From 56175a4cc27785d4401cd1e5f7d0e8192ae3b12e Mon Sep 17 00:00:00 2001
From: Cursor Agent <cursoragent@cursor.com>
Date: Sat, 3 Oct 2026 10:06:47 +0000
Subject: [PATCH 1/2] Add ApplicationPolicy default permission and scope
 regression specs.

Lock down Axis Mundi-only CRUD defaults and Scope#resolve deny-by-default
behavior used by campuses, schools, departments, and other catalog resources.

Co-authored-by: rsmoke <rsmoke@umich.edu>
---
 spec/policies/application_policy_spec.rb | 57 ++++++++++++++++++++++++
 1 file changed, 57 insertions(+)
 create mode 100644 spec/policies/application_policy_spec.rb

diff --git a/spec/policies/application_policy_spec.rb b/spec/policies/application_policy_spec.rb
new file mode 100644
index 00000000..5fd27273
--- /dev/null
+++ b/spec/policies/application_policy_spec.rb
@@ -0,0 +1,57 @@
+# frozen_string_literal: true
+
+require 'rails_helper'
+
+RSpec.describe ApplicationPolicy, type: :policy do
+  let(:record) { Object.new }
+
+  describe 'default action permissions' do
+    context 'with an Axis Mundi user' do
+      subject { described_class.new(create(:user, :with_axis_mundi_role), record) }
+
+      %i[index show create new update edit destroy].each do |action|
+        it { is_expected.to permit_action(action) }
+      end
+    end
+
+    context 'with a regular user' do
+      subject { described_class.new(create(:user), record) }
+
+      %i[index show create new update edit destroy].each do |action|
+        it { is_expected.not_to permit_action(action) }
+      end
+    end
+
+    context 'with a nil user' do
+      subject { described_class.new(nil, record) }
+
+      it { is_expected.not_to permit_action(:index) }
+      it { is_expected.not_to permit_action(:destroy) }
+    end
+  end
+
+  describe 'Scope#resolve' do
+    let!(:visible_role) { create(:role, kind: 'Scoped Role A') }
+    let!(:hidden_role) { create(:role, kind: 'Scoped Role B') }
+
+    it 'returns all records for Axis Mundi users' do
+      user = create(:user, :with_axis_mundi_role)
+      scope = described_class::Scope.new(user, Role.all).resolve
+
+      expect(scope).to include(visible_role, hidden_role)
+    end
+
+    it 'returns no records for regular users' do
+      user = create(:user)
+      scope = described_class::Scope.new(user, Role.all).resolve
+
+      expect(scope).to be_empty
+    end
+
+    it 'returns no records for a nil user' do
+      scope = described_class::Scope.new(nil, Role.all).resolve
+
+      expect(scope).to be_empty
+    end
+  end
+end

From 0af58035085382f44d0567dcd856b9b42d9f17fe Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Wed, 14 Oct 2026 13:29:40 +0000
Subject: [PATCH 2/2] Strengthen ApplicationPolicy regression specs

Co-authored-by: rsmoke <5861173+rsmoke@users.noreply.github.com>
---
 spec/policies/application_policy_spec.rb | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/spec/policies/application_policy_spec.rb b/spec/policies/application_policy_spec.rb
index 5fd27273..e1c88233 100644
--- a/spec/policies/application_policy_spec.rb
+++ b/spec/policies/application_policy_spec.rb
@@ -25,8 +25,9 @@
     context 'with a nil user' do
       subject { described_class.new(nil, record) }
 
-      it { is_expected.not_to permit_action(:index) }
-      it { is_expected.not_to permit_action(:destroy) }
+      %i[index show create new update edit destroy].each do |action|
+        it { is_expected.not_to permit_action(action) }
+      end
     end
   end
 
@@ -36,9 +37,10 @@
 
     it 'returns all records for Axis Mundi users' do
       user = create(:user, :with_axis_mundi_role)
+      roles = Role.all.to_a
       scope = described_class::Scope.new(user, Role.all).resolve
 
-      expect(scope).to include(visible_role, hidden_role)
+      expect(scope).to match_array(roles)
     end
 
     it 'returns no records for regular users' do