@stigmer/server 3.15.3-dev.20260914100347 → 3.15.3-dev.20260916211208

package/src/authorization/__tests__/fixtures/fga/agent-share-owner.fga.yaml

@@ -0,0 +1,109 @@
+# Pinned copy of stigmer-cloud backend/services/stigmer-server/fga/tests/agent-share-owner.fga.yaml
+# at commit b87dd1170 (the OpenFGA store test the cloud runs against its live model).
+# The body below is byte-identical to the source; the cloud re-runs the LIVE
+# file against this evaluator at the re-pin, so a stale copy is caught there.
+# Agent shares are owner-scoped channel config (decision 011, D1):
+# the creator owns the share; view/edit/delete/rotate require ownership or
+# an explicit grant. Plain org members get NO implicit access, and —
+# critically — no visitor-facing tuples exist at all: guest/member
+# admission to the hosted chat is app-level (shared-profile, mint, and
+# create-time gates), never FGA.
+#
+# T08: org ADMINS inherit owner (consistent with agents — an admin who can
+# edit the agent can manage its channels). The narrowness these tests pin
+# is now: owner + admins have control, granted viewers read, plain members
+# have nothing.
+
+name: agent-share-owner
+model_file: ../model/fga.mod
+
+tuples:
+  # Org membership for both accounts — proving membership grants nothing.
+  - user: identity_account:alice
+    relation: member
+    object: organization:acme
+  - user: identity_account:mallory
+    relation: member
+    object: organization:acme
+
+  # Org admin — proving T08 inheritance reaches shares.
+  - user: identity_account:ana
+    relation: admin
+    object: organization:acme
+
+  # The share, created by alice (the config-driven create tuples).
+  - user: organization:acme
+    relation: organization
+    object: agent_share:support-bot-share
+  - user: identity_account:alice
+    relation: owner
+    object: agent_share:support-bot-share
+
+  # An explicit viewer grant to carol (not even an org member).
+  - user: identity_account:carol
+    relation: viewer
+    object: agent_share:support-bot-share
+
+tests:
+  - name: owner has full control including grant management
+    check:
+      - user: identity_account:alice
+        object: agent_share:support-bot-share
+        assertions:
+          can_view: true
+          can_edit: true
+          can_delete: true
+          can_grant_access: true
+          can_view_access: true
+
+  - name: explicitly granted viewer can read but not mutate
+    check:
+      - user: identity_account:carol
+        object: agent_share:support-bot-share
+        assertions:
+          can_view: true
+          can_edit: false
+          can_delete: false
+          can_grant_access: false
+          can_view_access: true
+
+  - name: fellow org member has no implicit access
+    check:
+      - user: identity_account:mallory
+        object: agent_share:support-bot-share
+        assertions:
+          can_view: false
+          can_edit: false
+          can_delete: false
+          can_grant_access: false
+          can_view_access: false
+
+  - name: org admin inherits share management (T08)
+    check:
+      - user: identity_account:ana
+        object: agent_share:support-bot-share
+        assertions:
+          can_view: true
+          can_edit: true
+          can_delete: true
+          can_grant_access: true
+
+  - name: listing shares reflects ownership and grants, not membership
+    list_objects:
+      - user: identity_account:alice
+        type: agent_share
+        assertions:
+          can_view:
+            - agent_share:support-bot-share
+          can_edit:
+            - agent_share:support-bot-share
+      - user: identity_account:carol
+        type: agent_share
+        assertions:
+          can_view:
+            - agent_share:support-bot-share
+          can_edit: []
+      - user: identity_account:mallory
+        type: agent_share
+        assertions:
+          can_view: []

package/src/authorization/__tests__/fixtures/fga/artifact-org-and-owner.fga.yaml

@@ -0,0 +1,128 @@
+# Pinned copy of stigmer-cloud backend/services/stigmer-server/fga/tests/artifact-org-and-owner.fga.yaml
+# at commit b87dd1170 (the OpenFGA store test the cloud runs against its live model).
+# The body below is byte-identical to the source; the cloud re-runs the LIVE
+# file against this evaluator at the re-pin, so a stale copy is caught there.
