CMIS authoring operations

tests/cmis/test_cmis_runtime_browser_binding.py

@@ -118,3 +118,58 @@ def test_runtime_cmis_browser_rejects_unsupported_query_subset(cmis_runtime) ->
         )
 
     assert "Unsupported CMIS query subset" in str(exc_info.value)
+
+
+def test_runtime_cmis_governed_authoring_allows_selected_mutations(cmis_runtime) -> None:
+    runtime, context = cmis_runtime
+
+    created = runtime.cmis_create_document(
+        "governed-authoring",
+        {
+            "asset_id": "asset-authored",
+            "name": "Authored Through CMIS",
+            "sensitivity": "internal",
+            "topics": ["cmis"],
+            "content": "# Authored\n\nCreated through CMIS.",
+            "media_type": "text/markdown",
+            "metadata_records": [{"key": "status", "value": "draft", "confirmed": True}],
+        },
+        context,
+    )
+    updated = runtime.cmis_update_properties(
+        "governed-authoring",
+        "cmis:asset:asset-authored",
+        {"properties": {"kontextual:metadata:reviewer": "codex"}},
+        context,
+    )
+    streamed = runtime.cmis_set_content_stream(
+        "governed-authoring",
+        "cmis:asset:asset-authored",
+        {"content": "# Authored\n\nUpdated stream.", "media_type": "text/markdown"},
+        context,
+    )
+    deleted = runtime.cmis_delete_object(
+        "governed-authoring",
+        "cmis:asset:asset-authored",
+        {},
+        context,
+    )
+
+    assert created["object_id"] == "cmis:asset:asset-authored"
+    assert updated["properties"]["kontextual:metadata:reviewer"] == "codex"
+    assert streamed["content_stream"]["mime_type"] == "text/markdown"
+    assert deleted["deleted"] is False
+    assert deleted["lifecycle"] == "delete_requested"
+
+
+def test_runtime_cmis_readonly_profile_rejects_mutations(cmis_runtime) -> None:
+    runtime, context = cmis_runtime
+
+    with pytest.raises(Exception) as exc_info:
+        runtime.cmis_create_document(
+            "readonly-browser",
+            {"asset_id": "asset-readonly-denied", "name": "Denied"},
+            context,
+        )
+
+    assert "CMIS operation denied" in str(exc_info.value)