Verify document access isolation, tree integrity and review #276

Status (2026-09-17)

Covered by McpDiscoveryTests.DocumentationStaysInsideTheProjectAndTheKeysGrants, HttpTests.DocumentationPagesRenderAsATreeBesideThePage, ItemNumberConcurrencyTests.CrossedPageMovesNeverBothCommit, DocumentServiceTests.OrganizationMembersReadItsDocumentationOnlyWhileTheyBelong and DocumentServiceTests.LiveNotificationsCarryNoContent:

• Another user's key and a key for another project get the same answer as for a non-existent number from item_get (by number and slug), item_history, memory_recall, page_store, item_archive and item_delete; no title, no hint that it is a page.
• A read-only key reads pages but cannot create, edit, move, archive or delete them, and leaves no proposal behind.
• A page awaiting permanent deletion disappears from item_get, slug lookup and recall; its subpage stays readable.
• In the web app, another user's private docs (tree, page, versions, edit, slug-only address) answer 404 without the title, like a missing project.
• Organization members read the organization's documentation, are not moderators by membership, and lose access at once when removed.
• Live notifications carry only resource and project id; every open page reloads with its own permissions. A test fails if content is added to LiveChange.
• Crossed concurrent moves never both commit (SQL Server).
• There is no anonymous access: the whole web app requires sign-in, so the anonymous case is the signed-in non-member.

Search does not exist yet; its isolation belongs to #273.

Work

Integration tests across two users, organizations, public and private projects, and agents with differing grants, over UI, HTTP and MCP.

Acceptance

• Hidden pages leak neither through the tree, breadcrumbs, recall, backlinks, counts nor live updates (search: #273).
• Anonymous access returns 404 for private pages, identical to a missing page.
• Tree moves, deletions and concurrent edits keep numbering and hierarchy consistent.
• Review cannot be bypassed by moving a page or by editing through a relation.