@stigmer/react 3.32.0 → 3.33.0

package/platform-client/copy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"copy.js","sourceRoot":"","sources":["../../src/platform-client/copy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,yFAAyF;AACzF,MAAM,CAAC,MAAM,kCAAkC,GAC7C,6DAA6D,CAAC"}

package/settings/PlatformClientsSection.d.ts

@@ -8,6 +8,13 @@
  * A server too old to say either way is offered the button, and its own
  * answer to the create decides: the section never claims a limitation the
  * server did not report. Until the server has answered, it offers neither.
+ *
+ * The button also needs the caller to hold `can_create_platform_client` on
+ * the organization, which the model gives its admins. The list shows only
+ * the clients the caller may view (each client's creator and the
+ * organization's admins), so a caller who may not create them is told that
+ * the organization's admins manage them rather than that none is
+ * configured.
  */
 export declare function PlatformClientsSection(): import("react/jsx-runtime").JSX.Element;
 //# sourceMappingURL=PlatformClientsSection.d.ts.map

package/settings/PlatformClientsSection.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"PlatformClientsSection.d.ts","sourceRoot":"","sources":["../../src/settings/PlatformClientsSection.tsx"],"names":[],"mappings":"AAwBA;;;;;;;;;;GAUG;AACH,wBAAgB,sBAAsB,4CAkIrC"}
+{"version":3,"file":"PlatformClientsSection.d.ts","sourceRoot":"","sources":["../../src/settings/PlatformClientsSection.tsx"],"names":[],"mappings":"AA0BA;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,sBAAsB,4CA8IrC"}

package/settings/PlatformClientsSection.js

@@ -5,8 +5,10 @@ import { PlatformClientListPanel } from "../platform-client/PlatformClientListPa
 import { CreatePlatformClientForm } from "../platform-client/CreatePlatformClientForm.js";
 import { PlatformClientDetailPanel } from "../platform-client/PlatformClientDetailPanel.js";
 import { PlatformClientSecretAlert } from "../platform-client/PlatformClientSecretAlert.js";
+import { PLATFORM_CLIENTS_MANAGED_BY_ADMINS } from "../platform-client/copy.js";
+import { useCheckPermission } from "../iam-policy/useCheckPermission.js";
 import { CloudFeatureNotice } from "../internal/CloudFeatureNotice.js";
-import { useActiveOrgSlug } from "../organization/OrgProvider.js";
+import { useActiveOrgId, useActiveOrgSlug } from "../organization/OrgProvider.js";
 import { useServerInfo } from "../server-info.js";
 /**
  * Settings section for creating and maintaining platform clients.
@@ -18,13 +20,27 @@ import { useServerInfo } from "../server-info.js";
  * A server too old to say either way is offered the button, and its own
  * answer to the create decides: the section never claims a limitation the
  * server did not report. Until the server has answered, it offers neither.
+ *
+ * The button also needs the caller to hold `can_create_platform_client` on
+ * the organization, which the model gives its admins. The list shows only
+ * the clients the caller may view (each client's creator and the
+ * organization's admins), so a caller who may not create them is told that
+ * the organization's admins manage them rather than that none is
+ * configured.
  */
 export function PlatformClientsSection() {
     const headingId = useId();
     const org = useActiveOrgSlug();
+    const orgId = useActiveOrgId();
     const { serverInfo } = useServerInfo();
     const trustsEveryRequest = serverInfo?.authenticationRequired === false;
     const canMint = serverInfo !== null && !trustsEveryRequest;
+    const createCheck = useCheckPermission(orgId ? { kind: "organization", id: orgId } : null, "can_create_platform_client");
+    const canCreate = !createCheck.isLoading && createCheck.allowed;
+    const deniedCreate = !createCheck.isLoading && !createCheck.allowed;
+    const emptyState = deniedCreate
+        ? PLATFORM_CLIENTS_MANAGED_BY_ADMINS
+        : undefined;
     const [flow, setFlow] = useState({ phase: "idle" });
     const listRefetchRef = useRef(null);
     const handleRefetchRef = useCallback((refetch) => {
@@ -56,6 +72,6 @@ export function PlatformClientsSection() {
         listRefetchRef.current?.();
         setFlow({ phase: "idle" });
     }, []);
