test(19.6.1-03): last-superuser race, lifecycle, revocation, seam and roles tests

- TestAdministratorsLastSuperuser (D-09): A and B reduce each other on the
  five paths while a test transaction holds the guard's advisory lock until
  pg_locks shows both requests waiting; one succeeds, one gets last_superuser
- TestAdministratorsLastSuperuserConcurrent: ten unsynchronized rounds
- TestAdministratorsLifecycle (D-10) and TestAdministratorsRevocation (D-12),
  two-row bulk selections included
- TestActionExtensionBoot (-short) and TestActionExtensionRun (D-14, D-15)
- TestRolesLifecycle (D-16, D-17), TestRolesPermissionCeiling (D-07)
- TestBackendScreensActivation (-short, D-01, D-04)

modules/cabana/backend_screens_test.go

@@ -173,3 +173,66 @@ func recordActionOfName(cc *CompiledController, name string) bool {
 	_, ok := recordActionOf(cc, name)
 	return ok
 }
+
+// TestBackendScreensActivation (D-01, D-04): the admin's own screens join
+// only an application that has an admin; then they bring both controllers,
+// both settings links (Administrators before Roles), both permission codes
+// granted to no role, and no navigation entry.
+func TestBackendScreensActivation(t *testing.T) {
+	// No admin controllers: no admin, and no admin config is read (the app
+	// has no admin.jwt.secret).
+	app := backpack.New(nil)
+	plain := contributionPlugin{id: "acme.plain", permissions: []pact.Permission{{Code: "acme.plain.use"}}}
+	routes, err := Activate(app, []party.Plugin{plain})
+	if routes != nil || err != nil {
+		t.Fatalf("Activate without admin controllers = %v, %v", routes, err)
+	}
+	// With a controller the same app needs the secret: the admin is active.
+	if _, err := Activate(app, []party.Plugin{screensExtender{}}); err == nil || !strings.Contains(err.Error(), "admin.jwt.secret") {
+		t.Fatalf("Activate with a controller and no secret = %v", err)
+	}
+
+	reg, err := compileWithScreens(t, []party.Plugin{screensExtender{}})
+	if err != nil {
+		t.Fatal(err)
+	}
+	for _, id := range []string{AdministratorsControllerID, RolesControllerID} {
+		cc, ok := reg.Get(id)
+		if !ok || cc.PluginID != "summercms.cabana" || cc.List == nil || cc.Form == nil {
+			t.Fatalf("controller %s = %#v", id, cc)
+		}
+	}
+	for _, code := range []string{PermissionManageUsers, PermissionManageRoles} {
+		permission, ok := reg.permissions[code]
+		if !ok || len(permission.Roles) != 0 {
+			t.Fatalf("permission %s = %+v (present %v), want no role grants", code, permission, ok)
+		}
+		for _, role := range []string{"developer", "publisher"} {
+			if reg.rolePermissions(role)[code] {
+				t.Fatalf("role %s holds %s", role, code)
+			}
+		}
+	}
+
+	ctx := context.Background()
+	navigation, settings := reg.Metadata(ctx, &bouncer.Principal{ID: 1, Backend: true, IsSuperuser: true}, nil)
+	var codes []string
+	for _, entry := range settings {
+		if entry.Controller == AdministratorsControllerID || entry.Controller == RolesControllerID {
+			codes = append(codes, entry.Code)
+		}
+	}
+	if strings.Join(codes, ",") != "administrators,roles" {
+		t.Fatalf("superuser settings for the screens = %v, want administrators then roles", codes)
+	}
+	for _, entry := range navigation {
+		if strings.HasPrefix(entry.Controller, "summercms.cabana.") {
+			t.Fatalf("navigation entry %+v from the screens", entry)
+		}
+	}
+	// A holder of backend.manage_roles alone sees the Roles link only.
+	_, settings = reg.Metadata(ctx, &bouncer.Principal{ID: 2, Backend: true, PermissionGrants: map[string]bool{PermissionManageRoles: true}}, nil)
+	if len(settings) != 1 || settings[0].Code != "roles" {
+		t.Fatalf("holder of %s sees %+v", PermissionManageRoles, settings)
+	}
+}