refactor(users): obtain resource tokens via User#resource_token from models

shard.lock

@@ -223,7 +223,7 @@ shards:
 
   placeos-models:
     git: https://github.com/placeos/models.git
-    version: 9.118.1
+    version: 9.119.0
 
   placeos-resource:
     git: https://github.com/place-labs/resource.git

spec/controllers/asset_categories_spec.cr

@@ -134,8 +134,6 @@ module PlaceOS::Api
     end
 
     describe "support-subsystem permissions" do
-      ::Spec.before_each { clear_group_tables }
-
       it "allows POST for a support user with Create on the org zone (both sides)" do
         authority = Model::Authority.find_by_domain("localhost").not_nil!
         user, headers = Spec::Authentication.authentication(sys_admin: false, support: false)

spec/controllers/asset_purchase_orders_spec.cr

@@ -74,8 +74,6 @@ module PlaceOS::Api
     end
 
     describe "support-subsystem permissions" do
-      ::Spec.before_each { clear_group_tables }
-
       it "allows POST for a support user with Create on the org zone (both sides)" do
         authority = Model::Authority.find_by_domain("localhost").not_nil!
         user, headers = Spec::Authentication.authentication(sys_admin: false, support: false)

spec/controllers/asset_types_spec.cr

@@ -91,8 +91,6 @@ module PlaceOS::Api
     end
 
     describe "support-subsystem permissions" do
-      ::Spec.before_each { clear_group_tables }
-
       it "allows POST for a support user with Create on the org zone (both sides)" do
         authority = Model::Authority.find_by_domain("localhost").not_nil!
         user, headers = Spec::Authentication.authentication(sys_admin: false, support: false)

spec/controllers/assets_spec.cr

@@ -247,8 +247,6 @@ module PlaceOS::Api
     end
 
     describe "support-subsystem permissions" do
-      ::Spec.before_each { clear_group_tables }
-
       # Build an Asset (unsaved) whose `zone_id` is the supplied zone.
       build_asset = ->(zone : Model::Zone) {
         asset_type = Model::Generator.asset_type.save!

spec/controllers/chat_gpt_plugin_spec.cr

@@ -33,7 +33,9 @@ module PlaceOS::Api
       driver = Model::Generator.driver(role: Model::Driver::Role::Logic)
       driver.module_name = module_name
       driver.save!
+      # no custom name, so core maps the module by its driver's module_name
       mod = Model::Generator.module(driver: driver)
+      mod.custom_name = nil
       mod.running = true
       mod.save!
 
@@ -55,14 +57,8 @@ module PlaceOS::Api
       system.save!
       sys_id = system.id.as(String)
 
-      # the lookups core maintains. Core rebuilds them asynchronously when systems change,
-      # which can replace seeded entries, so they're seeded before each call
-      seed_lookups = -> {
-        lookup = ::PlaceOS::Driver::RedisStorage.new(sys_id, "system")
-        lookup["LLM/1"] = llm_id
-        lookup["Meet/1"] = meet_ids[0]
-        lookup["Meet/2"] = meet_ids[1]
-      }
+      # the module lookups the plugin resolves capabilities through, as core maps them
+      wait_for_module_lookups(sys_id, {"LLM/1" => llm_id, "Meet/1" => meet_ids[0], "Meet/2" => meet_ids[1]})
 
       ::PlaceOS::Driver::RedisStorage.new(llm_id)["prompt"] = {
         prompt:       "You help people use the boardroom",
@@ -74,7 +70,6 @@ module PlaceOS::Api
       ].to_json
 
       _, credentials = Spec::Authentication.authentication
-      seed_lookups.call
       headers, result = open_session.call(sys_id, credentials)
       result["serverInfo"]["name"].should eq "chat_gpt_plugin"
 
@@ -92,13 +87,11 @@ module PlaceOS::Api
       # every tool is hinted read only, so clients don't ask for confirmation
       tools.all?(&.["annotations"]["readOnlyHint"].as_bool).should be_true
 