-    return (_jsxs("section", { "aria-labelledby": headingId, children: [_jsxs("div", { className: "stg:mb-3 stg:flex stg:items-center stg:justify-between", children: [_jsx("h2", { id: headingId, className: "stg:text-foreground stg:text-sm stg:font-semibold", children: "Platform Clients" }), canMint && org && flow.phase === "idle" && (_jsx("button", { type: "button", onClick: () => setFlow({ phase: "creating" }), className: "stg:text-primary stg:hover:text-foreground stg:text-xs stg:font-medium stg:transition-colors", children: "+ New platform client" }))] }), _jsx("p", { className: "stg:text-muted-foreground stg:mb-4 stg:text-xs", children: "Platform clients let your backend mint Stigmer user tokens so you can embed Stigmer components in your application without requiring OIDC federation." }), trustsEveryRequest && (_jsxs(CloudFeatureNotice, { className: "stg:mb-4", children: ["This server trusts every request, so nothing would verify a platform client's tokens and it does not mint them. Configure an identity provider (", _jsx("code", { children: "STIGMER_OIDC_ISSUER" }), ") to create platform clients."] })), flow.phase === "creating" ? (_jsx("div", { className: "stg:border-border stg:bg-card stg:rounded-lg stg:border stg:p-4", children: _jsx(CreatePlatformClientForm, { org: org, onCreated: handleCreated, onCancel: () => setFlow({ phase: "idle" }) }) })) : flow.phase === "revealing" ? (_jsxs("div", { className: "stg:space-y-4", children: [_jsx(PlatformClientSecretAlert, { clientId: flow.clientId, clientSecret: flow.clientSecret, context: flow.context, onDismiss: () => setFlow({ phase: "idle" }) }), _jsx(PlatformClientListPanel, { org: org, onEdit: (pc) => setFlow({ phase: "editing", platformClient: pc }), onRefetchRef: handleRefetchRef })] })) : flow.phase === "editing" ? (_jsx("div", { className: "stg:border-border stg:bg-card stg:rounded-lg stg:border stg:p-4", children: _jsx(PlatformClientDetailPanel, { platformClient: flow.platformClient, onUpdated: handleUpdated, onSecretRotated: handleSecretRotated, onDeleted: handleDeleted, onBack: () => setFlow({ phase: "idle" }) }) })) : (_jsx(PlatformClientListPanel, { org: org, onEdit: (pc) => setFlow({ phase: "editing", platformClient: pc }), onRefetchRef: handleRefetchRef }))] }));
+    return (_jsxs("section", { "aria-labelledby": headingId, children: [_jsxs("div", { className: "stg:mb-3 stg:flex stg:items-center stg:justify-between", children: [_jsx("h2", { id: headingId, className: "stg:text-foreground stg:text-sm stg:font-semibold", children: "Platform Clients" }), canMint && canCreate && org && flow.phase === "idle" && (_jsx("button", { type: "button", onClick: () => setFlow({ phase: "creating" }), className: "stg:text-primary stg:hover:text-foreground stg:text-xs stg:font-medium stg:transition-colors", children: "+ New platform client" }))] }), _jsx("p", { className: "stg:text-muted-foreground stg:mb-4 stg:text-xs", children: "Platform clients let your backend mint Stigmer user tokens so you can embed Stigmer components in your application without requiring OIDC federation." }), trustsEveryRequest && (_jsxs(CloudFeatureNotice, { className: "stg:mb-4", children: ["This server trusts every request, so nothing would verify a platform client's tokens and it does not mint them. Configure an identity provider (", _jsx("code", { children: "STIGMER_OIDC_ISSUER" }), ") to create platform clients."] })), flow.phase === "creating" ? (_jsx("div", { className: "stg:border-border stg:bg-card stg:rounded-lg stg:border stg:p-4", children: _jsx(CreatePlatformClientForm, { org: org, onCreated: handleCreated, onCancel: () => setFlow({ phase: "idle" }) }) })) : flow.phase === "revealing" ? (_jsxs("div", { className: "stg:space-y-4", children: [_jsx(PlatformClientSecretAlert, { clientId: flow.clientId, clientSecret: flow.clientSecret, context: flow.context, onDismiss: () => setFlow({ phase: "idle" }) }), _jsx(PlatformClientListPanel, { org: org, onEdit: (pc) => setFlow({ phase: "editing", platformClient: pc }), onRefetchRef: handleRefetchRef, emptyState: emptyState })] })) : flow.phase === "editing" ? (_jsx("div", { className: "stg:border-border stg:bg-card stg:rounded-lg stg:border stg:p-4", children: _jsx(PlatformClientDetailPanel, { platformClient: flow.platformClient, onUpdated: handleUpdated, onSecretRotated: handleSecretRotated, onDeleted: handleDeleted, onBack: () => setFlow({ phase: "idle" }) }) })) : (_jsx(PlatformClientListPanel, { org: org, onEdit: (pc) => setFlow({ phase: "editing", platformClient: pc }), onRefetchRef: handleRefetchRef, emptyState: emptyState }))] }));
 }
 //# sourceMappingURL=PlatformClientsSection.js.map

