@stigmer/react 3.31.0 → 3.32.0

package/src/iam-policy/__tests__/useOwnerAssignment.test.tsx

@@ -0,0 +1,55 @@
+/**
+ * Pins useOwnerAssignment, the console's one reading of the owner rule: it
+ * asks `can_assign_roles` on the organization it is given (and nothing
+ * without one), and leaves owner out of a role picker exactly when the
+ * answer is no. The permission hook is stubbed: it is proven by its own
+ * tests, fail-open posture included.
+ */
+import { afterEach, describe, expect, it, vi } from "vitest";
+import { renderHook } from "@testing-library/react";
+import { IamRole } from "@stigmer/protos/ai/stigmer/iam/v1/enum_pb";
+
+const check = vi.hoisted(() => ({
+  allowed: false,
+  asked: [] as Array<{ resource: { kind: string; id: string } | null; relation: string }>,
+}));
+
+vi.mock("../useCheckPermission.js", () => ({
+  useCheckPermission: (resource: { kind: string; id: string } | null, relation: string) => {
+    check.asked.push({ resource, relation });
+    return { allowed: check.allowed, isLoading: false, error: null };
+  },
+}));
+
+import { useOwnerAssignment } from "../useOwnerAssignment";
+
+afterEach(() => {
+  check.allowed = false;
+  check.asked = [];
+});
+
+describe("useOwnerAssignment", () => {
+  it("asks can_assign_roles on the organization, and leaves owner out when the answer is no", () => {
+    const { result } = renderHook(() => useOwnerAssignment("acme"));
+    expect(check.asked.at(-1)).toEqual({
+      resource: { kind: "organization", id: "acme" },
+      relation: "can_assign_roles",
+    });
+    expect(result.current).toEqual({ canAssignOwner: false, unassignable: [IamRole.owner] });
+  });
+
+  it("leaves nothing out for an owner, and hands back the same list on every render", () => {
+    check.allowed = true;
+    const { result, rerender } = renderHook(() => useOwnerAssignment("acme"));
+    const first = result.current.unassignable;
+    rerender();
+    expect(result.current.canAssignOwner).toBe(true);
+    expect(result.current.unassignable).toEqual([]);
+    expect(result.current.unassignable).toBe(first);
+  });
+
+  it("names no organization to the check when it has none", () => {
+    renderHook(() => useOwnerAssignment(null));
+    expect(check.asked.at(-1)?.resource).toBeNull();
+  });
+});

package/src/iam-policy/useOwnerAssignment.ts

@@ -0,0 +1,40 @@
+"use client";
+
+import { IamRole } from "@stigmer/protos/ai/stigmer/iam/v1/enum_pb";
+import { useCheckPermission } from "./useCheckPermission.js";
+
+/** What a caller who is not an owner may not assign: owner is assigned by owners. */
+const OWNER_ONLY: readonly IamRole[] = [IamRole.owner];
+const NOTHING_OMITTED: readonly IamRole[] = [];
+
+/** Return value of {@link useOwnerAssignment}. */
+export interface UseOwnerAssignmentReturn {
+  /** Whether the caller may grant, revoke or remove the owner role on the organization. */
+  readonly canAssignOwner: boolean;
+  /**
+   * The organization roles to leave out of a role picker for this caller:
+   * owner unless they may assign it. A stable list, as `RoleSelector`'s
+   * `omitRoles` asks.
+   */
+  readonly unassignable: readonly IamRole[];
+}
+
+/**
+ * The console's one reading of the owner rule: the server asks
+ * `can_assign_roles` on an organization before any change to its owner
+ * role (only its owners hold it), and every surface that offers such a
+ * change asks the same question here. Fails open, like every capability
+ * gate: the server refuses whatever this lets through.
+ *
+ * @param orgId - The organization's id, or `null` to skip the check.
+ */
+export function useOwnerAssignment(orgId: string | null): UseOwnerAssignmentReturn {
+  const { allowed } = useCheckPermission(
+    orgId ? { kind: "organization", id: orgId } : null,
+    "can_assign_roles",
+  );
+  return {
+    canAssignOwner: allowed,
+    unassignable: allowed ? NOTHING_OMITTED : OWNER_ONLY,
+  };
+}

package/src/iam-policy/useRoleSelector.ts

@@ -12,6 +12,9 @@ import {
   type GranteeKind,
 } from "@stigmer/sdk";
 
