$ node --test --test-reporter=spec --test-concurrency=1 "test/*.test.mjs"   (v22.22.3, Payload 3.90.2, 2026-10-08T11:59Z)
✔ overrideAccess: false with the assistant as user: a draft save is allowed (2553.5386ms)
✔ overrideAccess: false with the assistant as user: publishing is refused by the access function (2.9018ms)
✔ overrideAccess: false with the assistant as user: a slug change is refused by the field rule (4.4372ms)
✔ overrideAccess: false without a user: refused, so a forgotten user fails closed (0.6069ms)
✔ the workflow log stays closed to the assistant on the Local API too (1.5559ms)
✔ a change and its log entry commit together: a failed entry rolls the change back (12.7042ms)
✔ passing the user without overrideAccess: false applies none of its permissions (13.874ms)
✔ rules written as data invariants still hold under the default (9.5776ms)
▶ the documented rule for restricting publishing
  ✔ blocks an editor's draft on a published post (67.9899ms)
  ✔ lets an editor publish a post whose latest version is a draft (53.9266ms)
  ✔ lets an editor publish a post that has never been published (33.5726ms)
✔ the documented rule for restricting publishing (2667.8854ms)
▶ writes without the draft flag
  ✔ change the live document when no draft is pending (29.34ms)
  ✔ take the page offline with the pending draft's content when a draft is pending (38.7464ms)
  ✔ update in bulk from the live row, not the latest draft (43.5782ms)
✔ writes without the draft flag (111.9665ms)
▶ field access and versions
  ✔ field update access drops a forbidden value and still answers 200 (31.7668ms)
  ✔ unpublishAllLocales on a draft save overwrites the latest version in place (31.7761ms)
  ✔ the version cap deletes the oldest versions whatever their status (72.0088ms)
  ✔ restoring a draft version without draft=true takes the page offline (42.2858ms)
  ✔ a restored version gets the document's original createdAt (59.0474ms)
  ✔ restoring a version keeps the current value of fields the restoring user may not update (39.5915ms)
  ✔ a version records the document and timestamps, not who saved it (38.2685ms)
✔ field access and versions (315.2174ms)
▶ what the assistant can read
  ✔ reads the live article (28.8196ms)
  ✔ cannot read the version history, the workflow log or the reference collection (18.5609ms)
  ✔ sees its own user record only, and never its API key (10.9063ms)
✔ what the assistant can read (2609.5421ms)
▶ the assistant proposes a draft
  ✔ a draft save is accepted and the live page does not change (39.7928ms)
  ✔ schema validation rejects an invalid draft and nothing is saved (35.7981ms)
  ✔ a full-document write that leaves the protected fields unchanged is accepted (23.4601ms)
✔ the assistant proposes a draft (99.8099ms)
▶ the assistant is refused by the server
  ✔ changing the URL slug (28.1042ms)
  ✔ approving its own draft (28.5684ms)
  ✔ writing who decided (26.2922ms)
  ✔ publishing (22.8707ms)
  ✔ publishing by adding _status to a draft save (26.4259ms)
  ✔ editing the live page without the draft flag (23.5706ms)
  ✔ unpublishing the page (23.9794ms)
  ✔ parameters that would rewrite a version in place (77.7871ms)
  ✔ changing a timestamp (28.9082ms)
  ✔ restoring a version, including its own earlier draft (49.5468ms)
{"level":50,"time":1791460798131,"err":{"type":"APIError","message":"Collection articles has disabled bulk edit","status":403},"msg":"Collection articles has disabled bulk edit"}
  ✔ updating articles in bulk (24.7229ms)
  ✔ deleting or creating articles (29.7188ms)
  ✔ locking the article against other people's writes (16.7717ms)
  ✔ clearing another user's login lockout (5.8397ms)
  ✔ changing its own role (8.0181ms)
  ✔ and an anonymous request cannot write at all (24.686ms)
✔ the assistant is refused by the server (446.6762ms)
▶ request shapes that must not break the guard or the log
  ✔ a body key named after an Object method is ignored (20.894ms)
  ✔ a draft save with ?select= is still logged (22.4935ms)
✔ request shapes that must not break the guard or the log (43.6953ms)
▶ review
  ✔ the reviewer can read the live page, the draft, the history, the log and who decided (17.8215ms)
  ✔ the reviewer cannot unpublish the page or create an article (25.1494ms)
  ✔ a decision has to name the version it applies to (24.9332ms)
  ✔ the reviewer rejects the draft with a note, and nothing goes live (29.9752ms)
  ✔ the assistant sees the decision and the note, but not who made it (3.9671ms)
  ✔ a rejected draft cannot be published (26.3485ms)
  ✔ the assistant's revision resets the decision, and a decision on the version read before it is refused (50.6814ms)
  ✔ the reviewer amends the draft, and an amendment is not an approval (16.7987ms)
  ✔ the reviewer cannot change the URL slug either (24.5186ms)
  ✔ an edit and a decision in the same request are refused (28.1185ms)
  ✔ the reviewer approves (23.6728ms)
  ✔ a decision sent without a note clears the earlier note (43.2259ms)
  ✔ the reviewer cannot publish, with an API key or a password login (148.3394ms)
  ✔ an edit after approval voids it, and the publisher is refused until the draft is approved again (73.391ms)
  ✔ a save that changes nothing keeps the approval, and the log does not claim a reset (27.5772ms)
✔ review (565.1844ms)
▶ publishing
  ✔ the publisher cannot record a review decision (28.9693ms)
  ✔ the publisher cannot edit the live page without a draft either (27.5916ms)
  ✔ the publisher cannot change content in the publish request (25.7197ms)
  ✔ an unpublish request cannot carry content (27.0776ms)
{"level":50,"time":1791460798957,"err":{"type":"APIError","message":"Collection articles has disabled bulk edit","status":403},"msg":"Collection articles has disabled bulk edit"}
  ✔ bulk publishing is refused (22.6896ms)
  ✔ the publisher publishes the approved draft (37.4311ms)
✔ publishing (169.8423ms)
▶ rollback
  ✔ the published copy has a mistake: 60 days instead of 30 (2.316ms)
  ✔ only the publisher can restore: the reviewer is refused (35.2289ms)
  ✔ the publisher restores the version published before the mistake (46.1018ms)
  ✔ a second mistake and a second rollback land on the copy that was live before it (70.7916ms)
✔ rollback (154.6651ms)
▶ restoring a version that was never published
  ✔ goes back as a draft that needs a new review (130.2453ms)
✔ restoring a version that was never published (130.3778ms)
▶ the publisher's other rights
  ✔ takes the page offline and puts the approved copy back (57.7066ms)
  ✔ saves a draft that changes the title and slug, and the draft then needs review (50.6174ms)
  ✔ no identity can delete an article, change any role, or add, edit or delete log entries (96.1644ms)
  ✔ creates a new article as a draft, and cannot create it published or with a review decision (23.2556ms)
  ✔ every version is kept: a long run of draft saves leaves the published versions in place (818.816ms)
✔ the publisher's other rights (1046.9881ms)
ℹ tests 76
ℹ suites 12
ℹ pass 76
ℹ fail 0
ℹ cancelled 0
ℹ skipped 0
ℹ todo 0
ℹ duration_ms 11273.2032