package/settings/PlatformClientsSection.js.map

@@ -1 +1 @@
-{"version":3,"file":"PlatformClientsSection.js","sourceRoot":"","sources":["../../src/settings/PlatformClientsSection.tsx"],"names":[],"mappings":"AAAA,YAAY,CAAC;;AAEb,OAAO,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAC;AAG7D,OAAO,EAAE,uBAAuB,EAAE,MAAM,+CAA+C,CAAC;AACxF,OAAO,EAAE,wBAAwB,EAAE,MAAM,gDAAgD,CAAC;AAC1F,OAAO,EAAE,yBAAyB,EAAE,MAAM,iDAAiD,CAAC;AAC5F,OAAO,EAAE,yBAAyB,EAAE,MAAM,iDAAiD,CAAC;AAC5F,OAAO,EAAE,kBAAkB,EAAE,MAAM,mCAAmC,CAAC;AACvE,OAAO,EAAE,gBAAgB,EAAE,MAAM,gCAAgC,CAAC;AAClE,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAalD;;;;;;;;;;GAUG;AACH,MAAM,UAAU,sBAAsB;IACpC,MAAM,SAAS,GAAG,KAAK,EAAE,CAAC;IAC1B,MAAM,GAAG,GAAG,gBAAgB,EAAE,CAAC;IAC/B,MAAM,EAAE,UAAU,EAAE,GAAG,aAAa,EAAE,CAAC;IACvC,MAAM,kBAAkB,GAAG,UAAU,EAAE,sBAAsB,KAAK,KAAK,CAAC;IACxE,MAAM,OAAO,GAAG,UAAU,KAAK,IAAI,IAAI,CAAC,kBAAkB,CAAC;IAE3D,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,QAAQ,CAAY,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;IAC/D,MAAM,cAAc,GAAG,MAAM,CAAsB,IAAI,CAAC,CAAC;IAEzD,MAAM,gBAAgB,GAAG,WAAW,CAAC,CAAC,OAAmB,EAAE,EAAE;QAC3D,cAAc,CAAC,OAAO,GAAG,OAAO,CAAC;IACnC,CAAC,EAAE,EAAE,CAAC,CAAC;IAEP,MAAM,aAAa,GAAG,WAAW,CAC/B,CAAC,QAAsC,EAAE,EAAE;QACzC,cAAc,CAAC,OAAO,EAAE,EAAE,CAAC;QAC3B,OAAO,CAAC;YACN,KAAK,EAAE,WAAW;YAClB,QAAQ,EAAE,QAAQ,CAAC,cAAc,EAAE,IAAI,EAAE,QAAQ,IAAI,EAAE;YACvD,YAAY,EAAE,QAAQ,CAAC,YAAY;YACnC,OAAO,EAAE,SAAS;SACnB,CAAC,CAAC;IACL,CAAC,EACD,EAAE,CACH,CAAC;IAEF,MAAM,mBAAmB,GAAG,WAAW,CACrC,CAAC,QAAsC,EAAE,EAAE;QACzC,cAAc,CAAC,OAAO,EAAE,EAAE,CAAC;QAC3B,OAAO,CAAC;YACN,KAAK,EAAE,WAAW;YAClB,QAAQ,EAAE,QAAQ,CAAC,cAAc,EAAE,IAAI,EAAE,QAAQ,IAAI,EAAE;YACvD,YAAY,EAAE,QAAQ,CAAC,YAAY;YACnC,OAAO,EAAE,SAAS;SACnB,CAAC,CAAC;IACL,CAAC,EACD,EAAE,CACH,CAAC;IAEF,MAAM,aAAa,GAAG,WAAW,CAAC,GAAG,EAAE;QACrC,cAAc,CAAC,OAAO,EAAE,EAAE,CAAC;QAC3B,OAAO,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;IAC7B,CAAC,EAAE,EAAE,CAAC,CAAC;IAEP,MAAM,aAAa,GAAG,WAAW,CAAC,GAAG,EAAE;QACrC,cAAc,CAAC,OAAO,EAAE,EAAE,CAAC;QAC3B,OAAO,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;IAC7B,CAAC,EAAE,EAAE,CAAC,CAAC;IAEP,OAAO,CACL,sCAA0B,SAAS,aACjC,eAAK,SAAS,EAAC,wDAAwD,aACrE,aACE,EAAE,EAAE,SAAS,EACb,SAAS,EAAC,mDAAmD,iCAG1D,EAEJ,OAAO,IAAI,GAAG,IAAI,IAAI,CAAC,KAAK,KAAK,MAAM,IAAI,CAC1C,iBACE,IAAI,EAAC,QAAQ,EACb,OAAO,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,EAC7C,SAAS,EAAC,8FAA8F,sCAGjG,CACV,IACG,EACN,YAAG,SAAS,EAAC,gDAAgD,sKAIzD,EAEH,kBAAkB,IAAI,CACrB,MAAC,kBAAkB,IAAC,SAAS,EAAC,UAAU,iKAGnB,iDAAgC,qCAEhC,CACtB,EAEA,IAAI,CAAC,KAAK,KAAK,UAAU,CAAC,CAAC,CAAC,CAC3B,cAAK,SAAS,EAAC,iEAAiE,YAC9E,KAAC,wBAAwB,IACvB,GAAG,EAAE,GAAG,EACR,SAAS,EAAE,aAAa,EACxB,QAAQ,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,GAC1C,GACE,CACP,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,KAAK,WAAW,CAAC,CAAC,CAAC,CAC/B,eAAK,SAAS,EAAC,eAAe,aAC5B,KAAC,yBAAyB,IACxB,QAAQ,EAAE,IAAI,CAAC,QAAQ,EACvB,YAAY,EAAE,IAAI,CAAC,YAAY,EAC/B,OAAO,EAAE,IAAI,CAAC,OAAO,EACrB,SAAS,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,GAC3C,EACF,KAAC,uBAAuB,IACtB,GAAG,EAAE,GAAG,EACR,MAAM,EAAE,CAAC,EAAE,EAAE,EAAE,CACb,OAAO,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,cAAc,EAAE,EAAE,EAAE,CAAC,EAEnD,YAAY,EAAE,gBAAgB,GAC9B,IACE,CACP,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,CAC7B,cAAK,SAAS,EAAC,iEAAiE,YAC9E,KAAC,yBAAyB,IACxB,cAAc,EAAE,IAAI,CAAC,cAAc,EACnC,SAAS,EAAE,aAAa,EACxB,eAAe,EAAE,mBAAmB,EACpC,SAAS,EAAE,aAAa,EACxB,MAAM,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,GACxC,GACE,CACP,CAAC,CAAC,CAAC,CACF,KAAC,uBAAuB,IACtB,GAAG,EAAE,GAAG,EACR,MAAM,EAAE,CAAC,EAAE,EAAE,EAAE,CACb,OAAO,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,cAAc,EAAE,EAAE,EAAE,CAAC,EAEnD,YAAY,EAAE,gBAAgB,GAC9B,CACH,IACO,CACX,CAAC;AACJ,CAAC"}
