@stigmer/react 3.30.0 → 3.32.0

package/src/iam-policy/useRoleSelector.ts

@@ -12,6 +12,9 @@ import {
   type GranteeKind,
 } from "@stigmer/sdk";
 
+/** The default for `omit`: one shared empty list, so the options never recompute for it. */
+const NOTHING_OMITTED: readonly IamRole[] = [];
+
 /** A single role option with display metadata. */
 export interface RoleOption {
   /** The IamRole enum value. */
@@ -52,6 +55,11 @@ export interface UseRoleSelectorReturn {
  * @param defaultRole - Optional initial selection.
  * @param granteeKind - Who the role is for: a person (the default) may
  *   hold any grantable role, a team only the kind's team roles.
+ * @param omit - Roles to leave out even though the kind grants them: the
+ *   ones the caller may not assign (an organization's `owner`, for anyone
+ *   who is not its owner). The server refuses them anyway; leaving them out
+ *   keeps a choice off the screen that could only fail. Pass a stable list
+ *   (a constant, or a memoized one): the options follow its identity.
  *
  * @example
  * ```tsx
@@ -68,6 +76,7 @@ export function useRoleSelector(
   kind: ApiResourceKind | null,
   defaultRole?: IamRole,
   granteeKind: GranteeKind = "identity_account",
+  omit: readonly IamRole[] = NOTHING_OMITTED,
 ): UseRoleSelectorReturn {
   const [selected, setSelected] = useState<IamRole | null>(
     defaultRole ?? null,
@@ -75,15 +84,17 @@ export function useRoleSelector(
 
   const options = useMemo<readonly RoleOption[]>(() => {
     if (kind === null) return [];
-    const roles =
-      granteeKind === "team" ? getTeamGrantableRoles(kind) : getGrantableRoles(kind);
+    const left = new Set(omit);
+    const roles = (
+      granteeKind === "team" ? getTeamGrantableRoles(kind) : getGrantableRoles(kind)
+    ).filter((role) => !left.has(role));
     return roles.map((role) => ({
       role,
       label: iamRoleDisplayName(role),
       description: iamRoleDescription(role),
       value: iamRoleToString(role),
     }));
-  }, [kind, granteeKind]);
+  }, [kind, granteeKind, omit]);
 
   const selectedValue = useMemo(
     () => (selected !== null ? iamRoleToString(selected) : ""),

package/src/invitation/InvitationManager.tsx

@@ -18,6 +18,7 @@ import { useRevokeInvitation } from "./useRevokeInvitation.js";
 import { InvitationCreatedAlert } from "./InvitationCreatedAlert.js";
 import { Tooltip, TooltipContent, TooltipTrigger } from "../internal/tooltip.js";
 import { RoleSelector } from "../iam-policy/RoleSelector.js";
+import { useOwnerAssignment } from "../iam-policy/useOwnerAssignment.js";
 import { SpinnerIcon } from "../internal/SpinnerIcon.js";
 import { useCopyFeedback } from "../internal/useCopyFeedback.js";
 
@@ -237,6 +238,9 @@ function CreateInvitationForm({
   onCancel: () => void;
 }) {
   const { create, isCreating, error, clearError } = useCreateInvitation();
+  // An invitation grants with its creator's authority: only an owner may
+  // invite an owner, and the server refuses anyone else.
+  const { unassignable } = useOwnerAssignment(org);
   const baseId = useId();
 
   const [label, setLabel] = useState("");
@@ -303,6 +307,7 @@ function CreateInvitationForm({
         kind={ApiResourceKind.organization}
         selected={role}
         onSelect={(r) => setRole(r)}
+        omitRoles={unassignable}
         disabled={isCreating}
       />
 

package/src/oauth-app/OAuthAppDetailPanel.tsx

@@ -11,6 +11,7 @@ import {
 import { timestampDate, type Timestamp } from "@bufbuild/protobuf/wkt";
 import { useUpdateOAuthApp } from "./useUpdateOAuthApp.js";
 import { useDeleteOAuthApp } from "./useDeleteOAuthApp.js";
+import { PermissionGate } from "../iam-policy/PermissionGate.js";
 import { SpinnerIcon } from "../internal/SpinnerIcon.js";
 