-      seed_lookups.call
       capabilities = call_tool.call(sys_id, headers, "capabilities", {} of String => JSON::Any)
       capabilities["isError"].should be_false
       capabilities["structuredContent"]["body"]["prompt"].should eq "You help people use the boardroom"
       capabilities["structuredContent"]["body"]["system_id"].should eq sys_id
 
-      seed_lookups.call
       schema = call_tool.call(sys_id, headers, "function_schema", {"capability_id" => JSON::Any.new("Meet_2")})
       schema["structuredContent"]["body"][0]["function"].should eq "set_power"
 
@@ -108,7 +101,6 @@ module PlaceOS::Api
         body: "true",
       )
       [JSON.parse(%({"state": true})), JSON::Any.new(%({"state": true}))].each do |function_params|
-        seed_lookups.call
         called = call_tool.call(sys_id, headers, "call_function", {
           "capability_id" => JSON::Any.new("Meet_2"),
           "function_name" => JSON::Any.new("set_power"),

spec/controllers/edges_spec.cr

@@ -42,7 +42,7 @@ module PlaceOS::Api
     end
 
     describe "CRUD operations", tags: "crud" do
-      ::Spec.before_each do
+      before_each do
         PlaceOS::Model::Edge.clear
       end
       Spec.test_crd(Model::Edge, Edges)
@@ -68,7 +68,7 @@ module PlaceOS::Api
     end
 
     describe "monitoring endpoints" do
-      ::Spec.before_each do
+      before_each do
         PlaceOS::Model::Edge.clear
       end
 

spec/controllers/groups/history_spec.cr

@@ -4,8 +4,6 @@ module PlaceOS::Api
   describe Groups::History do
     base = Groups::History.base_route
 
-    ::Spec.before_each { clear_group_tables }
-
     it "sys_admin can list all history; non-admin must scope to a managed group" do
       authority = Model::Authority.find_by_domain("localhost").not_nil!
       admin = Spec::Authentication.user(sys_admin: true)

spec/controllers/groups/invitation_spec.cr

@@ -4,8 +4,6 @@ module PlaceOS::Api
   describe Groups::Invitations do
     base = Groups::Invitations.base_route
 
-    ::Spec.before_each { clear_group_tables }
-
     it "manager can create and destroy invitations; response includes plaintext_secret once" do
       authority = Model::Authority.find_by_domain("localhost").not_nil!
       manager, manager_headers = Spec::Authentication.authentication(sys_admin: false, support: false)

spec/controllers/groups/user_spec.cr

@@ -4,8 +4,6 @@ module PlaceOS::Api
   describe Groups::Users do
     base = Groups::Users.base_route
 
-    ::Spec.before_each { clear_group_tables }
-
     it "manager can add and remove a user on their group" do
       authority = Model::Authority.find_by_domain("localhost").not_nil!
       manager, manager_headers = Spec::Authentication.authentication(sys_admin: false, support: false)

spec/controllers/groups/zone_spec.cr

@@ -4,8 +4,6 @@ module PlaceOS::Api
   describe Groups::Zones do
     base = Groups::Zones.base_route
 
-    ::Spec.before_each { clear_group_tables }
-
     it "manager can delegate a zone they already have coverage on" do
       authority = Model::Authority.find_by_domain("localhost").not_nil!
       manager, manager_headers = Spec::Authentication.authentication(sys_admin: false, support: false)

spec/controllers/groups_spec.cr

@@ -4,8 +4,6 @@ module PlaceOS::Api
   describe Groups do
     base = Groups.base_route
 