+/** The default for `omit`: one shared empty list, so the options never recompute for it. */
+const NOTHING_OMITTED: readonly IamRole[] = [];
+
 /** A single role option with display metadata. */
 export interface RoleOption {
   /** The IamRole enum value. */
@@ -52,6 +55,11 @@ export interface UseRoleSelectorReturn {
  * @param defaultRole - Optional initial selection.
  * @param granteeKind - Who the role is for: a person (the default) may
  *   hold any grantable role, a team only the kind's team roles.
+ * @param omit - Roles to leave out even though the kind grants them: the
+ *   ones the caller may not assign (an organization's `owner`, for anyone
+ *   who is not its owner). The server refuses them anyway; leaving them out
+ *   keeps a choice off the screen that could only fail. Pass a stable list
+ *   (a constant, or a memoized one): the options follow its identity.
  *
  * @example
  * ```tsx
@@ -68,6 +76,7 @@ export function useRoleSelector(
   kind: ApiResourceKind | null,
   defaultRole?: IamRole,
   granteeKind: GranteeKind = "identity_account",
+  omit: readonly IamRole[] = NOTHING_OMITTED,
 ): UseRoleSelectorReturn {
   const [selected, setSelected] = useState<IamRole | null>(
     defaultRole ?? null,
@@ -75,15 +84,17 @@ export function useRoleSelector(
 
   const options = useMemo<readonly RoleOption[]>(() => {
     if (kind === null) return [];
-    const roles =
-      granteeKind === "team" ? getTeamGrantableRoles(kind) : getGrantableRoles(kind);
+    const left = new Set(omit);
+    const roles = (
+      granteeKind === "team" ? getTeamGrantableRoles(kind) : getGrantableRoles(kind)
+    ).filter((role) => !left.has(role));
     return roles.map((role) => ({
       role,
       label: iamRoleDisplayName(role),
       description: iamRoleDescription(role),
       value: iamRoleToString(role),
     }));
-  }, [kind, granteeKind]);
+  }, [kind, granteeKind, omit]);
 
   const selectedValue = useMemo(
     () => (selected !== null ? iamRoleToString(selected) : ""),

package/src/invitation/InvitationManager.tsx

@@ -18,6 +18,7 @@ import { useRevokeInvitation } from "./useRevokeInvitation.js";
 import { InvitationCreatedAlert } from "./InvitationCreatedAlert.js";
 import { Tooltip, TooltipContent, TooltipTrigger } from "../internal/tooltip.js";
 import { RoleSelector } from "../iam-policy/RoleSelector.js";
+import { useOwnerAssignment } from "../iam-policy/useOwnerAssignment.js";
 import { SpinnerIcon } from "../internal/SpinnerIcon.js";
 import { useCopyFeedback } from "../internal/useCopyFeedback.js";
 
@@ -237,6 +238,9 @@ function CreateInvitationForm({
   onCancel: () => void;
 }) {
   const { create, isCreating, error, clearError } = useCreateInvitation();
+  // An invitation grants with its creator's authority: only an owner may
+  // invite an owner, and the server refuses anyone else.
+  const { unassignable } = useOwnerAssignment(org);
   const baseId = useId();
 
   const [label, setLabel] = useState("");
@@ -303,6 +307,7 @@ function CreateInvitationForm({
         kind={ApiResourceKind.organization}
         selected={role}
         onSelect={(r) => setRole(r)}
+        omitRoles={unassignable}
         disabled={isCreating}
       />
 

package/src/platform-client/PlatformClientDetailPanel.tsx

@@ -12,6 +12,7 @@ import { useUpdatePlatformClient } from "./useUpdatePlatformClient.js";
 import { useRotatePlatformClientSecret } from "./useRotatePlatformClientSecret.js";
 import { useDeletePlatformClient } from "./useDeletePlatformClient.js";
 import { SpinnerIcon } from "../internal/SpinnerIcon.js";
+import { isPlatformClientExpired } from "./expiry.js";
 
 /** Props for {@link PlatformClientDetailPanel}. */
 export interface PlatformClientDetailPanelProps {
@@ -87,6 +88,8 @@ export function PlatformClientDetailPanel({
   const [confirmingRotate, setConfirmingRotate] = useState(false);
 
   const isBusy = isUpdating || isRotating || isDeleting;
+  // Rotating never revives an expired client: only a later expiry does.
+  const expired = isPlatformClientExpired(spec);
 
   // Edit form state
   const [neverExpires, setNeverExpires] = useState(
@@ -507,6 +510,12 @@ export function PlatformClientDetailPanel({
               <p className="stg:text-xs stg:text-foreground">
                 Rotate secret? The current secret will be
                 <span className="stg:font-medium"> permanently invalidated</span>.
+                {expired && (
