feat: add core authorization foundation

core/tests/authorization-store.test.ts

@@ -0,0 +1,58 @@
+import { describe, expect, it, vi } from "vitest";
+
+const poolConstructor = vi.hoisted(() => vi.fn());
+
+vi.mock("pg", () => ({ Pool: poolConstructor }));
+
+import { createAuthorizationDrizzleDatabase } from "../src/authorization/database.js";
+import { AuthorizationStoreError, createAuthorizationStore } from "../src/authorization/store.js";
+
+describe("Core authorization store — import and construction safety", () => {
+  it("does not construct a pool or open a connection merely because the module is imported", () => {
+    expect(poolConstructor).not.toHaveBeenCalled();
+  });
+
+  it("does not perform any query merely because the store is constructed", () => {
+    poolConstructor.mockImplementation(function fakePool() {
+      return { end: async () => undefined, on: vi.fn(), query: vi.fn() };
+    });
+    const { db } = createAuthorizationDrizzleDatabase("postgresql://example.test/ekklesia");
+
+    const store = createAuthorizationStore(db);
+
+    expect(store).toBeDefined();
+    expect(typeof store.createGrant).toBe("function");
+    expect(typeof store.revokeGrant).toBe("function");
+    expect(typeof store.hasActiveGrant).toBe("function");
+    expect(typeof store.grantPlatformOwner).toBe("function");
+    expect(typeof store.revokePlatformOwner).toBe("function");
+    expect(typeof store.isPlatformOwner).toBe("function");
+    expect(Object.isFrozen(store)).toBe(true);
+  });
+});
+
+describe("AuthorizationStoreError", () => {
+  it.each([
+    "AUTHORIZATION_GRANT_CREATE_FAILED",
+    "AUTHORIZATION_GRANT_LOOKUP_FAILED",
+    "AUTHORIZATION_GRANT_NOT_FOUND",
+    "AUTHORIZATION_GRANT_REVOKE_FAILED",
+    "AUTHORIZATION_PLATFORM_OWNER_LOOKUP_FAILED",
+    "AUTHORIZATION_PLATFORM_OWNER_MUTATION_FAILED",
+    "AUTHORIZATION_PLATFORM_OWNER_NOT_FOUND",
+  ] as const)("exposes a stable code and a fixed, generic message for %s", (code) => {
+    const error = new AuthorizationStoreError(code);
+    expect(error.code).toBe(code);
+    expect(error.name).toBe("AuthorizationStoreError");
+    expect(Object.isFrozen(error)).toBe(true);
+    expect(error.message.length).toBeGreaterThan(0);
+  });
+
+  it("never carries a cause, raw driver error, SQL, or stack detail beyond the fixed message", () => {
+    const error = new AuthorizationStoreError("AUTHORIZATION_GRANT_CREATE_FAILED");
+    const publicText = `${String(error)}\n${error.stack ?? ""}`;
+    expect(publicText).toBe(
+      `AuthorizationStoreError: ${error.message}\nAuthorizationStoreError: ${error.message}`,
+    );
+  });
+});