@stigmer/server 3.15.3-dev.20260914100347 → 3.15.3-dev.20260916211208

package/src/authorization/__tests__/organization-directory.test.ts

@@ -0,0 +1,236 @@
+/**
+ * Pins the built-in organization directory on both store drivers as the
+ * twin of the cloud's `listObjectIds(identity_account, can_view,
+ * organization)`: the organizations a person holds a row in and can
+ * view — one of two, both, none; a grant on something other than an
+ * organization is not one; a role whose organization row is gone is
+ * still answered (the controller skips it — the division of labour
+ * pinned); an unprovisioned subject is `[]` and never a fault (the
+ * conformance sibling's readiness probe is this RPC with a fresh
+ * subject); the `internal` class is ALL_ORGANIZATIONS — the in-process
+ * authorization skip, applied to a directory answer; enumeration is
+ * refused, the cloud's posture; the person's rows are read once for
+ * candidates and evaluation together.
+ */
+import { create } from "@bufbuild/protobuf";
+import { afterAll, afterEach, beforeEach, describe, expect, it } from "vitest";
+
+import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
+import { ApiResourceVisibility } from "@stigmer/protos/ai/stigmer/commons/apiresource/enum_pb";
+import { IamPolicySchema } from "@stigmer/protos/ai/stigmer/iam/iampolicy/v1/api_pb";
+import { IdentityAccountSchema } from "@stigmer/protos/ai/stigmer/iam/identityaccount/v1/api_pb";
+import { IdentityAccountProvisioningMode } from "@stigmer/protos/ai/stigmer/iam/identityaccount/v1/enum_pb";
+
+import {
+  IAM_POLICY_API_VERSION,
+  IAM_POLICY_KIND,
+  policyIdFor,
+} from "../../domain/iampolicy/constants.js";
+import { newResourceIamPolicyStore } from "../../domain/iampolicy/resource-store.js";
+import type { IamPolicyStore } from "../../domain/iampolicy/store.js";
+import { orgRole, triple } from "../../domain/iampolicy/__tests__/support.js";
+import { accountIdFor } from "../../domain/identityaccount/constants.js";
+import { newResourceIdentityAccountStore } from "../../domain/identityaccount/resource-store.js";
+import type { IdentityAccountStore } from "../../domain/identityaccount/store.js";
+import type { CallerIdentity } from "../../extensions/identity.js";
+import { ALL_ORGANIZATIONS } from "../../extensions/organization-directory.js";
+import { builtInModel } from "../model/index.js";
+import { newBuiltInOrganizationDirectory } from "../organization-directory.js";
+import { driverFixtures, dropPostgresFixture } from "./drivers.js";
+import type { OpenedStore } from "./drivers.js";
+import { fixtureRow } from "./support.js";
+
+const FOUNDER = accountIdFor("auth0|founder");
+const MEMBER = accountIdFor("auth0|member");
+
+function resolved(accountId: string): CallerIdentity {
+  return {
+    identityId: accountId,
+    callerClass: "user",
+    issuer: "https://issuer.example",
+    rawToken: "opaque",
+  };
+}
+
+function idpShaped(subject: string): CallerIdentity {
+  const payload = Buffer.from(JSON.stringify({ sub: subject })).toString(
+    "base64url",
+  );
+  return {
+    identityId: subject,
+    callerClass: "user",
+    issuer: "https://issuer.example",
+    rawToken: `h.${payload}.unsigned`,
+  };
+}
+
+afterAll(dropPostgresFixture);
+
+describe.each(
+  driverFixtures([
+    ApiResourceKind.iam_policy,
+    ApiResourceKind.identity_account,
+    ApiResourceKind.organization,
+    ApiResourceKind.agent,
+  ]),
+)("the built-in organization directory on $name", (fixture) => {
+  describe.skipIf(fixture.skip)("listMyOrganizationIds", () => {
+    let opened: OpenedStore;
+    let policies: IamPolicyStore;
+    let accounts: IdentityAccountStore;
+    let principalReads: number;
+
+    async function organization(id: string) {
+      const declaration = builtInModel.byType("organization")!;
