feat: allow rank-gated housekeeping preview in production

src/features/housekeeping/foundation/preview-gate.test.ts

@@ -3,14 +3,24 @@ import { isHousekeepingPreviewEnabled } from "./preview-gate";
 
 describe("isHousekeepingPreviewEnabled", () => {
 	it.each([
-		["development", true, true],
-		["test", true, true],
-		["development", false, false],
-		["production", true, false],
-		["production", false, false],
-	] as const)("NODE_ENV=%s flag=%s => %s", (nodeEnv, flag, expected) => {
-		expect(isHousekeepingPreviewEnabled({ nodeEnv, flag })).toBe(expected);
-	});
+		["development", true, false, true],
+		["test", true, false, true],
+		["development", false, true, false],
+		["production", true, true, true],
+		["production", true, false, false],
+		["production", false, true, false],
+	] as const)(
+		"NODE_ENV=%s flag=%s productionAccess=%s => %s",
+		(nodeEnv, flag, hasProductionAccess, expected) => {
+			expect(
+				isHousekeepingPreviewEnabled({
+					nodeEnv,
+					flag,
+					hasProductionAccess,
+				}),
+			).toBe(expected);
+		},
+	);
 });
 
 describe("HOUSEKEEPING_NEXT_PREVIEW_ENABLED", () => {

src/features/housekeeping/foundation/preview-gate.ts

@@ -1,6 +1,10 @@
 export function isHousekeepingPreviewEnabled(input: {
 	nodeEnv: "development" | "test" | "production";
 	flag: boolean;
+	hasProductionAccess?: boolean;
 }): boolean {
-	return input.nodeEnv !== "production" && input.flag;
+	return (
+		input.flag &&
+		(input.nodeEnv !== "production" || input.hasProductionAccess === true)
+	);
 }

src/features/housekeeping/foundation/preview-route-contract.test.ts

@@ -365,10 +365,12 @@ describe("/admin-next preview gate", () => {
 		vi.clearAllMocks();
 		routeMocks.env.NODE_ENV = "test";
 		routeMocks.env.HOUSEKEEPING_NEXT_PREVIEW_ENABLED = true;
+		routeMocks.getHousekeepingCapabilityContext.mockResolvedValue(
+			capabilityContext([]),
+		);
 	});
 
 	it.each([
-		["production", true],
 		["production", false],
 		["development", false],
 	] as const)("returns 404 for NODE_ENV=%s flag=%s", async (nodeEnv, flag) => {
@@ -385,6 +387,35 @@ describe("/admin-next preview gate", () => {
 		expect(routeMocks.notFound).toHaveBeenCalledTimes(1);
 	});
 
+	it("returns 404 in production without the dedicated preview permission", async () => {
+		routeMocks.env.NODE_ENV = "production";
+
+		await expect(async () =>
+			renderRoute(
+				AdminNextLayout({
+					children: createElement("p", null, "Preview child"),
+				}),
+			),
+		).rejects.toThrow("NEXT_NOT_FOUND");
+		expect(routeMocks.notFound).toHaveBeenCalledTimes(1);
+	});
+
+	it("renders in production for a rank with the dedicated preview permission", async () => {
+		routeMocks.env.NODE_ENV = "production";
+		routeMocks.getHousekeepingCapabilityContext.mockResolvedValue(
+			capabilityContext(["housekeeping.preview.access"]),
+		);
+
+		const html = await renderRoute(
+			AdminNextLayout({
+				children: createElement("p", null, "Preview child"),
+			}),
+		);
+
+		expect(html).toContain("Preview child");
+		expect(routeMocks.notFound).not.toHaveBeenCalled();
+	});
+
 	it.each(["development", "test"] as const)(
 		"renders children in %s when explicitly enabled",
 		async (nodeEnv) => {