@stigmer/server 3.15.0 → 3.15.2-dev.20260913223433

package/src/domain/workflowinstance/controller.ts

@@ -748,9 +748,7 @@ async function getByWorkflow(
       ),
     )
     .addStep(newValidateProtoStep())
-    .addStep(
-      newLoadByWorkflowStep(deps.store, deps.logger, deps.listReadScope),
-    )
+    .addStep(newLoadByWorkflowStep(deps.store, deps.logger, deps.listReadScope))
     .build()
     .execute(reqCtx);
 
@@ -794,27 +792,22 @@ function newLoadByWorkflowStep(
           continue;
         }
       }
-      // 20260830.01 census lane 20: the scope narrows the decoded scan;
-      // the org/workflow filters below are contract parity in both editions.
-      const visible = await restrictListByReadScope(
+      // 20260830.01 census lane 20: the org/workflow filters are contract
+      // parity in both editions and run FIRST; the scope narrows the
+      // workflow's instances last (the scope is the last per-row
+      // predicate, stigmer-cloud 20260913.04 T02).
+      const filtered = await restrictListByReadScope(
         listReadScope,
         ctx.callerIdentity,
         ApiResourceKind.workflow_instance,
-        decoded,
+        decoded.filter(
+          (instance) =>
+            instance.spec?.workflowId === workflowId &&
+            (request.org === "" || instance.metadata?.org === request.org),
+        ),
         "",
       );
 
-      const filtered: WorkflowInstance[] = [];
-      for (const instance of visible) {
-        if (instance.spec?.workflowId !== workflowId) {
-          continue;
-        }
-        if (request.org !== "" && instance.metadata?.org !== request.org) {
-          continue;
-        }
-        filtered.push(instance);
-      }
-
       logger.info("found workflow instances for workflow", {
         workflowId,
         count: filtered.length,

package/src/extensions/__tests__/list-read-scope.test.ts

@@ -7,8 +7,11 @@
  *     byte-identity arm the four local conformance rosters also pin);
  *   - a composed scope narrows to the kept ids — and can only narrow:
  *     ids the scope answers that were never offered add nothing;
- *   - the org argument narrows AFTER the scope, only when non-blank
- *     (the Java repos' uniform blank-org posture);
+ *   - the org argument narrows BEFORE the scope, only when non-blank
+ *     (the Java repos' uniform blank-org posture; since stigmer-cloud
+ *     20260913.04 T02 the scope is the last per-row predicate, so it is
+ *     offered the org's rows and never the kind's — the same result set,
+ *     a fraction of the candidates);
  *   - the candidates carry {id, org, labels} — the driver's guest
  *     cookie rule keys on labels;
  *   - a scope failure PROPAGATES — never an empty result (the outage
@@ -76,24 +79,39 @@ describe("restrictListByReadScope", () => {
     expect(kept.map((r) => r.metadata.id)).toEqual(["ses_b"]);
   });
 
-  it("a non-blank org narrows AFTER the scope; blank org does not", async () => {
-    const scoped = scopeKeeping(["ses_a", "ses_c"]);
+  it("a non-blank org narrows BEFORE the scope: the scope is offered the org's rows only; blank org offers them all", async () => {
+    const offered: ReadonlyArray<ListEntryMeta>[] = [];
+    const recording: ListReadScope = {
+      authorizedResourceIds: () => Promise.resolve(new Set<string>()),
+      restrictListEntries: (_caller, _kind, entries) => {
+        offered.push(entries);
+        return Promise.resolve(new Set(["ses_a", "ses_c"]));
+      },
+    };
     const withOrg = await restrictListByReadScope(
-      scoped,
+      recording,
       caller,
       ApiResourceKind.session,
       rows,
       "acme",
     );
     expect(withOrg.map((r) => r.metadata.id)).toEqual(["ses_a"]);
+    // The rival's row was never a candidate: the engine is not asked
+    // about rows the request's own predicate excludes.
+    expect(offered[0]!.map((entry) => entry.id)).toEqual(["ses_a", "ses_b"]);
     const blankOrg = await restrictListByReadScope(
-      scoped,
+      recording,
       caller,
       ApiResourceKind.session,
       rows,
       "",
     );
     expect(blankOrg.map((r) => r.metadata.id)).toEqual(["ses_a", "ses_c"]);
+    expect(offered[1]!.map((entry) => entry.id)).toEqual([
+      "ses_a",
+      "ses_b",
+      "ses_c",
+    ]);
   });
 
