@stigmer/server 3.20.0 → 3.22.0

package/src/domain/plugin/controller.ts

@@ -51,7 +51,6 @@ import type {
   ApiResourceReference,
   UpdateVisibilityInput,
 } from "@stigmer/protos/ai/stigmer/commons/apiresource/io_pb";
-import { IamPermission } from "@stigmer/protos/ai/stigmer/iam/v1/enum_pb";
 
 import type { ContentAddressedArchiveStore } from "../../archive/content-store.js";
 import { MAX_ZIP_SIZE } from "../../archive/limits.js";
@@ -74,10 +73,7 @@ import {
   newRecordVisibilityBeforeUpdateStep,
   newUpdateVisibilityTuplesStep,
 } from "../../pipeline/steps/authorization-tuples.js";
-import {
-  authorizeResolvedResource,
-  newAuthorizeStep,
-} from "../../pipeline/steps/authorize.js";
+import { newAuthorizeStep } from "../../pipeline/steps/authorize.js";
 import { setAuditFieldsForUpdate } from "../../pipeline/steps/defaults.js";
 import {
   newDeleteResourceStep,
@@ -96,12 +92,16 @@ import { newValidateProtoStep } from "../../pipeline/steps/validation.js";
 import { newValidateVisibilityUpdateStep } from "../../pipeline/steps/validate-visibility.js";
 import { newDeleteVersionArchivesStep } from "../../pipeline/steps/version-archive.js";
 import {
-  LIST_VERSIONS_RESOURCE_ID_KEY,
   LIST_VERSIONS_RESPONSE_KEY,
   newLoadAndMapVersionsStep,
   newLoadByReferenceWithVersionStep,
   newResolveBySlugForVersionsStep,
+  versionHistoryTarget,
 } from "../../pipeline/steps/version-history.js";
+import {
+  loadedTargetAsMethod,
+  newAuthorizeResolvedTargetStep,
+} from "../../pipeline/steps/authorize-resolved-target.js";
 import type { VersionHistoryBinding } from "../../pipeline/steps/version-history.js";
 import { newAuthorizeVisibilityTransitionStep } from "../../pipeline/steps/visibility-gates.js";
 import { metadataOf } from "../../pipeline/steps/shapes.js";
@@ -718,22 +718,13 @@ async function getByReference(
         "LoadPluginByReference",
       ),
     )
-    .addStep({
-      name: "AuthorizeResolvedPlugin",
-      async execute(stepCtx): Promise<void> {
-        const resolved = stepCtx.get(TARGET_RESOURCE_KEY) as Plugin;
-        await authorizeResolvedResource(
-          deps.authorizer,
-          stepCtx.callerIdentity,
-          {
-            permission: IamPermission.can_view,
-            resourceKind: ApiResourceKind.plugin,
-            resourceId: resolved.metadata?.id ?? "",
-          },
-          "unauthorized to get plugin",
-        );
-      },
-    })
+    .addStep(
+      newAuthorizeResolvedTargetStep(
+        deps.authorizer,
+        loadedTargetAsMethod(PluginQueryController.method.get),
+        "AuthorizeResolvedPlugin",
+      ),
+    )
     .build()
     .execute(reqCtx);
   return reqCtx.get(TARGET_RESOURCE_KEY) as Plugin;
@@ -817,21 +808,16 @@ async function listVersions(
         "ResolvePluginBySlug",
       ),
     )
-    .addStep({
-      name: "AuthorizeResolvedPlugin",
-      async execute(stepCtx): Promise<void> {
-        await authorizeResolvedResource(
-          deps.authorizer,
-          stepCtx.callerIdentity,
-          {
-            permission: IamPermission.can_view,
-            resourceKind: ApiResourceKind.plugin,
-            resourceId: stepCtx.get(LIST_VERSIONS_RESOURCE_ID_KEY) as string,
-          },
+    .addStep(
+      newAuthorizeResolvedTargetStep(
+        deps.authorizer,
+        versionHistoryTarget(
+          ApiResourceKind.plugin,
           "unauthorized to view plugin version history",
-        );
-      },
-    })
+        ),
+        "AuthorizeResolvedPlugin",
+      ),
+    )
     .addStep(
       newLoadAndMapVersionsStep(
         deps.store,

package/src/domain/plugin/overlay/sanitize.ts

@@ -5,8 +5,8 @@
  * lane passes GuardReservedLabels structurally (the controller stamps the
  * membership labels by design), so this module is the one place plugin-
  * provided metadata is judged before it can ride that lane. Without it an
- * archive could carry `stigmer.ai/default-agent: "true"` in its agent
- * overlay and become every organization's default agent.
+ * archive could carry any `stigmer.ai/*` label in its overlays and have
+ * the server act on a platform decision the plugin's author made.
  *
  * Four rules, each one sentence with the document's path:
  *   - a `stigmer.ai/*` label costs `can_write_reserved_labels` on

