@cynodia/axiom-server 0.15.0-alpha.1 → 0.15.0-alpha.2

package/conformance/authenticated-client-rejects-system-only-action.json

@@ -13,7 +13,7 @@
     "contract": "axiom.server.v4",
     "id": "conformance-integrations",
     "name": "Conformance integrations",
-    "version": "0.8.2",
+    "version": "0.15.0",
     "entities": [
       {
         "id": "entity_effect_outcome",

package/conformance/authorization/action-allow-deny-anonymous.json

@@ -58,6 +58,15 @@
       "field_user_id": "u-nob",
       "field_user_role": "viewer",
       "field_user_tenant": "t1"
+    },
+    "banned": {
+      "field_user_id": "u-ban",
+      "field_user_role": "banned",
+      "field_user_tenant": "t1"
+    },
+    "norole": {
+      "field_user_id": "u-nr",
+      "field_user_tenant": "t1"
     }
   },
   "steps": [
@@ -94,7 +103,7 @@
     "contract": "axiom.server.v9",
     "id": "authz-conformance",
     "name": "Authorization Conformance",
-    "version": "0.15.0-alpha.1",
+    "version": "0.15.0-alpha.2",
     "entities": [
       {
         "id": "entity_user",
@@ -147,6 +156,14 @@
               "primitive": "string"
             },
             "required": true
+          },
+          {
+            "id": "field_doc_owner",
+            "valueType": {
+              "kind": "primitive",
+              "primitive": "string"
+            },
+            "required": false
           }
         ]
       },
@@ -236,6 +253,17 @@
           "required": true
         }
       },
+      "field_doc_owner": {
+        "entityId": "entity_doc",
+        "field": {
+          "id": "field_doc_owner",
+          "valueType": {
+            "kind": "primitive",
+            "primitive": "string"
+          },
+          "required": false
+        }
+      },
       "field_note_id": {
         "entityId": "entity_note",
         "field": {
@@ -383,6 +411,62 @@
         "preconditions": [],
         "failureModes": []
       },
+      "action_denylist": {
+        "id": "action_denylist",
+        "kind": "action",
+        "authorizationPolicy": "policy_denylist",
+        "operations": [
+          {
+            "kind": "set",
+            "target": {
+              "kind": "state",
+              "stateId": "state_count"
+            },
+            "value": {
+              "kind": "binary",
+              "operator": "add",
+              "left": {
+                "kind": "ref",
+                "targetId": "state_count"
+              },
+              "right": {
+                "kind": "literal",
+                "value": 1
+              }
+            }
+          }
+        ],
+        "preconditions": [],
+        "failureModes": []
+      },
+      "action_owner": {
+        "id": "action_owner",
+        "kind": "action",
+        "authorizationPolicy": "policy_owner",
+        "operations": [
+          {
+            "kind": "set",
+            "target": {
+              "kind": "state",
+              "stateId": "state_count"
+            },
+            "value": {
+              "kind": "binary",
+              "operator": "add",
+              "left": {
+                "kind": "ref",
+                "targetId": "state_count"
+              },
+              "right": {
+                "kind": "literal",
+                "value": 1
+              }
+            }
+          }
+        ],
+        "preconditions": [],
+        "failureModes": []
+      },
       "action_step": {
         "id": "action_step",
         "kind": "action",
@@ -594,6 +678,50 @@
           "kind": "literal",
           "value": false
         }
+      },
+      {
+        "id": "policy_denylist",
+        "kind": "authorization-policy",
+        "allow": {
+          "kind": "binary",
+          "operator": "neq",
+          "left": {
+            "kind": "field",
+            "source": {
+              "kind": "ref",
+              "targetId": "axiom_principal"
+            },
+            "fieldId": "field_user_role"
+          },
+          "right": {
+            "kind": "literal",
+            "value": "banned"
+          }
+        }
+      },
+      {
+        "id": "policy_owner",
+        "kind": "authorization-policy",
+        "allow": {
+          "kind": "binary",
+          "operator": "eq",
+          "left": {
+            "kind": "field",
+            "source": {
+              "kind": "ref",
+              "targetId": "axiom_resource"
+            },
+            "fieldId": "field_doc_owner"
+          },
+          "right": {
+            "kind": "field",
+            "source": {
+              "kind": "ref",
+              "targetId": "axiom_principal"
+            },
+            "fieldId": "field_user_id"
+          }
+        }
       }
     ],
     "workflows": [

