@stigmer/server 3.20.0 → 3.22.0

package/src/domain/agentshare/steps.ts

@@ -35,6 +35,7 @@ import { SkillSchema } from "@stigmer/protos/ai/stigmer/agentic/skill/v1/api_pb"
 import { ApiResourceVisibility } from "@stigmer/protos/ai/stigmer/commons/apiresource/enum_pb";
 import type { ApiResourceReference } from "@stigmer/protos/ai/stigmer/commons/apiresource/io_pb";
 import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
+import { IamPermission } from "@stigmer/protos/ai/stigmer/iam/v1/enum_pb";
 
 import {
   failedPreconditionError,
@@ -44,6 +45,13 @@ import {
 } from "../../pipeline/errors.js";
 import type { PipelineStep } from "../../pipeline/pipeline.js";
 import type { RequestContext } from "../../pipeline/request-context.js";
+import type { Authorizer } from "../../extensions/authorizer.js";
+import {
+  AUTHORIZATION_UNAVAILABLE_MESSAGE,
+  evaluateAuthorizer,
+} from "../../pipeline/steps/authorize.js";
+import type { AuthorizationTarget } from "../../pipeline/steps/authorize.js";
+import type { GetByReferenceDesc } from "../../pipeline/steps/authorize-resolved-target.js";
 import { findResourceBySlug } from "../../pipeline/steps/helpers.js";
 import { EXISTING_RESOURCE_KEY } from "../../pipeline/steps/load-existing.js";
 import type { Store } from "../../store/interface.js";
@@ -61,10 +69,66 @@ type AgentShareDesc = typeof AgentShareSchema;
 /**
  * Context key for the agent resolved from spec.agent_ref during
  * create/apply, so later steps never re-load it — Go referencedAgentKey.
- * Module-private: only ResolveShareDefaults writes it and StampAgentPin
- * reads it, both in this file.
+ * ResolveShareDefaults writes it; the create lane's authorization step and
+ * StampAgentPin read it.
  */
-const REFERENCED_AGENT_KEY = "agentShareReferencedAgent";
+export const REFERENCED_AGENT_KEY = "agentShareReferencedAgent";
+
+/** The deny copy of the agent's bar, the Java AgentShareCreateHandler's. */
+export const SHARE_AGENT_DENIED_MESSAGE =
+  "You don't have permission to share this agent";
+
+/** The deny copy of the sharing organization's bar, the Java handler's. */
+export const SHARE_ORGANIZATION_DENIED_MESSAGE =
+  "You don't have permission to create agent shares in this organization";
+
+/**
+ * The create lane's authorization questions, for AuthorizeResolvedTarget
+ * after ResolveShareDefaults: the two-arm consent bar the Java handler
+ * enforced and the model's comment on can_create_agent_share describes.
+ * The RPC is is_skip_authorization because the target is the referenced
+ * agent, resolved from a slug, not a request field.
+ *
+ * A same-org share (spec.agent_ref.org equals metadata.org, after the
+ * resolve step made the reference absolute) asks can_edit on the agent:
+ * sharing puts the agent in front of a wider audience, an editor's act.
+ *
+ * A cross-org share of another organization's public agent asks two
+ * questions, agent first as Java did: can_execute on the agent (whoever may
+ * run it may offer it) and then can_create_agent_share on the SHARING
+ * organization — a public share spends that organization's credits on the
+ * open internet, an admin-level act. The cross-org validity rules (public
+ * agent, no org audience, public dependencies) stay the resolve step's.
+ */
+export function resolveShareCreateTargets(
+  ctx: RequestContext<AgentShareDesc>,
+): ReadonlyArray<AuthorizationTarget> {
+  const agent = ctx.get(REFERENCED_AGENT_KEY) as Agent | undefined;
+  if (agent === undefined) {
+    throw new Error("referenced agent not found in context");
+  }
+  const share = ctx.newState;
+  const shareOrg = share.metadata?.org ?? "";
+  const crossOrg = (share.spec?.agentRef?.org ?? "") !== shareOrg;
+  const agentBar: AuthorizationTarget = {
+    permission: crossOrg ? IamPermission.can_execute : IamPermission.can_edit,
+    resourceKind: ApiResourceKind.agent,
+    resourceId: agent.metadata?.id ?? "",
+    deniedMessage: SHARE_AGENT_DENIED_MESSAGE,
+  };
+  if (!crossOrg) {
+    return [agentBar];
+  }
+  return [
+    agentBar,
+    {
+      permission: IamPermission.can_create_agent_share,
+      resourceKind: ApiResourceKind.organization,
+      resourceId: shareOrg,
+      deniedMessage: SHARE_ORGANIZATION_DENIED_MESSAGE,
+    },
+  ];
+}
 
