feat(api): bind encrypted workspaces to accounts and devices

server/tests/WebDrop.Core.Tests/PrimitivesTests.cs

@@ -60,7 +60,7 @@ public class EnvelopeTests
     public void RejectsReservedFlagBits()
     {
         var bytes = TestEnv.Frame(TestEnv.NewId(), 0, FrameFlags.Final, 4);
-        bytes[1] |= 0x10;
+        bytes[1] |= 0x20;
         Assert.False(Envelope.TryParse(bytes, out _));
     }
 
@@ -110,8 +110,17 @@ public class AuthTests
 
 public class PolicyTests
 {
+    [Fact]
+    public void AuthenticatedAuthorsCanManageOwnItemsAcrossDevices()
+    {
+        var first = TestEnv.Endpoint(); var second = TestEnv.Endpoint();
+        var item = ItemBy(first) with { AuthorAccount = "member" };
+        var channel = Chan(new ChannelSettings { DeletePolicy = DeletePolicy.Own });
+        Assert.True(ChannelPolicy.CanDeleteItem(channel, item, new Principal(Role.Read, second, "member")));
+        Assert.False(ChannelPolicy.CanDeleteItem(channel, item, new Principal(Role.Read, first, "other-account")));
+    }
     private static Channel Chan(ChannelSettings s, bool writeHash = true) => new(
-        TestEnv.NewId(), ChannelMode.Enc, s, new byte[32], writeHash ? new byte[32] : null, new byte[32], 0, 0, 0, 0, 0);
+        TestEnv.NewId(), ChannelMode.Enc, s, new byte[32], writeHash ? new byte[32] : null, new byte[32], 0, 0, 0, 0, 0, "owner");
 
     private static Item ItemBy(byte[] author) => new(
         TestEnv.NewId(), TestEnv.NewId(), author, FrameFlags.None, 0, 0, 0, -1, null, 0, 0, 0, null, null);