- Shipped
- September 9, 2026 at 3:26 AM UTC
- Author
- Kamo
- Commit
- e34b995
GamesEntitlementTest proves the gate answers correctly. Nothing proved the three controllers ask it — and that distinction is the entire defect this change set was about: a rule that exists and is not consulted. A suite that only unit-tests the rule would have passed just as happily against the code that shipped the hole. Verified by mutation rather than asserted. With `games.require(...)` removed from ChessController.player(): GamesEntitlementTest 7 run, 0 failures ← green, tells nobody anything GamesEntitlementEndpointTest 9 run, 3 failures ← red which is exactly the gap this file closes, and the reason it is worth having on top of the unit test rather than instead of it. GamesEntitlement is REAL here, not a mock. Mocking it would stub `require` into a method that never throws, and every test in this file would pass against a controller with no gate at all — the vacuous-guard failure. Only the two repositories underneath it are mocked, so the refusal is produced by the same code the pod runs and mapped to a status by the same @RestControllerAdvice. Nine cases, driven through the real routes with MockMvc: each of the three doors refusing a member who holds the right in an organization with no such app; the owner branch refusing too, since ownership stands in for a missing GRANT and never for a missing app; the wallet pairing each game with its OWN right, so a chess right cannot open the wallet of an org that only has Hold'em; and — the half worth keeping honest — that an entitled organization still plays, that its owner still gets in without the grant, and that entitlement does not replace the right. 404 rather than 403 on the app check doubles as the assertion that it was the APP that refused rather than the right. No production code changes.