@stigmer/server 3.15.3-dev.20260914121148 → 3.16.0

package/src/authorization/__tests__/fixtures/fga/channel-app-owner.fga.yaml

@@ -0,0 +1,125 @@
+# Pinned copy of stigmer-cloud backend/services/stigmer-server/fga/tests/channel-app-owner.fga.yaml
+# at commit b87dd1170 (the OpenFGA store test the cloud runs against its live model).
+# The body below is byte-identical to the source; the cloud re-runs the LIVE
+# file against this evaluator at the re-pin, so a stale copy is caught there.
+# Channel apps are owner-scoped provider credentials (T04 item 2, the
+# oauth_app RESTRICTED posture with T08 admin inheritance): the creator
+# owns the app; view/edit/delete require ownership or an explicit grant.
+# Plain org members get NO implicit access — the resource carries the
+# org's webhook signing secret and OAuth client secret.
+#
+# Org ADMINS inherit owner (T08): a credential holder needs an operator
+# of last resort more than any blueprint does — an ex-employee owner must
+# never strand secret rotation. The narrowness these tests pin: owner +
+# admins have control, granted viewers read, plain members have nothing,
+# and only admins can create.
+#
+# Run: fga model test --tests channel-app-owner.fga.yaml
+
+name: channel-app-owner
+model_file: ../model/fga.mod
+
+tuples:
+  # Org membership for both accounts — proving membership grants nothing.
+  # alice created the app while she was an admin and was later demoted to
+  # member (creation is admin-gated; the owner tuple survives demotion) —
+  # this keeps the direct-owner path distinct from admin inheritance.
+  - user: identity_account:alice
+    relation: member
+    object: organization:acme
+  - user: identity_account:mallory
+    relation: member
+    object: organization:acme
+
+  # Org admin — proving T08 inheritance reaches channel apps.
+  - user: identity_account:ana
+    relation: admin
+    object: organization:acme
+
+  # The channel app, created by alice (the config-driven create tuples).
+  - user: organization:acme
+    relation: organization
+    object: channel_app:acme-support-bot
+  - user: identity_account:alice
+    relation: owner
+    object: channel_app:acme-support-bot
+
+  # An explicit viewer grant to carol (not even an org member).
+  - user: identity_account:carol
+    relation: viewer
+    object: channel_app:acme-support-bot
+
+tests:
+  - name: owner has full control including grant management
+    check:
+      - user: identity_account:alice
+        object: channel_app:acme-support-bot
+        assertions:
+          can_view: true
+          can_edit: true
+          can_delete: true
+          can_grant_access: true
+          can_view_access: true
+
+  - name: explicitly granted viewer can read but not mutate
+    check:
+      - user: identity_account:carol
+        object: channel_app:acme-support-bot
+        assertions:
+          can_view: true
+          can_edit: false
+          can_delete: false
+          can_grant_access: false
+          can_view_access: true
+
+  - name: fellow org member has no implicit access
+    check:
+      - user: identity_account:mallory
+        object: channel_app:acme-support-bot
+        assertions:
+          can_view: false
+          can_edit: false
+          can_delete: false
+          can_grant_access: false
+          can_view_access: false
+
+  - name: org admin inherits channel app management (T08)
+    check:
+      - user: identity_account:ana
+        object: channel_app:acme-support-bot
+        assertions:
+          can_view: true
+          can_edit: true
+          can_delete: true
+          can_grant_access: true
+
+  - name: creation is admin-gated on the organization
+    check:
+      - user: identity_account:ana
+        object: organization:acme
+        assertions:
+          can_create_channel_app: true
+      - user: identity_account:mallory
+        object: organization:acme
+        assertions:
+          can_create_channel_app: false
+
+  - name: listing channel apps reflects ownership and grants, not membership
+    list_objects:
+      - user: identity_account:alice
+        type: channel_app
+        assertions:
+          can_view:
+            - channel_app:acme-support-bot
+          can_edit:
+            - channel_app:acme-support-bot
+      - user: identity_account:carol
+        type: channel_app
+        assertions:
+          can_view:
+            - channel_app:acme-support-bot
+          can_edit: []
+      - user: identity_account:mallory
+        type: channel_app
+        assertions:
+          can_view: []

package/src/authorization/__tests__/fixtures/fga/channel-participation.fga.yaml

@@ -0,0 +1,201 @@
+# Pinned copy of stigmer-cloud backend/services/stigmer-server/fga/tests/channel-participation.fga.yaml
+# at commit b87dd1170 (the OpenFGA store test the cloud runs against its live model).