+# Artifacts are org-scoped execution outputs with creator ownership on
+# top (cloud#216). The two access arms these tests pin:
+#
+# 1. Org inheritance — anyone who is at least a viewer of the owning org
+#    can view its artifacts ("if you can view resources in the org, you
+#    can view its artifacts"). Editing stays org-admin-only.
+# 2. Creator ownership — the identity whose execution produced the
+#    artifact can view it WITHOUT any org role. This is the guest-share /
+#    embedded-user case: org guests are not org viewers, but their
+#    sessions render artifact-backed review payloads and artifact tabs.
+#
+# The narrowness pinned: creator-owners read but never edit (all guests
+# of an org share one guest identity account — owner-edit would let one
+# guest soft-delete another's artifacts), and no arm crosses org
+# boundaries.
+#
+# Run: fga model test --tests artifact-org-and-owner.fga.yaml
+
+name: artifact-org-and-owner
+model_file: ../model/fga.mod
+
+tuples:
+  # Org roles: victor views, ana administers acme. Rival org for the
+  # cross-org boundary.
+  - user: identity_account:victor
+    relation: viewer
+    object: organization:acme
+  - user: identity_account:ana
+    relation: admin
+    object: organization:acme
+  - user: identity_account:eve
+    relation: member
+    object: organization:rival
+
+  # Guest identity: an org GUEST, deliberately not an org viewer.
+  - user: identity_account:acme-guest
+    relation: guest
+    object: organization:acme
+
+  # Artifact produced by a signed-in member's execution.
+  - user: organization:acme
+    relation: organization
+    object: artifact:art_report
+  - user: identity_account:victor
+    relation: owner
+    object: artifact:art_report
+
+  # Artifact produced by a guest-share execution: creator is the guest
+  # identity account (runner tokens carry the acting identity as sub).
+  - user: organization:acme
+    relation: organization
+    object: artifact:art_guest_plan
+  - user: identity_account:acme-guest
+    relation: owner
+    object: artifact:art_guest_plan
+
+tests:
+  - name: org viewer reads any org artifact but cannot edit
+    check:
+      - user: identity_account:victor
+        object: artifact:art_report
+        assertions:
+          can_view: true
+          can_edit: false
+      - user: identity_account:victor
+        object: artifact:art_guest_plan
+        assertions:
+          can_view: true
+          can_edit: false
+
+  - name: org admin views and edits org artifacts
+    check:
+      - user: identity_account:ana
+        object: artifact:art_report
+        assertions:
+          can_view: true
+          can_edit: true
+
+  - name: guest creator reads own execution's artifact via ownership, never edits
+    check:
+      - user: identity_account:acme-guest
+        object: artifact:art_guest_plan
+        assertions:
+          can_view: true
+          can_edit: false
+
+  - name: guest role alone grants nothing on other artifacts in the org
+    check:
+      - user: identity_account:acme-guest
+        object: artifact:art_report
+        assertions:
+          can_view: false
+          can_edit: false
+
+  - name: cross-org caller is denied everything
+    check:
+      - user: identity_account:eve
+        object: artifact:art_report
+        assertions:
+          can_view: false
+          can_edit: false
+      - user: identity_account:eve
+        object: artifact:art_guest_plan
+        assertions:
+          can_view: false
+          can_edit: false
+
+  - name: listing reflects org inheritance plus creator ownership
+    list_objects:
+      - user: identity_account:victor
+        type: artifact
+        assertions:
+          can_view:
+            - artifact:art_report
+            - artifact:art_guest_plan
+      - user: identity_account:acme-guest
+        type: artifact
+        assertions:
+          can_view:
+            - artifact:art_guest_plan
+      - user: identity_account:eve
+        type: artifact
+        assertions:
+          can_view: []

package/src/authorization/__tests__/fixtures/fga/blueprint-private-visibility.fga.yaml

@@ -0,0 +1,410 @@
+# Pinned copy of stigmer-cloud backend/services/stigmer-server/fga/tests/blueprint-private-visibility.fga.yaml
+# at commit 2ec420161 (the OpenFGA store test the cloud runs against its live model).