+{"version":3,"file":"PlatformClientsSection.js","sourceRoot":"","sources":["../../src/settings/PlatformClientsSection.tsx"],"names":[],"mappings":"AAAA,YAAY,CAAC;;AAEb,OAAO,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAC;AAG7D,OAAO,EAAE,uBAAuB,EAAE,MAAM,+CAA+C,CAAC;AACxF,OAAO,EAAE,wBAAwB,EAAE,MAAM,gDAAgD,CAAC;AAC1F,OAAO,EAAE,yBAAyB,EAAE,MAAM,iDAAiD,CAAC;AAC5F,OAAO,EAAE,yBAAyB,EAAE,MAAM,iDAAiD,CAAC;AAC5F,OAAO,EAAE,kCAAkC,EAAE,MAAM,4BAA4B,CAAC;AAChF,OAAO,EAAE,kBAAkB,EAAE,MAAM,qCAAqC,CAAC;AACzE,OAAO,EAAE,kBAAkB,EAAE,MAAM,mCAAmC,CAAC;AACvE,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,MAAM,gCAAgC,CAAC;AAClF,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAalD;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,sBAAsB;IACpC,MAAM,SAAS,GAAG,KAAK,EAAE,CAAC;IAC1B,MAAM,GAAG,GAAG,gBAAgB,EAAE,CAAC;IAC/B,MAAM,KAAK,GAAG,cAAc,EAAE,CAAC;IAC/B,MAAM,EAAE,UAAU,EAAE,GAAG,aAAa,EAAE,CAAC;IACvC,MAAM,kBAAkB,GAAG,UAAU,EAAE,sBAAsB,KAAK,KAAK,CAAC;IACxE,MAAM,OAAO,GAAG,UAAU,KAAK,IAAI,IAAI,CAAC,kBAAkB,CAAC;IAC3D,MAAM,WAAW,GAAG,kBAAkB,CACpC,KAAK,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,EAClD,4BAA4B,CAC7B,CAAC;IACF,MAAM,SAAS,GAAG,CAAC,WAAW,CAAC,SAAS,IAAI,WAAW,CAAC,OAAO,CAAC;IAChE,MAAM,YAAY,GAAG,CAAC,WAAW,CAAC,SAAS,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC;IACpE,MAAM,UAAU,GAAG,YAAY;QAC7B,CAAC,CAAC,kCAAkC;QACpC,CAAC,CAAC,SAAS,CAAC;IAEd,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,QAAQ,CAAY,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;IAC/D,MAAM,cAAc,GAAG,MAAM,CAAsB,IAAI,CAAC,CAAC;IAEzD,MAAM,gBAAgB,GAAG,WAAW,CAAC,CAAC,OAAmB,EAAE,EAAE;QAC3D,cAAc,CAAC,OAAO,GAAG,OAAO,CAAC;IACnC,CAAC,EAAE,EAAE,CAAC,CAAC;IAEP,MAAM,aAAa,GAAG,WAAW,CAC/B,CAAC,QAAsC,EAAE,EAAE;QACzC,cAAc,CAAC,OAAO,EAAE,EAAE,CAAC;QAC3B,OAAO,CAAC;YACN,KAAK,EAAE,WAAW;YAClB,QAAQ,EAAE,QAAQ,CAAC,cAAc,EAAE,IAAI,EAAE,QAAQ,IAAI,EAAE;YACvD,YAAY,EAAE,QAAQ,CAAC,YAAY;YACnC,OAAO,EAAE,SAAS;SACnB,CAAC,CAAC;IACL,CAAC,EACD,EAAE,CACH,CAAC;IAEF,MAAM,mBAAmB,GAAG,WAAW,CACrC,CAAC,QAAsC,EAAE,EAAE;QACzC,cAAc,CAAC,OAAO,EAAE,EAAE,CAAC;QAC3B,OAAO,CAAC;YACN,KAAK,EAAE,WAAW;YAClB,QAAQ,EAAE,QAAQ,CAAC,cAAc,EAAE,IAAI,EAAE,QAAQ,IAAI,EAAE;YACvD,YAAY,EAAE,QAAQ,CAAC,YAAY;YACnC,OAAO,EAAE,SAAS;SACnB,CAAC,CAAC;IACL,CAAC,EACD,EAAE,CACH,CAAC;IAEF,MAAM,aAAa,GAAG,WAAW,CAAC,GAAG,EAAE;QACrC,cAAc,CAAC,OAAO,EAAE,EAAE,CAAC;QAC3B,OAAO,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;IAC7B,CAAC,EAAE,EAAE,CAAC,CAAC;IAEP,MAAM,aAAa,GAAG,WAAW,CAAC,GAAG,EAAE;QACrC,cAAc,CAAC,OAAO,EAAE,EAAE,CAAC;QAC3B,OAAO,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;IAC7B,CAAC,EAAE,EAAE,CAAC,CAAC;IAEP,OAAO,CACL,sCAA0B,SAAS,aACjC,eAAK,SAAS,EAAC,wDAAwD,aACrE,aACE,EAAE,EAAE,SAAS,EACb,SAAS,EAAC,mDAAmD,iCAG1D,EAEJ,OAAO,IAAI,SAAS,IAAI,GAAG,IAAI,IAAI,CAAC,KAAK,KAAK,MAAM,IAAI,CACvD,iBACE,IAAI,EAAC,QAAQ,EACb,OAAO,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,EAC7C,SAAS,EAAC,8FAA8F,sCAGjG,CACV,IACG,EACN,YAAG,SAAS,EAAC,gDAAgD,sKAIzD,EAEH,kBAAkB,IAAI,CACrB,MAAC,kBAAkB,IAAC,SAAS,EAAC,UAAU,iKAGnB,iDAAgC,qCAEhC,CACtB,EAEA,IAAI,CAAC,KAAK,KAAK,UAAU,CAAC,CAAC,CAAC,CAC3B,cAAK,SAAS,EAAC,iEAAiE,YAC9E,KAAC,wBAAwB,IACvB,GAAG,EAAE,GAAG,EACR,SAAS,EAAE,aAAa,EACxB,QAAQ,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,GAC1C,GACE,CACP,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,KAAK,WAAW,CAAC,CAAC,CAAC,CAC/B,eAAK,SAAS,EAAC,eAAe,aAC5B,KAAC,yBAAyB,IACxB,QAAQ,EAAE,IAAI,CAAC,QAAQ,EACvB,YAAY,EAAE,IAAI,CAAC,YAAY,EAC/B,OAAO,EAAE,IAAI,CAAC,OAAO,EACrB,SAAS,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,GAC3C,EACF,KAAC,uBAAuB,IACtB,GAAG,EAAE,GAAG,EACR,MAAM,EAAE,CAAC,EAAE,EAAE,EAAE,CACb,OAAO,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,cAAc,EAAE,EAAE,EAAE,CAAC,EAEnD,YAAY,EAAE,gBAAgB,EAC9B,UAAU,EAAE,UAAU,GACtB,IACE,CACP,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,CAC7B,cAAK,SAAS,EAAC,iEAAiE,YAC9E,KAAC,yBAAyB,IACxB,cAAc,EAAE,IAAI,CAAC,cAAc,EACnC,SAAS,EAAE,aAAa,EACxB,eAAe,EAAE,mBAAmB,EACpC,SAAS,EAAE,aAAa,EACxB,MAAM,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,GACxC,GACE,CACP,CAAC,CAAC,CAAC,CACF,KAAC,uBAAuB,IACtB,GAAG,EAAE,GAAG,EACR,MAAM,EAAE,CAAC,EAAE,EAAE,EAAE,CACb,OAAO,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,cAAc,EAAE,EAAE,EAAE,CAAC,EAEnD,YAAY,EAAE,gBAAgB,EAC9B,UAAU,EAAE,UAAU,GACtB,CACH,IACO,CACX,CAAC;AACJ,CAAC"}