+                  <span className="stg:mt-1 stg:block stg:text-destructive">
+                    This client has expired. Rotating does not extend it; edit its
+                    expiry instead.
+                  </span>
+                )}
               </p>
               <div className="stg:flex stg:shrink-0 stg:items-center stg:gap-1.5">
                 <button
@@ -654,10 +663,18 @@ function ViewMode({
       {spec?.neverExpires ? (
         <Field label="Expiry" value="Never expires" />
       ) : spec?.expiresAt ? (
-        <Field
-          label="Expires"
-          value={formatDate(timestampDate(spec.expiresAt))}
-        />
+        isPlatformClientExpired(spec) ? (
+          <Field
+            label="Expired"
+            value={formatDate(timestampDate(spec.expiresAt))}
+            tone="destructive"
+          />
+        ) : (
+          <Field
+            label="Expires"
+            value={formatDate(timestampDate(spec.expiresAt))}
+          />
+        )
       ) : null}
 
       {/* JIT provisioning */}
@@ -726,10 +743,13 @@ function Field({
   label,
   value,
   mono,
+  tone,
 }: {
   label: string;
   value?: string;
   mono?: boolean;
+  /** `destructive` for a value that needs action (an expired client). */
+  tone?: "destructive";
 }) {
   if (!value) return null;
   return (
@@ -739,7 +759,10 @@ function Field({
       </dt>
       <dd
         className={cn(
-          "stg:text-foreground stg:mt-0.5 stg:break-all stg:text-xs",
+          "stg:mt-0.5 stg:break-all stg:text-xs",
+          tone === "destructive"
+            ? "stg:text-destructive stg:font-medium"
+            : "stg:text-foreground",
           mono && "stg:font-mono",
         )}
       >

package/src/platform-client/PlatformClientListPanel.tsx

@@ -9,6 +9,7 @@ import { Tooltip, TooltipContent, TooltipTrigger } from "../internal/tooltip.js"
 import { usePlatformClientList } from "./usePlatformClientList.js";
 import { useDeletePlatformClient } from "./useDeletePlatformClient.js";
 import { SpinnerIcon } from "../internal/SpinnerIcon.js";
+import { isPlatformClientExpired } from "./expiry.js";
 
 /** Props for {@link PlatformClientListPanel}. */
 export interface PlatformClientListPanelProps {
@@ -314,7 +315,7 @@ function ExpiryBadge({ spec }: { spec: PlatformClient["spec"] }) {
   }
   if (spec?.expiresAt) {
     const date = timestampDate(spec.expiresAt);
-    const isExpired = date < new Date();
+    const isExpired = isPlatformClientExpired(spec);
     return (
       <Tooltip>
         <TooltipTrigger

package/src/platform-client/__tests__/PlatformClientDetailPanel.test.tsx

@@ -1,6 +1,6 @@
 import { describe, it, expect, vi, afterEach } from "vitest";
 import { cleanup, fireEvent, render, screen, waitFor } from "@testing-library/react";
-import { create } from "@bufbuild/protobuf";
+import { clone, create } from "@bufbuild/protobuf";
 import { timestampFromDate } from "@bufbuild/protobuf/wkt";
 import {
   PlatformClientSchema,
@@ -18,6 +18,11 @@ import { PlatformClientDetailPanel } from "../PlatformClientDetailPanel";
  * NEVER sent `environment_refs` — saving any edit silently wiped the
  * client's credential-delivery environment bindings. The panel must
  * spread `toPlatformClientUpdateInput` and override only what it edits.
+ *
+ * Also pins how the panel presents an expired client (#1254): the view
+ * says "Expired", and the rotate confirmation says rotating will not help,
+ * because rotation leaves the expiry as it is. A live client shows
+ * neither.
  */
 
 const PLATFORM_CLIENT: PlatformClient = create(PlatformClientSchema, {
@@ -41,17 +46,32 @@ const PLATFORM_CLIENT: PlatformClient = create(PlatformClientSchema, {
   },
 });
 
-function renderPanel(update: ReturnType<typeof vi.fn>) {
+function renderPanel(
+  update: ReturnType<typeof vi.fn>,
+  platformClient: PlatformClient = PLATFORM_CLIENT,
+) {
   const client = {
     platformclient: { update },
   } as never;
   return render(
     <StigmerContext.Provider value={client}>
-      <PlatformClientDetailPanel platformClient={PLATFORM_CLIENT} />
+      <PlatformClientDetailPanel platformClient={platformClient} />
     </StigmerContext.Provider>,
   );
 }
 
+/** PLATFORM_CLIENT with an expiry a day from now (+1) or a day ago (-1). */
+function clientExpiringInDays(days: 1 | -1): PlatformClient {
+  const platformClient = clone(PlatformClientSchema, PLATFORM_CLIENT);
+  platformClient.spec!.expiresAt = timestampFromDate(
