Wire auth explain to local auth ops

crates/geth/tests/bootstrap.rs

@@ -154,6 +154,75 @@ fn auth_explain_distinguishes_discovered_peer_candidates() {
     }
 }
 
+#[test]
+fn auth_grant_revoke_and_explain_use_local_auth_log() {
+    let home = tempfile::tempdir().expect("tempdir");
+    let paths = geth_config::GethPaths::from_home(home.path());
+    let node = geth_node::init_node(&paths).expect("init node");
+
+    let response = geth_node::handle_request(
+        &node,
+        geth_control::ControlRequest::AuthGrant {
+            subject: "node:laptop".to_owned(),
+            resource: "resource:cas:local".to_owned(),
+            capability: "cas.fetch".to_owned(),
+            grant_id: Some("grant:test-fetch".to_owned()),
+        },
+    )
+    .expect("grant capability");
+    match response {
+        geth_control::ControlResponse::AuthOpRecorded { op } => {
+            assert_eq!(op.resource.to_string(), "resource:cas:local");
+        }
+        other => panic!("unexpected response: {other:?}"),
+    }
+
+    let response = geth_node::handle_request(
+        &node,
+        geth_control::ControlRequest::AuthExplain {
+            subject: "node:laptop".to_owned(),
+            resource: "resource:cas:local".to_owned(),
+            capability: "cas.fetch".to_owned(),
+        },
+    )
+    .expect("explain grant");
+    match response {
+        geth_control::ControlResponse::AuthExplain(explanation) => {
+            assert!(explanation.allowed);
+            assert_eq!(explanation.evaluated_ops, 1);
+            assert!(explanation.reason.contains("grant:test-fetch"));
+        }
+        other => panic!("unexpected response: {other:?}"),
+    }
+
+    geth_node::handle_request(
+        &node,
+        geth_control::ControlRequest::AuthRevoke {
+            resource: "resource:cas:local".to_owned(),
+            grant_id: "grant:test-fetch".to_owned(),
+        },
+    )
+    .expect("revoke grant");
+
+    let response = geth_node::handle_request(
+        &node,
+        geth_control::ControlRequest::AuthExplain {
+            subject: "node:laptop".to_owned(),
+            resource: "resource:cas:local".to_owned(),
+            capability: "cas.fetch".to_owned(),
+        },
+    )
+    .expect("explain revoke");
+    match response {
+        geth_control::ControlResponse::AuthExplain(explanation) => {
+            assert!(!explanation.allowed);
+            assert_eq!(explanation.evaluated_ops, 2);
+            assert!(explanation.reason.contains("no active"));
+        }
+        other => panic!("unexpected response: {other:?}"),
+    }
+}
+
 #[test]
 fn ssh_cert_request_approval_and_revocation_export_use_local_state() {
     let home = tempfile::tempdir().expect("tempdir");