-    ::Spec.before_each { clear_group_tables }
-
     it "sys_admin can create a root group; non-admin cannot" do
       authority = Model::Authority.find_by_domain("localhost").not_nil!
       payload = Model::Generator.group(authority: authority).to_json

spec/controllers/metadata_spec.cr

@@ -478,8 +478,6 @@ module PlaceOS::Api
     end
 
     describe "support subsystem permissions" do
-      ::Spec.before_each { clear_group_tables }
-
       # ----------------------------------------------------------------
       # 1. zone parent: PATCH needs Update on both sides
       # ----------------------------------------------------------------

spec/controllers/modules_spec.cr

@@ -3,7 +3,7 @@ require "timecop"
 
 module PlaceOS::Api
   describe Modules do
-    ::Spec.before_each do
+    before_each do
       Model::Module.clear
       Model::ControlSystem.clear
     end
@@ -467,8 +467,6 @@ module PlaceOS::Api
     end
 
     describe "support-subsystem permissions" do
-      ::Spec.before_each { clear_group_tables }
-
       # Build a logic module attached to a control system whose only zone is
       # `zone`. The module derives its zones from that system, so granting on
       # `zone` (via a "support" GroupZone) gates access to the module.

spec/controllers/oauth_applications_spec.cr

@@ -12,7 +12,7 @@ module PlaceOS::Api
   describe OAuthApplications do
     base = OAuthApplications.base_route
 
-    ::Spec.before_each do
+    before_each do
       clear_group_tables
       Model::DoorkeeperApplication.clear
     end

spec/controllers/pending_mails_spec.cr

@@ -403,8 +403,6 @@ module PlaceOS::Api
     end
 
     describe "subsystem-based permissions" do
-      ::Spec.before_each { clear_group_tables }
-
       it "allows a support-subsystem user with Delete reach on a mail's zone to destroy it" do
         authority = Model::Authority.find_by_domain("localhost").not_nil!
         user, headers = Spec::Authentication.authentication(sys_admin: false, support: false)

spec/controllers/public_events_spec.cr

@@ -10,7 +10,7 @@ module PlaceOS::Api
   end
 
   describe PublicEvents, tags: "public_events" do
-    ::Spec.before_each do
+    before_each do
       Model::ControlSystem.clear
       Model::Driver.clear
       Model::Module.clear
@@ -255,24 +255,26 @@ module PlaceOS::Api
       end
 
       it "delegates to the driver and returns its result when the module is present" do
-        system = PlaceOS::Api.public_control_system
-
         driver = Model::Generator.driver(role: Model::Driver::Role::Logic)
         driver.module_name = "PublicEvents"
         driver.save!
 
+        # no custom name, so core maps the module as "PublicEvents/1"
         mod = Model::Generator.module(driver: driver)
+        mod.custom_name = nil
         mod.running = true
         mod.save!
-        system.modules = [mod.id.as(String)]
-        system.save!
-
         module_id = mod.id.as(String)
+
+        # saved once with its module, so core maps the system from a single event
+        system = Model::Generator.control_system
+        system.public = true
+        system.modules = [module_id]
+        system.save!
         sys_id = system.id.as(String)
 
-        # Seed the system-to-module lookup so Proxy::System.module_id? resolves.
-        system_storage = ::PlaceOS::Driver::RedisStorage.new(sys_id, "system")
-        system_storage["PublicEvents/1"] = module_id
+        # Proxy::System.module_id? resolves through the lookup core maintains
+        wait_for_module_lookups(sys_id, {"PublicEvents/1" => module_id})
 
         # Seed the driver interface metadata so RemoteDriver.metadata? resolves
         # and function_present?("register_attendee") returns true.
@@ -304,7 +306,6 @@ module PlaceOS::Api
         result.status_code.should eq 200
         result.body.should eq "true"
 
