Merge PR #2: licence the code GPLv3 and contributed manifests CC0

tests/api.rs

@@ -218,6 +218,25 @@ async fn tokens_are_issued_anonymously_and_are_distinct() {
     assert!(a.starts_with("jray_"));
 }
 
+#[tokio::test]
+async fn the_token_response_carries_the_contribution_licence() {
+    // §5b / UR-019. There are no accounts, so token issuance is the only moment
+    // a grant can be taken — a licence the server publishes but never delivers
+    // is one no contributor agreed to, which is precisely the gap that leaves
+    // federated replication (UR-008) without a grant flowing through it.
+    let s = TestServer::new("token-licence");
+    let (status, body, _) = s.post_json("/api/v1/tokens", &json!({})).await;
+    assert_eq!(status, StatusCode::OK, "body: {body}");
+
+    assert_eq!(body["contribution_license"].as_str(), Some("CC0-1.0"));
+
+    let terms = body["contribution_terms"].as_str().expect("terms in response");
+    assert!(terms.contains("CC0 1.0"), "terms must name the licence: {terms}");
+    // The scope limit is the operative half: it must be impossible to read the
+    // grant as covering the film rather than the manifest.
+    assert!(terms.contains("manifest only"), "terms must bound the grant to the manifest: {terms}");
+}
+
 // ---------------------------------------------------------------------------
 // §6 — upload validation
 // ---------------------------------------------------------------------------
@@ -256,6 +275,7 @@ async fn a_pending_manifest_is_not_served() {
     assert_eq!(body["status"], "pending");
 }
 
+/// TRACES: DR-001 | SR-004
 #[tokio::test]
 async fn unknown_field_anywhere_is_rejected_with_400() {
     // §6 stage 2, enforced by `deny_unknown_fields` on every DTO.
@@ -300,6 +320,7 @@ async fn contributor_local_identifiers_are_rejected_not_ignored() {
     assert!(body["message"].as_str().unwrap_or("").contains("jellyfin_id"), "{body}");
 }
 
+/// TRACES: UR-015 | SR-003
 #[tokio::test]
 async fn the_withdrawn_anneal_sec_field_is_rejected() {
     // `anneal_sec` was withdrawn in the SR-003 bump: presence now follows track
@@ -323,6 +344,7 @@ async fn the_withdrawn_anneal_sec_field_is_rejected() {
     );
 }
 
+/// TRACES: UR-015, UR-016 | SR-003
 #[tokio::test]
 async fn the_schema_bump_fields_round_trip() {
     // `extinction_sec` and `gallery_scope` are the SR-003 additions. They are