package/src/api-key/ApiKeyListPanel.tsx

@@ -9,7 +9,7 @@ import { Tooltip, TooltipContent, TooltipTrigger } from "../internal/tooltip.js"
 import { useApiKeyList } from "./useApiKeyList.js";
 import { useDeleteApiKey } from "./useDeleteApiKey.js";
 import { SpinnerIcon } from "../internal/SpinnerIcon.js";
-import { formatRelativeTime } from "../activity/format-relative-time.js";
+import { LastUsedLabel } from "../internal/LastUsedLabel.js";
 
 // ---------------------------------------------------------------------------
 // Public API
@@ -263,11 +263,7 @@ function ApiKeyRow({
               ? `Expires ${formatShortDate(timestampDate(expiresAt))}`
               : "No expiry"}
         </span>
-        <span>
-          {lastUsedAt
-            ? formatRelativeTime(timestampDate(lastUsedAt), now)
-            : "Never used"}
-        </span>
+        <LastUsedLabel at={lastUsedAt} now={now} />
       </div>
 
       {/* Delete button */}

package/src/internal/LastUsedLabel.tsx

@@ -0,0 +1,41 @@
+"use client";
+
+import { timestampDate } from "@bufbuild/protobuf/wkt";
+import type { Timestamp } from "@bufbuild/protobuf/wkt";
+import { formatRelativeTime } from "../activity/format-relative-time.js";
+import { Tooltip, TooltipContent, TooltipTrigger } from "./tooltip.js";
+
+/** Props for {@link LastUsedLabel}. */
+export interface LastUsedLabelProps {
+  /** The credential's `status.last_used_at`; absent means it was never used. */
+  readonly at: Timestamp | undefined;
+  /** Frozen clock for tests; defaults to the wall clock. */
+  readonly now?: Date;
+}
+
+/**
+ * When a credential was last used, said one way on every surface that
+ * lists credentials (API keys, platform clients): "Used 5m" in the SDK's
+ * compact relative vocabulary, with the exact instant in a tooltip, or
+ * "Never used". The label names what the time is, because it sits beside
+ * other dates (created, expires) in the same row.
+ *
+ * The server records a use at most once a minute, so "Used now" means
+ * within the last minute or so.
+ */
+export function LastUsedLabel({ at, now }: LastUsedLabelProps) {
+  if (at === undefined) {
+    return <span>Never used</span>;
+  }
+  const date = timestampDate(at);
+  return (
+    <Tooltip>
+      <TooltipTrigger render={<time dateTime={date.toISOString()} />}>
+        {`Used ${formatRelativeTime(date, now)}`}
+      </TooltipTrigger>
+      <TooltipContent side="top">
+        {`Last used ${date.toISOString()}`}
+      </TooltipContent>
+    </Tooltip>
+  );
+}

package/src/platform-client/PlatformClientDetailPanel.tsx

@@ -11,6 +11,8 @@ import type { PlatformClientCreateResponse } from "@stigmer/protos/ai/stigmer/ia
 import { useUpdatePlatformClient } from "./useUpdatePlatformClient.js";
 import { useRotatePlatformClientSecret } from "./useRotatePlatformClientSecret.js";
 import { useDeletePlatformClient } from "./useDeletePlatformClient.js";
+import { formatRelativeTime } from "../activity/format-relative-time.js";
+import { useCheckPermission } from "../iam-policy/useCheckPermission.js";
 import { SpinnerIcon } from "../internal/SpinnerIcon.js";
 import { isPlatformClientExpired } from "./expiry.js";
 
@@ -33,14 +35,24 @@ export interface PlatformClientDetailPanelProps {
   readonly onBack?: () => void;
   /** Additional CSS class names for the root container. */
   readonly className?: string;
+  /**
+   * Reference instant for the "last used" relative stamp. Defaults to
+   * the live clock. **Deterministic hosts (documentation embeds, video
+   * export) must pass a frozen instant** — otherwise a depicted client's
+   * "2h ago" drifts with every replay.
+   */
+  readonly now?: Date;
 }
 
 /**
  * View and edit panel for an existing platform client.
  *
  * In **view mode**, displays all configuration fields in a structured
- * label/value layout with "Edit", "Rotate Secret", and "Delete"
- * actions.
+ * label/value layout, with when the client last minted a token, and
+ * "Edit", "Rotate Secret", and "Delete" actions offered only to a caller
+ * the server allows: `can_edit` for Edit and Rotate, `can_delete` for
+ * Delete. The organization's admins may view a client they did not
+ * create, and see no actions on it.
  *
  * In **edit mode**, mutable spec fields become editable: JIT
  * provisioning toggles, expiry, auto-grant role, and allowed
@@ -71,11 +83,18 @@ export function PlatformClientDetailPanel({
   onDeleted,
   onBack,
   className,
+  now,
 }: PlatformClientDetailPanelProps) {
   const baseId = useId();
   const spec = platformClient.spec;
   const meta = platformClient.metadata;
 
