test(webapp): restore PAT action type guard

Author: carderne

apps/webapp/test/types/patRouteBuilderIdentityOnly.types.ts

@@ -0,0 +1,27 @@
+import { json } from "@remix-run/server-runtime";
+import { z } from "zod";
+import {
+  createActionPATApiRoute,
+  createLoaderPATApiRoute,
+} from "~/services/routeBuilders/apiBuilder.server";
+
+// A type-level test, not a runtime one: `.test.ts` is excluded from `tsconfig.check.json`, so this
+// file is named `.types.ts` to be checked by `pnpm run typecheck --filter webapp`.
+//
+// `identityOnly` waives the refusal an environment-scoped user-actor token gets on a route that
+// names nothing to check its claim against. It is only sound for reads, so the action builder must
+// not accept it.
+
+export const identityOnlyLoader = createLoaderPATApiRoute({ identityOnly: true }, async () =>
+  json({ ok: true })
+);
+
+export const identityOnlyAction = createActionPATApiRoute(
+  {
+    method: "POST",
+    params: z.object({ id: z.string() }),
+    // @ts-expect-error — an action mutates, so it can never be identity-only.
+    identityOnly: true,
+  },
+  async () => json({ ok: true })
+);

knip.json

@@ -18,6 +18,7 @@
         "prisma/populate.ts",
         "scripts/**/*.{js,mjs,cjs,ts,mts,cts}",
         "test/**/*.producer.ts",
+        "test/types/**/*.types.ts",
         "test/setup/global-e2e-full-setup.ts",
         "vite/node-globals-shim.js",
         "app/v3/otlpTransformWorker.ts"