@agent-native/dispatch 0.40.23 → 0.40.24-nightly-20261015093558

package/CHANGELOG.md

@@ -1,5 +1,24 @@
 # @agent-native/dispatch
 
+## 0.40.24-nightly-20261015093558
+
+### Patch Changes
+
+- 2743662: Use the shared app permission policy for organization owner and admin access to Dispatch administration. Dispatch now requires `@agent-native/core` 0.206.0 or later, the first release with that policy.
+- Updated dependencies [eb4cd30]
+- Updated dependencies [ebf1cc7]
+- Updated dependencies [e90b90a]
+- Updated dependencies [5b201d1]
+- Updated dependencies [db3a30e]
+- Updated dependencies [b95626f]
+- Updated dependencies [64bf791]
+- Updated dependencies [e5a64ae]
+- Updated dependencies [ef6a530]
+- Updated dependencies [e6e1f56]
+- Updated dependencies [4e49b3a]
+  - @agent-native/core@0.209.1-nightly-20261015093558
+  - @agent-native/toolkit@0.209.1-nightly-20261015093558
+
 ## 0.40.23
 
 ### Patch Changes

package/dist/actions/provider-api-register.d.ts

@@ -47,10 +47,10 @@ declare const _default: import("node_modules/@agent-native/core/dist").ActionDef
     notes?: string | undefined;
     scope?: "org" | "user" | undefined;
 }, {
+    message?: undefined;
     id?: undefined;
     provider?: undefined;
     deleted?: undefined;
-    message?: undefined;
     providers: {
         id: string;
         label: string;
@@ -65,30 +65,30 @@ declare const _default: import("node_modules/@agent-native/core/dist").ActionDef
     registered?: undefined;
     label?: undefined;
 } | {
+    message?: undefined;
     id?: undefined;
-    count?: undefined;
     deleted?: undefined;
-    message?: undefined;
     providers?: undefined;
+    count?: undefined;
     found: boolean;
     provider: import("node_modules/@agent-native/core/dist/provider-api").CustomProviderConfig;
     registered?: undefined;
     label?: undefined;
 } | {
+    message?: undefined;
     provider?: undefined;
-    count?: undefined;
     deleted?: undefined;
-    message?: undefined;
     providers?: undefined;
+    count?: undefined;
     found: boolean;
     id: string;
     registered?: undefined;
     label?: undefined;
 } | {
-    provider?: undefined;
-    count?: undefined;
     message?: undefined;
+    provider?: undefined;
     providers?: undefined;
+    count?: undefined;
     found?: undefined;
     deleted: boolean;
     id: string;
@@ -96,9 +96,9 @@ declare const _default: import("node_modules/@agent-native/core/dist").ActionDef
     label?: undefined;
 } | {
     provider?: undefined;
-    count?: undefined;
     deleted?: undefined;
     providers?: undefined;
+    count?: undefined;
     found?: undefined;
     registered: boolean;
     id: string;

package/dist/server/index.js

@@ -2,7 +2,7 @@ import { defineAppRoles } from "@agent-native/core/org";
 import { registerPackageActions, } from "@agent-native/core/server";
 import { dispatchActions } from "../actions/index.js";
 import { dispatchAccessDescriptor } from "../shared/app-roles.js";
-defineAppRoles(dispatchAccessDescriptor);
+defineAppRoles(dispatchAccessDescriptor, { allowOrgAdmins: true });
 registerPackageActions(dispatchActions);
 let activeConfig = {};
 export function getDispatchConfig() {