 // ---------------------------------------------------------------------------
@@ -35,7 +36,11 @@ export interface OAuthAppDetailPanelProps {
  * View and edit panel for an existing OAuth app.
  *
  * In **view mode**, displays all OAuth configuration fields in a
- * structured label/value layout with "Edit" and "Delete" buttons.
+ * structured label/value layout, with an "Edit" button for a caller who
+ * may edit the app (`can_edit`) and a "Delete" button for one who may
+ * delete it (`can_delete`). Both belong to the app's creator alone: the
+ * organization's admins may view an app they did not create, never change
+ * it.
  *
  * In **edit mode**, fields become editable inputs. The client secret
  * field shows a placeholder — leave it empty to keep the existing
@@ -223,31 +228,41 @@ export function OAuthAppDetailPanel({
 
         {mode === "view" && (
           <div className="stg:flex stg:items-center stg:gap-1">
-            <button
-              type="button"
-              onClick={enterEdit}
-              className={cn(
-                "stg:shrink-0 stg:rounded-md stg:px-2.5 stg:py-1.5 stg:text-xs stg:font-medium",
-                "stg:text-muted-foreground stg:hover:text-foreground stg:hover:bg-accent-hover",
-                "stg:transition-colors",
-              )}
+            <PermissionGate
+              resource={{ kind: "oauth_app", id: meta?.id ?? "" }}
+              relation="can_edit"
             >
-              Edit
-            </button>
-            <button
-              type="button"
-              onClick={() => {
-                clearDeleteError();
-                setConfirmingDelete(true);
-              }}
-              className={cn(
-                "stg:shrink-0 stg:rounded-md stg:px-2.5 stg:py-1.5 stg:text-xs stg:font-medium",
-                "stg:text-destructive-muted stg:hover:text-destructive stg:hover:bg-destructive-subtle",
-                "stg:transition-colors",
-              )}
+              <button
+                type="button"
+                onClick={enterEdit}
+                className={cn(
+                  "stg:shrink-0 stg:rounded-md stg:px-2.5 stg:py-1.5 stg:text-xs stg:font-medium",
+                  "stg:text-muted-foreground stg:hover:text-foreground stg:hover:bg-accent-hover",
+                  "stg:transition-colors",
+                )}
+              >
+                Edit
+              </button>
+            </PermissionGate>
+            <PermissionGate
+              resource={{ kind: "oauth_app", id: meta?.id ?? "" }}
+              relation="can_delete"
             >
-              Delete
-            </button>
+              <button
+                type="button"
+                onClick={() => {
+                  clearDeleteError();
+                  setConfirmingDelete(true);
+                }}
+                className={cn(
+                  "stg:shrink-0 stg:rounded-md stg:px-2.5 stg:py-1.5 stg:text-xs stg:font-medium",
+                  "stg:text-destructive-muted stg:hover:text-destructive stg:hover:bg-destructive-subtle",
+                  "stg:transition-colors",
+                )}
+              >
+                Delete
+              </button>
+            </PermissionGate>
           </div>
         )}
       </div>

package/src/oauth-app/OAuthAppListPanel.tsx

@@ -1,5 +1,6 @@
 "use client";
 
+import type { ReactNode } from "react";
 import { cn } from "@stigmer/theme";
 import { getUserMessage } from "@stigmer/sdk";
 import { timestampDate } from "@bufbuild/protobuf/wkt";
@@ -23,13 +24,20 @@ export interface OAuthAppListPanelProps {
   readonly onEdit?: (app: OAuthApp) => void;
   /** Re-expose refetch so parents can trigger a list refresh. */
   readonly onRefetchRef?: (refetch: () => void) => void;
+  /**