+  const resource = meta?.id ? { kind: "platform_client", id: meta.id } : null;
+  const editCheck = useCheckPermission(resource, "can_edit");
+  const deleteCheck = useCheckPermission(resource, "can_delete");
+  const canEdit = !editCheck.isLoading && editCheck.allowed;
+  const canDelete = !deleteCheck.isLoading && deleteCheck.allowed;
+
   const { update, isUpdating, error: updateError, clearError: clearUpdateError } =
     useUpdatePlatformClient();
   const { rotateSecret, isRotating, error: rotateError, clearError: clearRotateError } =
@@ -239,6 +258,7 @@ export function PlatformClientDetailPanel({
 
   const createdAt = platformClient.status?.audit?.specAudit?.createdAt;
   const updatedAt = platformClient.status?.audit?.specAudit?.updatedAt;
+  const lastUsedAt = platformClient.status?.lastUsedAt;
 
   return (
     <div className={cn("stg:space-y-4", className)}>
@@ -272,7 +292,7 @@ export function PlatformClientDetailPanel({
           </div>
         </div>
 
-        {mode === "view" && (
+        {mode === "view" && canEdit && (
           <button
             type="button"
             onClick={enterEdit}
@@ -293,6 +313,8 @@ export function PlatformClientDetailPanel({
           spec={spec}
           createdAt={createdAt}
           updatedAt={updatedAt}
+          lastUsedAt={lastUsedAt}
+          now={now}
         />
       ) : (
         <form onSubmit={handleSave} className="stg:space-y-3">
@@ -499,13 +521,13 @@ export function PlatformClientDetailPanel({
         </form>
       )}
 
-      {/* Actions bar (view mode only) */}
-      {mode === "view" && (
+      {/* Actions bar (view mode only, and only the actions the caller may take) */}
+      {mode === "view" && (canEdit || canDelete) && (
         <div className="stg:space-y-2 stg:pt-2">
           <hr className="stg:border-border-muted" />
 
           {/* Rotate Secret */}
-          {confirmingRotate ? (
+          {!canEdit ? null : confirmingRotate ? (
             <div className="stg:flex stg:items-center stg:justify-between stg:rounded-md stg:border stg:border-warning/30 stg:bg-warning/5 stg:px-3 stg:py-2">
               <p className="stg:text-xs stg:text-foreground">
                 Rotate secret? The current secret will be
@@ -570,7 +592,7 @@ export function PlatformClientDetailPanel({
           )}
 
           {/* Delete */}
-          {confirmingDelete ? (
+          {!canDelete ? null : confirmingDelete ? (
             <div className="stg:flex stg:items-center stg:justify-between stg:rounded-md stg:border stg:border-destructive/30 stg:bg-destructive-subtle stg:px-3 stg:py-2">
               <div className="stg:min-w-0 stg:flex-1">
                 <p className="stg:text-xs stg:text-foreground">
@@ -641,10 +663,14 @@ function ViewMode({
   spec,
   createdAt,
   updatedAt,
+  lastUsedAt,
+  now,
 }: {
   spec: PlatformClient["spec"];
   createdAt?: Timestamp;
   updatedAt?: Timestamp;
+  lastUsedAt?: Timestamp;
+  now?: Date;
 }) {
   return (
     <dl className="stg:space-y-2.5">
@@ -730,6 +756,14 @@ function ViewMode({
             value={formatDate(timestampDate(updatedAt))}
           />
         )}
+        <Field
+          label="Last used"
+          value={
+            lastUsedAt
+              ? formatRelativeTime(timestampDate(lastUsedAt), now)
+              : "Never"
+          }
+        />
       </div>
     </dl>
   );

package/src/platform-client/PlatformClientListPanel.tsx

@@ -1,10 +1,13 @@
 "use client";
 
 import { useCallback, useState } from "react";
+import type { ReactNode } from "react";
 import { cn } from "@stigmer/theme";
 import { getUserMessage } from "@stigmer/sdk";
 import { timestampDate } from "@bufbuild/protobuf/wkt";
 import type { PlatformClient } from "@stigmer/protos/ai/stigmer/iam/platformclient/v1/api_pb";
+import { PermissionGate } from "../iam-policy/PermissionGate.js";
+import { LastUsedLabel } from "../internal/LastUsedLabel.js";
 import { Tooltip, TooltipContent, TooltipTrigger } from "../internal/tooltip.js";
 import { usePlatformClientList } from "./usePlatformClientList.js";
 import { useDeletePlatformClient } from "./useDeletePlatformClient.js";
@@ -19,8 +22,22 @@ export interface PlatformClientListPanelProps {
   readonly onEdit?: (pc: PlatformClient) => void;
   /** Expose the refetch function so parents can trigger a list refresh. */
   readonly onRefetchRef?: (refetch: () => void) => void;
+  /**
+   * Shown when the list is empty. Defaults to "No platform clients
+   * configured." The list holds only the clients the caller may view (each
+   * client's creator and the organization's admins), so a host that knows
+   * the caller may not manage platform clients should say who does instead.
+   */
+  readonly emptyState?: ReactNode;
   /** Additional CSS class names for the root container. */
   readonly className?: string;
+  /**
+   * Reference instant for the "last used" relative stamp. Defaults to
+   * the live clock. **Deterministic hosts (documentation embeds, video
+   * export) must pass a frozen instant** — otherwise a depicted client's
+   * "2h ago" drifts with every replay.
+   */
+  readonly now?: Date;
 }
 