package/dist/server/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/server/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AACxD,OAAO,EACL,sBAAsB,GAEvB,MAAM,2BAA2B,CAAC;AAEnC,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAEtD,OAAO,EAAE,wBAAwB,EAAE,MAAM,wBAAwB,CAAC;AAElE,cAAc,CAAC,wBAAwB,CAAC,CAAC;AAEzC,sBAAsB,CAAC,eAAe,CAAC,CAAC;AAExC,IAAI,YAAY,GAAmB,EAAE,CAAC;AAEtC,MAAM,UAAU,iBAAiB;IAC/B,OAAO,YAAY,CAAC;AACtB,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,MAAM,GAAmB,EAAE;IACvD,YAAY,GAAG,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,MAAM,EAAE,CAAC,CAAC;IAC5C,OAAO,CAAC,QAAQ,EAAE,EAAE;QAClB,KAAK,QAAQ,CAAC;IAChB,CAAC,CAAC;AACJ,CAAC;AAED,OAAO,EAAE,OAAO,IAAI,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AAClE,OAAO,EAAE,OAAO,IAAI,0BAA0B,EAAE,MAAM,2BAA2B,CAAC;AAClF,OAAO,EAAE,OAAO,IAAI,uBAAuB,EAAE,MAAM,yBAAyB,CAAC;AAC7E,OAAO,EACL,OAAO,IAAI,gBAAgB,EAC3B,qBAAqB,GACtB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,OAAO,IAAI,wBAAwB,EAAE,MAAM,0BAA0B,CAAC","sourcesContent":["import { defineAppRoles } from \"@agent-native/core/org\";\nimport {\n  registerPackageActions,\n  type NitroPluginDef,\n} from \"@agent-native/core/server\";\n\nimport { dispatchActions } from \"../actions/index.js\";\nimport type { DispatchConfig } from \"../config.js\";\nimport { dispatchAccessDescriptor } from \"../shared/app-roles.js\";\n\ndefineAppRoles(dispatchAccessDescriptor);\n\nregisterPackageActions(dispatchActions);\n\nlet activeConfig: DispatchConfig = {};\n\nexport function getDispatchConfig(): DispatchConfig {\n  return activeConfig;\n}\n\nexport function setupDispatch(config: DispatchConfig = {}): NitroPluginDef {\n  activeConfig = Object.freeze({ ...config });\n  return (nitroApp) => {\n    void nitroApp;\n  };\n}\n\nexport { default as dispatchAuthPlugin } from \"./plugins/auth.js\";\nexport { default as dispatchIntegrationsPlugin } from \"./plugins/integrations.js\";\nexport { default as dispatchAgentChatPlugin } from \"./plugins/agent-chat.js\";\nexport {\n  default as dispatchDbPlugin,\n  runDispatchMigrations,\n} from \"./plugins/db.js\";\nexport { default as dispatchCoreRoutesPlugin } from \"./plugins/core-routes.js\";\n\nexport type { DispatchConfig } from \"../config.js\";\n"]}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/server/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AACxD,OAAO,EACL,sBAAsB,GAEvB,MAAM,2BAA2B,CAAC;AAEnC,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAEtD,OAAO,EAAE,wBAAwB,EAAE,MAAM,wBAAwB,CAAC;AAElE,cAAc,CAAC,wBAAwB,EAAE,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC,CAAC;AAEnE,sBAAsB,CAAC,eAAe,CAAC,CAAC;AAExC,IAAI,YAAY,GAAmB,EAAE,CAAC;AAEtC,MAAM,UAAU,iBAAiB;IAC/B,OAAO,YAAY,CAAC;AACtB,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,MAAM,GAAmB,EAAE;IACvD,YAAY,GAAG,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,MAAM,EAAE,CAAC,CAAC;IAC5C,OAAO,CAAC,QAAQ,EAAE,EAAE;QAClB,KAAK,QAAQ,CAAC;IAChB,CAAC,CAAC;AACJ,CAAC;AAED,OAAO,EAAE,OAAO,IAAI,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AAClE,OAAO,EAAE,OAAO,IAAI,0BAA0B,EAAE,MAAM,2BAA2B,CAAC;AAClF,OAAO,EAAE,OAAO,IAAI,uBAAuB,EAAE,MAAM,yBAAyB,CAAC;AAC7E,OAAO,EACL,OAAO,IAAI,gBAAgB,EAC3B,qBAAqB,GACtB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,OAAO,IAAI,wBAAwB,EAAE,MAAM,0BAA0B,CAAC","sourcesContent":["import { defineAppRoles } from \"@agent-native/core/org\";\nimport {\n  registerPackageActions,\n  type NitroPluginDef,\n} from \"@agent-native/core/server\";\n\nimport { dispatchActions } from \"../actions/index.js\";\nimport type { DispatchConfig } from \"../config.js\";\nimport { dispatchAccessDescriptor } from \"../shared/app-roles.js\";\n\ndefineAppRoles(dispatchAccessDescriptor, { allowOrgAdmins: true });\n\nregisterPackageActions(dispatchActions);\n\nlet activeConfig: DispatchConfig = {};\n\nexport function getDispatchConfig(): DispatchConfig {\n  return activeConfig;\n}\n\nexport function setupDispatch(config: DispatchConfig = {}): NitroPluginDef {\n  activeConfig = Object.freeze({ ...config });\n  return (nitroApp) => {\n    void nitroApp;\n  };\n}\n\nexport { default as dispatchAuthPlugin } from \"./plugins/auth.js\";\nexport { default as dispatchIntegrationsPlugin } from \"./plugins/integrations.js\";\nexport { default as dispatchAgentChatPlugin } from \"./plugins/agent-chat.js\";\nexport {\n  default as dispatchDbPlugin,\n  runDispatchMigrations,\n} from \"./plugins/db.js\";\nexport { default as dispatchCoreRoutesPlugin } from \"./plugins/core-routes.js\";\n\nexport type { DispatchConfig } from \"../config.js\";\n"]}