   it("an empty kept set is a real answer — the empty list", async () => {
@@ -127,7 +145,11 @@ describe("restrictListByReadScope", () => {
     );
     expect(seenKind).toBe(ApiResourceKind.session);
     expect(seen).toEqual([
-      { id: "ses_a", org: "acme", labels: { "stigmer.ai/guest-cookie-id": "ck_1" } },
+      {
+        id: "ses_a",
+        org: "acme",
+        labels: { "stigmer.ai/guest-cookie-id": "ck_1" },
+      },
       { id: "ses_b", org: "acme", labels: {} },
       { id: "ses_c", org: "rival", labels: {} },
     ]);

package/src/extensions/list-read-scope.ts

@@ -47,6 +47,30 @@
  *     semantics (the Java baseline propagates the original caller
  *     through in-process calls, so a composed driver normally never
  *     sees `internal` on these lanes).
+ *   - THE SCOPE IS THE LAST PER-ROW PREDICATE IN A LANE (stigmer-cloud
+ *     20260913.04 T02, Q-LB-11). Every request predicate a lane applies
+ *     — the request's org, a phase, labels, a parent id, filter criteria
+ *     — is a pure function of one row and the request; the scope is a
+ *     pure function of one row and the caller; an intersection of
+ *     per-row predicates commutes, so the order is free and the cheap
+ *     ones go first: a lane offers the scope ONLY the rows its own
+ *     predicates keep. Sort, page and aggregate are not per-row and stay
+ *     after the scope, where they were. Why it matters: a composed
+ *     driver's cost is proportional to the candidates offered (the cloud
+ *     checks each one against its authorization engine), and the whole
+ *     kind across every tenant is what rolled back on 2026-09-14; the
+ *     request's org is tens of rows. Two idioms carry the rule and both
+ *     keep their reason: a lane whose Go/Java contract org-narrows in
+ *     BOTH editions (environment, memory, schedule, agent-instance,
+ *     agent-share and agent-channel lists; the getBy* parent filters)
+ *     applies its own filter ABOVE the helper call and passes `""`; a lane
+ *     whose contract is cross-org on OSS (`agentExecution.list`,
+ *     `workflowExecution.list`, `listPendingApprovals`) hands the request
+ *     org to the helper, which applies it before the scope ONLY when a
+ *     scope is composed — a scope-less server still returns the input
+ *     untouched with the org unconsulted (the first line above). Two lanes
+ *     have no org on the wire (`session.list`, `apiKey.findAll`) and offer
+ *     the kind until P1 entry 12 pages them.
  */
 import type { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
 
