@stigmer/server 3.15.3-dev.20260914100347 → 3.15.3-dev.20260916211208

package/src/domain/iampolicy/membership.ts

@@ -7,7 +7,8 @@
  * no unit registered an Authorizer); a composition with its own
  * Authorizer has its own onboarding and never constructs this.
  *
- * Two moments:
+ * Three moments, one set of arms (`roleFor`, the pure function the first
+ * and third share):
  *
  *   onAccountCreated(account, caller) — a person's FIRST provisioning, and
  *   only that (the identity-account domain's AccountCreatedHook, run by
@@ -50,6 +51,30 @@
  *   email and name — so its audit actor reads like every other write on
  *   that laptop.
  *
+ *   ensureRolesForExistingAccounts() — the built-in posture's boot
+ *   reconciliation, ONCE per database. The first moment runs only on the
+ *   call that CREATES an account, so a self-host whose people were
+ *   provisioned before the rules existed (3.15.x with OIDC on) holds
+ *   accounts with no role rows, and under an enforcing authorizer every
+ *   one of them would be an outsider on every organization with nobody
+ *   able to grant a way back. At the first boot where the bootstrap-state
+ *   marker (ROLES_RECONCILED_KEY) is absent, the arms above run for every
+ *   PERSON account (`isPersonAccount`: not a machine account, the row-
+ *   level twin of the `user`-class gate), acting as that account, in
+ *   creation order — the order the sign-ins would have run the hook in,
+ *   so arm 4 hands an unclaimed organization to its first sign-in and
+ *   not to whoever sorts first by id — and the marker is written after
+ *   the last account. A fault propagates and the boot fails loudly (the
+ *   storage stage's posture) with the marker unset; the grant path is
+ *   idempotent and an organization already held is skipped, so the next
+ *   boot converges. The marker, not "zero rows", is what makes it
+ *   one-shot: a database whose every role was revoked after the marker is
+ *   never handed back to anyone by a reboot (plan finding 2's reason,
+ *   applied to the whole store). Accounts are read through the generic
+ *   Store as the organizations and blueprints are (Q-S4-5) — the account
+ *   port carries no enumeration, by its own rule that a port does not
+ *   carry a method only one edition calls, and this act is open source's.
+ *
  * What a creator stamp is. The rules read `status.audit.spec_audit
  * .created_by.id` off organizations and blueprints. That stamp is the
  * caller's identityId at the time: a provisioned caller's ACCOUNT id, an
@@ -92,6 +117,8 @@ import { SkillSchema } from "@stigmer/protos/ai/stigmer/agentic/skill/v1/api_pb"
 import { WorkflowSchema } from "@stigmer/protos/ai/stigmer/agentic/workflow/v1/api_pb";
 import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
 import type { IdentityAccount } from "@stigmer/protos/ai/stigmer/iam/identityaccount/v1/api_pb";
+import { IdentityAccountSchema } from "@stigmer/protos/ai/stigmer/iam/identityaccount/v1/api_pb";
+import { IdentityAccountProvisioningMode } from "@stigmer/protos/ai/stigmer/iam/identityaccount/v1/enum_pb";
 import { IamRole } from "@stigmer/protos/ai/stigmer/iam/v1/enum_pb";
 import { OrganizationSchema } from "@stigmer/protos/ai/stigmer/tenancy/organization/v1/api_pb";
 
@@ -101,8 +128,10 @@ import { SYSTEM_OPERATOR_IDENTITY_ID } from "../../pipeline/interceptors/auth.js
 import { auditOf } from "../../pipeline/steps/defaults.js";
 import { metadataOf } from "../../pipeline/steps/shapes.js";
 import type { Store } from "../../store/interface.js";
+import { rfc3339Seconds } from "../../store/rfc3339.js";
+import { accountAsCaller } from "../identityaccount/actor.js";
 import type { AccountCreatedHook } from "../identityaccount/provisioning.js";
-import { BLUEPRINT_KINDS } from "./constants.js";
+import { BLUEPRINT_KINDS, ROLES_RECONCILED_KEY } from "./constants.js";
 import type { IamPolicyGrantPath } from "./grant-path.js";
 import { organizationRole, relationOf } from "./specs.js";
 import type { IamPolicyStore } from "./store.js";
@@ -119,6 +148,8 @@ export interface MembershipRulesDeps {
 export interface MembershipRules extends AccountCreatedHook {
   /** The trusted-local boot ensure: `owner` wherever no owner row exists. */
   ensureOperatorOwnership(operator: IdentityAccount): Promise<void>;
+  /** The built-in posture's boot reconciliation: the arms for every person provisioned before the rules existed, once per database. */
+  ensureRolesForExistingAccounts(): Promise<void>;
 }
 
