portal-auth P3（#24 #25）：Portal UI＋/portal/data/* server-side enforce（不 merge，待總管審） (#52)

cypher-executor/tests/portal-auth.test.ts

@@ -264,12 +264,17 @@ describe('GET /portal/session', () => {
   it('有效 session → 回 display_name/role/libraries，無租戶字串', async () => {
     await seedPortalSession('tok-1', 'rec_1');
     mockGetRecord('rec_1', activeUserValues());
+    // P3：session 多回 graph_allowed（D-4）——非 ["*"] 用戶要查庫目錄算 graph 來源庫
+    mockListByTemplate('portal_library', []);
     const res = await json('GET', '/portal/session', undefined, { Authorization: 'Bearer tok-1' });
     expect(res.status).toBe(200);
     const data = (await res.json()) as Record<string, unknown>;
     expect(data.valid).toBe(true);
     expect(data.libraries).toEqual(['general', 'finance']);
     expect('tenant' in data).toBe(false);
+    // P3 能力欄位：來源庫預設 general、本用戶有 general → graph 放行；workflows 預設 admin-only
+    expect(data.graph_allowed).toBe(true);
+    expect(data.workflows_visible).toBe(false);
   });
 
   it('帳號被停用 → 既有 session 立即失效（403）且 KV session 被清', async () => {