@stigmer/protos 0.0.34

package/ai/stigmer/iam/iampolicy/v1/command_pb.d.ts

@@ -0,0 +1,225 @@
+import type { GenFile, GenService } from "@bufbuild/protobuf/codegenv1";
+import type { IamPolicySchema } from "./api_pb";
+import type { ApiResourceRefSchema, IamPolicySpecSchema } from "./spec_pb";
+import type { EmptySchema } from "@bufbuild/protobuf/wkt";
+/**
+ * Describes the file ai/stigmer/iam/iampolicy/v1/command.proto.
+ */
+export declare const file_ai_stigmer_iam_iampolicy_v1_command: GenFile;
+/**
+ * IAM Policy Command Controller
+ *
+ * This service manages the lifecycle of IAM policies in Stigmer.
+ * IAM policies define access control rules by connecting three key elements:
+ * - Principal: WHO gets access (user, team, etc.)
+ * - Resource: WHAT is being accessed (any API resource)
+ * - Relation: HOW they can access it (viewer, admin, user, etc.)
+ *
+ * Under the hood, each IAM policy creates an OpenFGA tuple that enforces
+ * the permission in the authorization system.
+ *
+ * Common Use Cases:
+ * - Granting users access to organizations
+ * - Setting up team-based access control
+ * - Managing fine-grained permissions on any resource
+ *
+ * @generated from service ai.stigmer.iam.iampolicy.v1.IamPolicyCommandController
+ */
+export declare const IamPolicyCommandController: GenService<{
+    /**
+     * Create a new IAM policy
+     *
+     * Creates a single IAM policy that grants a principal access to a resource with a specific relation.
+     * This is the fundamental operation for establishing permissions.
+     *
+     * The operation:
+     * 1. Validates the input (principal, resource, relation are all valid)
+     * 2. Checks for duplicates (skips if the exact policy already exists, idempotent)
+     * 3. Creates the policy in the database with auto-generated ID and metadata
+     * 4. Writes the corresponding tuple to OpenFGA (where authorization is enforced)
+     *
+     * Authorization:
+     * - Caller must have 'can_grant_access' permission on the RESOURCE being shared
+     * - This ensures only resource owners/admins can grant access to their resources
+     *
+     * Example:
+     * Input:
+     *   principal: {kind: "identity_account", id: "ia-alice-123"}
+     *   resource: {kind: "organization", id: "org-demo-456"}
+     *   relation: "viewer"
+     * Result:
+     *   Created IamPolicy with auto-generated ID (e.g., "iamp-01HQ...")
+     *   Alice can view (but not modify) the organization
+     *
+     * Input: IamPolicySpec containing principal, resource, and relation
+     * Output: The created IamPolicy with generated ID and metadata
+     *
+     * @generated from rpc ai.stigmer.iam.iampolicy.v1.IamPolicyCommandController.create
+     */
+    create: {
+        methodKind: "unary";
+        input: typeof IamPolicySpecSchema;
+        output: typeof IamPolicySchema;
+    };
+    /**
+     * Delete a single IAM policy by spec
+     *
+     * Removes an existing IAM policy by matching the principal, resource, and relation.
+     * This is a surgical operation - it removes one specific policy without affecting others.
+     *
+     * The operation:
+     * 1. Finds the policy by matching principal+resource+relation
+     * 2. Removes it from the database
+     * 3. Deletes the corresponding tuple from OpenFGA
+     * 4. If no matching policy exists, the operation is idempotent (no error)
+     *
+     * Authorization:
+     * - Caller must have 'can_grant_access' permission on the RESOURCE referenced in the policy
+     *
+     * Use Cases:
+     * - Revoking a specific permission from a user
+     * - Removing access after a team member leaves
+     * - Cleaning up individual policies
+     *
+     * Example:
+     * Input:
+     *   principal: {kind: "identity_account", id: "ia-alice-123"}
+     *   resource: {kind: "organization", id: "org-demo-456"}
+     *   relation: "viewer"
+     * Result: The policy granting Alice viewer access to the organization is deleted
+     *
+     * Input: IamPolicySpec identifying the policy to delete (principal, resource, relation)
+     * Output: The deleted IamPolicy object (for audit/confirmation purposes)
+     *
+     * @generated from rpc ai.stigmer.iam.iampolicy.v1.IamPolicyCommandController.delete
+     */
+    delete: {
+        methodKind: "unary";
+        input: typeof IamPolicySpecSchema;
+        output: typeof IamPolicySchema;
+    };
+    /**
+     * Create platform link policy (operator-only)
+     *
+     * Creates a platform link policy that associates an identity account with the platform.