 /**
@@ -142,17 +173,106 @@ const ORGANIZATION = kindEnumName(ApiResourceKind.organization);
 const IDENTITY_ACCOUNT = kindEnumName(ApiResourceKind.identity_account);
 
 /** What the scan keeps of a resource: its id, its organization (blueprints), its creator stamp. */
-interface ScannedResource {
+export interface ScannedResource {
   readonly id: string;
   readonly org: string;
   readonly createdBy: string;
 }
 
-/** A creator stamp that names a person: non-empty and not the unconfigured laptop's placeholder. */
-function isPersonStamp(stamp: string): boolean {
+/**
+ * A creator stamp that names a person: non-empty and not the unconfigured
+ * laptop's placeholder. Exported for the built-in authorizer's derivation
+ * (authorization/derived-tuples.ts), which turns a stamp into an owner or
+ * creator tuple only when this says the stamp is somebody's — the one
+ * predicate, read from the module that owns the doctrine above.
+ */
+export function isPersonStamp(stamp: string): boolean {
   return stamp !== "" && stamp !== SYSTEM_OPERATOR_IDENTITY_ID;
 }
 
+/**
+ * An account row that is a person's — the row-level twin of the hook's
+ * `user`-class gate, for the reconciliation, which has a row and no
+ * caller. A machine account (`is_machine_account`, or the `machine`
+ * provisioning mode) earns no role, exactly as a `machine`-class caller
+ * earns none at the hook.
+ */
+export function isPersonAccount(account: IdentityAccount): boolean {
+  const spec = account.spec;
+  return (
+    spec !== undefined &&
+    !spec.isMachineAccount &&
+    spec.provisioningMode !== IdentityAccountProvisioningMode.machine
+  );
+}
+
+/** One organization's question for one account: everything the five arms read, resolved by the caller. */
+export interface RoleQuestion {
+  readonly accountId: string;
+  /** The account's issuer subject (`spec.idp_id`); a stamp equal to it is the account's own (the alias rule). */
+  readonly subject: string;
+  readonly email: string;
+  /** STIGMER_OPERATOR_EMAIL as configured; "" matches nobody. */
+  readonly operatorEmail: string;
+  readonly organization: ScannedResource;
+  readonly blueprintsInOrganization: ReadonlyArray<ScannedResource>;
+  /** Whether ANY role row exists on the organization — arm 4's "zero rows", read by the caller through the port. */
+  readonly organizationHasRows: boolean;
+}
+
+/**
+ * The five arms in their ruled order, as one pure function over what they
+ * read — the one statement of "which role does this person get here",
+ * shared by the first-sign-in hook and the boot reconciliation so the two
+ * moments cannot drift. Arms 3 and 4 both answer `admin`; 3 comes first
+ * because it is a string compare and 4 needs the rows read.
+ */
+export function roleFor(question: RoleQuestion): IamRole {
+  const {
+    accountId,
+    subject,
+    email,
+    operatorEmail,
+    organization,
+    blueprintsInOrganization,
+    organizationHasRows,
+  } = question;
+  const isMine = (stamp: string): boolean =>
+    stamp !== "" && (stamp === subject || stamp === accountId);
+  if (isMine(organization.createdBy)) {
+    return IamRole.owner;
+  }
+  if (blueprintsInOrganization.some((b) => isMine(b.createdBy))) {
+    return IamRole.admin;
+  }
+  if (operatorEmail !== "" && email === operatorEmail) {
+    return IamRole.admin;
+  }
+  const anotherPersonStamped = [
+    organization.createdBy,
+    ...blueprintsInOrganization.map((b) => b.createdBy),
+  ].some((stamp) => isPersonStamp(stamp) && !isMine(stamp));
+  if (!anotherPersonStamped && !organizationHasRows) {
+    return IamRole.admin;
+  }
+  return IamRole.member;
+}
+
+/** The world one pass of the arms reads: scanned ONCE by the caller, whether for one account or for all. */
+interface ScannedWorld {
+  readonly organizations: ReadonlyArray<ScannedResource>;
+  readonly blueprints: ReadonlyArray<ScannedResource>;
+}
+
+/** `spec_audit.created_at` in epoch milliseconds; a row with no stamp sorts first (it is the oldest thing we know nothing about). */
+function createdAtMillisOf(account: IdentityAccount): number {
+  const stamp = account.status?.audit?.specAudit?.createdAt;
+  if (stamp === undefined) {
+    return Number.NEGATIVE_INFINITY;
+  }
+  return Number(stamp.seconds) * 1000 + Math.floor(stamp.nanos / 1_000_000);
+}
+
 export function newMembershipRules(deps: MembershipRulesDeps): MembershipRules {
   const { grantPath, policies, store, operatorEmail } = deps;
 