@@ -112,10 +136,13 @@ export interface ScopedListResource {
  *     `requestOrg` deliberately not consulted — the OSS single-tenant
  *     posture treats the org field as a no-op, and new filtering on a
  *     scope-less server would be a silent wire change);
- *   - scope composed → entries narrowed to the kept ids, then to
- *     `requestOrg` when non-blank (the Java repos' uniform posture:
- *     blank org = permission-bounded across orgs, verified per lane in
- *     the entry's census — lanes Java does not org-narrow pass "").
+ *   - scope composed → entries narrowed to `requestOrg` when non-blank
+ *     FIRST (the Java repos' uniform posture: blank org =
+ *     permission-bounded across orgs, verified per lane in the entry's
+ *     census — lanes Java does not org-narrow pass ""), then to the kept
+ *     ids. The same set either way (both are per-row predicates); the
+ *     order is the header's last contract line: the scope sees the org's
+ *     rows, not the kind's.
  */
 export async function restrictListByReadScope<T extends ScopedListResource>(
   scope: ListReadScope | undefined,
@@ -127,17 +154,15 @@ export async function restrictListByReadScope<T extends ScopedListResource>(
   if (scope === undefined) {
     return [...resources];
   }
-  const entries: ListEntryMeta[] = resources.map((resource) => ({
+  const offered =
+    requestOrg === ""
+      ? resources
+      : resources.filter((resource) => resource.metadata?.org === requestOrg);
+  const entries: ListEntryMeta[] = offered.map((resource) => ({
     id: resource.metadata?.id ?? "",
     org: resource.metadata?.org ?? "",
     labels: resource.metadata?.labels ?? {},
   }));
   const keptIds = await scope.restrictListEntries(caller, kind, entries);
-  let kept = resources.filter((resource) =>
-    keptIds.has(resource.metadata?.id ?? ""),
-  );
-  if (requestOrg !== "") {
-    kept = kept.filter((resource) => resource.metadata?.org === requestOrg);
-  }
-  return kept;
+  return offered.filter((resource) => keptIds.has(resource.metadata?.id ?? ""));
 }

package/src/transport/console/__tests__/handler.test.ts

@@ -4,7 +4,14 @@
  *
  *   - documents, flight payloads, redirects, and the 404 posture arrive
  *     with the right status, Content-Type, and Cache-Control;
- *   - /config.json is synthesized per request with a Host-derived apiUrl;
+ *   - /config.json is synthesized per request: apiUrl is the empty string
+ *     the console reads as "my own origin" (20260913.02 Q-CL-3), and the
+ *     sign-in block tells the truth about the server's posture — trusted
+ *     local says `disabled`; the OIDC posture says `oidc` with the issuer,
+ *     the audience and the console's client id, the client id empty when
+ *     the operator has not registered one (Q-CL-1, Q-CL-2);
+ *   - the OIDC return leg: /auth/callback with the provider's query
+ *     resolves to the callback document;
  *   - the guard: RPC (POST and service-shaped GET), /v1/* paths, and
  *     OPTIONS preflights flow exactly as they do WITHOUT the lane — the
  *     wire-invisibility half of the P3 acceptance;
@@ -30,8 +37,8 @@ import {
   createUnifiedPortServer,
   type UnifiedPortServer,
 } from "../../server.js";
-import { resolveConsoleAssets } from "../assets.js";
-import { createConsoleLane } from "../handler.js";
+import { resolveConsoleAssets, type ConsoleAssets } from "../assets.js";
+import { createConsoleLane, type ConsoleSignInPosture } from "../handler.js";
 
 const silentLogger = createLogger({
   level: "error",
@@ -46,6 +53,7 @@ const FIXTURE_FILES: Record<string, string> = {
   "embed.js": "// embed loader",
   "conversations.html": "<html>conversations</html>",
   "conversations.txt": "flight:conversations",
+  "auth/callback.html": "<html>completing sign-in</html>",
   "sessions/__placeholder__.html": "<html>session detail</html>",
   "sessions/__placeholder__.txt": "flight:session",
   "sessions/__placeholder__/__next.sessions.txt": "flight:nested-session",
@@ -53,25 +61,18 @@ const FIXTURE_FILES: Record<string, string> = {
 };
 
 let fixtureRoot: string;
+let assets: ConsoleAssets;
 let server: UnifiedPortServer;
 let port: number;
 let baseUrl: string;
 