 /**
  * The single refusal for every anonymous/member resolution miss: share
@@ -78,6 +142,71 @@ export function sharedNotFound(slug: string): ConnectError {
   return notFoundError("Agent", slug);
 }
 
+/**
+ * AuthorizeMemberAudience — the member-profile lane's gate, membership
+ * BEFORE existence: the Java AgentShareGetSharedProfileForMemberHandler
+ * order. getSharedProfileForMember is the signed-in resolution path for a
+ * share URL, and the proto pins its contract: a share that does not exist,
+ * is disabled, or is asked for by someone who is not a member of the
+ * sharing organization all answer the SAME NOT_FOUND, so a share URL
+ * teaches a non-member nothing — not even whether the share exists. A
+ * non-member resolving a public share uses the anonymous lane instead.
+ *
+ * The question is can_view on the organization named in the reference (the
+ * viewer set: members and above), asked live on every call so a revoked
+ * member loses access at once; the RPC is is_skip_authorization because
+ * the target is the reference's organization, not a request field the
+ * annotation can key on. This is deliberately NOT the shared
+ * AuthorizeResolvedTarget step: that step answers deny with
+ * PERMISSION_DENIED, and this lane's wire contract is the indistinguishable
+ * NOT_FOUND above, so the lane keeps its own mapping over the same
+ * evaluation (the decision form checkMyPermission uses). An empty org is
+ * left to the loader's INVALID_ARGUMENT, the proto's own copy for it; an
+ * unavailable authorizer is INTERNAL, never softened into a refusal; the
+ * `internal` class is exempt as everywhere.
+ */
+export function newAuthorizeMemberAudienceStep(
+  authorizer: Authorizer,
+): PipelineStep<GetByReferenceDesc> {
+  return {
+    name: "AuthorizeMemberAudience",
+    async execute(ctx: RequestContext<GetByReferenceDesc>): Promise<void> {
+      const ref = ctx.input;
+      if (ref.org === "" || ctx.callerIdentity.callerClass === "internal") {
+        return;
+      }
+      const decision = await evaluateAuthorizer(
+        authorizer,
+        ctx.callerIdentity,
+        {
+          permission: IamPermission.can_view,
+          resourceKind: ApiResourceKind.organization,
+          resourceId: ref.org,
+        },
+      );
+      switch (decision.kind) {
+        case "allow":
+          return;
+        case "deny":
+        case "not-found":
+          throw sharedNotFound(ref.slug);
+        case "unavailable":
+          throw internalError(
+            decision.cause,
+            AUTHORIZATION_UNAVAILABLE_MESSAGE,
+          );
+        default: {
+          const exhaustive: never = decision;
+          throw internalError(
+            new Error(`unknown decision ${JSON.stringify(exhaustive)}`),
+            AUTHORIZATION_UNAVAILABLE_MESSAGE,
+          );
+        }
+      }
+    },
+  };
+}
+
 /**
  * The link-token predicate — Go sharingLinkTokenAllowed, the mirror of the
  * cloud edition's SharingLinkTokenPolicy:
@@ -90,7 +219,10 @@ export function sharedNotFound(slug: string): ConnectError {
  * guard restores Go's semantics; the length of a token is not secret (all
  * server-minted tokens are 27 chars).
  */
-export function sharingLinkTokenAllowed(presented: string, live: string): boolean {
+export function sharingLinkTokenAllowed(
+  presented: string,
+  live: string,
+): boolean {
   if (live === "") {
     return true;
   }
@@ -182,7 +314,9 @@ export async function findShareByOrgAndSlug(
  *      provided neither — the canonical share keeps the agent's hosted URL.
  *      Runs before ResolveSlug, which skips already-set slugs.
  */
-export function newResolveShareDefaultsStep(store: Store): PipelineStep<AgentShareDesc> {
+export function newResolveShareDefaultsStep(
+  store: Store,
+): PipelineStep<AgentShareDesc> {
   return {
     name: "ResolveShareDefaults",
     async execute(ctx: RequestContext<AgentShareDesc>): Promise<void> {
@@ -204,7 +338,11 @@ export function newResolveShareDefaultsStep(store: Store): PipelineStep<AgentSha
         agentRef!.org = metadata!.org;
       }
 