+# The body below is byte-identical to the source; the cloud re-runs the LIVE
+# file against this evaluator at the re-pin, so a stale copy is caught there.
+# Store tests for conversation participation on agent channels (the
+# `participant` relation and `can_participate` permission,
+# channel-conversations DD-010).
+#
+# The model change under test, in one line each:
+#   participant: [identity_account] or owner   (owner participates free)
+#   viewer:      [identity_account] or participant   (widened from `or owner`)
+#   can_participate: participant               (the reply/takeover bar)
+#
+# The invariants this suite pins:
+#   1. Read and speak are DIFFERENT powers: a granted viewer can see
+#      conversations but cannot participate (the DD-010 rejected
+#      alternative "widen viewer alone" stays rejected).
+#   2. Participation is NOT configuration: a participant can never
+#      edit/delete/grant on the channel.
+#   3. The viewer widening is behavior-preserving for existing grants:
+#      owner ⊆ participant ⊆ viewer, so every pre-DD-010 owner/admin
+#      read keeps working (asserted below, byte-identical semantics).
+#   4. Conversation READ rides the existing session.can_view composition
+#      (`viewer from channel`) unchanged, still read-only — participants
+#      inherit view on channel sessions but never
+#      can_create_execution_in (DD-012's read-only-by-construction).
+#   5. The personal-session invariant is untouched: a participant sees
+#      nothing of anyone's console sessions.
+#
+# Run with:
+#   fga model test --tests channel-participation.fga.yaml
+#
+# Scenario: org "acme" has admin alice, member bob (who connected the
+# WhatsApp channel and owns it), member trina (an ISC trainer granted
+# participant — the DD-010 launch persona), member carol (granted plain
+# viewer), and member dave (no relation to the channel). "rival" is
+# another org whose admin eve must see nothing. The channel session is
+# owned by acme's system-channel account; bob also has a personal
+# console session to prove invariant 5.
+name: channel-participation
+model_file: ../model/fga.mod
+
+tuples:
+  # --- Org roles ---
+  - user: identity_account:alice
+    relation: admin
+    object: organization:acme
+  - user: identity_account:bob
+    relation: member
+    object: organization:acme
+  - user: identity_account:trina
+    relation: member
+    object: organization:acme
+  - user: identity_account:carol
+    relation: member
+    object: organization:acme
+  - user: identity_account:dave
+    relation: member
+    object: organization:acme
+  - user: identity_account:eve
+    relation: admin
+    object: organization:rival
+
+  # --- The AgentChannel (tuples written on create: org link + creator owner) ---
+  - user: organization:acme
+    relation: organization
+    object: agent_channel:wa-line
+  - user: identity_account:bob
+    relation: owner
+    object: agent_channel:wa-line
+
+  # --- The DD-010 grants (IamPolicy-written: participant vs plain viewer) ---
+  - user: identity_account:trina
+    relation: participant
+    object: agent_channel:wa-line
+  - user: identity_account:carol
+    relation: viewer
+    object: agent_channel:wa-line
+
+  # --- A channel session (owned by the org's system-channel account) ---
+  - user: organization:acme
+    relation: organization
+    object: session:member-chat
+  - user: identity_account:sys-channel-acme
+    relation: owner
+    object: session:member-chat
+  # The structural link written by ChannelSessionLinkStep:
+  - user: agent_channel:wa-line
+    relation: channel
+    object: session:member-chat
+
+  # --- Bob's personal console session (invariant 5's control subject) ---
+  - user: organization:acme
+    relation: organization
+    object: session:bobs-chat
+  - user: identity_account:bob
+    relation: owner
+    object: session:bobs-chat
+
+tests:
+  - name: a granted participant may read and speak but never configure
+    check:
+      - user: identity_account:trina
+        object: agent_channel:wa-line
+        assertions:
+          can_view: true
+          can_participate: true
+          can_edit: false
+          can_delete: false