package/dist/server/lib/app-roles.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"app-roles.d.ts","sourceRoot":"","sources":["../../../src/server/lib/app-roles.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AAsBlE,wBAAsB,sBAAsB,CAC1C,KAAK,EAAE,OAAO,EACd,GAAG,CAAC,EAAE,gBAAgB,GACrB,OAAO,CAAC,IAAI,CAAC,CAqCf"}
+{"version":3,"file":"app-roles.d.ts","sourceRoot":"","sources":["../../../src/server/lib/app-roles.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AAwBlE,wBAAsB,sBAAsB,CAC1C,KAAK,EAAE,OAAO,EACd,GAAG,CAAC,EAAE,gBAAgB,GACrB,OAAO,CAAC,IAAI,CAAC,CAoCf"}

package/dist/server/lib/app-roles.js

@@ -4,7 +4,9 @@ import { ForbiddenError } from "@agent-native/core/sharing";
 import { dispatchAccessDescriptor } from "../../shared/app-roles.js";
 let dispatchAccess;
 function getDispatchAccess() {
-    return (dispatchAccess ??= defineAppRoles(dispatchAccessDescriptor));
+    return (dispatchAccess ??= defineAppRoles(dispatchAccessDescriptor, {
+        allowOrgAdmins: true,
+    }));
 }
 export async function authorizeDispatchAdmin(_args, ctx) {
     const email = ctx?.userEmail !== undefined ? ctx.userEmail : getRequestUserEmail();
@@ -31,8 +33,6 @@ export async function authorizeDispatchAdmin(_args, ctx) {
     if (!membership.active) {
         throw new ForbiddenError("Dispatch administration requires active organization membership.");
     }
-    if (membership.role === "owner" || membership.role === "admin")
-        return;
     await getDispatchAccess().assertPermission(["administer"], {
         userEmail: email,
         orgId,

