Policy: admit anonymous writes as a user the realm's config names

packages/catalog/test-subset.json

@@ -23,6 +23,7 @@
       "realm-policy-activation-test",
       "realm-policy-anonymous-read-test",
       "realm-policy-anonymous-search-test",
+      "realm-policy-anonymous-write-test",
       "realm-policy-archived-seal-test",
       "realm-policy-batch-test",
       "realm-policy-capabilities-test",

packages/realm-server/tests/realm-policy-anonymous-read-test.ts

@@ -193,8 +193,8 @@ module(basename(import.meta.filename), function (hooks) {
                 anonymous: true,
                 where: '.status == "published"',
               },
-              // Opts a write in to such callers, which no route admits them
-              // to, so it never admits one.
+              // Opts a write in to such callers as an acting user the
+              // newsroom's config doesn't name, so it never admits one.
               {
                 operation: 'update',
                 anonymous: true,
@@ -554,9 +554,9 @@ module(basename(import.meta.filename), function (hooks) {
     );
     let update = await explainAnonymous(NEWSROOM_POLICY, PUBLISHED, 'update');
     assert.strictEqual(
-      update.reason,
-      'actor-required',
-      'a write is answered as its route answers it, whatever the policy opens',
+      update.decision,
+      'denied',
+      'a write whose acting user the realm does not name admits nothing',
     );
   });
 
@@ -825,18 +825,21 @@ module(basename(import.meta.filename), function (hooks) {
             .send(JSON.stringify({ filter: { type: ARTICLE } })),
       ],
       [
-        'an operations batch',
+        'an operations batch that creates',
         () =>
           request
             .post(`${path}_operations`)
-            .set('X-HTTP-Method-Override', 'QUERY')
             .set('Accept', SupportedMimeType.BoxelOperations)
             .set('Content-Type', SupportedMimeType.BoxelOperations)
             .set('X-Forwarded-For', VISITOR)
             .send(
               JSON.stringify({
                 'boxel:operations': [
-                  { op: 'invoke', 'boxel:name': 'read', href: PUBLISHED },
+                  {
+                    op: 'invoke',
+                    'boxel:name': 'create',
+                    data: JSON.parse(document).data,
+                  },
                 ],
               }),
             ),
@@ -871,6 +874,10 @@ module(basename(import.meta.filename), function (hooks) {
     for (let [label, send] of closed) {
       assert.strictEqual((await send()).status, 401, `${label}: 401`);
     }
-    assert.deepEqual(articleRecords(), [], 'and none of them is admitted');
+    assert.deepEqual(
+      articleRecords().filter((r) => r.outcome !== 'refused'),
+      [],
+      'and none of them is admitted',
+    );
   });
 });