+# The body below is byte-identical to the source; the cloud re-runs the LIVE
+# file against this evaluator at the re-pin, so a stale copy is caught there.
+# Store tests for real blueprint privacy (Phase 3 of the visibility model).
+#
+# Blueprint viewer relations no longer include the unconditional
+# `viewer from organization` grant: a PRIVATE blueprint is invisible to the
+# rest of its own org. Every broader level is an explicit tuple written by
+# VisibilityTupleReconciler:
+#
+#   ORG       viewer@organization:<org>#viewer   (the org's FULL read audience —
+#             every role satisfies organization#viewer, including read-only
+#             viewers; pre-cloud#257 tuples carried #member, which excluded
+#             viewer-role users — still honored until backfilled, see the
+#             legacy-bot fixture)
+#   PUBLIC    viewer@identity_account:* (allow_public)  +  the ORG tuple
+#   PLATFORM  platform_viewer@identity_provider:<idp>#platform_user  +  the ORG tuple
+#
+# Read vs spend: an org viewer-role user READS org-visible blueprints (and, at
+# the model level, satisfies can_execute — run-what-you-can-read), but every
+# spend path is gated in Java on the org-level can_create_session /
+# can_create_execution_in permissions, which require member-or-guest. The
+# vera assertions pin both halves of that contract.
+#
+# The ORG tuple rides along on PUBLIC/PLATFORM (the "org floor") so a shared
+# blueprint stays listable in its own org — org-scoped ListObjects runs with
+# {"allow": false}, which suppresses the public wildcard.
+#
+# T08 exception: org ADMINS (and org owners, via the role hierarchy) are
+# composed into blueprint `owner` and therefore see, list, and manage
+# PRIVATE blueprints — the GitHub-org-admin model. "Private is real" now
+# means: invisible to plain members, never to org admins. Pinned by the
+# oscar (org admin) assertions below.
+#
+# Run with:
+#   fga model test --tests blueprint-private-visibility.fga.yaml
+#
+# Scenario: org "acme" has owner-creator carol, org admin oscar, plain
+# member dave, and read-only viewer vera (the role SSO auto-provisioning
+# grants by default); mallory belongs to an unrelated org. Carol authors one
+# blueprint of each kind at PRIVATE, plus an ORG agent, a PUBLIC agent, and
+# a legacy ORG agent whose tuple still carries the pre-cloud#257 shape.
+name: blueprint-private-visibility
+model_file: ../model/fga.mod
+
+tuples:
+  # --- Org memberships ---
+  - user: identity_account:carol
+    relation: owner
+    object: organization:acme
+  - user: identity_account:oscar
+    relation: admin
+    object: organization:acme
+  - user: identity_account:dave
+    relation: member
+    object: organization:acme
+  - user: identity_account:vera
+    relation: viewer
+    object: organization:acme
+  - user: identity_account:mallory
+    relation: member
+    object: organization:outsider
+
+  # --- PRIVATE blueprints (no visibility tuples at all) ---
+  - user: organization:acme
+    relation: organization
+    object: agent:secret-bot
+  - user: identity_account:carol
+    relation: owner
+    object: agent:secret-bot
+  - user: organization:acme
+    relation: organization
+    object: skill:secret-notes
+  - user: identity_account:carol
+    relation: owner
+    object: skill:secret-notes
+  - user: organization:acme
+    relation: organization
+    object: workflow:secret-flow
+  - user: identity_account:carol
+    relation: owner
+    object: workflow:secret-flow
+  - user: organization:acme
+    relation: organization
+    object: mcp_server:secret-tools
+  - user: identity_account:carol
+    relation: owner
+    object: mcp_server:secret-tools
+
+  # --- ORG-visible agent (explicit org viewer tuple, cloud#257 shape) ---
+  - user: organization:acme
+    relation: organization
+    object: agent:team-bot
+  - user: identity_account:carol
+    relation: owner
+    object: agent:team-bot
+  - user: organization:acme#viewer
+    relation: viewer
+    object: agent:team-bot
+
+  # --- ORG-visible agent with the LEGACY pre-cloud#257 tuple shape ---
+  # Pins two transition facts until the boot backfill converges prod tuples:
+  # members must keep their access through the old shape, and viewer-role
+  # users are still refused by it (the cloud#257 defect, alive on legacy
+  # tuples only).