+   * Shown when the list is empty. Defaults to "No OAuth apps configured
+   * yet." The list holds only the apps the caller may view (each app's
+   * creator and the organization's admins), so a host that knows the
+   * caller may not manage OAuth apps should say who does instead.
+   */
+  readonly emptyState?: ReactNode;
   /** Additional CSS class names for the root container. */
   readonly className?: string;
 }
 
 /**
- * Displays a list of {@link OAuthApp} resources owned by an
- * organization.
+ * Displays the {@link OAuthApp} resources of an organization that the
+ * caller may view.
  *
  * Each row shows the provider name, client ID (non-secret), and
  * creation date. When `onEdit` is provided, rows include a pencil
@@ -56,6 +64,7 @@ export function OAuthAppListPanel({
   org,
   onEdit,
   onRefetchRef,
+  emptyState = "No OAuth apps configured yet.",
   className,
 }: OAuthAppListPanelProps) {
   const { oauthApps, isLoading, error, refetch } = useOAuthAppList(org);
@@ -97,7 +106,7 @@ export function OAuthAppListPanel({
           className,
         )}
       >
-        No OAuth apps configured yet.
+        {emptyState}
       </p>
     );
   }

package/src/oauth-app/__tests__/OAuthAppDetailPanel.test.tsx

@@ -6,17 +6,24 @@ import {
   type OAuthApp,
 } from "@stigmer/protos/ai/stigmer/iam/oauthapp/v1/api_pb";
 import { TokenEndpointAuthMethod } from "@stigmer/protos/ai/stigmer/iam/oauthapp/v1/spec_pb";
+import type { CheckMyPermissionInput } from "@stigmer/protos/ai/stigmer/iam/iampolicy/v1/io_pb";
 import type { OAuthAppInput } from "@stigmer/sdk";
 import { StigmerContext } from "../../context";
 import { OAuthAppDetailPanel } from "../OAuthAppDetailPanel";
 
 /**
- * Regression suite for the full-spec-replace wipe bug: the panel must
- * spread `toOAuthAppUpdateInput` and override only what it edits, so a
- * spec field the form does not know about survives the save. The secret
- * has its own contract: an empty secret input sends the fetched value —
- * the server's redaction marker — which the update pipeline treats as
- * "keep the stored secret" (oss#395 pins the marker/ciphertext boundary).
+ * Pins two things about the detail panel:
+ *
+ *   - the full-spec-replace wipe bug: the panel must spread
+ *     `toOAuthAppUpdateInput` and override only what it edits, so a spec
+ *     field the form does not know about survives the save. The secret has
+ *     its own contract: an empty secret input sends the fetched value — the
+ *     server's redaction marker — which the update pipeline treats as "keep
+ *     the stored secret" (oss#395 pins the marker/ciphertext boundary);
+ *   - Edit is offered only with `can_edit` and Delete only with
+ *     `can_delete` on the app, so an organization admin who may view an app
+ *     they did not create is never handed a control the server would
+ *     refuse (both belong to the creator; stigmer/stigmer#1257).
  */
 
 const REDACTED = "***REDACTED***";
@@ -39,9 +46,15 @@ const APP: OAuthApp = create(OAuthAppSchema, {
   },
 });
 
-function renderPanel(update: ReturnType<typeof vi.fn>) {
+function renderPanel(
+  update: ReturnType<typeof vi.fn>,
+  checkMyPermission: ReturnType<typeof vi.fn> = vi.fn(async () => ({
+    isAuthorized: true,
+  })),
+) {
   const client = {
     oauthapp: { update },
+    iamPolicy: { checkMyPermission },
   } as never;
   return render(
     <StigmerContext.Provider value={client}>
@@ -57,7 +70,7 @@ describe("OAuthAppDetailPanel save payload", () => {
     const update = vi.fn(async (_input: OAuthAppInput) => APP);
     renderPanel(update);
 
-    fireEvent.click(screen.getByRole("button", { name: "Edit" }));
+    fireEvent.click(await screen.findByRole("button", { name: "Edit" }));
     const provider = await screen.findByLabelText("Provider");
