$ node --test --test-reporter=spec --test-concurrency=1 "test/*.test.mjs"   (v24.21.0, Payload 3.90.2, 2026-10-08T12:00Z)
✔ overrideAccess: false with the assistant as user: a draft save is allowed (2256.7623ms)
✔ overrideAccess: false with the assistant as user: publishing is refused by the access function (3.1016ms)
✔ overrideAccess: false with the assistant as user: a slug change is refused by the field rule (3.8458ms)
✔ overrideAccess: false without a user: refused, so a forgotten user fails closed (0.9252ms)
✔ the workflow log stays closed to the assistant on the Local API too (1.205ms)
✔ a change and its log entry commit together: a failed entry rolls the change back (12.1384ms)
✔ passing the user without overrideAccess: false applies none of its permissions (12.4872ms)
✔ rules written as data invariants still hold under the default (7.6599ms)
▶ the documented rule for restricting publishing
  ✔ blocks an editor's draft on a published post (54.0335ms)
  ✔ lets an editor publish a post whose latest version is a draft (46.6341ms)
  ✔ lets an editor publish a post that has never been published (32.2594ms)
✔ the documented rule for restricting publishing (2343.4693ms)
▶ writes without the draft flag
  ✔ change the live document when no draft is pending (28.0007ms)
  ✔ take the page offline with the pending draft's content when a draft is pending (35.8129ms)
  ✔ update in bulk from the live row, not the latest draft (50.1356ms)
✔ writes without the draft flag (114.3395ms)
▶ field access and versions
  ✔ field update access drops a forbidden value and still answers 200 (30.3648ms)
  ✔ unpublishAllLocales on a draft save overwrites the latest version in place (28.4264ms)
  ✔ the version cap deletes the oldest versions whatever their status (66.7063ms)
  ✔ restoring a draft version without draft=true takes the page offline (39.8201ms)
  ✔ a restored version gets the document's original createdAt (50.8578ms)
  ✔ restoring a version keeps the current value of fields the restoring user may not update (36.7556ms)
  ✔ a version records the document and timestamps, not who saved it (35.714ms)
✔ field access and versions (289.2151ms)
▶ what the assistant can read
  ✔ reads the live article (29.978ms)
  ✔ cannot read the version history, the workflow log or the reference collection (14.137ms)
  ✔ sees its own user record only, and never its API key (9.6431ms)
✔ what the assistant can read (2301.9012ms)
▶ the assistant proposes a draft
  ✔ a draft save is accepted and the live page does not change (31.6742ms)
  ✔ schema validation rejects an invalid draft and nothing is saved (27.7634ms)
  ✔ a full-document write that leaves the protected fields unchanged is accepted (23.4144ms)
✔ the assistant proposes a draft (83.495ms)
▶ the assistant is refused by the server
  ✔ changing the URL slug (25.5231ms)
  ✔ approving its own draft (23.5417ms)
  ✔ writing who decided (32.385ms)
  ✔ publishing (21.6313ms)
  ✔ publishing by adding _status to a draft save (19.8243ms)
  ✔ editing the live page without the draft flag (19.3227ms)
  ✔ unpublishing the page (20.0339ms)
  ✔ parameters that would rewrite a version in place (59.6682ms)
  ✔ changing a timestamp (22.8711ms)
  ✔ restoring a version, including its own earlier draft (52.1776ms)
{"level":50,"time":1791460809012,"err":{"type":"APIError","message":"Collection articles has disabled bulk edit","status":403},"msg":"Collection articles has disabled bulk edit"}
  ✔ updating articles in bulk (19.1133ms)
  ✔ deleting or creating articles (26.2302ms)
  ✔ locking the article against other people's writes (14.5508ms)
  ✔ clearing another user's login lockout (6.0802ms)
  ✔ changing its own role (7.7117ms)
  ✔ and an anonymous request cannot write at all (20.5719ms)
✔ the assistant is refused by the server (392.3111ms)
▶ request shapes that must not break the guard or the log
  ✔ a body key named after an Object method is ignored (21.2665ms)
  ✔ a draft save with ?select= is still logged (18.9717ms)
✔ request shapes that must not break the guard or the log (40.45ms)
▶ review
  ✔ the reviewer can read the live page, the draft, the history, the log and who decided (14.2341ms)
  ✔ the reviewer cannot unpublish the page or create an article (21.9334ms)
  ✔ a decision has to name the version it applies to (22.5087ms)
  ✔ the reviewer rejects the draft with a note, and nothing goes live (23.5944ms)
  ✔ the assistant sees the decision and the note, but not who made it (4.1638ms)
  ✔ a rejected draft cannot be published (28.8168ms)
  ✔ the assistant's revision resets the decision, and a decision on the version read before it is refused (44.2917ms)
  ✔ the reviewer amends the draft, and an amendment is not an approval (16.6937ms)
  ✔ the reviewer cannot change the URL slug either (25.7473ms)
  ✔ an edit and a decision in the same request are refused (27.3783ms)
  ✔ the reviewer approves (21.4422ms)
  ✔ a decision sent without a note clears the earlier note (39.1371ms)
  ✔ the reviewer cannot publish, with an API key or a password login (147.3087ms)
  ✔ an edit after approval voids it, and the publisher is refused until the draft is approved again (72.5136ms)
  ✔ a save that changes nothing keeps the approval, and the log does not claim a reset (20.6911ms)
✔ review (531.3275ms)
▶ publishing
  ✔ the publisher cannot record a review decision (26.1647ms)
  ✔ the publisher cannot edit the live page without a draft either (22.3299ms)
  ✔ the publisher cannot change content in the publish request (22.3679ms)
  ✔ an unpublish request cannot carry content (23.326ms)
{"level":50,"time":1791460809773,"err":{"type":"APIError","message":"Collection articles has disabled bulk edit","status":403},"msg":"Collection articles has disabled bulk edit"}
  ✔ bulk publishing is refused (21.3892ms)
  ✔ the publisher publishes the approved draft (33.3944ms)
✔ publishing (149.3774ms)
▶ rollback
  ✔ the published copy has a mistake: 60 days instead of 30 (1.7967ms)
  ✔ only the publisher can restore: the reviewer is refused (42.2221ms)
  ✔ the publisher restores the version published before the mistake (35.4485ms)
  ✔ a second mistake and a second rollback land on the copy that was live before it (63.0706ms)
✔ rollback (142.9417ms)
▶ restoring a version that was never published
  ✔ goes back as a draft that needs a new review (124.1637ms)
✔ restoring a version that was never published (124.4587ms)
▶ the publisher's other rights
  ✔ takes the page offline and puts the approved copy back (51.8129ms)
  ✔ saves a draft that changes the title and slug, and the draft then needs review (39.7603ms)
  ✔ no identity can delete an article, change any role, or add, edit or delete log entries (80.873ms)
  ✔ creates a new article as a draft, and cannot create it published or with a review decision (20.2497ms)
  ✔ every version is kept: a long run of draft saves leaves the published versions in place (743.8365ms)
✔ the publisher's other rights (936.9886ms)
ℹ tests 76
ℹ suites 12
ℹ pass 76
ℹ fail 0
ℹ cancelled 0
ℹ skipped 0
ℹ todo 0
ℹ duration_ms 10094.0926
