🌍 Dev.to
Refuse an unentitled caller in a Forge resolver, and prove it with a test that goes red without the gate
Refuse an unentitled caller in a Forge resolver, and prove it with a test that goes red without the gate
Key takeaways
END STATE: a resolver that refuses an unentitled caller, proven by a test suite that scores 1/6 against the ungated version and 6/6 against the gated one.
The happy path passes either way. That is why a positive-only test proves nothing about authorization.
Fail CLOSED: a probe that throws, times out, or returns an unexpected shape must refuse, not allow. ...