package/conformance/authorization/constant-deny-policy.json

@@ -55,6 +55,15 @@
       "field_user_id": "u-nob",
       "field_user_role": "viewer",
       "field_user_tenant": "t1"
+    },
+    "banned": {
+      "field_user_id": "u-ban",
+      "field_user_role": "banned",
+      "field_user_tenant": "t1"
+    },
+    "norole": {
+      "field_user_id": "u-nr",
+      "field_user_tenant": "t1"
     }
   },
   "steps": [
@@ -75,7 +84,7 @@
     "contract": "axiom.server.v9",
     "id": "authz-conformance",
     "name": "Authorization Conformance",
-    "version": "0.15.0-alpha.1",
+    "version": "0.15.0-alpha.2",
     "entities": [
       {
         "id": "entity_user",
@@ -128,6 +137,14 @@
               "primitive": "string"
             },
             "required": true
+          },
+          {
+            "id": "field_doc_owner",
+            "valueType": {
+              "kind": "primitive",
+              "primitive": "string"
+            },
+            "required": false
           }
         ]
       },
@@ -217,6 +234,17 @@
           "required": true
         }
       },
+      "field_doc_owner": {
+        "entityId": "entity_doc",
+        "field": {
+          "id": "field_doc_owner",
+          "valueType": {
+            "kind": "primitive",
+            "primitive": "string"
+          },
+          "required": false
+        }
+      },
       "field_note_id": {
         "entityId": "entity_note",
         "field": {
@@ -364,6 +392,62 @@
         "preconditions": [],
         "failureModes": []
       },
+      "action_denylist": {
+        "id": "action_denylist",
+        "kind": "action",
+        "authorizationPolicy": "policy_denylist",
+        "operations": [
+          {
+            "kind": "set",
+            "target": {
+              "kind": "state",
+              "stateId": "state_count"
+            },
+            "value": {
+              "kind": "binary",
+              "operator": "add",
+              "left": {
+                "kind": "ref",
+                "targetId": "state_count"
+              },
+              "right": {
+                "kind": "literal",
+                "value": 1
+              }
+            }
+          }
+        ],
+        "preconditions": [],
+        "failureModes": []
+      },
+      "action_owner": {
+        "id": "action_owner",
+        "kind": "action",
+        "authorizationPolicy": "policy_owner",
+        "operations": [
+          {
+            "kind": "set",
+            "target": {
+              "kind": "state",
+              "stateId": "state_count"
+            },
+            "value": {
+              "kind": "binary",
+              "operator": "add",
+              "left": {
+                "kind": "ref",
+                "targetId": "state_count"
+              },
+              "right": {
+                "kind": "literal",
+                "value": 1
+              }
+            }
+          }
+        ],
+        "preconditions": [],
+        "failureModes": []
+      },
       "action_step": {
         "id": "action_step",
         "kind": "action",
@@ -575,6 +659,50 @@
           "kind": "literal",
           "value": false
         }
+      },
+      {
+        "id": "policy_denylist",
+        "kind": "authorization-policy",
+        "allow": {
+          "kind": "binary",
+          "operator": "neq",
+          "left": {
+            "kind": "field",
+            "source": {
+              "kind": "ref",
+              "targetId": "axiom_principal"
+            },
+            "fieldId": "field_user_role"
+          },
+          "right": {
+            "kind": "literal",
+            "value": "banned"
+          }
+        }
+      },
+      {
+        "id": "policy_owner",
+        "kind": "authorization-policy",
+        "allow": {
+          "kind": "binary",
+          "operator": "eq",
+          "left": {
+            "kind": "field",
+            "source": {
+              "kind": "ref",
+              "targetId": "axiom_resource"
+            },
+            "fieldId": "field_doc_owner"
+          },
+          "right": {
+            "kind": "field",
+            "source": {
+              "kind": "ref",
+              "targetId": "axiom_principal"
+            },
+            "fieldId": "field_user_id"
+          }
+        }
       }
     ],
     "workflows": [