+  - user: organization:acme
+    relation: organization
+    object: agent:legacy-bot
+  - user: identity_account:carol
+    relation: owner
+    object: agent:legacy-bot
+  - user: organization:acme#member
+    relation: viewer
+    object: agent:legacy-bot
+
+  # --- PUBLIC agent (wildcard + org floor tuple) ---
+  - user: organization:acme
+    relation: organization
+    object: agent:open-bot
+  - user: identity_account:carol
+    relation: owner
+    object: agent:open-bot
+  - user: identity_account:*
+    relation: viewer
+    object: agent:open-bot
+    condition:
+      name: allow_public
+  - user: organization:acme#viewer
+    relation: viewer
+    object: agent:open-bot
+
+  # --- PRIVATE agent with an explicit individual viewer grant ---
+  - user: organization:acme
+    relation: organization
+    object: agent:shared-secret
+  - user: identity_account:carol
+    relation: owner
+    object: agent:shared-secret
+  - user: identity_account:dave
+    relation: viewer
+    object: agent:shared-secret
+
+tests:
+  - name: private blueprints are invisible to fellow org members (all four kinds)
+    check:
+      - user: identity_account:dave
+        object: agent:secret-bot
+        context:
+          allow: false
+        assertions:
+          can_view: false
+          can_execute: false
+          can_create_instance: false
+          can_clone: false
+      - user: identity_account:dave
+        object: skill:secret-notes
+        context:
+          allow: false
+        assertions:
+          can_view: false
+          can_use: false
+      - user: identity_account:dave
+        object: workflow:secret-flow
+        context:
+          allow: false
+        assertions:
+          can_view: false
+          can_execute: false
+      - user: identity_account:dave
+        object: mcp_server:secret-tools
+        context:
+          allow: false
+        assertions:
+          can_view: false
+          can_use: false
+          can_connect: false
+
+  - name: org admin sees and manages private blueprints of every kind (T08)
+    check:
+      - user: identity_account:oscar
+        object: agent:secret-bot
+        context:
+          allow: false
+        assertions:
+          can_view: true
+          can_edit: true
+          can_delete: true
+          can_execute: true
+      - user: identity_account:oscar
+        object: skill:secret-notes
+        context:
+          allow: false
+        assertions:
+          can_view: true
+          can_edit: true
+      - user: identity_account:oscar
+        object: workflow:secret-flow
+        context:
+          allow: false
+        assertions:
+          can_view: true
+          can_edit: true
+      # mcp_server had admin inheritance before T08 — asserted here so all
+      # four private-blueprint kinds are pinned to the same rule.
+      - user: identity_account:oscar
+        object: mcp_server:secret-tools
+        context:
+          allow: false
+        assertions:
+          can_view: true
+          can_edit: true
+
+  - name: org admin's listable agents include private ones (T08)
+    list_objects:
+      - user: identity_account:oscar
+        type: agent
+        context:
+          allow: false
+        assertions:
+          can_view:
+            - agent:secret-bot
+            - agent:team-bot
+            - agent:legacy-bot
+            - agent:open-bot
+            - agent:shared-secret
+
+  - name: owner retains full access to private blueprints
+    check:
+      - user: identity_account:carol
+        object: agent:secret-bot
+        context:
+          allow: false
+        assertions:
+          can_view: true
+          can_execute: true
+          can_create_instance: true
+          can_edit: true
+          can_delete: true
+      - user: identity_account:carol
+        object: workflow:secret-flow
+        context:
+          allow: false
+        assertions:
+          can_view: true
+          can_execute: true
+          can_edit: true
+
+  - name: org-visible agent is viewable and runnable by org members, not outsiders
+    check:
+      - user: identity_account:dave
+        object: agent:team-bot
+        context:
+          allow: false
+        assertions:
+          can_view: true
+          can_execute: true
+          can_create_instance: true
+          can_edit: false
+          can_delete: false
+      - user: identity_account:mallory
+        object: agent:team-bot
+        context:
+          allow: false
+        assertions:
+          can_view: false
+          can_execute: false
+
+  - name: public agent is reachable by everyone with allow context, and by org members without it
+    check:
+      # Outsider resolves through the conditional wildcard ({"allow": true}).
