fix(housekeeping): address task 14 review round 1

src/features/housekeeping/domains/content/content-providers.test.ts

@@ -4,10 +4,7 @@ import {
 	anyCapability,
 	type HousekeepingCapabilityContext,
 } from "../../foundation/contracts";
-import {
-	CONTENT_INBOX_SOURCE_IDS,
-	createContentInboxSources,
-} from "./inbox";
+import { CONTENT_INBOX_SOURCE_IDS, createContentInboxSources } from "./inbox";
 import {
 	CONTENT_SEARCH_PROVIDER_IDS,
 	createContentSearchProviders,
@@ -74,27 +71,30 @@ describe("Content search providers", () => {
 		"/ase/content/%255c..%255csystem",
 		"https://example.test/ase/content/editorial",
 		"//example.test/ase/content/editorial",
-	])("rejects normalized and double-encoded traversal href %s", async (href) => {
-		const adapters = {
-			articles: async () => [
-				{
-					id: "unsafe",
-					title: "Unsafe",
-					href,
-					capability: anyCapability(PERMS.NEWS_VIEW),
-				},
-			],
-			events: async () => [],
-			media: async () => [],
-			help: async () => [],
-		};
-		const [provider] = createContentSearchProviders(adapters);
-		const result = await provider.search(context([PERMS.NEWS_VIEW]), {
-			term: "",
-			limit: 25,
-		});
-		expect(result).toMatchObject({ ok: true, data: [] });
-	});
+	])(
+		"rejects normalized and double-encoded traversal href %s",
+		async (href) => {
+			const adapters = {
+				articles: async () => [
+					{
+						id: "unsafe",
+						title: "Unsafe",
+						href,
+						capability: anyCapability(PERMS.NEWS_VIEW),
+					},
+				],
+				events: async () => [],
+				media: async () => [],
+				help: async () => [],
+			};
+			const [provider] = createContentSearchProviders(adapters);
+			const result = await provider.search(context([PERMS.NEWS_VIEW]), {
+				term: "",
+				limit: 25,
+			});
+			expect(result).toMatchObject({ ok: true, data: [] });
+		},
+	);
 });
 
 describe("Content inbox and widgets", () => {
@@ -119,6 +119,20 @@ describe("Content inbox and widgets", () => {
 		});
 	});
 
+	it("does not advertise media permissions for an event-and-poll attention source", async () => {
+		const attention = vi.fn(async () => []);
+		const [, source] = createContentInboxSources({
+			publication: async () => [],
+			attention,
+		});
+		const result = await source.getItems(
+			context([PERMS.PAGES_VIEW, PERMS.BANNERS_VIEW]),
+			new AbortController().signal,
+		);
+		expect(result).toMatchObject({ ok: false, error: { code: "FORBIDDEN" } });
+		expect(attention).not.toHaveBeenCalled();
+	});
+
 	it("keeps editorial mandatory and media/localization optional without preview DB imports", async () => {
 		const adapters = {
 			editorial: vi.fn(async () => ({ drafts: 2, scheduled: 1 })),