 /**
@@ -28,8 +45,9 @@ export interface PlatformClientListPanelProps {
  * organization with inline delete confirmation.
  *
  * Each row shows the client name, `client_id` (monospace), secret
- * fingerprint, expiry status, and creation date. A delete button
- * triggers an inline confirmation flow.
+ * fingerprint, expiry status, creation date and when the client last
+ * minted a token. Edit and delete are offered only to a caller the
+ * server allows (`can_edit`, `can_delete`); delete confirms inline.
  *
  * Platform clients are admin-level resources with small cardinality
  * (typically 1–5 per org), so the list is rendered without pagination.
@@ -54,7 +72,9 @@ export function PlatformClientListPanel({
   org,
   onEdit,
   onRefetchRef,
+  emptyState = "No platform clients configured.",
   className,
+  now,
 }: PlatformClientListPanelProps) {
   const { platformClients, isLoading, error, refetch } =
     usePlatformClientList(org);
@@ -97,7 +117,7 @@ export function PlatformClientListPanel({
           className,
         )}
       >
-        No platform clients configured.
+        {emptyState}
       </p>
     );
   }
@@ -115,6 +135,7 @@ export function PlatformClientListPanel({
             key={id}
             platformClient={pc}
             isConfirming={confirmingId === id}
+            now={now}
             onEdit={onEdit ? () => onEdit(pc) : undefined}
             onConfirmDelete={() => setConfirmingId(id)}
             onCancelDelete={() => setConfirmingId(null)}
@@ -136,6 +157,7 @@ export function PlatformClientListPanel({
 function PlatformClientRow({
   platformClient,
   isConfirming,
+  now,
   onEdit,
   onConfirmDelete,
   onCancelDelete,
@@ -143,6 +165,7 @@ function PlatformClientRow({
 }: {
   platformClient: PlatformClient;
   isConfirming: boolean;
+  now?: Date;
   onEdit?: () => void;
   onConfirmDelete: () => void;
   onCancelDelete: () => void;
@@ -158,6 +181,7 @@ function PlatformClientRow({
   const fingerprint = spec?.secretFingerprint ?? "";
   const createdAt =
     platformClient.status?.audit?.specAudit?.createdAt;
+  const lastUsedAt = platformClient.status?.lastUsedAt;
 
   const handleDelete = useCallback(async () => {
     try {
@@ -269,35 +293,46 @@ function PlatformClientRow({
             </TooltipContent>
           </Tooltip>
         )}
+        <LastUsedLabel at={lastUsedAt} now={now} />
       </div>
 
       <div className="stg:flex stg:shrink-0 stg:items-center stg:gap-1">
         {onEdit && (
+          <PermissionGate
+            resource={{ kind: "platform_client", id }}
+            relation="can_edit"
+          >
+            <button
+              type="button"
+              onClick={onEdit}
+              aria-label={`Edit ${name}`}
+              className={cn(
+                "stg:shrink-0 stg:rounded stg:p-1",
+                "stg:text-muted-foreground stg:hover:text-foreground stg:hover:bg-accent-hover",
+                "stg:transition-colors",
+              )}
+            >
+              <PencilIcon />
+            </button>
+          </PermissionGate>
+        )}
+        <PermissionGate
+          resource={{ kind: "platform_client", id }}
+          relation="can_delete"
+        >
           <button
             type="button"
-            onClick={onEdit}
-            aria-label={`Edit ${name}`}
+            onClick={onConfirmDelete}
+            aria-label={`Delete ${name}`}
             className={cn(
               "stg:shrink-0 stg:rounded stg:p-1",
-              "stg:text-muted-foreground stg:hover:text-foreground stg:hover:bg-accent-hover",
+              "stg:text-muted-foreground stg:hover:text-destructive stg:hover:bg-destructive-subtle",
               "stg:transition-colors",
             )}
           >
-            <PencilIcon />
+            <TrashIcon />
           </button>
-        )}
-        <button
-          type="button"
-          onClick={onConfirmDelete}
-          aria-label={`Delete ${name}`}
-          className={cn(
-            "stg:shrink-0 stg:rounded stg:p-1",
-            "stg:text-muted-foreground stg:hover:text-destructive stg:hover:bg-destructive-subtle",
-            "stg:transition-colors",
-          )}
-        >
-          <TrashIcon />
-        </button>
+        </PermissionGate>
       </div>
     </div>
   );

package/src/platform-client/__tests__/PlatformClientDetailPanel.test.tsx

@@ -4,9 +4,11 @@ import { clone, create } from "@bufbuild/protobuf";
 import { timestampFromDate } from "@bufbuild/protobuf/wkt";
 import {
   PlatformClientSchema,
+  PlatformClientStatusSchema,
   type PlatformClient,
 } from "@stigmer/protos/ai/stigmer/iam/platformclient/v1/api_pb";
 import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
+import type { CheckMyPermissionInput } from "@stigmer/protos/ai/stigmer/iam/iampolicy/v1/io_pb";
 import { IamRole } from "@stigmer/protos/ai/stigmer/iam/v1/enum_pb";
 import type { PlatformClientInput } from "@stigmer/sdk";
 import { StigmerContext } from "../../context";
@@ -23,6 +25,13 @@ import { PlatformClientDetailPanel } from "../PlatformClientDetailPanel";
  * says "Expired", and the rotate confirmation says rotating will not help,
  * because rotation leaves the expiry as it is. A live client shows
  * neither.
+ *
+ * And what the view offers (stigmer/stigmer#1302): Edit and Rotate secret
+ * only with `can_edit`, Delete only with `can_delete` on the client, so an
+ * organization admin who may view a client they did not create reads it
+ * with no actions at all; and when the client last minted a token, or
+ * "Never" (stigmer/stigmer#1255). The permission check runs through the
+ * real hook over a stubbed `checkMyPermission`.
  */
 
 const PLATFORM_CLIENT: PlatformClient = create(PlatformClientSchema, {
@@ -46,16 +55,25 @@ const PLATFORM_CLIENT: PlatformClient = create(PlatformClientSchema, {
   },
 });
 