+    new Date(Date.now() + days * 86_400_000),
+  );
+  return platformClient;
+}
+
+const ROTATE_WILL_NOT_HELP =
+  "This client has expired. Rotating does not extend it; edit its expiry instead.";
+
 afterEach(cleanup);
 
 describe("PlatformClientDetailPanel save payload", () => {
@@ -80,3 +100,25 @@ describe("PlatformClientDetailPanel save payload", () => {
     expect(input.name).toBe("Embed Client");
   });
 });
+
+describe("PlatformClientDetailPanel expiry", () => {
+  it("an expired client reads Expired, and its rotate confirmation says rotating will not help", () => {
+    renderPanel(vi.fn(), clientExpiringInDays(-1));
+
+    expect(screen.getByText("Expired")).toBeTruthy();
+    expect(screen.queryByText("Expires")).toBeNull();
+
+    fireEvent.click(screen.getByRole("button", { name: "Rotate secret" }));
+    expect(screen.getByText(ROTATE_WILL_NOT_HELP)).toBeTruthy();
+  });
+
+  it("a live client reads Expires, and its rotate confirmation carries no expiry warning", () => {
+    renderPanel(vi.fn(), clientExpiringInDays(1));
+
+    expect(screen.getByText("Expires")).toBeTruthy();
+    expect(screen.queryByText("Expired")).toBeNull();
+
+    fireEvent.click(screen.getByRole("button", { name: "Rotate secret" }));
+    expect(screen.queryByText(ROTATE_WILL_NOT_HELP)).toBeNull();
+  });
+});

package/src/platform-client/__tests__/expiry.test.ts

@@ -0,0 +1,37 @@
+/**
+ * Pins the one expiry rule the platform-client panels share (#1254): it is
+ * the server's rule, so a client reads expired exactly when the mint would
+ * refuse it — an expiry set, never_expires off, and the expiry passed.
+ */
+import { describe, expect, it } from "vitest";
+import { create } from "@bufbuild/protobuf";
+import { timestampFromDate } from "@bufbuild/protobuf/wkt";
+import { PlatformClientSpecSchema } from "@stigmer/protos/ai/stigmer/iam/platformclient/v1/spec_pb";
+
+import { isPlatformClientExpired } from "../expiry";
+
+const NOW = new Date("2026-09-28T12:00:00Z");
+const before = timestampFromDate(new Date(NOW.getTime() - 1000));
+const after = timestampFromDate(new Date(NOW.getTime() + 1000));
+
+describe("isPlatformClientExpired", () => {
+  it("is true only for a passed expiry with never_expires off", () => {
+    expect(
+      isPlatformClientExpired(create(PlatformClientSpecSchema, { expiresAt: before }), NOW),
+    ).toBe(true);
+    expect(
+      isPlatformClientExpired(create(PlatformClientSpecSchema, { expiresAt: after }), NOW),
+    ).toBe(false);
+  });
+
+  it("never_expires, an unset expiry and a missing spec never read expired", () => {
+    expect(
+      isPlatformClientExpired(
+        create(PlatformClientSpecSchema, { expiresAt: before, neverExpires: true }),
+        NOW,
+      ),
+    ).toBe(false);
+    expect(isPlatformClientExpired(create(PlatformClientSpecSchema, {}), NOW)).toBe(false);
+    expect(isPlatformClientExpired(undefined, NOW)).toBe(false);
+  });
+});

package/src/platform-client/expiry.ts

@@ -0,0 +1,22 @@
+/**
+ * The one rule for "this PlatformClient has expired", shared by the list's
+ * expiry badge, the detail view and the rotate confirmation so the three
+ * never disagree. It is the server's rule, the one the mint refuses by: an
+ * expiry is set, `never_expires` is off, and the expiry has passed.
+ *
+ * Package-internal on purpose: every name the barrel exports is a public
+ * API contract, and no platform builder has asked for this one.
+ */
+import { timestampDate } from "@bufbuild/protobuf/wkt";
+import type { PlatformClient } from "@stigmer/protos/ai/stigmer/iam/platformclient/v1/api_pb";
+
+/** Whether the client's secret no longer mints (its expiry has passed). */
+export function isPlatformClientExpired(
+  spec: PlatformClient["spec"],
+  now: Date = new Date(),
+): boolean {
+  if (spec === undefined || spec.neverExpires || spec.expiresAt === undefined) {
+    return false;
+  }
+  return timestampDate(spec.expiresAt).getTime() < now.getTime();
+}

package/src/settings/MembersSection.tsx

@@ -45,7 +45,8 @@ export function MembersSection() {
       </h2>
       <p className="stg:text-muted-foreground stg:mb-4 stg:text-xs">
         Manage who has access to this organization and what they can do.
-        Members can be granted owner, admin, member, or viewer roles.
+        Members can be granted owner, admin, member, or viewer roles; only
+        an owner grants or removes owner.
         {!invitationsAvailable && (
           <>
             {" "}