fix tests

Author: icecrasher321

apps/sim/app/api/skills/[id]/members/route.ts

@@ -91,11 +91,14 @@ export const GET = withRouteHandler(async (_request: NextRequest, context: Route
       return NextResponse.json({ error: 'Not found' }, { status: 404 })
     }
 
-    const entries = await listSkillMembers({
-      id: actor.skill.id,
-      workspaceId: actor.skill.workspaceId,
-      workspaceShared: actor.skill.workspaceShared,
-    })
+    const entries = await listSkillMembers(
+      {
+        id: actor.skill.id,
+        workspaceId: actor.skill.workspaceId,
+        workspaceShared: actor.skill.workspaceShared,
+      },
+      { role: actor.role }
+    )
 
     const members = entries.map((entry) => ({
       ...entry,

apps/sim/lib/skills/access.test.ts

@@ -349,7 +349,10 @@ describe('listSkillMembers', () => {
       ])
     )
 
-    const entries = await listSkillMembers({ id: 's1', workspaceId: 'ws', workspaceShared: true })
+    const entries = await listSkillMembers(
+      { id: 's1', workspaceId: 'ws', workspaceShared: true },
+      { role: 'admin' }
+    )
     const byUser = new Map(entries.map((e) => [e.userId, e]))
 
     expect(byUser.get('boss')).toMatchObject({
@@ -384,7 +387,10 @@ describe('listSkillMembers', () => {
       ])
     )
 
-    const entries = await listSkillMembers({ id: 's1', workspaceId: 'ws', workspaceShared: false })
+    const entries = await listSkillMembers(
+      { id: 's1', workspaceId: 'ws', workspaceShared: false },
+      { role: 'admin' }
+    )
 
     // Derived access can never be broken by explicit rows: the workspace admin
     // stays an active admin even with a stale revoked row.
@@ -396,4 +402,25 @@ describe('listSkillMembers', () => {
       roleSource: 'workspace-admin',
     })
   })
+
+  it('hides deny markers from non-admin viewers', async () => {
+    dbState.results = [
+      [{ id: 'row-1', userId: 'denied', role: 'member', status: 'revoked', joinedAt: null }],
+    ]
+    mockGetUsersWithPermissions.mockResolvedValue(
+      roster([
+        { userId: 'denied', permissionType: 'write' },
+        { userId: 'reader', permissionType: 'read' },
+      ])
+    )
+
+    const entries = await listSkillMembers(
+      { id: 's1', workspaceId: 'ws', workspaceShared: true },
+      { role: 'member' }
+    )
+
+    // A member viewer sees the active roster only — who was explicitly denied
+    // is admin-only data.
+    expect(entries.map((e) => e.userId)).toEqual(['reader'])
+  })
 })

apps/sim/lib/skills/access.ts

@@ -175,19 +175,24 @@ export interface SkillMemberEntry {
 }
 
 /**
- * The canonical member roster for a skill: every CURRENT workspace member
- * mapped through {@link resolveSkillRole}, so the list always matches what
- * enforcement grants. Workspace admins surface as derived admins, explicit
- * active rows as their role, revoked rows as removed (deny) entries, and —
- * while the skill is workspace-shared — remaining members as implicit members.
- * Explicit rows for users no longer in the workspace are ignored, exactly as
- * enforcement ignores them.
+ * The canonical member roster for a skill, scoped to what the viewer may see:
+ * every CURRENT workspace member mapped through {@link resolveSkillRole}, so
+ * the list always matches what enforcement grants. Workspace admins surface as
+ * derived admins, explicit active rows as their role, and — while the skill is
+ * workspace-shared — remaining members as implicit members. Revoked rows are
+ * deliberate per-skill deny markers and exist to be restored, so they are
+ * included only for skill-admin viewers; other members never learn who was
+ * denied. Explicit rows for users no longer in the workspace are ignored,
+ * exactly as enforcement ignores them.
  */
-export async function listSkillMembers(skillRow: {
-  id: string
-  workspaceId: string
-  workspaceShared: boolean
-}): Promise<SkillMemberEntry[]> {
+export async function listSkillMembers(
+  skillRow: {
+    id: string
+    workspaceId: string
+    workspaceShared: boolean
+  },
+  viewer: { role: SkillMemberRole }
+): Promise<SkillMemberEntry[]> {
   const [explicitRows, workspaceMembers] = await Promise.all([
     db
       .select({
@@ -215,7 +220,10 @@ export async function listSkillMembers(skillRow: {
       workspaceAccess: { hasAccess: true, canAdmin },
     })
 
-    if (role === null && row?.status !== 'revoked') continue
+    if (role === null) {
+      // Entries only a deny marker would produce are admin-only data.
+      if (row?.status !== 'revoked' || viewer.role !== 'admin') continue
+    }
 
     entries.push({
       id: row?.id ?? `${canAdmin ? 'workspace-admin' : 'workspace'}-${wsMember.userId}`,

packages/testing/src/mocks/audit.mock.ts

@@ -129,6 +129,9 @@ export const auditMock = {
     SKILL_CREATED: 'skill.created',
     SKILL_UPDATED: 'skill.updated',
     SKILL_DELETED: 'skill.deleted',
+    SKILL_MEMBER_ADDED: 'skill_member.added',
+    SKILL_MEMBER_REMOVED: 'skill_member.removed',
+    SKILL_MEMBER_ROLE_CHANGED: 'skill_member.role_changed',
     TABLE_CREATED: 'table.created',
     TABLE_UPDATED: 'table.updated',
     TABLE_DELETED: 'table.deleted',