-beforeAll(async () => {
-  fixtureRoot = mkdtempSync(path.join(tmpdir(), "console-lane-fixture-"));
-  for (const [file, content] of Object.entries(FIXTURE_FILES)) {
-    const target = path.join(fixtureRoot, ...file.split("/"));
-    mkdirSync(path.dirname(target), { recursive: true });
-    writeFileSync(target, content);
-  }
-
-  const assets = resolveConsoleAssets(fixtureRoot, silentLogger);
-  if (assets === undefined) {
-    throw new Error("fixture export was not discovered");
-  }
+/** A unified-port server whose console lane serves the fixture under `signIn`. */
+async function startServer(
+  signIn: ConsoleSignInPosture,
+): Promise<UnifiedPortServer> {
   const healthState = new HealthState();
   healthState.setOverall(ServingStatus.SERVING);
-  server = createUnifiedPortServer({
+  return createUnifiedPortServer({
     logger: silentLogger,
     routes: (router) => registerHealthService(router, healthState),
     interceptors: [],
@@ -83,12 +84,24 @@ beforeAll(async () => {
       response.setHeader("x-lane", "model");
       response.end("{}");
     },
-    consoleLane: createConsoleLane({
-      assets,
-      grpcPort: 7234,
-      logger: silentLogger,
-    }),
+    consoleLane: createConsoleLane({ assets, signIn, logger: silentLogger }),
   });
+}
+
+beforeAll(async () => {
+  fixtureRoot = mkdtempSync(path.join(tmpdir(), "console-lane-fixture-"));
+  for (const [file, content] of Object.entries(FIXTURE_FILES)) {
+    const target = path.join(fixtureRoot, ...file.split("/"));
+    mkdirSync(path.dirname(target), { recursive: true });
+    writeFileSync(target, content);
+  }
+
+  const discovered = resolveConsoleAssets(fixtureRoot, silentLogger);
+  if (discovered === undefined) {
+    throw new Error("fixture export was not discovered");
+  }
+  assets = discovered;
+  server = await startServer({ posture: "trusted-local" });
   port = await server.listen(0, "127.0.0.1");
   baseUrl = `http://127.0.0.1:${port}`;
 });
@@ -175,8 +188,19 @@ describe("document serving", () => {
   });
 });
 
+describe("the OIDC return leg", () => {
+  it("serves /auth/callback with the provider's query the callback document", async () => {
+    const response = await fetch(`${baseUrl}/auth/callback?code=abc&state=xyz`);
+    expect(response.status).toBe(200);
+    expect(response.headers.get("content-type")).toBe(
+      "text/html; charset=utf-8",
+    );
+    expect(await response.text()).toBe(FIXTURE_FILES["auth/callback.html"]);
+  });
+});
+
 describe("/config.json synthesis", () => {
-  it("derives apiUrl from the request Host and forbids caching", async () => {
+  it("under trusted local: same-origin apiUrl, sign-in disabled, never cached", async () => {
     const response = await fetch(`${baseUrl}/config.json`);
     expect(response.status).toBe(200);
     expect(response.headers.get("content-type")).toBe("application/json");
@@ -184,7 +208,7 @@ describe("/config.json synthesis", () => {
       "no-cache, no-store, must-revalidate",
     );
     expect(await response.json()).toEqual({
-      apiUrl: `http://127.0.0.1:${port}`,
+      apiUrl: "",
       appUrl: "",
       authMode: "disabled",
       oidcIssuer: "",
@@ -192,6 +216,52 @@ describe("/config.json synthesis", () => {
       oidcAudience: "",
     });
   });
+
+  describe("under the OIDC posture", () => {
+    const ISSUER = "https://auth.example.com/realms/main";
+    const AUDIENCE = "https://stigmer.example.com/";
+
+    async function configUnder(consoleClientId: string): Promise<unknown> {
+      const oidcServer = await startServer({
+        posture: "oidc",
+        issuer: ISSUER,
+        audience: AUDIENCE,
+        consoleClientId,
+      });
+      const oidcPort = await oidcServer.listen(0, "127.0.0.1");
+      try {
+        const response = await fetch(
+          `http://127.0.0.1:${oidcPort}/config.json`,
+        );
+        expect(response.status).toBe(200);
+        return await response.json();
+      } finally {
+        await oidcServer.shutdown();
+      }
+    }
+
+    it("tells the console the issuer, the audience and its client id", async () => {
+      expect(await configUnder("stigmer-console")).toEqual({
+        apiUrl: "",
+        appUrl: "",
+        authMode: "oidc",
+        oidcIssuer: ISSUER,
+        oidcClientId: "stigmer-console",
+        oidcAudience: AUDIENCE,
+      });
+    });
+
+    it("keeps authMode honest when no console client is registered — the client id is empty, never a disabled lie", async () => {
+      expect(await configUnder("")).toEqual({
+        apiUrl: "",
+        appUrl: "",
+        authMode: "oidc",
+        oidcIssuer: ISSUER,
+        oidcClientId: "",
+        oidcAudience: AUDIENCE,
+      });
+    });
+  });
 });
 