+      await opened.store.saveResource(
+        ApiResourceKind.organization,
+        id,
+        declaration.schema,
+        fixtureRow(declaration, {
+          id,
+          org: "",
+          visibility: ApiResourceVisibility.visibility_private,
+          createdBy: FOUNDER,
+        }),
+      );
+    }
+
+    async function grant(spec: ReturnType<typeof orgRole>) {
+      await policies.save(
+        create(IamPolicySchema, {
+          apiVersion: IAM_POLICY_API_VERSION,
+          kind: IAM_POLICY_KIND,
+          metadata: { id: policyIdFor(spec) },
+          spec,
+        }),
+      );
+    }
+
+    function directory() {
+      return newBuiltInOrganizationDirectory({
+        store: opened.store,
+        policies: {
+          ...policies,
+          findByPrincipal(principalKind, principalId) {
+            principalReads += 1;
+            return policies.findByPrincipal(principalKind, principalId);
+          },
+        },
+        accounts,
+      });
+    }
+
+    beforeEach(async () => {
+      opened = await fixture.open();
+      principalReads = 0;
+      policies = newResourceIamPolicyStore(opened.store);
+      accounts = newResourceIdentityAccountStore(opened.store);
+      for (const [id, subject] of [
+        [FOUNDER, "auth0|founder"],
+        [MEMBER, "auth0|member"],
+      ] as const) {
+        await accounts.save(
+          create(IdentityAccountSchema, {
+            metadata: { id, name: subject },
+            spec: {
+              idpId: subject,
+              provisioningMode: IdentityAccountProvisioningMode.direct,
+            },
+          }),
+        );
+      }
+      await organization("alpha");
+      await organization("beta");
+      await grant(orgRole(FOUNDER, "owner", "alpha"));
+      await grant(orgRole(FOUNDER, "owner", "beta"));
+      await grant(orgRole(MEMBER, "member", "alpha"));
+    });
+
+    afterEach(async () => {
+      await opened.close();
+    });
+
+    it("refuses enumeration — the cloud's posture; `find` would otherwise hand every member every organization", () => {
+      expect(directory().refusesEnumeration).toBe(true);
+    });
+
+    it("the internal class — the server acting as itself — is ALL_ORGANIZATIONS, the in-process authorization skip; no account is even asked for", async () => {
+      let accountReads = 0;
+      const dir = newBuiltInOrganizationDirectory({
+        store: opened.store,
+        policies,
+        accounts: {
+          findById: (id) => {
+            accountReads += 1;
+            return accounts.findById(id);
+          },
+          findDirectByIdpId: (idpId) => {
+            accountReads += 1;
+            return accounts.findDirectByIdpId(idpId);
+          },
+        },
+      });
+      expect(
+        await dir.listMyOrganizationIds({
+          identityId: "system",
+          callerClass: "internal",
+          issuer: "",
+          rawToken: "",
+          origin: "in-process",
+        }),
+      ).toBe(ALL_ORGANIZATIONS);
+      expect(accountReads).toBe(0);
+    });
+
+    it("a member of one of two organizations sees that one; the owner of both sees both; never ALL_ORGANIZATIONS for a person", async () => {
+      const dir = directory();
+      expect(await dir.listMyOrganizationIds(resolved(MEMBER))).toEqual([
+        "alpha",
+      ]);
+      const founders = await dir.listMyOrganizationIds(resolved(FOUNDER));
+      expect(founders).not.toBe(ALL_ORGANIZATIONS);
+      expect([...(founders as ReadonlyArray<string>)].sort()).toEqual([
+        "alpha",
+        "beta",
+      ]);
+    });
+
+    it("an unprovisioned subject holds nothing and is answered [], never a fault (the sibling's readiness probe)", async () => {
+      expect(
+        await directory().listMyOrganizationIds(idpShaped("auth0|fresh")),
+      ).toEqual([]);
+    });