-        system_storage.delete("PublicEvents/1")
         ::PlaceOS::Driver::RedisStorage.with_redis(&.del("interface/#{module_id}"))
       end
     end

spec/controllers/settings_spec.cr

@@ -223,8 +223,6 @@ module PlaceOS::Api
     end
 
     describe "support subsystem permissions" do
-      ::Spec.before_each { clear_group_tables }
-
       # ----------------------------------------------------------------
       # 1. show / index(?parent_id=zone-…) gated on Read
       # ----------------------------------------------------------------

spec/controllers/signage/playlist_media_spec.cr

@@ -24,7 +24,7 @@ module PlaceOS::Api
   describe PlaylistMedia do
     base = PlaylistMedia.base_route
 
-    ::Spec.before_each do
+    before_each do
       Model::Playlist::Item.clear
       Model::Playlist.clear
       clear_group_tables

spec/controllers/signage/playlists_spec.cr

@@ -24,7 +24,7 @@ module PlaceOS::Api
   describe Playlist do
     base = Playlist.base_route
 
-    ::Spec.before_each do
+    before_each do
       Model::Playlist::ItemSchedule.clear
       Model::Playlist::Revision.clear
       Model::Playlist::Item.clear
@@ -772,7 +772,7 @@ module PlaceOS::Api
     end
 
     describe "approval requests" do
-      ::Spec.before_each { Model::PendingMail.clear }
+      before_each { Model::PendingMail.clear }
 
       describe "GET /approvers" do
         it "returns approve and manage users (not read-only members)" do

spec/controllers/signage/signage_ai_providers_spec.cr

@@ -10,6 +10,11 @@ module PlaceOS::Api
     before_each do
       Model::SignageAIJob.clear
       Model::SignageAIProvider.clear
+      # `setup_signage_ai` creates the domain's storage, which has to be the
+      # only one (a leftover can collide with it, or be picked as the default)
+      Model::Playlist::Item.clear
+      Model::Upload.clear
+      Model::Storage.clear
       WebMock.allow_net_connect = false
     end
 

spec/controllers/signage/template_mappings_spec.cr

@@ -7,7 +7,7 @@ module PlaceOS::Api
     # NOTE: don't clear Zone here — the shared auth helper's org zone
     # ("zone-perm-org") must survive between examples (clearing it orphans
     # its permissions Metadata and later re-creation collides).
-    ::Spec.before_each do
+    before_each do
       Model::SignageTemplate::SystemTemplate.clear
       Model::SignageTemplate.clear
       Model::Playlist::Item.clear

spec/controllers/signage/templates_spec.cr

@@ -75,7 +75,7 @@ module PlaceOS::Api
   describe SignageTemplates do
     base = SignageTemplates.base_route
 
-    ::Spec.before_each do
+    before_each do
       Model::SignageTemplate::SystemTemplate.clear
       Model::SignageTemplate.clear
       clear_group_tables
@@ -1041,7 +1041,7 @@ module PlaceOS::Api
     end
 
     describe "approval requests" do
-      ::Spec.before_each { Model::PendingMail.clear }
+      before_each { Model::PendingMail.clear }
 
       describe "GET /approvers" do
         it "returns approve and manage users (not read-only members)" do

spec/controllers/signage_plugins_spec.cr

@@ -2,7 +2,7 @@ require "../helper"
 
 module PlaceOS::Api
   describe SignagePlugins do
-    ::Spec.before_each do
+    before_each do
       Model::SignagePlugin.clear
     end
 

spec/controllers/signage_spec.cr

@@ -3,7 +3,7 @@ require "timecop"
 
 module PlaceOS::Api
   describe Signage do
-    ::Spec.before_each do
+    before_each do
       Model::SignageTemplate::SystemTemplate.clear
       Model::SignageTemplate.clear
       Model::Playlist::ItemSchedule.clear

spec/controllers/system-triggers_spec.cr

@@ -213,8 +213,6 @@ module PlaceOS::Api
     end
 
     describe "support-subsystem permissions" do
-      ::Spec.before_each { clear_group_tables }
-
       # A control system scoped to `zone`, plus a persisted trigger instance
       # attached to it. The instance inherits the system's zones, so granting
       # on `zone` (via a "support" GroupZone) gates index/show/mutations.