     fireEvent.change(provider, { target: { value: "github-enterprise" } });
     fireEvent.click(screen.getByRole("button", { name: "Save changes" }));
@@ -83,7 +96,7 @@ describe("OAuthAppDetailPanel save payload", () => {
     const update = vi.fn(async (_input: OAuthAppInput) => APP);
     renderPanel(update);
 
-    fireEvent.click(screen.getByRole("button", { name: "Edit" }));
+    fireEvent.click(await screen.findByRole("button", { name: "Edit" }));
     const secret = await screen.findByLabelText("Client secret");
     fireEvent.change(secret, { target: { value: "new-secret" } });
     fireEvent.click(screen.getByRole("button", { name: "Save changes" }));
@@ -92,3 +105,38 @@ describe("OAuthAppDetailPanel save payload", () => {
     expect(update.mock.calls[0]![0].clientSecret).toBe("new-secret");
   });
 });
+
+describe("OAuthAppDetailPanel edit and delete gates", () => {
+  it("offers Edit only with can_edit and Delete only with can_delete on the app", async () => {
+    const checkMyPermission = vi.fn(async (input: CheckMyPermissionInput) => ({
+      isAuthorized: input.relation === "can_delete",
+    }));
+    renderPanel(vi.fn(), checkMyPermission);
+
+    await screen.findByRole("button", { name: "Delete" });
+    expect(screen.queryByRole("button", { name: "Edit" })).toBeNull();
+    const asked = checkMyPermission.mock.calls.map(
+      ([input]) =>
+        `${input.resource?.kind}:${input.resource?.id}:${input.relation}`,
+    );
+    expect(asked.sort()).toEqual([
+      "oauth_app:oa-1:can_delete",
+      "oauth_app:oa-1:can_edit",
+    ]);
+  });
+
+  it("an admin who did not create the app reads it with neither control", async () => {
+    const checkMyPermission = vi.fn(async (_input: CheckMyPermissionInput) => ({
+      isAuthorized: false,
+    }));
+    renderPanel(vi.fn(), checkMyPermission);
+
+    await waitFor(() => expect(checkMyPermission).toHaveBeenCalledTimes(2));
+    // The configuration stays readable; only the change affordances are withheld.
+    expect(screen.getByRole("heading", { name: "github" })).toBeTruthy();
+    await waitFor(() =>
+      expect(screen.queryByRole("button", { name: "Edit" })).toBeNull(),
+    );
+    expect(screen.queryByRole("button", { name: "Delete" })).toBeNull();
+  });
+});

package/src/oauth-app/copy.ts

@@ -0,0 +1,16 @@
+/**
+ * OAuth-app copy shared by more than one surface, so the settings section
+ * and anything else that lists an organization's OAuth apps say the same
+ * thing.
+ *
+ * OAuth apps are administrative infrastructure: an app carries its
+ * organization's vendor credentials and endpoints, so its creator and the
+ * organization's admins see it and other members may not see it at all
+ * (stigmer/stigmer#1257). An empty list is therefore not evidence that none
+ * is configured, so a caller who may not create OAuth apps is told who
+ * manages them instead of being told that nothing exists.
+ */
+
+/** Shown in place of the empty state to a caller who may not create OAuth apps. */
+export const OAUTH_APPS_MANAGED_BY_ADMINS =
+  "OAuth apps are managed by your organization's admins.";

package/src/oauth-app/useDeleteOAuthApp.ts

@@ -22,9 +22,10 @@ export interface UseDeleteOAuthAppReturn {
  * state.
  *
  * Deletes an OAuth app by its resource ID. Returns the deleted
- * {@link OAuthApp} on success so callers can confirm which app was
- * removed. The deletion is permanent — any MCP server overrides
- * referencing this app will lose their binding.
+ * {@link OAuthApp} on success, its client secret redacted like every
+ * read, so callers can confirm which app was removed. The deletion is
+ * permanent, and the server refuses it while an MCP server's
+ * `oauth_app_ref` still resolves to the app.
  *
  * @example
  * ```tsx