package/dist/server/lib/app-roles.js.map

@@ -1 +1 @@
-{"version":3,"file":"app-roles.js","sourceRoot":"","sources":["../../../src/server/lib/app-roles.ts"],"names":[],"mappings":"AACA,OAAO,EACL,cAAc,EACd,+BAA+B,EAC/B,2BAA2B,EAE3B,wDAAwD,GACzD,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,eAAe,EACf,mBAAmB,GACpB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAE5D,OAAO,EAAE,wBAAwB,EAAE,MAAM,2BAA2B,CAAC;AAErE,IAAI,cAA2D,CAAC;AAEhE,SAAS,iBAAiB;IACxB,OAAO,CAAC,cAAc,KAAK,cAAc,CAAC,wBAAwB,CAAC,CAAC,CAAC;AACvE,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,KAAc,EACd,GAAsB;IAEtB,MAAM,KAAK,GACT,GAAG,EAAE,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,mBAAmB,EAAE,CAAC;IACvE,MAAM,KAAK,GAAG,GAAG,EAAE,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,eAAe,EAAE,CAAC;IACvE,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC;QACnB,MAAM,IAAI,cAAc,CACtB,yDAAyD,CAC1D,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE;QAAE,OAAO;IAC3B,IAAI,UAAU,CAAC;IACf,IAAI,CAAC;QACH,UAAU,GAAG,MAAM,wDAAwD,CACzE;YACE,KAAK;YACL,KAAK;SACN,CACF,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IACE,+BAA+B,CAAC,KAAK,CAAC;YACtC,2BAA2B,EAAE,EAC7B,CAAC;YACD,OAAO;QACT,CAAC;QACD,MAAM,KAAK,CAAC;IACd,CAAC;IACD,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,CAAC;QACvB,MAAM,IAAI,cAAc,CACtB,kEAAkE,CACnE,CAAC;IACJ,CAAC;IACD,IAAI,UAAU,CAAC,IAAI,KAAK,OAAO,IAAI,UAAU,CAAC,IAAI,KAAK,OAAO;QAAE,OAAO;IACvE,MAAM,iBAAiB,EAAE,CAAC,gBAAgB,CAAC,CAAC,YAAY,CAAC,EAAE;QACzD,SAAS,EAAE,KAAK;QAChB,KAAK;KACN,CAAC,CAAC;AACL,CAAC","sourcesContent":["import type { ActionRunContext } from \"@agent-native/core/action\";\nimport {\n  defineAppRoles,\n  isMissingOrganizationTableError,\n  isStandaloneDispatchRuntime,\n  type AppRoles,\n  validateFederatedOrganizationMembershipForCurrentRequest,\n} from \"@agent-native/core/org\";\nimport {\n  getRequestOrgId,\n  getRequestUserEmail,\n} from \"@agent-native/core/server\";\nimport { ForbiddenError } from \"@agent-native/core/sharing\";\n\nimport { dispatchAccessDescriptor } from \"../../shared/app-roles.js\";\n\nlet dispatchAccess: AppRoles<\"admin\", \"administer\"> | undefined;\n\nfunction getDispatchAccess(): AppRoles<\"admin\", \"administer\"> {\n  return (dispatchAccess ??= defineAppRoles(dispatchAccessDescriptor));\n}\n\nexport async function authorizeDispatchAdmin(\n  _args: unknown,\n  ctx?: ActionRunContext,\n): Promise<void> {\n  const email =\n    ctx?.userEmail !== undefined ? ctx.userEmail : getRequestUserEmail();\n  const orgId = ctx?.orgId !== undefined ? ctx.orgId : getRequestOrgId();\n  if (!email?.trim()) {\n    throw new ForbiddenError(\n      \"Dispatch administration requires an authenticated user.\",\n    );\n  }\n  if (!orgId?.trim()) return;\n  let membership;\n  try {\n    membership = await validateFederatedOrganizationMembershipForCurrentRequest(\n      {\n        orgId,\n        email,\n      },\n    );\n  } catch (error) {\n    if (\n      isMissingOrganizationTableError(error) &&\n      isStandaloneDispatchRuntime()\n    ) {\n      return;\n    }\n    throw error;\n  }\n  if (!membership.active) {\n    throw new ForbiddenError(\n      \"Dispatch administration requires active organization membership.\",\n    );\n  }\n  if (membership.role === \"owner\" || membership.role === \"admin\") return;\n  await getDispatchAccess().assertPermission([\"administer\"], {\n    userEmail: email,\n    orgId,\n  });\n}\n"]}