+     * This is a privileged operation that can only be called by platform operators.
+     *
+     * The operation:
+     * 1. Validates that caller has operator permission on platform:stigmer
+     * 2. Validates the input is a platform link (principal=platform, relation=platform)
+     * 3. Checks for duplicates (idempotent if already exists)
+     * 4. Creates the policy in the database with auto-generated ID and metadata
+     * 5. Writes the corresponding tuple to OpenFGA
+     *
+     * Authorization:
+     * - Caller must have 'operator' permission on platform:stigmer
+     * - This is typically only granted to machine accounts (service-to-service)
+     *
+     * Use Cases:
+     * - Bootstrapping new identity accounts
+     * - Initial permission setup when standard authorization cannot work yet
+     * - Establishing platform-level relationships for new resources
+     *
+     * Example:
+     * Input:
+     *   principal: {kind: "platform", id: "stigmer"}
+     *   resource: {kind: "identity_account", id: "ida-alice-123"}
+     *   relation: "platform"
+     * Result:
+     *   Created IamPolicy linking the identity account to the platform
+     *   Machine accounts with operator permission can now manage this account
+     *
+     * Input: IamPolicySpec with principal=platform:stigmer, relation=platform, resource=identity_account:{id}
+     * Output: The created IamPolicy with generated ID and metadata
+     *
+     * @generated from rpc ai.stigmer.iam.iampolicy.v1.IamPolicyCommandController.createPlatformLink
+     */
+    createPlatformLink: {
+        methodKind: "unary";
+        input: typeof IamPolicySpecSchema;
+        output: typeof IamPolicySchema;
+    };
+    /**
+     * Bootstrap IAM policy during resource creation (operator-only)
+     *
+     * Creates IAM policies during resource creation when standard authorization cannot work yet
+     * because no tuples exist. This solves the chicken-and-egg problem where creating the first
+     * policy for a resource requires authorization, but authorization requires that first policy.
+     *
+     * The operation:
+     * 1. Validates that caller has operator permission on platform:stigmer
+     * 2. Validates the input (principal, resource, relation are all valid)
+     * 3. Checks for duplicates (skips if the exact policy already exists, idempotent)
+     * 4. Creates the policy in the database with auto-generated ID and metadata
+     * 5. Writes the corresponding tuple to OpenFGA (where authorization is enforced)
+     *
+     * Authorization:
+     * - Caller must have 'operator' permission on platform:stigmer
+     * - This is typically only called by resource creation handlers running as machine accounts
+     *
+     * Use Cases:
+     * - Creating scope links (agent#organization@organization:acme) during agent creation
+     * - Creating owner relations (agent#owner@identity_account:alice) during agent creation
+     * - Establishing initial authorization tuples for any newly created resource
+     *
+     * Example:
+     * Input:
+     *   principal: {kind: "organization", id: "org-demo-123"}
+     *   resource: {kind: "agent", id: "agt-abc-456"}
+     *   relation: "organization"
+     * Result:
+     *   Created IamPolicy establishing agent's organization scope
+     *   Subsequent IAM policy operations can now use standard authorization
+     *
+     * Note: After the bootstrap policies are created, subsequent IAM policy modifications
+     * must use the standard 'create' RPC which requires 'can_grant_access' permission.