+
+    it("a grant on an agent is not an organization, and a role whose organization row is gone is still answered — the controller skips it", async () => {
+      await grant(
+        triple({ kind: "identity_account", id: MEMBER }, "viewer", {
+          kind: "agent",
+          id: "agt_1",
+        }),
+      );
+      await grant(orgRole(MEMBER, "viewer", "gamma")); // no `gamma` row
+      const mine = await directory().listMyOrganizationIds(resolved(MEMBER));
+      expect([...(mine as ReadonlyArray<string>)].sort()).toEqual([
+        "alpha",
+        "gamma",
+      ]);
+    });
+
+    it("reads the person's rows ONCE — the candidates and the evaluation share the source's read", async () => {
+      await directory().listMyOrganizationIds(resolved(FOUNDER));
+      expect(principalReads).toBe(1);
+    });
+
+    it("a store fault propagates as the fault it is — the controller maps it, never this driver", async () => {
+      const fault = new Error("connection reset");
+      const dir = newBuiltInOrganizationDirectory({
+        store: opened.store,
+        policies: { ...policies, findByPrincipal: () => Promise.reject(fault) },
+        accounts,
+      });
+      await expect(dir.listMyOrganizationIds(resolved(FOUNDER))).rejects.toBe(
+        fault,
+      );
+    });
+  });
+});

package/src/authorization/__tests__/person.test.ts

@@ -0,0 +1,114 @@
+/**
+ * Pins the one construction of the person the built-in drivers evaluate
+ * for: `personFor` builds the aliases — the account id and the account's
+ * issuer subject for a provisioned caller, the bare identity for an
+ * unprovisioned one — and refuses an identity that names no person
+ * through the same predicate that keeps such stamps out of tuples;
+ * `resolvePerson` reads the account through the port the way whoAmI does
+ * (by id, then by the token's subject) so a caller a verifier re-stamped
+ * and a caller a composition verifier left idp-shaped both land on the
+ * same person, and a store fault propagates as the fault it is.
+ */
+import { create } from "@bufbuild/protobuf";
+import { describe, expect, it } from "vitest";
+
+import { IdentityAccountSchema } from "@stigmer/protos/ai/stigmer/iam/identityaccount/v1/api_pb";
+import { IdentityAccountProvisioningMode } from "@stigmer/protos/ai/stigmer/iam/identityaccount/v1/enum_pb";
+
+import { fakeIdentityAccountStore } from "../../domain/identityaccount/__tests__/support.js";
+import { accountIdFor } from "../../domain/identityaccount/constants.js";
+import type { CallerIdentity } from "../../extensions/identity.js";
+import { personFor, resolvePerson } from "../person.js";
+
+function caller(identityId: string): CallerIdentity {
+  return {
+    identityId,
+    callerClass: "user",
+    issuer: "https://issuer.example",
+    rawToken: "opaque",
+  };
+}
+
+/** A caller whose raw token carries `sub` — what a composition verifier that stamps the raw subject produces. */
+function jwtCaller(sub: string, identityId: string = sub): CallerIdentity {
+  const payload = Buffer.from(JSON.stringify({ sub })).toString("base64url");
+  return {
+    identityId,
+    callerClass: "user",
+    issuer: "https://issuer.example",
+    rawToken: `h.${payload}.unsigned`,
+  };
+}
+
+function seeded(sub: string) {
+  const accounts = fakeIdentityAccountStore();
+  const id = accountIdFor(sub);
+  accounts.rows.set(
+    id,
+    create(IdentityAccountSchema, {
+      metadata: { id, name: sub },
+      spec: {
+        idpId: sub,
+        provisioningMode: IdentityAccountProvisioningMode.direct,
+      },
+    }),
+  );
+  return { accounts, id };
+}
+
+describe("personFor", () => {
+  it("a provisioned caller is their account id and the account's issuer subject", () => {
+    const account = create(IdentityAccountSchema, {
+      metadata: { id: "ida_carol" },