-      const agent = await findAgentByOrgAndSlug(store, agentRef!.org, agentRef!.slug);
+      const agent = await findAgentByOrgAndSlug(
+        store,
+        agentRef!.org,
+        agentRef!.slug,
+      );
       if (agent === undefined) {
         throw notFoundError("Agent", agentRef!.slug);
       }
@@ -288,7 +426,10 @@ async function findNonPublicDependencies(
 
   const seen = new Set<string>();
   const deps: DepRef[] = [];
-  const add = (kind: ApiResourceKind, ref: ApiResourceReference | undefined): void => {
+  const add = (
+    kind: ApiResourceKind,
+    ref: ApiResourceReference | undefined,
+  ): void => {
     if (ref === undefined || ref.slug === "") {
       return;
     }
@@ -320,8 +461,20 @@ async function findNonPublicDependencies(
       // are the only dependency kinds an agent blueprint declares.
       const resolved =
         dep.kind === ApiResourceKind.skill
-          ? await findResourceBySlug(store, dep.kind, SkillSchema, dep.slug, dep.org)
-          : await findResourceBySlug(store, dep.kind, McpServerSchema, dep.slug, dep.org);
+          ? await findResourceBySlug(
+              store,
+              dep.kind,
+              SkillSchema,
+              dep.slug,
+              dep.org,
+            )
+          : await findResourceBySlug(
+              store,
+              dep.kind,
+              McpServerSchema,
+              dep.slug,
+              dep.org,
+            );
       visibility = resolved?.metadata?.visibility;
     } catch (error) {
       throw internalError(
@@ -396,20 +549,28 @@ export function newValidateShareUpdateStep(): PipelineStep<AgentShareDesc> {
       // Normalize the input ref's org the same way create does (empty
       // means the share's own org) before comparing.
       const inputOrg =
-        (inputRef?.org ?? "") !== "" ? inputRef!.org : (existing.metadata?.org ?? "");
+        (inputRef?.org ?? "") !== ""
+          ? inputRef!.org
+          : (existing.metadata?.org ?? "");
 
       if (
         (inputRef?.slug ?? "") !== (existingRef?.slug ?? "") ||
         inputOrg !== (existingRef?.org ?? "")
       ) {
         throw failedPreconditionError(
-          agentRefImmutableMessage(existingRef?.org ?? "", existingRef?.slug ?? ""),
+          agentRefImmutableMessage(
+            existingRef?.org ?? "",
+            existingRef?.slug ?? "",
+          ),
         );
       }
 
-      const isCrossOrg = (existingRef?.org ?? "") !== (existing.metadata?.org ?? "");
+      const isCrossOrg =
+        (existingRef?.org ?? "") !== (existing.metadata?.org ?? "");
       if (isCrossOrg && ctx.input.spec?.audience === AgentShareAudience.org) {
-        throw failedPreconditionError(crossOrgAudienceMessage(existingRef?.org ?? ""));
+        throw failedPreconditionError(
+          crossOrgAudienceMessage(existingRef?.org ?? ""),
+        );
       }
     },
   };
@@ -430,7 +591,11 @@ export async function buildSharedAgentProfile(
   share: AgentShare,
 ): Promise<SharedAgentProfile> {
   const ref = share.spec?.agentRef;
-  const agent = await findAgentByOrgAndSlug(store, ref?.org ?? "", ref?.slug ?? "");
+  const agent = await findAgentByOrgAndSlug(
+    store,
+    ref?.org ?? "",
+    ref?.slug ?? "",
+  );
   if (agent === undefined) {
     throw sharedNotFound(share.metadata?.slug ?? "");
   }
@@ -440,7 +605,8 @@ export async function buildSharedAgentProfile(
     throw sharedNotFound(share.metadata?.slug ?? "");
   }
 
