Added integration coverage for the lazy find-resource hook

ref https://linear.app/ghost/issue/HKG-1817

- the unit tests stub the database, so nothing proved the model queries the hook
  depends on; this exercises the hook against real models so a change to the
  published-only scoping, the post/page split, or the TagPublic/Author
  shouldHavePosts gate fails loudly
- pins the security-relevant guards: a guessed slug must not surface a draft, a
  tag with no published posts, or a staff user, matching what the eager service
  would have hidden
- asserts withRelated genuinely populates tags/authors, since that population is
  what lets the service re-check tag:/author: route filters rather than silently
  404ing

Co-authored-by: Cursor <cursoragent@cursor.com>

Author: vershwal

ghost/core/test/integration/url-service.test.js

@@ -2,7 +2,10 @@ const assert = require('node:assert/strict');
 const sinon = require('sinon');
 const testUtils = require('../utils');
 const configUtils = require('../utils/config-utils');
+const models = require('../../core/server/models');
 const UrlService = require('../../core/server/services/url/url-service');
+const LazyUrlService = require('../../core/server/services/url/lazy-url-service');
+const {createFindResource} = require('../../core/server/services/url/lazy-find-resource');
 
 describe('Integration: services/url/UrlService', function () {
     let urlService;
@@ -108,6 +111,108 @@ describe('Integration: services/url/UrlService', function () {
         });
     });
 
+    describe('functional: lazy findResource against real models', function () {
+        let findResource;
+
+        before(testUtils.teardownDb);
+        before(testUtils.setup('users:roles', 'posts'));
+
+        before(function () {
+            findResource = createFindResource(models);
+        });
+
+        describe('posts', function () {
+            it('finds a published post by slug and loads its tags/authors relations', async function () {
+                const post = await findResource('posts', {slug: 'html-ipsum'});
+
+                assert.ok(post, 'expected the published post to be found');
+                assert.equal(post.slug, 'html-ipsum');
+                assert.equal(post.type, 'post');
+                assert.ok(Array.isArray(post.tags), 'tags relation should be loaded');
+                assert.ok(Array.isArray(post.authors), 'authors relation should be loaded');
+                assert.ok(post.authors.length >= 1, 'posts always have at least one author');
+            });
+
+            it('does not return draft posts', async function () {
+                assert.equal(await findResource('posts', {slug: 'unfinished'}), null);
+            });
+
+            it('does not return a page when querying the posts collection', async function () {
+                assert.equal(await findResource('posts', {slug: 'static-page-test'}), null);
+            });
+        });
+
+        describe('pages', function () {
+            it('finds a published page by slug', async function () {
+                const page = await findResource('pages', {slug: 'static-page-test'});
+
+                assert.ok(page, 'expected the published page to be found');
+                assert.equal(page.slug, 'static-page-test');
+                assert.equal(page.type, 'page');
+            });
+
+            it('does not return draft pages', async function () {
+                assert.equal(await findResource('pages', {slug: 'static-page-draft'}), null);
+            });
+
+            it('does not return a post when querying the pages collection', async function () {
+                assert.equal(await findResource('pages', {slug: 'html-ipsum'}), null);
+            });
+        });
+
+        describe('tags', function () {
+            it('finds a public tag that has published posts', async function () {
+                const tag = await findResource('tags', {slug: 'kitchen-sink'});
+
+                assert.ok(tag, 'expected the public tag to be found');
+                assert.equal(tag.slug, 'kitchen-sink');
+            });
+
+            it('does not surface a tag with no published posts', async function () {
+                const emptyTag = testUtils.DataGenerator.forKnex.tags[3];
+                assert.equal(await findResource('tags', {slug: emptyTag.slug}), null);
+            });
+        });
+
+        describe('authors', function () {
+            it('finds an author with published posts', async function () {
+                const author = await findResource('authors', {slug: 'joe-bloggs'});
+
+                assert.ok(author, 'expected the author with posts to be found');
+                assert.equal(author.slug, 'joe-bloggs');
+            });
+
+            it('does not surface a user with no published posts', async function () {
+                const noPosts = testUtils.DataGenerator.forKnex.users[1];
+                assert.equal(await findResource('authors', {slug: noPosts.slug}), null);
+            });
+        });
+
+        it('returns null for unknown router types without querying', async function () {
+            assert.equal(await findResource('unknown', {slug: 'html-ipsum'}), null);
+        });
+
+        describe('end-to-end via LazyUrlService.resolveUrl', function () {
+            it('resolves a real published post URL through the service', async function () {
+                const service = new LazyUrlService({findResource});
+                service.onRouterAddedType('posts', null, 'posts', '/:slug/');
+
+                const resource = await service.resolveUrl('/html-ipsum/');
+
+                assert.ok(resource);
+                assert.equal(resource.type, 'posts');
+                assert.equal(resource.slug, 'html-ipsum');
+            });
+
+            it('returns null for a draft slug', async function () {
+                const service = new LazyUrlService({findResource});
+                service.onRouterAddedType('posts', null, 'posts', '/:slug/');
+
+                assert.equal(await service.resolveUrl('/unfinished/'), null);
+            });
+        });
+    });
+
     describe('functional: extended/modified routing set', function () {
         before(testUtils.teardownDb);
         before(testUtils.setup('users:roles', 'posts'));