 describe("the guard: RPC and /v1/* flow exactly as without the lane", () => {

package/src/transport/console/__tests__/resolver.test.ts

@@ -32,6 +32,7 @@ const index = buildConsoleFileIndex([
   "/__next._tree.txt",
   "/conversations.html",
   "/conversations.txt",
+  "/auth/callback.html",
   "/auth/github/callback.html",
   "/sessions/__placeholder__.html",
   "/sessions/__placeholder__.txt",
@@ -69,6 +70,11 @@ describe("page contract (the nginx chain)", () => {
     expect(servedFile("/auth/github/callback")).toBe(
       "/auth/github/callback.html",
     );
+    // The OIDC return leg (20260913.02): the provider redirects here with
+    // `?code&state`; the handler strips the query, so the resolver sees
+    // exactly this path and must answer the callback document, never
+    // the 404 page — a 404 here is a login that can never complete.
+    expect(servedFile("/auth/callback")).toBe("/auth/callback.html");
   });
 
   it("resolves one trailing dynamic segment to its placeholder document", () => {

package/src/transport/console/handler.ts

@@ -6,6 +6,13 @@
  * nginx-equivalence-gated); this module owns the HTTP half: the lane
  * guard, header policy, config synthesis, and file streaming.
  *
+ * /config.json is also how the served console learns to sign in
+ * (20260913.02 sp.console-login; stigmer#924): the composition root hands
+ * the lane the server's authentication posture (ConsoleSignInPosture) and
+ * the lane publishes it in the console's own vocabulary — the OIDC
+ * issuer, audience and the console's PKCE client id under the posture,
+ * `disabled` under trusted local.
+ *
  * Lane guard (consoleLaneEligible): the lane claims GET/HEAD only — RPC
  * traffic is POST on service-qualified paths, and OPTIONS preflights keep
  * flowing to the RPC lane's CORS handling — and it never claims:
@@ -74,18 +81,39 @@ function isServiceShapedPath(pathname: string): boolean {
   return segments.length === 2 && (segments[0] ?? "").includes(".");
 }
 
+/**
+ * How the console this lane serves signs in — the server's authentication
+ * posture as the console needs to hear it (20260913.02 sp.console-login).
+ * A modeled state, never a nullable: "no issuer configured" and "forgot to
+ * wire the posture" must stay distinguishable at the call site.
+ *
+ * Under `oidc`, `consoleClientId` is the PUBLIC client the operator
+ * registered for the browser's PKCE flow, or "" when they have not
+ * (Q-CL-1): the lane publishes that truth as-is and the console refuses
+ * with copy that names the knob (Q-CL-2), while the composition root has
+ * already WARNed at wiring time. Emitting `disabled` instead would send
+ * the console into every RPC tokenless, to fail with a worse message.
+ */
+export type ConsoleSignInPosture =
+  | { readonly posture: "trusted-local" }
+  | {
+      readonly posture: "oidc";
+      readonly issuer: string;
+      readonly audience: string;
+      readonly consoleClientId: string;
+    };
+
 export interface ConsoleLaneOptions {
   readonly assets: ConsoleAssets;
-  /**
-   * Fallback port for the synthesized apiUrl when a request carries no
-   * Host/:authority (technically possible on HTTP/1.0-style clients).
-   */
-  readonly grpcPort: number;
+  readonly signIn: ConsoleSignInPosture;
   readonly logger: Logger;
 }
 
 export function createConsoleLane(options: ConsoleLaneOptions): LaneHandler {
-  const { assets, grpcPort, logger } = options;
+  const { assets, signIn, logger } = options;
+  // The console's runtime config is a pure function of the posture: one
+  // body, built once, served on every request.
+  const configJsonBody = JSON.stringify(consoleRuntimeConfig(signIn));
 
