test(schedules): runs for a creator have exactly the creator's access

Owner decision 2026-10-16 (QQQ DelegatedAccess.USER). Needs the QQQ RC
with qqq#1265.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

.circleci/config.yml

@@ -1,14 +1,60 @@
 version: 2.1
-setup: true
+
 orbs:
-  qqq-orb: kingsrook/qqq-orb@0.7.12
+   qqq-orb: kingsrook/qqq-orb@0.6.9
+
+commands:
+   configure-package-install:
+      steps:
+         - run:
+              name: Keep package installation unattended
+              command: |
+                 # These build machines are discarded after the job.
+                 sudo install -d /etc/needrestart/conf.d
+                 printf '%s\n' '$nrconf{restart} = "l";' | sudo tee /etc/needrestart/conf.d/99-qqq-ci.conf >/dev/null
+
 workflows:
-  setup:
+   test_only:
-    jobs:
+      jobs:
-    - qqq-orb/generate_pipeline:
+         - qqq-orb/mvn_test_only:
-        orb_version: 0.7.12
+              pre-steps:
-        filters:
+                 - configure-package-install
-          branches:
+              context: [qqq-maven-registry-credentials]
-            ignore: automation/qbit-rc-pending
+              filters:
-          tags:
+                 branches:
-            only: /^v\d+\.\d+\.\d+$/
+                    ignore: /(develop|release\/.*)/
+
+   publish_snapshot:
+      jobs:
+         - qqq-orb/mvn_publish:
+              pre-steps:
+                 - configure-package-install
+              context: [qqq-maven-registry-credentials]
+              branch_type: snapshot
+              filters:
+                 branches:
+                    only: [develop]
+
+   publish_release_candidate:
+      jobs:
+         - qqq-orb/mvn_publish:
+              pre-steps:
+                 - configure-package-install
+              context: [qqq-maven-registry-credentials]
+              branch_type: release_candidate
+              filters:
+                 branches:
+                    only: [/release\/.*/]
+
+   publish_release:
+      jobs:
+         - qqq-orb/mvn_publish:
+              pre-steps:
+                 - configure-package-install
+              context: [qqq-maven-registry-credentials]
+              branch_type: release
+              filters:
+                 branches:
+                    ignore: /.*/
+                 tags:
+                    only: [/^v\d+\.\d+\.\d+$/]

.github/workflows/codeql.yml

@@ -1,23 +0,0 @@
-name: CodeQL
-'on':
-  push:
-    branches:
-    - main
-    - develop
-    - release/**
-    - hotfix/**
-  pull_request: {}
-  schedule:
-  - cron: 41 16 * * 0
-  workflow_dispatch: {}
-permissions:
-  contents: read
-  actions: read
-  security-events: write
-  packages: read
-concurrency:
-  group: codeql-${{ github.event.pull_request.number || github.ref }}
-  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
-jobs:
-  analyze:
-    uses: QRun-IO/qqq-orb/.github/workflows/qbit-codeql.yml@c288a8864fe9054f68410e1d78f5863aea4c4d22

.github/workflows/release-rc.yml

@@ -1,74 +1,26 @@
+# Cut the next release candidate (QRun-IO/qqq docs/QRUN-QBIT-REPO-STANDARD.md, C6):
+# run this workflow by hand, or merge a develop PR labelled `release:rc`. It merges develop into
+# the release line and the release/* push runs CircleCI publish_release_candidate.
 name: Release candidate
-'on':
+
+on:
   workflow_dispatch:
     inputs:
       dry_run:
-        description: Plan a cut without changing release state
+        description: Print the plan without merging or creating branches
         type: boolean
         default: false
-      finalize:
-        description: Retry finalization of an existing cut; do not cut another RC
-        type: boolean
-        default: false
-      recover:
-        description: Recover the same published RC after a deployment timeout; never
-          reupload
-        type: boolean
-        default: false
-      circle_build:
-        description: Original Circle publisher build number (recovery only)
-        type: string
-        default: ''
-      merge_sha:
-        description: Existing cut merge_sha (finalize retry only)
-        type: string
-        default: ''
-      bump_sha:
-        description: Existing cut bump_sha (finalize retry only)
-        type: string
-        default: ''
-      branch:
-        description: Existing cut branch (finalize retry only)
-        type: string
-        default: ''
-      version:
-        description: Existing cut version (finalize retry only)
-        type: string
-        default: ''
   pull_request:
-    types:
+    types: [closed]
-    - closed
+    branches: [develop]
-    branches:
+
-    - develop
-  repository_dispatch:
-    types:
-    - qbit-rc-published
 permissions:
   contents: write
-  actions: read
+
-  checks: read
 jobs:
   release-rc:
-    if: github.event_name == 'workflow_dispatch' || github.event_name == 'repository_dispatch'
+    if: github.event_name == 'workflow_dispatch' || (github.event.pull_request.merged == true && contains(github.event.pull_request.labels.*.name, 'release:rc'))
-      || (github.event_name == 'pull_request' && github.event.pull_request.merged
+    uses: QRun-IO/.github/.github/workflows/qbit-release-rc.yml@main
-      == true && github.event.pull_request.base.ref == 'develop' && contains(github.event.pull_request.labels.*.name,
-      'release:rc'))
-    uses: QRun-IO/qqq-orb/.github/workflows/qbit-release-rc.yml@cc30f599e63c8e41629c99d23395bac1adb8bc44
-    with:
-      dry_run: ${{ github.event_name == 'workflow_dispatch' && inputs.dry_run || false
-        }}
-      finalize: ${{ github.event_name == 'repository_dispatch' || (github.event_name
-        == 'workflow_dispatch' && inputs.finalize) }}
-      recover: ${{ github.event_name == 'workflow_dispatch' && inputs.recover || false
-        }}
-      circle_build: ${{ github.event_name == 'workflow_dispatch' && inputs.circle_build
-        || '' }}
-      merge_sha: ${{ github.event_name == 'repository_dispatch' && github.event.client_payload.merge_sha
-        || inputs.merge_sha || '' }}
-      bump_sha: ${{ github.event_name == 'repository_dispatch' && github.event.client_payload.bump_sha
-        || inputs.bump_sha || '' }}
-      branch: ${{ github.event_name == 'repository_dispatch' && github.event.client_payload.branch
-        || inputs.branch || '' }}
-      version: ${{ github.event_name == 'repository_dispatch' && github.event.client_payload.version
-        || inputs.version || '' }}
     secrets: inherit
+    with:
+      dry_run: ${{ github.event_name == 'workflow_dispatch' && inputs.dry_run }}