@@ -195,13 +315,79 @@ export function newMembershipRules(deps: MembershipRulesDeps): MembershipRules {
     );
   }
 
+  /** The whole world one pass reads, scanned once: every organization and every blueprint. */
+  async function scanWorld(): Promise<ScannedWorld> {
+    return {
+      organizations: await scan(ApiResourceKind.organization),
+      blueprints: await scanBlueprints(),
+    };
+  }
+
+  /**
+   * The arms for ONE account over a scanned world: a row on every
+   * organization the account holds none on, granted as `caller`. Shared
+   * by the hook (one account, the world scanned for it) and the
+   * reconciliation (the world scanned once for every account).
+   */
+  async function applyRulesTo(
+    account: IdentityAccount,
+    caller: CallerIdentity,
+    world: ScannedWorld,
+  ): Promise<void> {
+    const accountId = account.metadata?.id ?? "";
+    if (accountId === "") {
+      throw new Error("membership rules: the account carries no id");
+    }
+    const subject = account.spec?.idpId ?? "";
+    const email = account.spec?.email ?? "";
+    const held = await organizationsHeldBy(accountId);
+
+    for (const organization of world.organizations) {
+      if (held.has(organization.id)) {
+        continue;
+      }
+      const blueprintsInOrganization = world.blueprints.filter(
+        (blueprint) => blueprint.org === organization.id,
+      );
+      const role = roleFor({
+        accountId,
+        subject,
+        email,
+        operatorEmail,
+        organization,
+        blueprintsInOrganization,
+        organizationHasRows:
+          (await policies.findByResource(ORGANIZATION, organization.id))
+            .length > 0,
+      });
+      await grantPath.grant(
+        organizationRole(accountId, role, organization.id),
+        caller,
+      );
+    }
+  }
+
+  /** Every person account the store holds, oldest first (creation stamp, then id) — the order their sign-ins ran in. */
+  async function scanPersonAccounts(): Promise<IdentityAccount[]> {
+    const rows = await store.listResources(ApiResourceKind.identity_account);
+    return rows
+      .map((bytes) => fromBinary(IdentityAccountSchema, bytes))
+      .filter(isPersonAccount)
+      .sort((a, b) => {
+        const byCreation = createdAtMillisOf(a) - createdAtMillisOf(b);
+        if (byCreation !== 0) {
+          return byCreation;
+        }
+        return (a.metadata?.id ?? "").localeCompare(b.metadata?.id ?? "");
+      });
+  }
+
   return {
     async onAccountCreated(account, caller): Promise<void> {
       if (caller.callerClass !== "user") {
         return;
       }
-      const accountId = account.metadata?.id ?? "";
-      if (accountId === "") {
+      if ((account.metadata?.id ?? "") === "") {
         throw new Error(
           "membership rules: the provisioned account carries no id",
         );
@@ -210,44 +396,33 @@ export function newMembershipRules(deps: MembershipRulesDeps): MembershipRules {
       if (organizations.length === 0) {
         return;
       }
-      const subject = account.spec?.idpId ?? "";
-      const email = account.spec?.email ?? "";
-      const isMine = (stamp: string): boolean =>
-        stamp !== "" && (stamp === subject || stamp === accountId);
-      const held = await organizationsHeldBy(accountId);
-      const blueprints = await scanBlueprints();
+      await applyRulesTo(account, caller, {
+        organizations,
+        blueprints: await scanBlueprints(),
+      });
+    },
 