package/conformance/authorization/live-query-resume.json

@@ -57,6 +57,15 @@
       "field_user_id": "u-nob",
       "field_user_role": "viewer",
       "field_user_tenant": "t1"
+    },
+    "banned": {
+      "field_user_id": "u-ban",
+      "field_user_role": "banned",
+      "field_user_tenant": "t1"
+    },
+    "norole": {
+      "field_user_id": "u-nr",
+      "field_user_tenant": "t1"
     }
   },
   "steps": [
@@ -105,7 +114,7 @@
     "contract": "axiom.server.v9",
     "id": "authz-conformance",
     "name": "Authorization Conformance",
-    "version": "0.15.0-alpha.1",
+    "version": "0.15.0-alpha.2",
     "entities": [
       {
         "id": "entity_user",
@@ -158,6 +167,14 @@
               "primitive": "string"
             },
             "required": true
+          },
+          {
+            "id": "field_doc_owner",
+            "valueType": {
+              "kind": "primitive",
+              "primitive": "string"
+            },
+            "required": false
           }
         ]
       },
@@ -247,6 +264,17 @@
           "required": true
         }
       },
+      "field_doc_owner": {
+        "entityId": "entity_doc",
+        "field": {
+          "id": "field_doc_owner",
+          "valueType": {
+            "kind": "primitive",
+            "primitive": "string"
+          },
+          "required": false
+        }
+      },
       "field_note_id": {
         "entityId": "entity_note",
         "field": {
@@ -394,6 +422,62 @@
         "preconditions": [],
         "failureModes": []
       },
+      "action_denylist": {
+        "id": "action_denylist",
+        "kind": "action",
+        "authorizationPolicy": "policy_denylist",
+        "operations": [
+          {
+            "kind": "set",
+            "target": {
+              "kind": "state",
+              "stateId": "state_count"
+            },
+            "value": {
+              "kind": "binary",
+              "operator": "add",
+              "left": {
+                "kind": "ref",
+                "targetId": "state_count"
+              },
+              "right": {
+                "kind": "literal",
+                "value": 1
+              }
+            }
+          }
+        ],
+        "preconditions": [],
+        "failureModes": []
+      },
+      "action_owner": {
+        "id": "action_owner",
+        "kind": "action",
+        "authorizationPolicy": "policy_owner",
+        "operations": [
+          {
+            "kind": "set",
+            "target": {
+              "kind": "state",
+              "stateId": "state_count"
+            },
+            "value": {
+              "kind": "binary",
+              "operator": "add",
+              "left": {
+                "kind": "ref",
+                "targetId": "state_count"
+              },
+              "right": {
+                "kind": "literal",
+                "value": 1
+              }
+            }
+          }
+        ],
+        "preconditions": [],
+        "failureModes": []
+      },
       "action_step": {
         "id": "action_step",
         "kind": "action",
@@ -605,6 +689,50 @@
           "kind": "literal",
           "value": false
         }
+      },
+      {
+        "id": "policy_denylist",
+        "kind": "authorization-policy",
+        "allow": {
+          "kind": "binary",
+          "operator": "neq",
+          "left": {
+            "kind": "field",
+            "source": {
+              "kind": "ref",
+              "targetId": "axiom_principal"
+            },
+            "fieldId": "field_user_role"
+          },
+          "right": {
+            "kind": "literal",
+            "value": "banned"
+          }
+        }
+      },
+      {
+        "id": "policy_owner",
+        "kind": "authorization-policy",
+        "allow": {
+          "kind": "binary",
+          "operator": "eq",
+          "left": {
+            "kind": "field",
+            "source": {
+              "kind": "ref",
+              "targetId": "axiom_resource"
+            },
+            "fieldId": "field_doc_owner"
+          },
+          "right": {
+            "kind": "field",
+            "source": {
+              "kind": "ref",
+              "targetId": "axiom_principal"
+            },
+            "fieldId": "field_user_id"
+          }
+        }
       }
     ],
     "workflows": [

package/conformance/authorization/manifest.json

@@ -2,7 +2,7 @@
   "conformance": "axiom.conformance.v9",
   "baseContract": "axiom.server.v9",
   "protocol": "axiom.protocol.v1",
-  "release": "0.15.0-alpha.1",
+  "release": "0.15.0-alpha.2",
   "description": "Portable authorization conformance fixtures (spec15 §71-§73). Each file carries a compiled axiom.server.v9 Server IR, the principal records each credential resolves to, provider seed rows, and a deterministic driver script — every step carrying the decision the fixture author computed independently (ALLOW/DENY, and for a query the exact authorized row set). Running one needs only runAuthorizationConformanceFixture from @cynodia/axiom-server and the semantics in docs/AUTHORIZATION.md. Full mixed-build semantic-fingerprint divergence and real-process crash boundaries are the spec15 Phase I suite.",
   "fixtures": [
     {
@@ -88,6 +88,23 @@
         "deny",
         "query filtering"
       ]
+    },
+    {
+      "name": "pt2-deny-list-absent-value",
+      "covers": [
+        "deny",
+        "role/claim condition",
+        "action invocation",
+        "allow"
+      ]
+    },
+    {
+      "name": "pt2-owner-both-absent",
+      "covers": [
+        "deny",
+        "owner",
+        "resource-owner condition"
+      ]
     }
   ]
 }