+      spec: { idpId: "auth0|carol" },
+    });
+    const person = personFor(caller("ida_carol"), account);
+    expect(person.accountId).toBe("ida_carol");
+    expect([...person.aliases].sort()).toEqual(["auth0|carol", "ida_carol"]);
+  });
+
+  it("an unprovisioned caller is their identity id alone", () => {
+    const person = personFor(caller("auth0|newcomer"), undefined);
+    expect(person.accountId).toBe("auth0|newcomer");
+    expect([...person.aliases]).toEqual(["auth0|newcomer"]);
+  });
+
+  it("refuses an identity that names no person — the empty id and the laptop's placeholder", () => {
+    expect(() => personFor(caller(""), undefined)).toThrow("names no person");
+    expect(() => personFor(caller("system"), undefined)).toThrow(
+      "names no person",
+    );
+  });
+});
+
+describe("resolvePerson", () => {
+  it("a caller stamped with the account id resolves by id — one read, the subject never consulted", async () => {
+    const { accounts, id } = seeded("auth0|carol");
+    const person = await resolvePerson(accounts, caller(id));
+    expect(person.accountId).toBe(id);
+    expect([...person.aliases].sort()).toEqual(["auth0|carol", id].sort());
+  });
+
+  it("a caller a verifier left idp-shaped resolves through the token's subject to the same person", async () => {
+    const { accounts, id } = seeded("auth0|carol");
+    const person = await resolvePerson(accounts, jwtCaller("auth0|carol"));
+    expect(person.accountId).toBe(id);
+    expect(person.aliases.has("auth0|carol")).toBe(true);
+  });
+
+  it("an unprovisioned subject is themselves alone and holds nothing", async () => {
+    const person = await resolvePerson(
+      fakeIdentityAccountStore(),
+      jwtCaller("auth0|stranger"),
+    );
+    expect(person.accountId).toBe("auth0|stranger");
+    expect([...person.aliases]).toEqual(["auth0|stranger"]);
+  });
+
+  it("a store fault propagates as the fault it is — the driver above folds it, never this function", async () => {
+    const accounts = fakeIdentityAccountStore();
+    const fault = new Error("connection reset");
+    accounts.findById = () => Promise.reject(fault);
+    await expect(resolvePerson(accounts, caller("ida_x"))).rejects.toBe(fault);
+  });
+});

package/src/authorization/__tests__/posture.test.ts

@@ -0,0 +1,25 @@
+/**
+ * Pins the three authorization postures over the four input
+ * combinations: a unit's Authorizer wins whatever the authentication
+ * posture; without one, the require-authentication posture selects the
+ * built-in drivers and its absence keeps the trusted-local default.
+ */
+import { describe, expect, it } from "vitest";
+
+import { authorizationPostureOf } from "../posture.js";
+
+describe("authorizationPostureOf", () => {
+  it.each([
+    [false, false, "trusted-local"],
+    [false, true, "built-in"],
+    [true, false, "unit-authorizer"],
+    [true, true, "unit-authorizer"],
+  ] as const)(
+    "unitAuthorizer=%s requireAuthentication=%s → %s",
+    (unitAuthorizer, requireAuthentication, want) => {
+      expect(
+        authorizationPostureOf({ unitAuthorizer, requireAuthentication }),
+      ).toBe(want);
+    },
+  );
+});

package/src/authorization/__tests__/schedule-fire-caller.test.ts

@@ -0,0 +1,134 @@
+/**
+ * Pins the built-in schedule fire caller on both store drivers: a fire
+ * acts as the schedule's creator — resolved from the row's stamp as an
+ * account id (3.15+) or as the raw issuer subject (the 3.14.x stamp) —
+ * in the exact identity shape `accountAsCaller` builds; a schedule whose
+ * stamp names no person this server knows (`""`, `"system"`, a
+ * trusted-local email, a deleted account) is the seam's DETERMINISTIC
+ * refusal with the copy the schedule's status will carry; a missing
+ * schedule row and a store fault stay infrastructure throws.