+          can_grant_access: false
+          can_view_access: true
+
+  - name: a granted viewer may read but never speak — read and speak are different powers
+    check:
+      - user: identity_account:carol
+        object: agent_channel:wa-line
+        assertions:
+          can_view: true
+          can_participate: false
+          can_edit: false
+
+  - name: the channel owner participates without an explicit tuple
+    check:
+      - user: identity_account:bob
+        object: agent_channel:wa-line
+        assertions:
+          can_view: true
+          can_participate: true
+          can_edit: true
+          can_delete: true
+          can_grant_access: true
+
+  - name: an org admin participates through owner inheritance, no tuple needed
+    check:
+      - user: identity_account:alice
+        object: agent_channel:wa-line
+        assertions:
+          can_view: true
+          can_participate: true
+          can_edit: true
+
+  - name: a plain org member has no access of any kind
+    check:
+      - user: identity_account:dave
+        object: agent_channel:wa-line
+        assertions:
+          can_view: false
+          can_participate: false
+          can_edit: false
+          can_delete: false
+          can_grant_access: false
+          can_view_access: false
+
+  - name: a foreign org admin has no access of any kind
+    check:
+      - user: identity_account:eve
+        object: agent_channel:wa-line
+        assertions:
+          can_view: false
+          can_participate: false
+          can_edit: false
+
+  - name: participants inherit channel-session read through the existing composition, read-only
+    check:
+      - user: identity_account:trina
+        object: session:member-chat
+        assertions:
+          can_view: true
+          can_create_execution_in: false
+          can_edit: false
+          can_delete: false
+          can_grant_access: false
+
+  - name: the personal-session invariant is untouched — a participant sees no console sessions
+    check:
+      - user: identity_account:trina
+        object: session:bobs-chat
+        assertions:
+          can_view: false
+          can_create_execution_in: false
+
+  - name: list viewable and participable channels resolve per grant (drives listConversations)
+    list_objects:
+      - user: identity_account:trina
+        type: agent_channel
+        assertions:
+          can_view:
+            - agent_channel:wa-line
+          can_participate:
+            - agent_channel:wa-line
+      - user: identity_account:carol
+        type: agent_channel
+        assertions:
+          can_view:
+            - agent_channel:wa-line
+          can_participate: []
+      - user: identity_account:dave
+        type: agent_channel
+        assertions:
+          can_view: []
+          can_participate: []

package/src/authorization/__tests__/fixtures/fga/channel-session-visibility.fga.yaml

@@ -0,0 +1,187 @@
+# Pinned copy of stigmer-cloud backend/services/stigmer-server/fga/tests/channel-session-visibility.fga.yaml
+# at commit b87dd1170 (the OpenFGA store test the cloud runs against its live model).
+# The body below is byte-identical to the source; the cloud re-runs the LIVE
+# file against this evaluator at the re-pin, so a stale copy is caught there.
+# Store tests for channel-session read-only observability (the session
+# `channel` structural link).
+#
+# A session created by the channel runtime carries a single
+#   session#channel@agent_channel:<id>
+# tuple and inherits the channel's viewer set (connector owner + org admins
+# via `admin from organization` on agent_channel) into can_view ONLY —
+# `viewer from channel` is composed into session.can_view, deliberately NOT
+# into session.viewer, so channel observers never gain
+# can_create_execution_in / can_edit / can_delete / can_grant_access.
+# Executions follow through agent_execution's
+# `can_view: viewer or can_view from session`.
+#
+# The personal-session invariant is untouched: console sessions never carry
+# a channel tuple, so `viewer from channel` resolves to nothing for them
+# (pinned below and by session-personal-resource.fga.yaml).