-  const isCrossOrg = (share.metadata?.org ?? "") !== (agent.metadata?.org ?? "");
+  const isCrossOrg =
+    (share.metadata?.org ?? "") !== (agent.metadata?.org ?? "");
   if (
     isCrossOrg &&
     agent.metadata?.visibility !== ApiResourceVisibility.visibility_public

package/src/domain/artifact/controller.ts

@@ -66,9 +66,9 @@ import { callerIdentityOf } from "../../pipeline/interceptors/auth.js";
 import { RequestContext } from "../../pipeline/request-context.js";
 import {
   authorizeDirect,
-  authorizeResolvedResource,
   newAuthorizeStep,
 } from "../../pipeline/steps/authorize.js";
+import { newAuthorizeResolvedTargetStep } from "../../pipeline/steps/authorize-resolved-target.js";
 import {
   generateId,
   setAuditFieldsForCreate,
@@ -426,23 +426,18 @@ async function listByExecution(
         }
       },
     })
-    .addStep({
-      name: "AuthorizeParentExecution",
-      async execute(stepCtx): Promise<void> {
-        // The Java ArtifactListByExecutionHandler's hand-rolled gate
-        // (20260830.01 ruling Q8): can_view on the PARENT execution —
-        // "if you can view an execution, you can list its artifacts."
-        // The two-field dispatch (workflow-execution first, the Java
-        // order) is why the declarative annotation cannot express this
-        // lane and the proto carries is_skip_authorization. Deny copy is
-        // the Java handler's byte-pinned error_msg; a nonexistent id
-        // answers NOT_FOUND through the authorizer's probe — the ruled
-        // uniform unknown-id posture (DD-007 addendum), a recorded
-        // divergence from Java's deny-everyone arm on this lane.
-        const input = stepCtx.input;
-        await authorizeResolvedResource(
-          deps.authorizer,
-          stepCtx.callerIdentity,
+    // The Java ArtifactListByExecutionHandler's gate: can_view on the PARENT
+    // execution — "if you can view an execution, you can list its
+    // artifacts." The two-field dispatch (workflow-execution first, the Java
+    // order) is why the declarative annotation cannot express this lane and
+    // the proto carries is_skip_authorization. Deny copy is the Java
+    // handler's byte-pinned error_msg; a nonexistent id answers NOT_FOUND
+    // through the authorizer's probe — the ruled uniform unknown-id
+    // posture, a recorded divergence from Java's deny-everyone arm here.
+    .addStep(
+      newAuthorizeResolvedTargetStep(
+        deps.authorizer,
+        ({ input }) => [
           {
             permission: IamPermission.can_view,
             resourceKind:
@@ -453,11 +448,12 @@ async function listByExecution(
               input.workflowExecutionId !== ""
                 ? input.workflowExecutionId
                 : input.agentExecutionId,
+            deniedMessage: "unauthorized to list artifacts for this execution",
           },
-          "unauthorized to list artifacts for this execution",
-        );
-      },
-    })
+        ],
+        "AuthorizeParentExecution",
+      ),
+    )
     .addStep({
       name: "QueryArtifactsByExecution",
       async execute(stepCtx): Promise<void> {

package/src/domain/channelapp/controller.ts

@@ -51,6 +51,10 @@ import type { PipelineStep } from "../../pipeline/pipeline.js";
 import { callerIdentityOf } from "../../pipeline/interceptors/auth.js";
 import { RequestContext } from "../../pipeline/request-context.js";
 import { newAuthorizeStep } from "../../pipeline/steps/authorize.js";
+import {
+  loadedTargetAsMethod,
+  newAuthorizeResolvedTargetStep,
+} from "../../pipeline/steps/authorize-resolved-target.js";
 import { newGuardReservedLabelsStep } from "../../pipeline/steps/guard-reserved-labels.js";
 import { newBuildNewStateStep } from "../../pipeline/steps/defaults.js";
 import { newBuildUpdateStateStep } from "../../pipeline/steps/build-update-state.js";
@@ -369,6 +373,12 @@ async function getByReference(
     )
     .addStep(newValidateProtoStep())
     .addStep(newLoadByReferenceStep(deps.store, ChannelAppSchema))
+    .addStep(
+      newAuthorizeResolvedTargetStep(
+        deps.authorizer,
+        loadedTargetAsMethod(ChannelAppQueryController.method.get),
+      ),
+    )
     .build()
     .execute(reqCtx);
   const app = reqCtx.get(TARGET_RESOURCE_KEY) as ChannelApp;

