fixes:

Author: KevLehman

ee/packages/abac/src/clients/virtru/VirtruClient.spec.ts

@@ -67,15 +67,15 @@ describe('VirtruClient', () => {
 		expect(tokenCalls).toHaveLength(2);
 	});
 
-	it('getConfig exposes only baseUrl, defaultEntityKey and attributeNamespace', () => {
+	it('getConfig exposes only baseUrl, defaultEntityKey, attributeNamespace and clientId', () => {
 		const c = new VirtruClient(cfg);
 		const pub = c.getConfig();
 		expect(pub).toEqual({
 			baseUrl: cfg.baseUrl,
 			defaultEntityKey: cfg.defaultEntityKey,
 			attributeNamespace: cfg.attributeNamespace,
+			clientId: cfg.clientId,
 		});
-		expect(pub).not.toHaveProperty('clientId');
 		expect(pub).not.toHaveProperty('clientSecret');
 		expect(pub).not.toHaveProperty('oidcEndpoint');
 	});

ee/packages/abac/src/clients/virtru/VirtruClient.ts

@@ -8,7 +8,7 @@ const virtruClientLogger = logger.section('VirtruClient');
 export const HEALTH_CHECK_TIMEOUT = 5000;
 const REQUEST_TIMEOUT = 10000;
 
-type PublicVirtruConfig = Pick<IVirtruPDPConfig, 'baseUrl' | 'defaultEntityKey' | 'attributeNamespace'>;
+type PublicVirtruConfig = Pick<IVirtruPDPConfig, 'baseUrl' | 'defaultEntityKey' | 'attributeNamespace' | 'clientId'>;
 
 export class VirtruClient {
 	private tokenCache: ITokenCache | null = null;
@@ -25,8 +25,8 @@ export class VirtruClient {
 	}
 
 	getConfig(): PublicVirtruConfig {
-		const { baseUrl, defaultEntityKey, attributeNamespace } = this.config;
-		return { baseUrl, defaultEntityKey, attributeNamespace };
+		const { baseUrl, defaultEntityKey, attributeNamespace, clientId } = this.config;
+		return { baseUrl, defaultEntityKey, attributeNamespace, clientId };
 	}
 
 	async isAvailable(): Promise<boolean> {

ee/packages/abac/src/index.ts

@@ -535,15 +535,15 @@ export class AbacService extends ServiceClass implements IAbacService {
 		const room = await getAbacRoom(rid);
 		const store = await this.resolveAttributeStore();
 
-		await store.assertCanModifyRoom(room, actor);
-
 		if (!Object.keys(attributes).length && room.abacAttributes?.length) {
 			await Rooms.unsetAbacAttributesById(rid);
 			void Audit.objectAttributesRemoved({ _id: room._id, name: room.name }, room.abacAttributes, actor);
 			this.broadcastRoomUpdate({ ...room, abacAttributes: undefined });
 			return;
 		}
 
+		await store.assertCanModifyRoom(room, actor);
+
 		const normalized = validateAndNormalizeAttributes(attributes);
 
 		await store.validateAssignable(normalized, actor);

ee/packages/abac/src/service.spec.ts

@@ -1110,15 +1110,16 @@ describe('AbacService (unit)', () => {
 			});
 		});
 
-		it('blocks the empty-clear path of setRoomAbacAttributes when assertCanModifyRoom rejects', async () => {
+		it('skips assertCanModifyRoom on the empty-clear path of setRoomAbacAttributes and still unsets', async () => {
 			const store = makeStore();
 			store.assertCanModifyRoom.mockRejectedValueOnce(new Error('error-pdp-unavailable'));
 			(service as any).attributeStores.local.store = store;
 
-			await expect(service.setRoomAbacAttributes('r1', {}, fakeActor)).rejects.toThrow('error-pdp-unavailable');
+			await expect(service.setRoomAbacAttributes('r1', {}, fakeActor)).resolves.toBeUndefined();
 
-			expect(mockUnsetAbacAttributesById).not.toHaveBeenCalled();
-			expect(mockCreateAuditServerEvent).not.toHaveBeenCalled();
+			expect(store.assertCanModifyRoom).not.toHaveBeenCalled();
+			expect(store.validateAssignable).not.toHaveBeenCalled();
+			expect(mockUnsetAbacAttributesById).toHaveBeenCalledWith('r1');
 		});
 	});