+#
+# Run with:
+#   fga model test --tests channel-session-visibility.fga.yaml
+#
+# Scenario: org "acme" has admin alice, member bob (who connected the Slack
+# channel and owns it), and member carol (no relation to the channel).
+# "rival" is another org whose admin eve must see nothing. The channel
+# session is owned by acme's system-channel account; bob also has a normal
+# personal console session to prove the invariant.
+name: channel-session-visibility
+model_file: ../model/fga.mod
+
+tuples:
+  # --- Org roles ---
+  - user: identity_account:alice
+    relation: admin
+    object: organization:acme
+  - user: identity_account:bob
+    relation: member
+    object: organization:acme
+  - user: identity_account:carol
+    relation: member
+    object: organization:acme
+  - user: identity_account:eve
+    relation: admin
+    object: organization:rival
+
+  # --- The AgentChannel (tuples written on create: org link + creator owner) ---
+  - user: organization:acme
+    relation: organization
+    object: agent_channel:slack-conn
+  - user: identity_account:bob
+    relation: owner
+    object: agent_channel:slack-conn
+
+  # --- The channel session (owned by the org's system-channel account) ---
+  - user: organization:acme
+    relation: organization
+    object: session:channel-chat
+  - user: identity_account:sys-channel-acme
+    relation: owner
+    object: session:channel-chat
+  # The structural link written by ChannelSessionLinkStep:
+  - user: agent_channel:slack-conn
+    relation: channel
+    object: session:channel-chat
+
+  # --- An execution inside the channel session ---
+  - user: session:channel-chat
+    relation: session
+    object: agent_execution:channel-run-1
+
+  # --- bob's ordinary personal console session (NO channel tuple) ---
+  - user: organization:acme
+    relation: organization
+    object: session:bobs-chat
+  - user: identity_account:bob
+    relation: owner
+    object: session:bobs-chat
+  - user: session:bobs-chat
+    relation: session
+    object: agent_execution:bobs-run-1
+
+tests:
+  - name: channel connector can view the conversation but only view it
+    check:
+      - user: identity_account:bob
+        object: session:channel-chat
+        assertions:
+          can_view: true
+          can_create_execution_in: false
+          can_edit: false
+          can_delete: false
+          can_grant_access: false
+          can_view_access: false
+
+  - name: org admin inherits view through the channel, read-only
+    check:
+      - user: identity_account:alice
+        object: session:channel-chat
+        assertions:
+          can_view: true
+          can_create_execution_in: false
+          can_edit: false
+          can_delete: false
+          can_grant_access: false
+
+  - name: plain org member without channel access sees nothing
+    check:
+      - user: identity_account:carol
+        object: session:channel-chat
+        assertions:
+          can_view: false
+          can_create_execution_in: false
+
+  - name: another org's admin sees nothing
+    check:
+      - user: identity_account:eve
+        object: session:channel-chat
+        assertions:
+          can_view: false
+
+  - name: the system-channel account keeps full session ownership
+    check:
+      - user: identity_account:sys-channel-acme
+        object: session:channel-chat
+        assertions:
+          can_view: true
+          can_create_execution_in: true
+          can_edit: true
+          can_delete: true
+
+  - name: executions inherit read-only channel observability
+    check:
+      - user: identity_account:bob
+        object: agent_execution:channel-run-1
+        assertions:
+          can_view: true
+          can_edit: false
+      - user: identity_account:alice
+        object: agent_execution:channel-run-1
+        assertions:
+          can_view: true
+          can_edit: false
+      - user: identity_account:carol
+        object: agent_execution:channel-run-1
+        assertions:
+          can_view: false
+
+  - name: personal-session invariant is untouched by the channel model
+    check:
+      # Admin still has no path into a console session (no channel tuple).
+      - user: identity_account:alice
+        object: session:bobs-chat
+        assertions:
+          can_view: false
+          can_edit: false
+          can_delete: false
+      - user: identity_account:alice
+        object: agent_execution:bobs-run-1
+        assertions:
+          can_view: false
+      # And the owner's own access is unchanged.