package/src/domain/environment/__tests__/personal.test.ts

@@ -0,0 +1,143 @@
+/**
+ * Pins the shared personal-environment lookup (personal.ts) on the seam
+ * both its callers stand on: outcomes are VALUES (no personal environment;
+ * resolved with the required keys still missing named), a declaration's
+ * is_secret rides onto the value, optional keys are skipped silently in
+ * every absent arm, only stored keys are read (existence before the
+ * secret read; own-key membership), and a failing list is the one thrown
+ * fault. The connect lane's refusals over these outcomes are pinned in
+ * mcpserver/__tests__/connect.test.ts; the build's warnings in
+ * agentexecution/__tests__/create-execution-context-step.test.ts.
+ */
+import { create } from "@bufbuild/protobuf";
+import { Code, ConnectError } from "@connectrpc/connect";
+import { describe, expect, it } from "vitest";
+
+import { EnvironmentSchema } from "@stigmer/protos/ai/stigmer/agentic/environment/v1/api_pb";
+import { EnvironmentListSchema } from "@stigmer/protos/ai/stigmer/agentic/environment/v1/io_pb";
+import {
+  EnvVarDeclarationSchema,
+  EnvironmentValueSchema,
+} from "@stigmer/protos/ai/stigmer/agentic/environment/v1/spec_pb";
+
+import { createLogger } from "../../../boot/logger.js";
+import { PERSONAL_LABEL_KEY, PERSONAL_LABEL_VALUE } from "../constants.js";
+import type { PersonalEnvironmentReader } from "../personal.js";
+import { resolveDeclaredFromPersonalEnvironment } from "../personal.js";
+
+const silentLogger = createLogger({
+  level: "error",
+  pretty: false,
+  write: () => {},
+});
+
+/** A declaration literal as the generated message. */
+function decl(init: { isSecret: boolean; optional?: boolean }) {
+  return create(EnvVarDeclarationSchema, init);
+}
+
+function readerOver(
+  stored: Record<string, string>,
+  reads: string[],
+  failing: ReadonlySet<string> = new Set(),
+): PersonalEnvironmentReader {
+  return {
+    list: async (request) => {
+      expect(request.labels).toEqual({ [PERSONAL_LABEL_KEY]: PERSONAL_LABEL_VALUE });
+      return create(EnvironmentListSchema, {
+        totalCount: 1,
+        items: [
+          create(EnvironmentSchema, {
+            metadata: { id: "env_p", org: "acme", slug: "personal" },
+            spec: {
+              data: Object.fromEntries(
+                Object.keys(stored).map((k) => [k, { value: "***", isSecret: true }]),
+              ),
+            },
+          }),
+        ],
+      });
+    },
+    getSecretValue: async (input) => {
+      const key = input.key ?? "";
+      reads.push(key);
+      if (failing.has(key)) {
+        throw new ConnectError("decrypt failed", Code.Internal);
+      }
+      return create(EnvironmentValueSchema, { value: stored[key] ?? "", isSecret: true });
+    },
+  };
+}
+
+describe("resolveDeclaredFromPersonalEnvironment", () => {
+  it("answers no-personal-environment as a value when the org has none", async () => {
+    const reader: PersonalEnvironmentReader = {
+      list: async () => create(EnvironmentListSchema, { totalCount: 0, items: [] }),
+      getSecretValue: async () => {
+        throw new Error("unreached");
+      },
+    };
+    const out = await resolveDeclaredFromPersonalEnvironment(reader, silentLogger, "acme", {
+      TOKEN: decl({ isSecret: true }),
+    });
+    expect(out).toEqual({ kind: "no-personal-environment" });
+  });
+
+  it("resolves stored keys with the declaration's is_secret, names missing required keys, skips optional ones", async () => {
+    const reads: string[] = [];
+    const reader = readerOver({ TOKEN: "t-1", PUBLIC_URL: "https://x", EMPTY: "" }, reads);