   return (request: LaneRequest, response: LaneResponse): void => {
     const url = request.url ?? "";
@@ -94,7 +122,7 @@ export function createConsoleLane(options: ConsoleLaneOptions): LaneHandler {
     const query = queryStart === -1 ? "" : url.slice(queryStart);
 
     if (rawPath === CONFIG_JSON_PATH) {
-      serveConfigJson(request, response, grpcPort);
+      serveConfigJson(request, response, configJsonBody);
       return;
     }
 
@@ -134,34 +162,60 @@ export function createConsoleLane(options: ConsoleLaneOptions): LaneHandler {
 
 /**
  * The runtime config the cloud container's entrypoint.sh generates from
- * env — synthesized here from the server's own knowledge instead (DD-012:
- * the nginx entrypoint script is not ported). apiUrl derives from the
- * request's own Host so the answer is correct wherever the browser
- * reached us from (localhost, a LAN address, a self-host name) — the
- * console cannot express "same origin" itself (its config loader maps
- * empty fields to a localhost default). TLS-terminating proxies
- * (x-forwarded-proto) are out of scope until a tier serves TLS.
+ * env, synthesized here from the server's own knowledge instead (DD-012:
+ * the nginx entrypoint script is not ported). The field names are the
+ * console's loader's (client-apps/web/src/config/runtime-config.ts).
+ *
+ * `apiUrl` is the empty string, which the console reads as "my own
+ * origin" — the rule its `appUrl` already follows (20260913.02 Q-CL-3).
+ * This lane and the RPC lane share one port, so the console can never
+ * need a different origin, and it makes the answer right behind a
+ * TLS-terminating proxy without trusting x-forwarded-proto: the earlier
+ * Host-derived `http://<host>` sent an https-loaded console to an http
+ * API and died on mixed content.
+ *
+ * Every value here is public metadata: an OIDC issuer URL, an audience
+ * string and a PKCE client id are what a browser is handed by design.
  */
+function consoleRuntimeConfig(signIn: ConsoleSignInPosture): {
+  readonly apiUrl: "";
+  readonly appUrl: "";
+  readonly authMode: "disabled" | "oidc";
+  readonly oidcIssuer: string;
+  readonly oidcClientId: string;
+  readonly oidcAudience: string;
+} {
+  switch (signIn.posture) {
+    case "trusted-local":
+      return {
+        apiUrl: "",
+        appUrl: "",
+        authMode: "disabled",
+        oidcIssuer: "",
+        oidcClientId: "",
+        oidcAudience: "",
+      };
+    case "oidc":
+      return {
+        apiUrl: "",
+        appUrl: "",
+        authMode: "oidc",
+        oidcIssuer: signIn.issuer,
+        oidcClientId: signIn.consoleClientId,
+        oidcAudience: signIn.audience,
+      };
+    default: {
+      const exhaustive: never = signIn;
+      throw new Error(`unhandled sign-in posture ${String(exhaustive)}`);
+    }
+  }
+}
+
 function serveConfigJson(
   request: LaneRequest,
   response: LaneResponse,
-  grpcPort: number,
+  body: string,
 ): void {
-  // HTTP/1.1 carries Host; Node maps HTTP/2's :authority into the same
-  // headers view (and Http2ServerRequest.authority falls back to it).
-  const host = request.headers.host ?? request.headers[":authority"];
-  const apiUrl =
-    typeof host === "string" && host !== ""
-      ? `http://${host}`
-      : `http://localhost:${grpcPort}`;
-  const body = JSON.stringify({
-    apiUrl,
-    appUrl: "",
-    authMode: "disabled",
-    oidcIssuer: "",
-    oidcClientId: "",
-    oidcAudience: "",
-  });
   response.statusCode = 200;
   response.setHeader("Content-Type", "application/json");
   response.setHeader("Cache-Control", CONFIG_JSON_CACHE_CONTROL);