package/src/oauth-app/useOAuthAppList.ts

@@ -21,11 +21,13 @@ export interface UseOAuthAppListReturn {
 }
 
 /**
- * Data hook that fetches all {@link OAuthApp} entries for an organization.
+ * Data hook that fetches the {@link OAuthApp} entries of an organization
+ * that the caller may view.
  *
- * Returns every OAuthApp whose `metadata.org` matches the input. In
- * practice these are the BYOA OAuth apps created through the "Bring
- * your own app" flow on MCP server detail pages.
+ * Returns the organization's OAuthApps that a `get` would return to the
+ * caller: each app's creator and the organization's admins see it, other
+ * members and viewers see none. In practice these are the BYOA OAuth apps
+ * created through the "Bring your own app" flow on MCP server detail pages.
  *
  * Pass `null` for `org` to skip fetching (stable no-op). Useful when
  * the active organization has not been resolved yet.

package/src/platform-client/PlatformClientDetailPanel.tsx

@@ -12,6 +12,7 @@ import { useUpdatePlatformClient } from "./useUpdatePlatformClient.js";
 import { useRotatePlatformClientSecret } from "./useRotatePlatformClientSecret.js";
 import { useDeletePlatformClient } from "./useDeletePlatformClient.js";
 import { SpinnerIcon } from "../internal/SpinnerIcon.js";
+import { isPlatformClientExpired } from "./expiry.js";
 
 /** Props for {@link PlatformClientDetailPanel}. */
 export interface PlatformClientDetailPanelProps {
@@ -87,6 +88,8 @@ export function PlatformClientDetailPanel({
   const [confirmingRotate, setConfirmingRotate] = useState(false);
 
   const isBusy = isUpdating || isRotating || isDeleting;
+  // Rotating never revives an expired client: only a later expiry does.
+  const expired = isPlatformClientExpired(spec);
 
   // Edit form state
   const [neverExpires, setNeverExpires] = useState(
@@ -507,6 +510,12 @@ export function PlatformClientDetailPanel({
               <p className="stg:text-xs stg:text-foreground">
                 Rotate secret? The current secret will be
                 <span className="stg:font-medium"> permanently invalidated</span>.
+                {expired && (
+                  <span className="stg:mt-1 stg:block stg:text-destructive">
+                    This client has expired. Rotating does not extend it; edit its
+                    expiry instead.
+                  </span>
+                )}
               </p>
               <div className="stg:flex stg:shrink-0 stg:items-center stg:gap-1.5">
                 <button
@@ -654,10 +663,18 @@ function ViewMode({
       {spec?.neverExpires ? (
         <Field label="Expiry" value="Never expires" />
       ) : spec?.expiresAt ? (
-        <Field
-          label="Expires"
-          value={formatDate(timestampDate(spec.expiresAt))}
-        />
+        isPlatformClientExpired(spec) ? (
+          <Field
+            label="Expired"
+            value={formatDate(timestampDate(spec.expiresAt))}
+            tone="destructive"
+          />
+        ) : (
+          <Field
+            label="Expires"
+            value={formatDate(timestampDate(spec.expiresAt))}
+          />
+        )
       ) : null}
 
       {/* JIT provisioning */}
@@ -726,10 +743,13 @@ function Field({
   label,
   value,
   mono,
+  tone,
 }: {
   label: string;
   value?: string;
   mono?: boolean;
+  /** `destructive` for a value that needs action (an expired client). */
+  tone?: "destructive";
 }) {
   if (!value) return null;
   return (
@@ -739,7 +759,10 @@ function Field({
       </dt>
       <dd
         className={cn(
-          "stg:text-foreground stg:mt-0.5 stg:break-all stg:text-xs",
+          "stg:mt-0.5 stg:break-all stg:text-xs",
+          tone === "destructive"
+            ? "stg:text-destructive stg:font-medium"
+            : "stg:text-foreground",
           mono && "stg:font-mono",
         )}
       >

package/src/platform-client/PlatformClientListPanel.tsx

@@ -9,6 +9,7 @@ import { Tooltip, TooltipContent, TooltipTrigger } from "../internal/tooltip.js"
 import { usePlatformClientList } from "./usePlatformClientList.js";
 import { useDeletePlatformClient } from "./useDeletePlatformClient.js";
 import { SpinnerIcon } from "../internal/SpinnerIcon.js";
+import { isPlatformClientExpired } from "./expiry.js";
 
