto "editor in the selected group" vs "editor not in it" — no vets group, no Newman needed); the version chain is seeded; and the feature is real — the warning is an NcNoteCard sibling of .openbuild-access-editor, with the copy in SchemaDesigner.vue. .note-stub never existed.

A fourth blocker, found by driving it rather than reading it, is not resolved: the schema designer is unreachable for a non-admin. rbac-editor lands on the first-time setup wizard with .openbuild-schema-list count 0, because /api/setup/status is admin-only and useSetupStatus read its 403 as "nothing done". Fixed upstream in ConductionNL/nextcloud-vue#574 (merged); unblocks on a published bump.

The comment also records #83, found while measuring: availableGroups feeds the dropdown group:-prefixed values while authorLockedOut compares bare gids, so the lock-out warning fires for members too — precisely the REQ-OBDSA-004 scenario. Noted so this suite is not simply un-skipped and declared green once the wizard blocker lifts.

Verification

versionRouting.spec.ts — 6 passed against the disposable instance (3.6m), including all four new 9.2 scenarios. Full-suite result reported in a comment below.

🤖 Generated with Claude Code

[github-actions]

Quality Report — ConductionNL/openbuild @ 141929f

Check	PHP	Vue	Security	License	Tests
lint	✅
phpcs	✅
phpmd	✅
psalm	✅
phpstan	✅
phpmetrics	✅
eslint		✅
stylelint		✅
composer			✅	✅ 100/100
npm			✅	✅ 659/659
PHPUnit					✅
Newman					⏭️
Playwright					⏭️

Coverage: 89.4% (17/19 statements)

---

Quality workflow — 2026-08-01 21:55 UTC

Download the full PDF report from the workflow artifacts.