+{"version":3,"file":"app-roles.js","sourceRoot":"","sources":["../../../src/server/lib/app-roles.ts"],"names":[],"mappings":"AACA,OAAO,EACL,cAAc,EACd,+BAA+B,EAC/B,2BAA2B,EAE3B,wDAAwD,GACzD,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,eAAe,EACf,mBAAmB,GACpB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAE5D,OAAO,EAAE,wBAAwB,EAAE,MAAM,2BAA2B,CAAC;AAErE,IAAI,cAA2D,CAAC;AAEhE,SAAS,iBAAiB;IACxB,OAAO,CAAC,cAAc,KAAK,cAAc,CAAC,wBAAwB,EAAE;QAClE,cAAc,EAAE,IAAI;KACrB,CAAC,CAAC,CAAC;AACN,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,KAAc,EACd,GAAsB;IAEtB,MAAM,KAAK,GACT,GAAG,EAAE,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,mBAAmB,EAAE,CAAC;IACvE,MAAM,KAAK,GAAG,GAAG,EAAE,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,eAAe,EAAE,CAAC;IACvE,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC;QACnB,MAAM,IAAI,cAAc,CACtB,yDAAyD,CAC1D,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE;QAAE,OAAO;IAC3B,IAAI,UAAU,CAAC;IACf,IAAI,CAAC;QACH,UAAU,GAAG,MAAM,wDAAwD,CACzE;YACE,KAAK;YACL,KAAK;SACN,CACF,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IACE,+BAA+B,CAAC,KAAK,CAAC;YACtC,2BAA2B,EAAE,EAC7B,CAAC;YACD,OAAO;QACT,CAAC;QACD,MAAM,KAAK,CAAC;IACd,CAAC;IACD,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,CAAC;QACvB,MAAM,IAAI,cAAc,CACtB,kEAAkE,CACnE,CAAC;IACJ,CAAC;IACD,MAAM,iBAAiB,EAAE,CAAC,gBAAgB,CAAC,CAAC,YAAY,CAAC,EAAE;QACzD,SAAS,EAAE,KAAK;QAChB,KAAK;KACN,CAAC,CAAC;AACL,CAAC","sourcesContent":["import type { ActionRunContext } from \"@agent-native/core/action\";\nimport {\n  defineAppRoles,\n  isMissingOrganizationTableError,\n  isStandaloneDispatchRuntime,\n  type AppRoles,\n  validateFederatedOrganizationMembershipForCurrentRequest,\n} from \"@agent-native/core/org\";\nimport {\n  getRequestOrgId,\n  getRequestUserEmail,\n} from \"@agent-native/core/server\";\nimport { ForbiddenError } from \"@agent-native/core/sharing\";\n\nimport { dispatchAccessDescriptor } from \"../../shared/app-roles.js\";\n\nlet dispatchAccess: AppRoles<\"admin\", \"administer\"> | undefined;\n\nfunction getDispatchAccess(): AppRoles<\"admin\", \"administer\"> {\n  return (dispatchAccess ??= defineAppRoles(dispatchAccessDescriptor, {\n    allowOrgAdmins: true,\n  }));\n}\n\nexport async function authorizeDispatchAdmin(\n  _args: unknown,\n  ctx?: ActionRunContext,\n): Promise<void> {\n  const email =\n    ctx?.userEmail !== undefined ? ctx.userEmail : getRequestUserEmail();\n  const orgId = ctx?.orgId !== undefined ? ctx.orgId : getRequestOrgId();\n  if (!email?.trim()) {\n    throw new ForbiddenError(\n      \"Dispatch administration requires an authenticated user.\",\n    );\n  }\n  if (!orgId?.trim()) return;\n  let membership;\n  try {\n    membership = await validateFederatedOrganizationMembershipForCurrentRequest(\n      {\n        orgId,\n        email,\n      },\n    );\n  } catch (error) {\n    if (\n      isMissingOrganizationTableError(error) &&\n      isStandaloneDispatchRuntime()\n    ) {\n      return;\n    }\n    throw error;\n  }\n  if (!membership.active) {\n    throw new ForbiddenError(\n      \"Dispatch administration requires active organization membership.\",\n    );\n  }\n  await getDispatchAccess().assertPermission([\"administer\"], {\n    userEmail: email,\n    orgId,\n  });\n}\n"]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agent-native/dispatch",
-  "version": "0.40.23",
+  "version": "0.40.24-nightly-20261015093558",
   "description": "Dispatch — workspace control plane for agent-native apps. Vault, integrations, destinations, scheduled jobs, and cross-app delegation, shipped as a single drop-in package.",
   "homepage": "https://github.com/BuilderIO/agent-native#readme",
   "bugs": {
@@ -89,7 +89,7 @@
     "tailwind-merge": "^3.5.0",
     "vaul": "^1.1.2",
     "zod": "^4.3.6",
-    "@agent-native/toolkit": "0.209.0"
+    "@agent-native/toolkit": "0.209.1-nightly-20261015093558"
   },
   "devDependencies": {
     "@react-router/dev": "^8.1.0",
@@ -103,10 +103,10 @@
     "typescript-7": "npm:typescript@^7.0.2",
     "vite": "8.1.0",
     "vitest": "^4.1.5",
-    "@agent-native/core": "0.209.0"
+    "@agent-native/core": "0.209.1-nightly-20261015093558"
   },
   "peerDependencies": {
-    "@agent-native/core": ">=0.198.6",
+    "@agent-native/core": "0.209.1-nightly-20261015093558",
     "react": ">=19.2.7",
     "react-dom": ">=19.2.7",
     "react-router": ">=8"

