* test: expect app scoping to refuse a foreign app_script id in app_preview_auth
#11777 scopes run-mode app_script ids to their app, so another app's id is
now refused with 401 before the content-hash pin check is reached.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* test: run end_user_email inline scripts through the deployed app_script id
#11777 runs inline code only through the app_script rows the deployed lite
value references once it exists, so id-less raw_code is refused. Shape the
fixtures like real apps (nested inlineScript) and run by the deployed id.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* test: wait for both dedicated worker jobs on one listener
The second completed-job listener was opened only after the first job
completed, so a second job that finished first was never seen and the test
hung until the 90s worker timeout.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* fix: expose apps:run in the token scope picker and let apps:write grant it
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix: confine path-scoped app run/write tokens to the app they name
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix: let apps:run read back its own app's S3 files, condense scope comments
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix: let apps:write mint apps:run and extend run read-back to app S3 display routes
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* docs: drop stale embed-token wording from the app S3 helper summary
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix: require pinned sha for inline raw_code in viewer app run mode
* fix: gate rd_string import behind parquet feature to fix oss build
* fix: also require pin for raw_code with app_script id in viewer run mode
* fix: enforce auth guards on app component preview execution
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* fix: guard previewed runnable path and worker tag in app preview
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* fix: validate app_script id ownership and keep root push isolation
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* refactor: scope app preview guards to operator check + referenced runnables
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* fix: require jobs:run scope and tag check on app preview (apps:run escalation)
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Ruben FiszelandClaude Opus 5.5