 /** Props for {@link PlatformClientListPanel}. */
 export interface PlatformClientListPanelProps {
@@ -314,7 +315,7 @@ function ExpiryBadge({ spec }: { spec: PlatformClient["spec"] }) {
   }
   if (spec?.expiresAt) {
     const date = timestampDate(spec.expiresAt);
-    const isExpired = date < new Date();
+    const isExpired = isPlatformClientExpired(spec);
     return (
       <Tooltip>
         <TooltipTrigger

package/src/platform-client/__tests__/PlatformClientDetailPanel.test.tsx

@@ -1,6 +1,6 @@
 import { describe, it, expect, vi, afterEach } from "vitest";
 import { cleanup, fireEvent, render, screen, waitFor } from "@testing-library/react";
-import { create } from "@bufbuild/protobuf";
+import { clone, create } from "@bufbuild/protobuf";
 import { timestampFromDate } from "@bufbuild/protobuf/wkt";
 import {
   PlatformClientSchema,
@@ -18,6 +18,11 @@ import { PlatformClientDetailPanel } from "../PlatformClientDetailPanel";
  * NEVER sent `environment_refs` — saving any edit silently wiped the
  * client's credential-delivery environment bindings. The panel must
  * spread `toPlatformClientUpdateInput` and override only what it edits.
+ *
+ * Also pins how the panel presents an expired client (#1254): the view
+ * says "Expired", and the rotate confirmation says rotating will not help,
+ * because rotation leaves the expiry as it is. A live client shows
+ * neither.
  */
 
 const PLATFORM_CLIENT: PlatformClient = create(PlatformClientSchema, {
@@ -41,17 +46,32 @@ const PLATFORM_CLIENT: PlatformClient = create(PlatformClientSchema, {
   },
 });
 
-function renderPanel(update: ReturnType<typeof vi.fn>) {
+function renderPanel(
+  update: ReturnType<typeof vi.fn>,
+  platformClient: PlatformClient = PLATFORM_CLIENT,
+) {
   const client = {
     platformclient: { update },
   } as never;
   return render(
     <StigmerContext.Provider value={client}>
-      <PlatformClientDetailPanel platformClient={PLATFORM_CLIENT} />
+      <PlatformClientDetailPanel platformClient={platformClient} />
     </StigmerContext.Provider>,
   );
 }
 
+/** PLATFORM_CLIENT with an expiry a day from now (+1) or a day ago (-1). */
+function clientExpiringInDays(days: 1 | -1): PlatformClient {
+  const platformClient = clone(PlatformClientSchema, PLATFORM_CLIENT);
+  platformClient.spec!.expiresAt = timestampFromDate(
+    new Date(Date.now() + days * 86_400_000),
+  );
+  return platformClient;
+}
+
+const ROTATE_WILL_NOT_HELP =
+  "This client has expired. Rotating does not extend it; edit its expiry instead.";
+
 afterEach(cleanup);
 
 describe("PlatformClientDetailPanel save payload", () => {
@@ -80,3 +100,25 @@ describe("PlatformClientDetailPanel save payload", () => {
     expect(input.name).toBe("Embed Client");
   });
 });
+
+describe("PlatformClientDetailPanel expiry", () => {
+  it("an expired client reads Expired, and its rotate confirmation says rotating will not help", () => {
+    renderPanel(vi.fn(), clientExpiringInDays(-1));
+
+    expect(screen.getByText("Expired")).toBeTruthy();
+    expect(screen.queryByText("Expires")).toBeNull();
+
+    fireEvent.click(screen.getByRole("button", { name: "Rotate secret" }));
+    expect(screen.getByText(ROTATE_WILL_NOT_HELP)).toBeTruthy();
+  });
+
+  it("a live client reads Expires, and its rotate confirmation carries no expiry warning", () => {
+    renderPanel(vi.fn(), clientExpiringInDays(1));
+
+    expect(screen.getByText("Expires")).toBeTruthy();
+    expect(screen.queryByText("Expired")).toBeNull();
+
+    fireEvent.click(screen.getByRole("button", { name: "Rotate secret" }));
+    expect(screen.queryByText(ROTATE_WILL_NOT_HELP)).toBeNull();
+  });
+});

