Major revamp of the Playground

.github/workflows/lint.yaml

@@ -23,5 +23,3 @@ jobs:
         run: "yarn run lint"
       - name: "Run formatting check"
         run: "yarn run format:check"
-      - name: "Run Typescript type checking"
-        run: "yarn run typecheck"

.github/workflows/test.yaml

@@ -10,19 +10,25 @@ on:
 jobs:
   test:
     name: "Run Tests"
-    runs-on: "depot-ubuntu-24.04-small"
+    runs-on: "depot-ubuntu-24.04-4"
     steps:
       - uses: "actions/checkout@v6"
         with:
+          lfs: true
           submodules: true
-      - uses: "authzed/action-spicedb@v1"
-        with:
-          version: "latest"
       - uses: "actions/setup-node@v6"
         with:
           node-version: 24
           cache-dependency-path: "yarn.lock"
           cache: "yarn"
       - uses: "bahmutov/npm-install@v1"
+      - name: "Install chromium for playwright"
+        run: "yarn test:install-chromium-headless"
       - name: "Run tests"
         run: "yarn test"
+      - name: "Upload test artifacts"
+        if: "failure()"
+        uses: "actions/upload-artifact@v4"
+        with:
+          name: "test-screenshots"
+          path: "src/tests/browser/__screenshots__"

api/lookupshare.ts

@@ -1,7 +1,7 @@
 import { GetObjectCommand, S3Client } from "@aws-sdk/client-s3";
 import type { VercelRequest, VercelResponse } from "@vercel/node";
 
-const encodeURL = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_";
+export const encodeURL = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_";
 
 export default async function handler(req: VercelRequest, res: VercelResponse) {
   const shareid = req.query.shareid ?? "";
@@ -76,6 +76,27 @@ export default async function handler(req: VercelRequest, res: VercelResponse) {
       }
     }
 
+    if ("check_watches" in shareData) {
+      if (!Array.isArray(shareData.check_watches)) {
+        return res.status(400).json({ error: "Share data is not supported" });
+      }
+      for (const w of shareData.check_watches) {
+        if (typeof w !== "object" || w === null) {
+          return res.status(400).json({ error: "Share data is not supported" });
+        }
+        if (
+          typeof w.object !== "string" ||
+          typeof w.action !== "string" ||
+          typeof w.subject !== "string"
+        ) {
+          return res.status(400).json({ error: "Share data is not supported" });
+        }
+        if ("context" in w && typeof w.context !== "string") {
+          return res.status(400).json({ error: "Share data is not supported" });
+        }
+      }
+    }
+
     return res.status(200).send(bodyContents);
   } catch (error) {
     if (error instanceof Error && error.name === "NoSuchKey") {

api/share.ts

@@ -11,6 +11,12 @@ export type SharedDataV2 = {
   relationships_yaml?: string;
   validation_yaml?: string;
   assertions_yaml?: string;
+  check_watches?: Array<{
+    object: string;
+    action: string;
+    subject: string;
+    context?: string;
+  }>;
 };
 
 const hashPrefixSize = 12;
@@ -51,6 +57,20 @@ function validateSharedDataV2(data: VercelRequestBody): data is SharedDataV2 {
     }
   }
 
+  if ("check_watches" in data) {
+    const watches = data.check_watches;
+    if (!Array.isArray(watches)) {
+      return false;
+    }
+    for (const w of watches) {
+      if (typeof w !== "object" || w === null) return false;
+      if (typeof w.object !== "string") return false;
+      if (typeof w.action !== "string") return false;
+      if (typeof w.subject !== "string") return false;
+      if ("context" in w && typeof w.context !== "string") return false;
+    }
+  }
+
   return true;
 }
 

dev-api/README.md

@@ -0,0 +1,6 @@
+## The Dev API
+
+The share logic in prod is taken care of by Vercel API routes
+that write and read to object storage. This provides a similar
+API, but stores the shares in-memory. It exists to make it possible
+to test share logic in development.