+const ALLOW_ALL = async (_input: CheckMyPermissionInput) => ({
+  isAuthorized: true,
+});
+
 function renderPanel(
   update: ReturnType<typeof vi.fn>,
   platformClient: PlatformClient = PLATFORM_CLIENT,
+  checkMyPermission: (
+    input: CheckMyPermissionInput,
+  ) => Promise<{ isAuthorized: boolean }> = ALLOW_ALL,
+  now?: Date,
 ) {
   const client = {
     platformclient: { update },
+    iamPolicy: { checkMyPermission },
   } as never;
   return render(
     <StigmerContext.Provider value={client}>
-      <PlatformClientDetailPanel platformClient={platformClient} />
+      <PlatformClientDetailPanel platformClient={platformClient} now={now} />
     </StigmerContext.Provider>,
   );
 }
@@ -79,7 +97,7 @@ describe("PlatformClientDetailPanel save payload", () => {
     const update = vi.fn(async (_input: PlatformClientInput) => PLATFORM_CLIENT);
     renderPanel(update);
 
-    fireEvent.click(screen.getByRole("button", { name: "Edit" }));
+    fireEvent.click(await screen.findByRole("button", { name: "Edit" }));
     fireEvent.click(screen.getByRole("button", { name: "Save changes" }));
 
     await waitFor(() => expect(update).toHaveBeenCalledTimes(1));
@@ -102,23 +120,98 @@ describe("PlatformClientDetailPanel save payload", () => {
 });
 
 describe("PlatformClientDetailPanel expiry", () => {
-  it("an expired client reads Expired, and its rotate confirmation says rotating will not help", () => {
+  it("an expired client reads Expired, and its rotate confirmation says rotating will not help", async () => {
     renderPanel(vi.fn(), clientExpiringInDays(-1));
 
     expect(screen.getByText("Expired")).toBeTruthy();
     expect(screen.queryByText("Expires")).toBeNull();
 
-    fireEvent.click(screen.getByRole("button", { name: "Rotate secret" }));
+    fireEvent.click(await screen.findByRole("button", { name: "Rotate secret" }));
     expect(screen.getByText(ROTATE_WILL_NOT_HELP)).toBeTruthy();
   });
 
-  it("a live client reads Expires, and its rotate confirmation carries no expiry warning", () => {
+  it("a live client reads Expires, and its rotate confirmation carries no expiry warning", async () => {
     renderPanel(vi.fn(), clientExpiringInDays(1));
 
     expect(screen.getByText("Expires")).toBeTruthy();
     expect(screen.queryByText("Expired")).toBeNull();
 
-    fireEvent.click(screen.getByRole("button", { name: "Rotate secret" }));
+    fireEvent.click(await screen.findByRole("button", { name: "Rotate secret" }));
     expect(screen.queryByText(ROTATE_WILL_NOT_HELP)).toBeNull();
   });
 });
+
+describe("PlatformClientDetailPanel actions by permission", () => {
+  it("asks can_edit and can_delete on the client", async () => {
+    const checkMyPermission = vi.fn(ALLOW_ALL);
+    renderPanel(vi.fn(), PLATFORM_CLIENT, checkMyPermission);
+
+    await screen.findByRole("button", { name: "Edit" });
+    const asked = checkMyPermission.mock.calls.map(
+      ([input]) =>
+        `${input.resource?.kind}:${input.resource?.id}:${input.relation}`,
+    );
+    expect(asked.sort()).toEqual([
+      "platform_client:pc-1:can_delete",
+      "platform_client:pc-1:can_edit",
+    ]);
+  });
+
+  it("offers Edit and Rotate secret only with can_edit, Delete only with can_delete", async () => {
+    renderPanel(vi.fn(), PLATFORM_CLIENT, async (input) => ({
+      isAuthorized: input.relation === "can_delete",
+    }));
+
+    await screen.findByRole("button", { name: "Delete platform client" });
+    expect(screen.queryByRole("button", { name: "Edit" })).toBeNull();
+    expect(screen.queryByRole("button", { name: "Rotate secret" })).toBeNull();
+  });
+
+  it("an admin who did not create the client reads it with no actions at all", async () => {
+    const checkMyPermission = vi.fn(async (_input: CheckMyPermissionInput) => ({
+      isAuthorized: false,
+    }));
+    const { container } = renderPanel(vi.fn(), PLATFORM_CLIENT, checkMyPermission);
+
+    await waitFor(() => expect(checkMyPermission).toHaveBeenCalledTimes(2));
+    // The configuration stays readable; only the change affordances are withheld.
+    expect(screen.getByText("client-abc")).toBeTruthy();
+    await waitFor(() => {
+      expect(screen.queryByRole("button", { name: "Edit" })).toBeNull();
+      expect(screen.queryByRole("button", { name: "Rotate secret" })).toBeNull();
+      expect(
+        screen.queryByRole("button", { name: "Delete platform client" }),
+      ).toBeNull();
+    });
+    const withoutActions = container.querySelectorAll("hr").length;
+    cleanup();
+
+    const allowed = renderPanel(vi.fn());
+    await screen.findByRole("button", { name: "Delete platform client" });
+    expect(
+      withoutActions,
+      "no empty actions bar is left behind: only the actions bar's divider goes",
+    ).toBe(allowed.container.querySelectorAll("hr").length - 1);
+  });
+});
+
+describe("PlatformClientDetailPanel last use", () => {
+  it("reads Never for a client that never minted a token", () => {
+    renderPanel(vi.fn());
+    expect(screen.getByText("Last used").nextElementSibling?.textContent).toBe(
+      "Never",
+    );
+  });
+
+  it("reads how long ago the client last minted a token", () => {
+    const used = clone(PlatformClientSchema, PLATFORM_CLIENT);
+    const now = new Date("2026-09-28T12:00:00Z");
+    used.status = create(PlatformClientStatusSchema, {
+      lastUsedAt: timestampFromDate(new Date(now.getTime() - 5 * 60_000)),
+    });
+    renderPanel(vi.fn(), used, ALLOW_ALL, now);
+    expect(screen.getByText("Last used").nextElementSibling?.textContent).toBe(
+      "5m",
+    );
+  });
+});