+    const out = await resolveDeclaredFromPersonalEnvironment(reader, silentLogger, "acme", {
+      TOKEN: decl({ isSecret: true }),
+      PUBLIC_URL: decl({ isSecret: false }),
+      EMPTY: decl({ isSecret: true }),
+      ABSENT_REQUIRED: decl({ isSecret: true }),
+      ABSENT_OPTIONAL: decl({ isSecret: true, optional: true }),
+    });
+    expect(out.kind).toBe("resolved");
+    if (out.kind !== "resolved") return;
+    expect(out.values["TOKEN"]?.value).toBe("t-1");
+    expect(out.values["TOKEN"]?.isSecret).toBe(true);
+    expect(out.values["PUBLIC_URL"]?.value).toBe("https://x");
+    expect(out.values["PUBLIC_URL"]?.isSecret).toBe(false);
+    // An empty stored value is absent; required → missing.
+    expect(out.values["EMPTY"]).toBeUndefined();
+    expect([...out.missing].sort()).toEqual(["ABSENT_REQUIRED", "EMPTY"]);
+    // Only stored keys are read: absent declarations cost no secret read.
+    expect(reads.sort()).toEqual(["EMPTY", "PUBLIC_URL", "TOKEN"]);
+  });
+
+  it("treats a failing secret read as absent: missing when required, skipped when optional", async () => {
+    const reads: string[] = [];
+    const reader = readerOver({ A: "a", B: "b" }, reads, new Set(["A", "B"]));
+    const out = await resolveDeclaredFromPersonalEnvironment(reader, silentLogger, "acme", {
+      A: decl({ isSecret: true }),
+      B: decl({ isSecret: true, optional: true }),
+    });
+    expect(out).toEqual({ kind: "resolved", values: {}, missing: ["A"] });
+  });
+
+  it("never reads a prototype name as a stored key", async () => {
+    const reads: string[] = [];
+    const reader = readerOver({}, reads);
+    const out = await resolveDeclaredFromPersonalEnvironment(reader, silentLogger, "acme", {
+      constructor: decl({ isSecret: true }),
+      toString: decl({ isSecret: true, optional: true }),
+    });
+    expect(out).toEqual({ kind: "resolved", values: {}, missing: ["constructor"] });
+    expect(reads).toEqual([]);
+  });
+
+  it("throws Internal when the personal environment cannot be listed", async () => {
+    const reader: PersonalEnvironmentReader = {
+      list: async () => {
+        throw new Error("store offline");
+      },
+      getSecretValue: async () => {
+        throw new Error("unreached");
+      },
+    };
+    await expect(
+      resolveDeclaredFromPersonalEnvironment(reader, silentLogger, "acme", { A: decl({ isSecret: true }) }),
+    ).rejects.toMatchObject({ code: Code.Internal });
+  });
+});

package/src/domain/environment/controller.ts

@@ -58,6 +58,10 @@ import type { PipelineStep } from "../../pipeline/pipeline.js";
 import { callerIdentityOf } from "../../pipeline/interceptors/auth.js";
 import { RequestContext } from "../../pipeline/request-context.js";
 import { newAuthorizeStep } from "../../pipeline/steps/authorize.js";
+import {
+  loadedTargetAsMethod,
+  newAuthorizeResolvedTargetStep,
+} from "../../pipeline/steps/authorize-resolved-target.js";
 import { newGuardReservedLabelsStep } from "../../pipeline/steps/guard-reserved-labels.js";
 import { newAuthorizeVisibilityTransitionStep } from "../../pipeline/steps/visibility-gates.js";
 import {
@@ -682,6 +686,12 @@ async function getByReference(
     )
     .addStep(newValidateProtoStep())
     .addStep(newLoadByReferenceStep(deps.store, EnvironmentSchema))
+    .addStep(
+      newAuthorizeResolvedTargetStep(
+        deps.authorizer,
+        loadedTargetAsMethod(EnvironmentQueryController.method.get),
+      ),
+    )
     .build()
     .execute(reqCtx);
   const env = reqCtx.get(TARGET_RESOURCE_KEY) as Environment;