feat(permissions): expose network permission state (#103)

frontend/src/features/permissions/permissions.test.tsx

@@ -86,4 +86,58 @@ describe("PermissionsPanel", () => {
       expect(doc.agents).toEqual([]);
     });
   });
+
+  it("saves project network defaults in the separate system permissions document", async () => {
+    const { permission } = await renderPanel();
+
+    fireEvent.change(screen.getByLabelText("Réseau — defaults projet network"), {
+      target: { value: "allow" },
+    });
+    fireEvent.click(screen.getByRole("button", { name: "Save network" }));
+
+    await waitFor(async () => {
+      const doc = await permission.getProjectSystemPermissions(PROJECT_ID);
+      expect(doc.projectDefault?.network).toBe("allow");
+    });
+    expect(screen.getAllByText("Réseau autorisé").length).toBeGreaterThan(0);
+  });
+
+  it("renders the network control read-only when the resolved runtime says so", async () => {
+    const agent = new MockAgentGateway();
+    const permission = new MockPermissionGateway();
+    const created = await agent.createAgent(PROJECT_ID, {
+      name: "Builder",
+      profileId: "p1",
+    });
+    permission.setResolvedAgentSystemPermissions(created.id, {
+      wanted: "allow",
+      effective: "deny",
+      runtimeLock: {
+        state: "locked",
+        source: "external-runtime",
+        reason: "Runtime network is locked.",
+      },
+      control: { mode: "readOnly", reason: "Runtime network is locked." },
+    });
+    const gateways = {
+      agent,
+      permission,
+      profile: new MockProfileGateway(),
+    } as unknown as Gateways;
+
+    render(
+      <DIProvider gateways={gateways}>
+        <PermissionsPanel projectId={PROJECT_ID} />
+      </DIProvider>,
+    );
+
+    await waitFor(() => {
+      expect(screen.getByText("Verrouillé par le runtime")).toBeTruthy();
+    });
+    expect(screen.getByText("Runtime network is locked.")).toBeTruthy();
+    expect(
+      (screen.getByLabelText("Réseau — defaults projet network") as HTMLSelectElement)
+        .disabled,
+    ).toBe(true);
+  });
 });