package/src/server/index.ts

@@ -8,7 +8,7 @@ import { dispatchActions } from "../actions/index.js";
 import type { DispatchConfig } from "../config.js";
 import { dispatchAccessDescriptor } from "../shared/app-roles.js";
 
-defineAppRoles(dispatchAccessDescriptor);
+defineAppRoles(dispatchAccessDescriptor, { allowOrgAdmins: true });
 
 registerPackageActions(dispatchActions);
 

package/src/server/lib/app-roles.spec.ts

@@ -1,26 +1,33 @@
 import { beforeEach, describe, expect, it, vi } from "vitest";
 
 const mocks = vi.hoisted(() => ({
-  assertAny: vi.fn(),
-  assertPermission: vi.fn(),
+  roles: [] as string[],
+  orgRole: "member",
+  member: true,
+  federated: false,
+  overrides: [] as { permission: string; roles_json: string }[],
+  execute: vi.fn(),
   getRequestOrgId: vi.fn(),
   getRequestUserEmail: vi.fn(),
   isStandaloneDispatchRuntime: vi.fn(),
   validateFederatedOrganizationMembershipForCurrentRequest: vi.fn(),
 }));
 
-vi.mock("@agent-native/core/org", () => ({
-  defineAppRoles: () => ({
-    assertAny: mocks.assertAny,
-    assertPermission: mocks.assertPermission,
-  }),
+vi.mock("../../../../core/src/db/client.js", () => ({
+  getDbExec: () => ({ execute: mocks.execute }),
+}));
+vi.mock("../../../../core/src/org/federation.js", () => ({
+  validateFederatedOrganizationMembershipForCurrentRequest:
+    mocks.validateFederatedOrganizationMembershipForCurrentRequest,
+}));
+vi.mock("@agent-native/core/org", async () => ({
+  ...(await import("../../../../core/src/org/app-roles.js")),
   isMissingOrganizationTableError: (error: unknown) =>
     /(?:organizations|org_members).*does not exist/i.test(String(error)),
   isStandaloneDispatchRuntime: mocks.isStandaloneDispatchRuntime,
   validateFederatedOrganizationMembershipForCurrentRequest:
     mocks.validateFederatedOrganizationMembershipForCurrentRequest,
 }));
-
 vi.mock("@agent-native/core/server", () => ({
   getRequestOrgId: mocks.getRequestOrgId,
   getRequestUserEmail: mocks.getRequestUserEmail,
@@ -39,57 +46,87 @@ const context = {
 describe("authorizeDispatchAdmin", () => {
   beforeEach(() => {
     vi.clearAllMocks();
+    mocks.roles = [];
+    mocks.orgRole = "member";
+    mocks.member = true;
+    mocks.federated = false;
+    mocks.overrides = [];
+    mocks.execute.mockImplementation(async ({ sql }: { sql: string }) => ({
+      rows: sql.includes("app_permission_overrides")
+        ? mocks.overrides
+        : mocks.member
+          ? [
+              {
+                roles: mocks.roles,
+                orgRole: mocks.orgRole,
+                identityAuthority: mocks.federated
+                  ? "https://hub.example.test"
+                  : null,
+                identityId: mocks.federated ? "org_hub" : null,
+              },
+            ]
+          : [],
+    }));
     mocks.validateFederatedOrganizationMembershipForCurrentRequest.mockResolvedValue(
       { active: true, role: "member" },
     );
-    mocks.assertAny.mockResolvedValue("admin");
-    mocks.assertPermission.mockResolvedValue(undefined);
     mocks.getRequestOrgId.mockReturnValue(undefined);
     mocks.getRequestUserEmail.mockReturnValue(undefined);
     mocks.isStandaloneDispatchRuntime.mockReturnValue(false);
   });
 
   it("denies an organization member without the Dispatch admin role", async () => {
-    mocks.assertAny.mockRejectedValue(
-      new ForbiddenError("Requires dispatch role admin"),
-    );
-    mocks.assertPermission.mockRejectedValue(
-      new ForbiddenError("Requires dispatch role admin"),
+    await expect(authorizeDispatchAdmin({}, context)).rejects.toThrow(
+      "Requires dispatch permission administer",
     );
+  });
 
+  it.each(["owner", "admin"])(
+    "allows an organization %s without app roles through the shared policy",
+    async (role) => {
+      mocks.orgRole = role;
+      mocks.validateFederatedOrganizationMembershipForCurrentRequest.mockResolvedValue(
+        { active: true, role },
+      );
+      await expect(
+        authorizeDispatchAdmin({}, context),
+      ).resolves.toBeUndefined();
+      expect(mocks.execute).toHaveBeenCalledWith(
+        expect.objectContaining({
+          args: ["dispatch", "org-1", "member@example.test"],
+        }),
+      );
+    },
+  );
+
+  it("uses the identity hub role over a stale local organization admin role", async () => {
+    mocks.federated = true;
+    mocks.orgRole = "admin";
     await expect(authorizeDispatchAdmin({}, context)).rejects.toThrow(
-      "Requires dispatch role admin",
+      "Requires dispatch permission administer",
     );
-    expect(
-      mocks.validateFederatedOrganizationMembershipForCurrentRequest,
-    ).toHaveBeenCalledWith({
-      orgId: "org-1",
-      email: "member@example.test",
-    });
-    expect(mocks.assertPermission).toHaveBeenCalledWith(["administer"], {
-      orgId: "org-1",
-      userEmail: "member@example.test",
-    });
   });
 
