feat(model-apps): verify what persona security roles actually grant - #423

plugins/model-apps/docs/jtbd-probe-design.md:133

• Same as above: lib/surface-route.js suggests a directory that doesn’t exist in this plugin. Consider aligning the proposed module location with the established scripts/lib/ convention.

`lib/surface-route.js`: a resolved ref → an MDA deep link.

plugins/model-apps/docs/jtbd-probe-design.md:111

• The proposed module path lib/surface-resolver.js doesn’t match the existing repo layout (there is no plugins/model-apps/lib/; shared code lives under scripts/lib/). Using the correct path in the design note will reduce implementation ambiguity.

This issue also appears on line 133 of the same file.

A new pure module `lib/surface-resolver.js`:

plugins/model-apps/docs/jtbd-probe-design.md:104

• Section numbering is inconsistent: this is labeled “## 3.” after “## 3a.” and “## 3b.” above, which makes references harder to follow in reviews and future discussions. Consider renaming this heading to keep the sequence monotonic.

## 3. Four rungs, each shippable alone

plugins/model-apps/docs/jtbd-probe-design.md:215

• This sentence says to prototype auth before writing any of Rungs 0–3, but earlier the doc explicitly stages Rungs 0–1 to be offline and valuable even if auth never works unattended. Tightening this to “Rungs 2–3” keeps the sequencing internally consistent.

for. **Prototype this before writing any of Rungs 0–3.** If a persisted profile cannot be made to

plugins/model-apps/scripts/verify-model-app.js:113

• privilegedepthmask is documented as a bitmask; mapping only the exact values 1/2/4/8 will return an empty depth string if the service ever returns a combined mask (e.g. 3/5/6/7), causing false failures in the role-privileges subset comparison. Translate masks by taking the most-permissive bit set (Global > Deep > Local > Basic).

      const DEPTH_BY_MASK = { 1: 'Basic', 2: 'Local', 4: 'Deep', 8: 'Global' };
      const rows = await sdk.queryRecords('roleprivileges', {
        select: ['privilegeid', 'privilegedepthmask'],
        filter: `roleid eq ${roleId}`,
        top: 5000,

plugins/model-apps/docs/jtbd-probe-design.md:3

• The doc still states "proposal, not yet built" / "Nothing here is implemented", but this PR actually implements rung 0 (surface resolution + lint/verify wiring) and the role privilege-depth verification. Update the status/title to reflect that parts have shipped and clarify which rungs remain proposed, otherwise readers (and the PR description) will be inaccurate.

# JTBD probes — design note (proposal, not yet built)

**Status:** proposal for review. Nothing here is implemented.

plugins/model-apps/scripts/verify-model-app.js:127

• readerFor() now always exposes entityPrivileges()/rolePrivileges(), but entityPrivileges depends on opts.httpClient. build-model-app.js calls readerFor(provisionSdk, …) without passing httpClient, so role-privilege verification will fail closed for every persona (entityPrivileges throws, entityPrivileges map stays empty, compareRolePrivileges reports every declared privilege as unreadable). Either thread httpClient through build-model-app’s verify reader, or gate these readers so they are only present when an httpClient is supplied.

    entityPrivileges: async (logical) => {
      const name = String(logical).toLowerCase();
      const url = `/EntityDefinitions(LogicalName='${odataLit(name)}')?$select=LogicalName,Privileges`;
      const res = await opts.httpClient.get(url);
      if (!res || res.status < 200 || res.status >= 300) return null;

plugins/model-apps/scripts/lib/surface-resolver.js:67

• declaredSurfaces() has the same malformed-shape hazard: for (const p of spec.personas || []) will throw if personas is a truthy non-array (object/string), and (p && p.jobs) || [] will throw if jobs is truthy non-array. If this helper is meant to be safe on WIP specs, use Array.isArray guards for personas/jobs/surfaces.

function declaredSurfaces(spec) {
  const out = [];
  for (const p of spec.personas || []) {
    for (const j of (p && p.jobs) || []) {
      for (const s of (j && j.surfaces) || []) {
        if (typeof s === 'string' && s.trim()) out.push({ persona: (p.persona || '').trim(), job: (j.name || '').trim(), surface: s.trim() });

plugins/model-apps/scripts/verify-model-app.js:113

• privilegedepthmask is a bitmask; Dataverse can return combined values (e.g., 7 or 15) representing the max depth. Mapping only {1,2,4,8} turns combined masks into an empty depth string, which then reads as “held at , below declared …” and can false-fail privilege checks. Decode the bitmask by taking the highest set bit (Global > Deep > Local > Basic).

      const DEPTH_BY_MASK = { 1: 'Basic', 2: 'Local', 4: 'Deep', 8: 'Global' };
      const rows = await sdk.queryRecords('roleprivileges', {
        select: ['privilegeid', 'privilegedepthmask'],
        filter: `roleid eq ${roleId}`,
        top: 5000,

plugins/model-apps/scripts/lib/surface-resolver.js:55

• buildIndex() iterates with for (const x of spec.<field> || []). If a malformed/in-progress spec has a truthy non-array (e.g., { views: {} }), spec.views || [] yields an object and for..of throws, contradicting the module’s “tolerates a malformed spec” intent. Guard each collection with Array.isArray (similar to spec-lint’s arrOf()) before iterating.

This issue also appears on line 62 of the same file.

  for (const v of spec.views || []) add(v && v.name, { kind: 'view', name: v.name, entity: v.entity });
  for (const f of spec.forms || []) add(f && f.name, { kind: 'form', name: f.name, entity: f.entity });
  for (const d of spec.dashboards || []) add(d && d.name, { kind: 'dashboard', name: d.name });
  for (const p of spec.pages || []) {
    // A page is referenced by stable KEY in schemaVersion 2 and by display name in prose, so accept

plugins/model-apps/scripts/verify-model-app.js:222

• entityPrivileges now relies on opts.envUrl to build an absolute Dataverse Web API URL. The current readerFor(...) call does not pass the env URL, so the privilege metadata read will return null and the new role-privileges check will fail-closed. Pass the env URL through the reader options (and ensure other callers of the exported readerFor do the same).

  const r = await verifySpec(spec, readerFor(sdk, appUniqueName(spec), { genpageCli, workspaceDir, httpClient }));

plugins/model-apps/scripts/verify-model-app.js:128

• entityPrivileges calls opts.httpClient.get() with a relative URL (/EntityDefinitions...). The injected createAzHttpClient explicitly refuses non-absolute URLs (it expects the SDK-style full URL https://<org>/api/data/v9.x/...), so this will throw and make the role-privileges check fail-closed even in healthy environments.

      const name = String(logical).toLowerCase();
      const url = `/EntityDefinitions(LogicalName='${odataLit(name)}')?$select=LogicalName,Privileges`;
      const res = await opts.httpClient.get(url);
      if (!res || res.status < 200 || res.status >= 300) return null;
      return (res.body && res.body.Privileges) || null;

plugins/model-apps/scripts/lib/role-privileges.js:8

• Comment typo: this line starts with ////, which looks accidental and makes the header harder to read.

//// SUBSET, not equality. We assert the role holds AT LEAST every declared privilege at AT LEAST the