refac: debt on role backend

test/roles_permissions_enforcement_http_test.go

@@ -340,7 +340,7 @@ func TestRolesPermissionsEnforcementHTTP(t *testing.T) {
 			{grantsOf("media.view"), http.MethodPost, "/v1/media", "media.upload"},
 			{grantsOf("apikeys.create"), http.MethodGet, "/v1/api-key", "apikeys.view"},
 			{grantsOf("settings.edit_general"), http.MethodPatch, "/v1/media/purge-settings", ""},
-			{grantsOf("system.apply_updates"), http.MethodPost, "/v1/system/update/check", ""},
+			{grantsOf("system.apply_updates"), http.MethodPost, "/v1/system/update/check", "system.apply_updates"},
 			{nil, http.MethodGet, "/v1/author", "authors.view"},
 		}
 		for _, row := range rows {
@@ -479,13 +479,19 @@ func TestRolesPermissionsEnforcementHTTP(t *testing.T) {
 		}
 	})
 
-	t.Run("Articles and entries are not gated in this slice", func(t *testing.T) {
+	t.Run("Articles and entries are gated by the content keys since the content scope slice", func(t *testing.T) {
 		e := newEnforcementEnv(t)
 		e.customRoleUser(enforcementCustomID)
-		for _, route := range [][2]string{{http.MethodPost, "/v1/article"}, {http.MethodDelete, "/v1/article/1"}, {http.MethodGet, "/v1/content-type/events/entry"}, {http.MethodPost, "/v1/content-type/events/entry"}} {
-			if e.gateAs(t, enforcementCustomID, route[0], route[1], `{}`).blocked() {
-				t.Errorf("%s %s is gated", route[0], route[1])
-			}
+		rows := []struct {
+			method, path, key string
+		}{
+			{http.MethodPost, "/v1/article", "content.create"},
+			{http.MethodDelete, "/v1/article/1", "content.delete"},
+			{http.MethodGet, "/v1/content-type/events/entry", "content.read"},
+			{http.MethodPost, "/v1/content-type/events/entry", "content.create"},
+		}
+		for _, row := range rows {
+			assertGate(t, e.gateAs(t, enforcementCustomID, row.method, row.path, `{}`), row.key)
 		}
 	})
 }