+      - user: identity_account:bob
+        object: session:bobs-chat
+        assertions:
+          can_view: true
+          can_edit: true
+          can_create_execution_in: true
+
+  - name: list viewable sessions resolves the channel chain (drives listByChannel)
+    list_objects:
+      - user: identity_account:alice
+        type: session
+        assertions:
+          can_view:
+            - session:channel-chat
+      - user: identity_account:bob
+        type: session
+        assertions:
+          can_view:
+            - session:channel-chat
+            - session:bobs-chat
+      - user: identity_account:carol
+        type: session
+        assertions:
+          can_view: []

package/src/authorization/__tests__/fixtures/fga/cross-org-share-creation.fga.yaml

@@ -0,0 +1,98 @@
+# Pinned copy of stigmer-cloud backend/services/stigmer-server/fga/tests/cross-org-share-creation.fga.yaml
+# at commit 2ec420161 (the OpenFGA store test the cloud runs against its live model).
+# The body below is byte-identical to the source; the cloud re-runs the LIVE
+# file against this evaluator at the re-pin, so a stale copy is caught there.
+# Cross-org share creation, the FGA half of the decision 013 D2 consent
+# bar. Creating a share of ANOTHER org's marketplace-public agent requires:
+#
+#   1. can_execute on the agent — granted to every authenticated account by
+#      the allow_public wildcard when the agent is public (checked here),
+#      and to nobody cross-org when it is not.
+#   2. can_create_agent_share on the SHARE's own org — admin-level: a
+#      public share spends the org's credits on the open internet. The
+#      per-kind can_create_* pattern, one more row.
+#
+# The same-org bar (agent can_edit) is untouched and pinned by
+# agent-share-owner.fga.yaml; the app-level halves of the contract
+# (visibility check, audience rule, dependency sweep, agent-id pin) are
+# handler logic outside FGA, pinned by the Java and Go unit tests.
+
+name: cross-org-share-creation
+model_file: ../model/fga.mod
+
+tuples:
+  # provider-org publishes a marketplace-public agent (the conditional
+  # wildcard viewer tuple visibility_public writes).
+  - user: organization:provider-org
+    relation: organization
+    object: agent:public-helper
+  - user: identity_account:paula
+    relation: owner
+    object: agent:public-helper
+  - user: identity_account:*
+    relation: viewer
+    object: agent:public-helper
+    condition:
+      name: allow_public
+      context: {}
+
+  # A private agent in the same provider org — the wildcard is absent.
+  - user: organization:provider-org
+    relation: organization
+    object: agent:private-helper
+  - user: identity_account:paula
+    relation: owner
+    object: agent:private-helper
+
+  # consumer-org: an admin and a plain member.
+  - user: identity_account:adam
+    relation: admin
+    object: organization:consumer-org
+  - user: identity_account:mia
+    relation: member
+    object: organization:consumer-org
+
+tests:
+  - name: consumer-org admin holds both halves of the cross-org bar
+    check:
+      - user: identity_account:adam
+        object: agent:public-helper
+        context:
+          allow: true
+        assertions:
+          can_execute: true
+          can_edit: false
+      - user: identity_account:adam
+        object: organization:consumer-org
+        assertions:
+          can_create_agent_share: true
+
+  - name: plain member lacks the org-side bar (spending is admin-level)
+    check:
+      - user: identity_account:mia
+        object: agent:public-helper
+        context:
+          allow: true
+        assertions:
+          can_execute: true
+      - user: identity_account:mia
+        object: organization:consumer-org
+        assertions:
+          can_create_agent_share: false
+
+  - name: nobody cross-org can execute a private agent
+    check:
+      - user: identity_account:adam
+        object: agent:private-helper
+        context:
+          allow: true
+        assertions:
+          can_execute: false
+          can_view: false
+
+  - name: the org-side bar does not leak across orgs
+    check:
+      - user: identity_account:paula
+        object: organization:consumer-org
+        assertions:
+          can_create_agent_share: false