test(e2e): anchor the inference authority pair on Add a provider (#2270)

[graycyrus]

Summary

Fixes the inference half of connections-authority.spec.ts, which is what keeps Console E2E and Console E2E (live brain) red on main and, through PR CI Gate, blocks every open PR. Part of #2270.

What failed

On main @ 892d3d64c (CI run 34818294967) both E2E lanes failed exactly one test, connections-authority.spec.ts:183 › "an admin is still offered every control across the four pages":

• Console E2E (live brain): timed out on getByTestId('inference-save') (spec line 224 at that commit).
• Console E2E: timed out on #composio-api-key. feat(composio): rework the credential page into single-select rows #2278 (b038b0202, merged as 282d90c05) has since gated that half on COMPOSIO and reworked it for the dialog, so it is not touched here.

Why

inference-save was removed, not renamed. #2262 retired the single-provider form ("feat(console): retire the single-provider form; the Routing tab lands") and nothing in frontend/src carries the id now. The admin assertion could never pass, and the member assertion (expect(memberPage.getByTestId("inference-save")).toHaveCount(0)) had been passing vacuously for both roles.

What it asserts now, and why that is the real contract

The post-#2262 LLM page expresses authority by disabling controls, not by hiding them. So:

• Member: inference-read-only is visible, and inference-add-open ("Add a provider") is visible and disabled.
• Admin: inference-read-only has count 0, and inference-add-open is enabled. Because the admin half requires the button to be enabled, the member half can't pass just because the button is disabled for every viewer.

Justification:

• frontend/src/inference/ProvidersTab.tsx:284-288: the button renders unconditionally in the tab's body with disabled={!canManage}.
• frontend/src/views/InferenceView.tsx:40-43: connect (the Providers tab) is the default tab, so #/settings/inference lands on it.
• frontend/src/views/InferenceView.tsx:66-74: inference-read-only renders exactly when !canManage.
• frontend/src/hooks/use-can-manage.ts:31-35: useCanManage fails closed until the role read answers. toBeEnabled on the admin side therefore waits for the resolved role rather than reading the first render.
• A member reaches this render and does not hit the unreachable state. The status read is ScopedCompany (src/server/ops/inference.rs:979-981), so use-inference.ts:111 sets ready. The admin-only routes read (AdminScopedCompany, src/server/ops/inference/providers.rs:1903) refuses a member with 403, and use-inference.ts:130 handles that as an authority answer rather than an error. ProvidersTab.tsx:192-195 therefore does not return early.

Why not the Routing tab's Save (inference-own-save): it lives inside {mode === "own" && (…)} (frontend/src/inference/RoutingTab.tsx:216, testid at :266). It exists only when the company's routing mode is own, so the test would pass or fail depending on the harness company's boot mode instead of on authority. "Add a provider" is on the default tab in every routing mode. inference.spec.ts already clicks it as the harness admin, ungated, and all nine of its tests passed in both lanes on run 34818294967.

API Or Behavior Changes

None. Test-only; no console or host code is touched.

Tests

• Not run locally, by design: the spec needs target/debug/opencompany, and the E2E lanes on this PR are the verification. They exercise both the default-feature host (Console E2E) and the --features composio live-brain host (Console E2E (live brain)).
• npm run typecheck:e2e (the gate covering this spec) runs in the Console lane on this PR. The change adds no new imports or types, only toBeVisible / toBeDisabled / toBeEnabled / toHaveCount on existing locators.

Not fixed here: Rust (openhuman, tinymemory) is also red on main

It also feeds PR CI Gate, so a PR can stay red for this reason alone. It is unrelated to this change.

• Failing test: policy::judgement::tests::an_uncatalogued_composio_call_logs_the_catalogue_miss_once_not_twice (src/policy/judgement.rs:872, left: 0, right: 1: zero WARN events counted, not two). It failed in the step cargo test --locked -p opencompany-core --features openhuman,chargebee,paypal,composio --lib composio.
• Flaky, not a regression. 892d3d64c changes no Rust (git diff --stat 7c2d39844 892d3d64c touches only .github/workflows/* and scripts/ci/assert-merge-group-workflow.sh). The same test passed in the same composio-scoped step on the previous main run (31daea47f, run 34808415119). It also passed earlier in the failing job itself, in the --features openhuman step.
• Likely cause (inferred, not reproduced): the test counts WARNs through a thread-local tracing::subscriber::with_default. tracing caches callsite interest and the max level globally, so a sibling test hitting the same catalogue_miss callsite on another thread can leave the event filtered out before this test's subscriber sees it. A count of 0 fits that; the regression the test guards against would show 2.

[coderabbitai]

Warning

Review limit reached

• Run on-demand review

_{On-demand reviews are free for the next 6 days. After that, they cost $0.25 per reviewed file.}

Or wait 14 minutes for your next included review.

Check out review usage here.

View limit details

Limit details: You’ve used all 2 included reviews currently available.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Advanced

Run ID: fbf5c0f2-b1cb-4898-b7ed-aec69dec47f5

📥 Commits

Reviewing files that changed from the base of the PR and between 282d90c and 639c525.

📒 Files selected for processing (1)

• frontend/test/e2e/connections-authority.spec.ts

---

_{Comment @coderabbitai help to get the list of available commands.}

[tinysweeper]

How this change flows

0 changed behaviours across 3 relationships. 5 surrounding behaviours are shown (17 graph nodes walked). 12 further behaviours left out to keep the diagram readable.

flowchart LR
  n0["signInAsMember"]:::impacted
  n1["openConnectionsPage"]:::impacted
  n2["openSettingsPage"]:::impacted
  n3["MEMBER_EMAIL"]:::impacted
  n4["Page"]:::impacted
  n0 -->|uses| n3
  n1 -->|uses| n4
  n2 -->|uses| n4
  classDef changed fill:#0d4429,stroke:#238636,color:#e6edf3
  classDef impacted fill:#161b22,stroke:#6e7681,color:#c9d1d9
  classDef flagged fill:#5a1e02,stroke:#d93f0b,color:#ffffff
  classDef blocking fill:#67060c,stroke:#f85149,color:#ffffff

Loading

_{Green: changed behaviour. Grey: surrounding behaviour. Arrows name the call, use, implementation, or test relationship. Orange: has findings. Red: has a finding that blocks the merge.}

[tinysweeper]

tinysweeper found nothing blocking. Approving.

$0.0000 · 0 in / 0 out