.qqq-ci.yml

@@ -1,16 +0,0 @@
-profile: qbit
-orb_version: 0.7.12
-default_branch: develop
-java_version: '21'
-browsers: true
-api_checks: false
-docs_only: false
-release_on_main: false
-release_tag_policy: stable
-test_branch_policy: non-release
-publish:
-  snapshot: true
-  release_candidate: true
-  release: true
-  asciidoc: false
-release_completion: true

src/test/java/com/kingsrook/qbits/dataanalysis/AnalysisSessionsTest.java

@@ -0,0 +1,87 @@
+/*
+ * QQQ - Low-code Application Framework for Engineers.
+ * Copyright (C) 2021-2025.  Kingsrook, LLC
+ * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
+ * contact@kingsrook.com
+ * https://github.com/Kingsrook/
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.kingsrook.qbits.dataanalysis;
+
+
+import java.io.Serializable;
+import java.util.HashMap;
+import com.kingsrook.qbits.dataanalysis.model.DataAnalysisTables;
+import com.kingsrook.qbits.dataanalysis.schedule.AnalysisSessions;
+import com.kingsrook.qqq.backend.core.model.metadata.QInstance;
+import com.kingsrook.qqq.backend.core.model.metadata.code.QCodeReference;
+import com.kingsrook.qqq.backend.core.model.session.QSession;
+import com.kingsrook.qqq.backend.core.modules.authentication.QAuthenticationModuleCustomizerInterface;
+import com.kingsrook.qqq.backend.core.modules.authentication.implementations.MockAuthenticationModule;
+import com.kingsrook.qqq.backend.core.serviceidentity.QDelegatedSession;
+import com.kingsrook.qqq.backend.core.serviceidentity.QServicePrincipalMetaData;
+import com.kingsrook.qqq.backend.core.serviceidentity.ServiceIdentities;
+import com.kingsrook.qqq.backend.core.serviceidentity.ServiceIdentitiesMetaData;
+import org.junit.jupiter.api.Test;
+import static org.assertj.core.api.Assertions.assertThat;
+
+
+/*******************************************************************************
+ ** Owner decision 2026-10-16: a schedule or watch run for its creator (or a
+ ** recipient) through the data-analysis principal sees exactly what that user
+ ** can see - their permissions and record-lock keys, not the principal's.
+ *******************************************************************************/
+class AnalysisSessionsTest extends EngineFixture
+{
+   /*******************************************************************************
+    **
+    *******************************************************************************/
+   @Test
+   void runsForTheCreatorWithExactlyTheCreatorsAccess() throws Exception
+   {
+      instance.withInstanceDefaultAuthentication(new com.kingsrook.qqq.backend.core.model.metadata.authentication.QAuthenticationMetaData().withName("mock")
+         .withType(com.kingsrook.qqq.backend.core.model.metadata.QAuthenticationType.MOCK));
+      instance.getAuthentication().setCustomizer(new QCodeReference(CreatorCustomizer.class));
+      ServiceIdentitiesMetaData.declare(instance, new QServicePrincipalMetaData().withName("data-analysis").withMayActOnBehalfOfUsers(true)
+         .withLocalPermissions("data_analysis.saved.read"));
+      DataAnalysisQBitConfig creatorConfig = new DataAnalysisQBitConfig().withServicePrincipal("data-analysis");
+
+      QSession own     = new MockAuthenticationModule().createAutomatedSessionForUser(instance, "alice");
+      QSession forUser = AnalysisSessions.forUser(creatorConfig, "alice");
+      assertThat(forUser).isInstanceOf(QDelegatedSession.class);
+      assertThat(forUser.getPermissions()).isEqualTo(own.getPermissions()).contains("orders.analyze");
+      assertThat(new HashMap<>(forUser.getSecurityKeyValues())).isEqualTo(new HashMap<>(own.getSecurityKeyValues()));
+      assertThat(forUser.getSecurityKeyValues().get(DataAnalysisTables.USER_KEY)).containsExactly("alice");
+      assertThat(ServiceIdentities.attributionName(forUser)).endsWith("via service:data-analysis");
+   }
+
+
+
+   /*******************************************************************************
+    ** The creator's own grants and owner key, as the host customizer sets them.
+    *******************************************************************************/
+   public static class CreatorCustomizer implements QAuthenticationModuleCustomizerInterface
+   {
+      /***************************************************************************
+       **
+       ***************************************************************************/
+      @Override
+      public void customizeAutomatedSessionForUser(QInstance qInstance, QSession session, Serializable userId)
+      {
+         session.withPermissions("orders.read", "orders.analyze", "data_analysis.saved.read", "data_analysis.saved.edit");
+         session.withSecurityKeyValue(DataAnalysisTables.USER_KEY, String.valueOf(userId));
+      }
+   }
+}