-  it("allows an organization admin without an app-role assignment", async () => {
+  it("allows an organization admin granted by the identity hub", async () => {
+    mocks.federated = true;
     mocks.validateFederatedOrganizationMembershipForCurrentRequest.mockResolvedValue(
       { active: true, role: "admin" },
     );
-
     await expect(authorizeDispatchAdmin({}, context)).resolves.toBeUndefined();
-    expect(mocks.assertAny).not.toHaveBeenCalled();
+    expect(
+      mocks.validateFederatedOrganizationMembershipForCurrentRequest,
+    ).toHaveBeenCalledTimes(2);
   });
 
   it("denies a stale linked organization admin", async () => {
+    mocks.orgRole = "admin";
     mocks.validateFederatedOrganizationMembershipForCurrentRequest.mockResolvedValue(
       { active: false, role: null },
     );
-
     await expect(authorizeDispatchAdmin({}, context)).rejects.toThrow(
       "active organization membership",
     );
-    expect(mocks.assertAny).not.toHaveBeenCalled();
+    expect(mocks.execute).not.toHaveBeenCalled();
   });
 
   it("allows standalone administration when the org schema is absent", async () => {
@@ -97,27 +134,28 @@ describe("authorizeDispatchAdmin", () => {
     mocks.validateFederatedOrganizationMembershipForCurrentRequest.mockRejectedValue(
       new Error('relation "org_members" does not exist'),
     );
-
     await expect(authorizeDispatchAdmin({}, context)).resolves.toBeUndefined();
-    expect(mocks.assertAny).not.toHaveBeenCalled();
+    expect(mocks.execute).not.toHaveBeenCalled();
   });
 
   it("allows a member with the Dispatch admin role", async () => {
+    mocks.roles = ["admin"];
     await expect(authorizeDispatchAdmin({}, context)).resolves.toBeUndefined();
-    expect(mocks.assertPermission).toHaveBeenCalledWith(["administer"], {
-      orgId: "org-1",
-      userEmail: "member@example.test",
-    });
+  });
+
+  it("honors a permission override for an app admin", async () => {
+    mocks.roles = ["admin"];
+    mocks.overrides = [{ permission: "administer", roles_json: "[]" }];
+    await expect(authorizeDispatchAdmin({}, context)).rejects.toThrow(
+      "Requires dispatch permission administer",
+    );
   });
 
   it("allows authenticated personal-mode administration", async () => {
     await expect(
       authorizeDispatchAdmin({}, { ...context, orgId: null }),
     ).resolves.toBeUndefined();
-    expect(
-      mocks.validateFederatedOrganizationMembershipForCurrentRequest,
-    ).not.toHaveBeenCalled();
-    expect(mocks.assertAny).not.toHaveBeenCalled();
+    expect(mocks.execute).not.toHaveBeenCalled();
   });
 
   it("denies an unauthenticated caller", async () => {

package/src/server/lib/app-roles.ts

@@ -17,7 +17,9 @@ import { dispatchAccessDescriptor } from "../../shared/app-roles.js";
 let dispatchAccess: AppRoles<"admin", "administer"> | undefined;
 
 function getDispatchAccess(): AppRoles<"admin", "administer"> {
-  return (dispatchAccess ??= defineAppRoles(dispatchAccessDescriptor));
+  return (dispatchAccess ??= defineAppRoles(dispatchAccessDescriptor, {
+    allowOrgAdmins: true,
+  }));
 }
 
 export async function authorizeDispatchAdmin(
@@ -55,7 +57,6 @@ export async function authorizeDispatchAdmin(
       "Dispatch administration requires active organization membership.",
     );
   }
-  if (membership.role === "owner" || membership.role === "admin") return;
   await getDispatchAccess().assertPermission(["administer"], {
     userEmail: email,
     orgId,