MongooseChangelog
Shared object-control checks and ordinary-permission tests
2026-10-18 04:15 UTC · Claude (#13505)
Programmers can use $perm_utils:controls_strict(who, object) for the usual wizard, self or object-owner admission rule. For example: $perm_utils:controls_strict(caller_perms(), target) || raise(E_PERM); It leaves native indirection errors visible. Keep separate checks for the actual caller, captured authority, consent and object lifetime when your operation needs them; property and verb ownership still use controls_property and controls_verb.
The existing $perm_utils:controls keeps its legacy allowances for invalid references, including native anonymous-object cleanup. The invalid-indirection failure reported during disconnect cleanup has been corrected. Use controls_strict for ordinary softcode admission rather than changing controls to reject that native cleanup context.
Wizard-owned tests can call $test_runner:call_as(principal, target, verb, arguments) to invoke the real verb in a separate activation using the supplied principal as task permissions and player context. Pass arguments as a list. The helper is wizard-only and propagates native errors; combine it with assert_raises to check denial, and use fresh ordinary fixtures so owner and stranger cases do not depend on live players.