+ */
+import { create } from "@bufbuild/protobuf";
+import { afterAll, afterEach, beforeEach, describe, expect, it } from "vitest";
+
+import { ScheduleSchema } from "@stigmer/protos/ai/stigmer/agentic/schedule/v1/api_pb";
+import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
+import { IdentityAccountSchema } from "@stigmer/protos/ai/stigmer/iam/identityaccount/v1/api_pb";
+import { IdentityAccountProvisioningMode } from "@stigmer/protos/ai/stigmer/iam/identityaccount/v1/enum_pb";
+
+import { accountIdFor } from "../../domain/identityaccount/constants.js";
+import { newResourceIdentityAccountStore } from "../../domain/identityaccount/resource-store.js";
+import type { IdentityAccountStore } from "../../domain/identityaccount/store.js";
+import { ScheduleFireCallerRefusedError } from "../../extensions/schedule-fire-caller.js";
+import { ResourceNotFoundError } from "../../store/interface.js";
+import {
+  newBuiltInScheduleFireCaller,
+  scheduleHasNoPersonMessage,
+} from "../schedule-fire-caller.js";
+import { driverFixtures, dropPostgresFixture } from "./drivers.js";
+import type { OpenedStore } from "./drivers.js";
+
+const SUBJECT = "auth0|carol";
+const CAROL = accountIdFor(SUBJECT);
+
+afterAll(dropPostgresFixture);
+
+describe.each(
+  driverFixtures([ApiResourceKind.schedule, ApiResourceKind.identity_account]),
+)("the built-in schedule fire caller on $name", (fixture) => {
+  describe.skipIf(fixture.skip)("mintFireCaller", () => {
+    let opened: OpenedStore;
+    let accounts: IdentityAccountStore;
+
+    beforeEach(async () => {
+      opened = await fixture.open();
+      accounts = newResourceIdentityAccountStore(opened.store);
+      await accounts.save(
+        create(IdentityAccountSchema, {
+          metadata: { id: CAROL, name: "Carol Danvers" },
+          spec: {
+            idpId: SUBJECT,
+            email: "carol@example.com",
+            provisioningMode: IdentityAccountProvisioningMode.direct,
+          },
+        }),
+      );
+    });
+
+    afterEach(async () => {
+      await opened.close();
+    });
+
+    async function schedule(id: string, createdBy: string): Promise<void> {
+      await opened.store.saveResource(
+        ApiResourceKind.schedule,
+        id,
+        ScheduleSchema,
+        create(ScheduleSchema, {
+          metadata: { id, name: id, org: "acme" },
+          status: { audit: { specAudit: { createdBy: { id: createdBy } } } },
+        }),
+      );
+    }
+
+    function mint() {
+      return newBuiltInScheduleFireCaller({ store: opened.store, accounts });
+    }
+
+    it("a schedule stamped with the creator's account id fires as that account, in the in-process identity shape", async () => {
+      await schedule("sch_by_id", CAROL);
+      expect(await mint().mintFireCaller("acme", "sch_by_id")).toEqual({
+        identityId: CAROL,
+        callerClass: "user",
+        issuer: "",
+        rawToken: "",
+        email: "carol@example.com",
+        displayName: "Carol Danvers",
+      });
+    });
+
+    it("a schedule stamped with the raw issuer subject (the 3.14.x shape) resolves to the same account", async () => {
+      await schedule("sch_by_sub", SUBJECT);
+      expect(
+        (await mint().mintFireCaller("acme", "sch_by_sub")).identityId,
+      ).toBe(CAROL);
+    });
+
+    it.each([
+      ["the empty stamp", ""],
+      ["the laptop's placeholder", "system"],
+      ["a trusted-local email stamp", "operator@example.com"],
+      ["a deleted account", accountIdFor("auth0|gone")],
+    ])(
+      "%s is the seam's deterministic refusal, with the copy the schedule's status carries",
+      async (_label, stamp) => {
+        await schedule("sch_nobody", stamp);
+        const failure = await mint()
+          .mintFireCaller("acme", "sch_nobody")
+          .catch((error: unknown) => error);
+        expect(failure).toBeInstanceOf(ScheduleFireCallerRefusedError);
+        expect((failure as Error).message).toBe(
+          scheduleHasNoPersonMessage("sch_nobody"),
+        );
+      },
+    );
+
+    it("a schedule that no longer exists is an infrastructure throw, never a refusal", async () => {
+      const failure = await mint()
+        .mintFireCaller("acme", "sch_missing")
+        .catch((error: unknown) => error);
+      expect(failure).toBeInstanceOf(ResourceNotFoundError);
+    });
+
+    it("a store fault reading the schedule propagates as the fault it is", async () => {
+      const fault = new Error("connection reset");
+      const failing = newBuiltInScheduleFireCaller({
+        store: { ...opened.store, getResource: () => Promise.reject(fault) },
+        accounts,
+      });
+      await expect(failing.mintFireCaller("acme", "sch_by_id")).rejects.toBe(
+        fault,
+      );
+    });
+  });
+});