+     *
+     * Input: IamPolicySpec containing principal, resource, and relation
+     * Output: The created IamPolicy with generated ID and metadata
+     *
+     * @generated from rpc ai.stigmer.iam.iampolicy.v1.IamPolicyCommandController.bootstrapPolicy
+     */
+    bootstrapPolicy: {
+        methodKind: "unary";
+        input: typeof IamPolicySpecSchema;
+        output: typeof IamPolicySchema;
+    };
+    /**
+     * Cleanup all IAM policies for a deleted resource (operator-only)
+     *
+     * This is a system-level cleanup operation that removes all IAM policies
+     * associated with a deleted resource. It performs bidirectional cleanup:
+     * 1. Policies where resource is the TARGET (policies granting access TO this resource)
+     * 2. Policies where resource is the PRINCIPAL (policies where this resource HAS access)
+     *
+     * The operation:
+     * 1. Validates operator permission on platform:stigmer
+     * 2. Finds all policies where resource_id appears (as principal OR resource)
+     * 3. Deletes all matching policies from MongoDB
+     * 4. Removes all corresponding tuples from OpenFGA
+     * 5. Returns Empty (idempotent if no policies exist)
+     *
+     * Authorization:
+     * - Caller must have 'operator' permission on platform:stigmer
+     * - This is typically only granted to platform services
+     *
+     * Use Cases:
+     * - Resource deletion cleanup
+     * - Preventing orphaned FGA tuples
+     * - Maintaining authorization system integrity
+     *
+     * Example:
+     * Input: {kind: "organization", id: "org-demo-123"}
+     * Result: All policies referencing org-demo-123 are deleted
+     *
+     * Input: ApiResourceRef with resource kind and ID
+     * Output: Empty (google.protobuf.Empty)
+     *
+     * @generated from rpc ai.stigmer.iam.iampolicy.v1.IamPolicyCommandController.cleanupResourcePolicies
+     */
+    cleanupResourcePolicies: {
+        methodKind: "unary";
+        input: typeof ApiResourceRefSchema;
+        output: typeof EmptySchema;
+    };
+}>;

package/ai/stigmer/iam/iampolicy/v1/command_pb.js

@@ -0,0 +1,34 @@
+// @generated by protoc-gen-es v2.2.2 with parameter "target=ts"
+// @generated from file ai/stigmer/iam/iampolicy/v1/command.proto (package ai.stigmer.iam.iampolicy.v1, syntax proto3)
+/* eslint-disable */
+import { fileDesc, serviceDesc } from "@bufbuild/protobuf/codegenv1";
+import { file_ai_stigmer_commons_apiresource_rpc_service_options } from "../../../commons/apiresource/rpc_service_options_pb";
+import { file_ai_stigmer_iam_iampolicy_v1_api } from "./api_pb";
+import { file_ai_stigmer_iam_iampolicy_v1_rpcauthorization_method_options } from "./rpcauthorization/method_options_pb";
+import { file_ai_stigmer_iam_iampolicy_v1_spec } from "./spec_pb";
+import { file_google_protobuf_empty } from "@bufbuild/protobuf/wkt";
+/**
+ * Describes the file ai/stigmer/iam/iampolicy/v1/command.proto.
+ */