package/src/platform-client/__tests__/expiry.test.ts

@@ -0,0 +1,37 @@
+/**
+ * Pins the one expiry rule the platform-client panels share (#1254): it is
+ * the server's rule, so a client reads expired exactly when the mint would
+ * refuse it — an expiry set, never_expires off, and the expiry passed.
+ */
+import { describe, expect, it } from "vitest";
+import { create } from "@bufbuild/protobuf";
+import { timestampFromDate } from "@bufbuild/protobuf/wkt";
+import { PlatformClientSpecSchema } from "@stigmer/protos/ai/stigmer/iam/platformclient/v1/spec_pb";
+
+import { isPlatformClientExpired } from "../expiry";
+
+const NOW = new Date("2026-09-28T12:00:00Z");
+const before = timestampFromDate(new Date(NOW.getTime() - 1000));
+const after = timestampFromDate(new Date(NOW.getTime() + 1000));
+
+describe("isPlatformClientExpired", () => {
+  it("is true only for a passed expiry with never_expires off", () => {
+    expect(
+      isPlatformClientExpired(create(PlatformClientSpecSchema, { expiresAt: before }), NOW),
+    ).toBe(true);
+    expect(
+      isPlatformClientExpired(create(PlatformClientSpecSchema, { expiresAt: after }), NOW),
+    ).toBe(false);
+  });
+
+  it("never_expires, an unset expiry and a missing spec never read expired", () => {
+    expect(
+      isPlatformClientExpired(
+        create(PlatformClientSpecSchema, { expiresAt: before, neverExpires: true }),
+        NOW,
+      ),
+    ).toBe(false);
+    expect(isPlatformClientExpired(create(PlatformClientSpecSchema, {}), NOW)).toBe(false);
+    expect(isPlatformClientExpired(undefined, NOW)).toBe(false);
+  });
+});

package/src/platform-client/expiry.ts

@@ -0,0 +1,22 @@
+/**
+ * The one rule for "this PlatformClient has expired", shared by the list's
+ * expiry badge, the detail view and the rotate confirmation so the three
+ * never disagree. It is the server's rule, the one the mint refuses by: an
+ * expiry is set, `never_expires` is off, and the expiry has passed.
+ *
+ * Package-internal on purpose: every name the barrel exports is a public
+ * API contract, and no platform builder has asked for this one.
+ */
+import { timestampDate } from "@bufbuild/protobuf/wkt";
+import type { PlatformClient } from "@stigmer/protos/ai/stigmer/iam/platformclient/v1/api_pb";
+
+/** Whether the client's secret no longer mints (its expiry has passed). */
+export function isPlatformClientExpired(
+  spec: PlatformClient["spec"],
+  now: Date = new Date(),
+): boolean {
+  if (spec === undefined || spec.neverExpires || spec.expiresAt === undefined) {
+    return false;
+  }
+  return timestampDate(spec.expiresAt).getTime() < now.getTime();
+}

package/src/settings/MembersSection.tsx

@@ -45,7 +45,8 @@ export function MembersSection() {
       </h2>
       <p className="stg:text-muted-foreground stg:mb-4 stg:text-xs">
         Manage who has access to this organization and what they can do.
-        Members can be granted owner, admin, member, or viewer roles.
+        Members can be granted owner, admin, member, or viewer roles; only
+        an owner grants or removes owner.
         {!invitationsAvailable && (
           <>
             {" "}