-      for (const organization of organizations) {
-        if (held.has(organization.id)) {
-          continue;
-        }
-        const inOrganization = blueprints.filter(
-          (blueprint) => blueprint.org === organization.id,
-        );
-        let role: IamRole;
-        if (isMine(organization.createdBy)) {
-          role = IamRole.owner;
-        } else if (inOrganization.some((b) => isMine(b.createdBy))) {
-          role = IamRole.admin;
-        } else if (operatorEmail !== "" && email === operatorEmail) {
-          role = IamRole.admin;
-        } else if (
-          ![
-            organization.createdBy,
-            ...inOrganization.map((b) => b.createdBy),
-          ].some((stamp) => isPersonStamp(stamp) && !isMine(stamp)) &&
-          (await policies.findByResource(ORGANIZATION, organization.id))
-            .length === 0
-        ) {
-          role = IamRole.admin;
-        } else {
-          role = IamRole.member;
+    async ensureRolesForExistingAccounts(): Promise<void> {
+      if ((await store.bootstrapState.get(ROLES_RECONCILED_KEY)) !== "") {
+        return;
+      }
+      const accounts = await scanPersonAccounts();
+      if (accounts.length > 0) {
+        const world = await scanWorld();
+        for (const account of accounts) {
+          // As the account itself (actor.ts, the one construction), so the
+          // row's audit actor reads exactly as the person's own first
+          // sign-in would have stamped it.
+          await applyRulesTo(account, accountAsCaller(account), world);
         }
-        await grantPath.grant(
-          organizationRole(accountId, role, organization.id),
-          caller,
-        );
       }
+      // After the last account, never before: a fault above leaves the
+      // marker unset and the next boot converges (the grant path is
+      // idempotent; an organization already held is skipped).
+      await store.bootstrapState.set(
+        ROLES_RECONCILED_KEY,
+        rfc3339Seconds(new Date()),
+      );
     },
 
     async ensureOperatorOwnership(operator): Promise<void> {
@@ -255,7 +430,10 @@ export function newMembershipRules(deps: MembershipRulesDeps): MembershipRules {
       if (accountId === "") {
         throw new Error("membership rules: the operator account carries no id");
       }
-      const actor = operatorActor(operator, accountId);
+      // The operator acting as its account (domain/identityaccount/actor.ts,
+      // the one construction): the row's audit actor is the account,
+      // named the way every other trusted-local write names it.
+      const actor = accountAsCaller(operator);
       for (const organization of await scan(ApiResourceKind.organization)) {
         const owners = await policies.findByResourceWithRelations(
           ORGANIZATION,
@@ -273,26 +451,3 @@ export function newMembershipRules(deps: MembershipRulesDeps): MembershipRules {
     },
   };
 }
-
-/**
- * The operator acting as its account: the trusted-local identity shape
- * (pipeline/interceptors/auth.ts trustedLocalIdentityFor — no issuer, no
- * token; email and display name only when known) with the account id as
- * the principal, so the row's audit actor is the account, named the way
- * every other trusted-local write names it.
- */
-function operatorActor(
-  operator: IdentityAccount,
-  accountId: string,
-): CallerIdentity {
-  const email = operator.spec?.email ?? "";
-  const displayName = operator.metadata?.name ?? "";
-  return {
-    identityId: accountId,
-    callerClass: "user",
-    issuer: "",
-    rawToken: "",
-    ...(email !== "" ? { email } : {}),
-    ...(displayName !== "" ? { displayName } : {}),
-  };
-}