+export const file_ai_stigmer_iam_iampolicy_v1_command = /*@__PURE__*/ fileDesc("CilhaS9zdGlnbWVyL2lhbS9pYW1wb2xpY3kvdjEvY29tbWFuZC5wcm90bxIbYWkuc3RpZ21lci5pYW0uaWFtcG9saWN5LnYxMuoGChpJYW1Qb2xpY3lDb21tYW5kQ29udHJvbGxlchKCAQoGY3JlYXRlEiouYWkuc3RpZ21lci5pYW0uaWFtcG9saWN5LnYxLklhbVBvbGljeVNwZWMaJi5haS5zdGlnbWVyLmlhbS5pYW1wb2xpY3kudjEuSWFtUG9saWN5IiTCuBggCAgqHHVuYXV0aG9yaXplZCB0byBncmFudCBhY2Nlc3MSgwEKBmRlbGV0ZRIqLmFpLnN0aWdtZXIuaWFtLmlhbXBvbGljeS52MS5JYW1Qb2xpY3lTcGVjGiYuYWkuc3RpZ21lci5pYW0uaWFtcG9saWN5LnYxLklhbVBvbGljeSIlwrgYIQgIKh11bmF1dGhvcml6ZWQgdG8gcmV2b2tlIGFjY2VzcxLAAQoSY3JlYXRlUGxhdGZvcm1MaW5rEiouYWkuc3RpZ21lci5pYW0uaWFtcG9saWN5LnYxLklhbVBvbGljeVNwZWMaJi5haS5zdGlnbWVyLmlhbS5pYW1wb2xpY3kudjEuSWFtUG9saWN5IlbCuBhSCAUQHypDdW5hdXRob3JpemVkIHRvIGNyZWF0ZSBwbGF0Zm9ybSBsaW5rIC0gb3BlcmF0b3IgcGVybWlzc2lvbiByZXF1aXJlZDIHc3RpZ21lchK5AQoPYm9vdHN0cmFwUG9saWN5EiouYWkuc3RpZ21lci5pYW0uaWFtcG9saWN5LnYxLklhbVBvbGljeVNwZWMaJi5haS5zdGlnbWVyLmlhbS5pYW1wb2xpY3kudjEuSWFtUG9saWN5IlLCuBhOCAUQHyo/dW5hdXRob3JpemVkIHRvIGJvb3RzdHJhcCBwb2xpY3kgLSBvcGVyYXRvciBwZXJtaXNzaW9uIHJlcXVpcmVkMgdzdGlnbWVyErsBChdjbGVhbnVwUmVzb3VyY2VQb2xpY2llcxIrLmFpLnN0aWdtZXIuaWFtLmlhbXBvbGljeS52MS5BcGlSZXNvdXJjZVJlZhoWLmdvb2dsZS5wcm90b2J1Zi5FbXB0eSJbwrgYVwgFEB8qSHVuYXV0aG9yaXplZCB0byBjbGVhbnVwIHJlc291cmNlIHBvbGljaWVzIC0gb3BlcmF0b3IgcGVybWlzc2lvbiByZXF1aXJlZDIHc3RpZ21lchoEoP8rCmIGcHJvdG8z", [file_ai_stigmer_commons_apiresource_rpc_service_options, file_ai_stigmer_iam_iampolicy_v1_api, file_ai_stigmer_iam_iampolicy_v1_rpcauthorization_method_options, file_ai_stigmer_iam_iampolicy_v1_spec, file_google_protobuf_empty]);
+/**
+ * IAM Policy Command Controller
+ *
+ * This service manages the lifecycle of IAM policies in Stigmer.
+ * IAM policies define access control rules by connecting three key elements:
+ * - Principal: WHO gets access (user, team, etc.)
+ * - Resource: WHAT is being accessed (any API resource)
+ * - Relation: HOW they can access it (viewer, admin, user, etc.)
+ *
+ * Under the hood, each IAM policy creates an OpenFGA tuple that enforces
+ * the permission in the authorization system.
+ *
+ * Common Use Cases:
+ * - Granting users access to organizations
+ * - Setting up team-based access control
+ * - Managing fine-grained permissions on any resource
+ *
+ * @generated from service ai.stigmer.iam.iampolicy.v1.IamPolicyCommandController
+ */
+export const IamPolicyCommandController = /*@__PURE__*/ serviceDesc(file_ai_stigmer_iam_iampolicy_v1_command, 0);
+//# sourceMappingURL=command_pb.js.map

package/ai/stigmer/iam/iampolicy/v1/command_pb.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"command_pb.js","sourceRoot":"","sources":["../../../../../../ai/stigmer/iam/iampolicy/v1/command_pb.ts"],"names":[],"mappings":"AAAA,gEAAgE;AAChE,sHAAsH;AACtH,oBAAoB;AAGpB,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AACrE,OAAO,EAAE,uDAAuD,EAAE,MAAM,qDAAqD,CAAC;AAE9H,OAAO,EAAE,oCAAoC,EAAE,MAAM,UAAU,CAAC;AAChE,OAAO,EAAE,gEAAgE,EAAE,MAAM,sCAAsC,CAAC;AAExH,OAAO,EAAE,qCAAqC,EAAE,MAAM,WAAW,CAAC;AAElE,OAAO,EAAE,0BAA0B,EAAE,MAAM,wBAAwB,CAAC;AAEpE;;GAEG;AACH,MAAM,CAAC,MAAM,wCAAwC,GAAY,aAAa,CAC5E,QAAQ,CAAC,8vCAA8vC,EAAE,CAAC,uDAAuD,EAAE,oCAAoC,EAAE,gEAAgE,EAAE,qCAAqC,EAAE,0BAA0B,CAAC,CAAC,CAAC;AAEj/C;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAqMlC,aAAa,CAChB,WAAW,CAAC,wCAAwC,EAAE,CAAC,CAAC,CAAC"}