+      - user: identity_account:mallory
+        object: agent:open-bot
+        context:
+          allow: true
+        assertions:
+          can_view: true
+          can_execute: true
+      # Org member resolves through the org floor tuple even with the
+      # wildcard suppressed — this is what keeps public blueprints in
+      # org-scoped listings.
+      - user: identity_account:dave
+        object: agent:open-bot
+        context:
+          allow: false
+        assertions:
+          can_view: true
+          can_execute: true
+
+  - name: explicit individual viewer grant on a private agent conveys view and run
+    check:
+      # Run-what-you-can-read: can_execute derives from viewer, so an
+      # explicit viewer grant is enough to run (matches the execution gate,
+      # which checks can_view).
+      - user: identity_account:dave
+        object: agent:shared-secret
+        context:
+          allow: false
+        assertions:
+          can_view: true
+          can_execute: true
+          can_edit: false
+
+  - name: org member's listable agents exclude private ones (wildcard suppressed)
+    list_objects:
+      - user: identity_account:dave
+        type: agent
+        context:
+          allow: false
+        assertions:
+          can_view:
+            - agent:team-bot
+            - agent:legacy-bot
+            - agent:open-bot
+            - agent:shared-secret
+
+  - name: owner's listable agents include everything they authored
+    list_objects:
+      - user: identity_account:carol
+        type: agent
+        context:
+          allow: false
+        assertions:
+          can_view:
+            - agent:secret-bot
+            - agent:team-bot
+            - agent:legacy-bot
+            - agent:open-bot
+            - agent:shared-secret
+
+  # ── cloud#257: the viewer-role cell (previously untested) ──────────────
+
+  - name: org viewer reads org-visible blueprints — the cloud#257 contract
+    check:
+      # View, clone and (model-level) execute all derive from viewer; the
+      # spend refusal is pinned separately on the org permissions below.
+      - user: identity_account:vera
+        object: agent:team-bot
+        context:
+          allow: false
+        assertions:
+          can_view: true
+          can_clone: true
+          can_execute: true
+          can_edit: false
+          can_delete: false
+      # The org floor of a PUBLIC blueprint reaches viewers the same way.
+      - user: identity_account:vera
+        object: agent:open-bot
+        context:
+          allow: false
+        assertions:
+          can_view: true
+      # Private stays private — the viewer role grants nothing beyond the
+      # explicit visibility tuples.
+      - user: identity_account:vera
+        object: agent:secret-bot
+        context:
+          allow: false
+        assertions:
+          can_view: false
+          can_execute: false
+
+  - name: org viewer holds no spend authority on the org (the cost gate)
+    check:
+      # Java execution lanes (session create, agent-execution create,
+      # workflow-execution create, EC create) all check these org-level
+      # permissions — this is why widening read to viewers exposes no cost.
+      - user: identity_account:vera
+        object: organization:acme
+        assertions:
+          can_view: true
+          can_create_session: false
+          can_create_execution_in: false
+      - user: identity_account:dave
+        object: organization:acme
+        assertions:
+          can_create_session: true
+          can_create_execution_in: true
+
+  - name: legacy member-shaped tuple keeps members but still excludes viewers (until backfilled)
+    check:
+      - user: identity_account:dave
+        object: agent:legacy-bot
+        context:
+          allow: false
+        assertions:
+          can_view: true
+          can_execute: true
+      # The original cloud#257 defect, pinned on the legacy shape: the org
+      # role hierarchy flows downward, so a viewer-role user never satisfies
+      # organization#member. The boot backfill converges these tuples.
+      - user: identity_account:vera
+        object: agent:legacy-bot
+        context:
+          allow: false
+        assertions:
+          can_view: false
+          can_execute: false
+
+  - name: org viewer's listable agents are exactly the viewer-shaped org-visible ones
+    list_objects:
+      - user: identity_account:vera
+        type: agent
+        context:
+          allow: false
+        assertions:
+          can_view:
+            - agent:team-bot
+            - agent:open-bot