package/src/domain/identityaccount/actor.ts

@@ -0,0 +1,44 @@
+/**
+ * An account acting as itself — the ONE construction of the caller
+ * identity server code stamps when it acts on a person's behalf without
+ * a token in hand. The shape is the trusted-local identity's
+ * (pipeline/interceptors/auth.ts trustedLocalIdentityFor: no issuer, no
+ * token; email and display name only when known) with the account id as
+ * the principal, so the audit actor on every write it makes is the
+ * account, named the way every other write names it.
+ *
+ * Two lanes build it: the trusted-local boot ensure, which grants the
+ * operator ownership AS their account (domain/iampolicy/membership.ts),
+ * and the built-in schedule fire caller, which makes a fire act as the
+ * schedule's creator (authorization/schedule-fire-caller.ts). Both ride
+ * the in-process transport, whose interceptor stamps `origin:
+ * "in-process"` on top — the transport-trust marker is never set here.
+ *
+ * Why not a token: open source mints no credential for a person the
+ * server is composing a request for; the identity is what the
+ * propagation header carries, and every consumer that reads a subject off
+ * the raw token (`idpIdOf`) is reached only through `accountForCaller`,
+ * which resolves this identity by its id first and never asks the token.
+ */
+import type { IdentityAccount } from "@stigmer/protos/ai/stigmer/iam/identityaccount/v1/api_pb";
+
+import type { CallerIdentity } from "../../extensions/identity.js";
+
+export function accountAsCaller(account: IdentityAccount): CallerIdentity {
+  const accountId = account.metadata?.id ?? "";
+  if (accountId === "") {
+    throw new Error(
+      "identity account carries no id — refusing to build a caller for an empty principal",
+    );
+  }
+  const email = account.spec?.email ?? "";
+  const displayName = account.metadata?.name ?? "";
+  return {
+    identityId: accountId,
+    callerClass: "user",
+    issuer: "",
+    rawToken: "",
+    ...(email !== "" ? { email } : {}),
+    ...(displayName !== "" ? { displayName } : {}),
+  };
+}

package/src/domain/mcpserver/controller.ts

@@ -77,6 +77,7 @@ import {
   EXISTING_RESOURCE_KEY,
   newLoadExistingStep,
 } from "../../pipeline/steps/load-existing.js";
+import { newGuardPluginManagedStep } from "../../pipeline/steps/guard-plugin-managed.js";
 import {
   SHOULD_CREATE_KEY,
   newLoadForApplyStep,
@@ -269,6 +270,10 @@ async function update(
     .addStep(newValidateProtoStep())
     .addStep(newResolveSlugStep())
     .addStep(newLoadExistingStep(deps.store))
+    // A resource a plugin materialised is the plugin's to redefine; a client
+    // write is refused naming the plugin (GuardPluginManaged, keyed on the
+    // STORED labels and the plugin row's existence).
+    .addStep(newGuardPluginManagedStep(deps.store))
     .addStep(newBuildUpdateStateStep())
     .addStep(newGuardReservedLabelsStep(deps.authorizer))
     .addStep(newValidateDefaultEnabledToolsStep())
@@ -374,6 +379,7 @@ async function deleteMcpServer(
     )
     .addStep(newValidateProtoStep())
     .addStep(newLoadExistingForDeleteStep(deps.store, McpServerSchema))
+    .addStep(newGuardPluginManagedStep(deps.store))
     .addStep(newDeleteResourceStep(deps.store))
     .addStep(
       newCleanupIamPoliciesStep(deps.authorizationLifecycle, deps.logger),
@@ -426,6 +432,11 @@ async function updateVisibility(
     )
     .addStep(newValidateProtoStep())
     .addStep(newLoadMcpServerForVisibilityUpdateStep(deps.store))
+    .addStep(
+      newGuardPluginManagedStep(deps.store, {
+        existingKey: UPDATE_VISIBILITY_MCP_SERVER_KEY,
+      }),
+    )
     .addStep(
       newRecordVisibilityBeforeUpdateStep(UPDATE_VISIBILITY_MCP_SERVER_KEY),
     )