package/src/domain/schedule/__tests__/create-authorization.test.ts

@@ -0,0 +1,58 @@
+/**
+ * Pins the create lane's authorization question (steps.ts,
+ * resolveScheduleCreateTargets): can_edit on the REFERENCED AGENT with the
+ * Java handler's copy, and nothing on the organization (the same-org
+ * invariant already binds the schedule to the agent's); a missing
+ * referenced agent throws.
+ */
+import { describe, expect, it } from "vitest";
+import { create } from "@bufbuild/protobuf";
+
+import { AgentSchema } from "@stigmer/protos/ai/stigmer/agentic/agent/v1/api_pb";
+import { ScheduleSchema } from "@stigmer/protos/ai/stigmer/agentic/schedule/v1/api_pb";
+import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
+import { IamPermission } from "@stigmer/protos/ai/stigmer/iam/v1/enum_pb";
+
+import { testCallerIdentity } from "../../../pipeline/__tests__/support.js";
+import { RequestContext } from "../../../pipeline/request-context.js";
+import {
+  REFERENCED_AGENT_KEY,
+  SCHEDULE_CREATE_DENIED_MESSAGE,
+  resolveScheduleCreateTargets,
+} from "../steps.js";
+
+const agent = create(AgentSchema, {
+  metadata: { id: "agt_01target", name: "helper", org: "acme" },
+});
+
+function ctxFor(stash = true) {
+  const ctx = new RequestContext(
+    ScheduleSchema,
+    create(ScheduleSchema, { metadata: { name: "nightly", org: "acme" } }),
+    testCallerIdentity(),
+    ApiResourceKind.schedule,
+  );
+  if (stash) {
+    ctx.set(REFERENCED_AGENT_KEY, agent);
+  }
+  return ctx;
+}
+
+describe("resolveScheduleCreateTargets", () => {
+  it("asks can_edit on the referenced agent and nothing else", () => {
+    expect(resolveScheduleCreateTargets(ctxFor())).toEqual([
+      {
+        permission: IamPermission.can_edit,
+        resourceKind: ApiResourceKind.agent,
+        resourceId: "agt_01target",
+        deniedMessage: SCHEDULE_CREATE_DENIED_MESSAGE,
+      },
+    ]);
+  });
+
+  it("a missing referenced agent is a broken chain invariant and throws", () => {
+    expect(() => resolveScheduleCreateTargets(ctxFor(false))).toThrow(
+      "referenced agent not found in context",
+    );
+  });
+});

package/src/domain/schedule/controller.ts

@@ -62,6 +62,10 @@ import type { PipelineStep } from "../../pipeline/pipeline.js";
 import { callerIdentityOf } from "../../pipeline/interceptors/auth.js";
 import { RequestContext } from "../../pipeline/request-context.js";
 import { newAuthorizeStep } from "../../pipeline/steps/authorize.js";
+import {
+  loadedTargetAsMethod,
+  newAuthorizeResolvedTargetStep,
+} from "../../pipeline/steps/authorize-resolved-target.js";
 import { newGuardReservedLabelsStep } from "../../pipeline/steps/guard-reserved-labels.js";
 import { newBuildNewStateStep } from "../../pipeline/steps/defaults.js";
 import { newBuildUpdateStateStep } from "../../pipeline/steps/build-update-state.js";
@@ -116,6 +120,7 @@ import { newClearSchedulePauseStep } from "./resume.js";
 import {
   newResolveScheduleDefaultsStep,
   newValidateScheduleUpdateStep,
+  resolveScheduleCreateTargets,
 } from "./steps.js";
 import {
   TRIGGER_RESULT_KEY,
@@ -201,6 +206,15 @@ async function createSchedule(
     .addStep(newValidateProtoStep())
     .addStep(newValidateVisibilityStep())
     .addStep(newResolveScheduleDefaultsStep(deps))
+    // Before the duplicate check and before ArmSchedule: a refused caller
+    // learns nothing about existing slugs and costs no Temporal schedule
+    // (steps.ts, resolveScheduleCreateTargets).
+    .addStep(
+      newAuthorizeResolvedTargetStep(
+        deps.authorizer,
+        resolveScheduleCreateTargets,
+      ),
+    )
     .addStep(newResolveSlugStep())
     .addStep(newCheckDuplicateStep(deps.store))
     .addStep(newBuildNewStateStep())
@@ -477,6 +491,12 @@ async function getByReference(
     )
     .addStep(newValidateProtoStep())
     .addStep(newLoadByReferenceStep(deps.store, ScheduleSchema))
+    .addStep(
+      newAuthorizeResolvedTargetStep(
+        deps.authorizer,
+        loadedTargetAsMethod(ScheduleQueryController.method.get),
+      ),
+    )
     .build()
     .execute(reqCtx);
   return reqCtx.get(TARGET_RESOURCE_KEY) as Schedule;

package/src/domain/schedule/steps.ts

@@ -8,10 +8,12 @@
  * __tests__/schedule.composed.test.ts.
  */
 import { AgentSchema } from "@stigmer/protos/ai/stigmer/agentic/agent/v1/api_pb";
+import type { Agent } from "@stigmer/protos/ai/stigmer/agentic/agent/v1/api_pb";
 import { ScheduleSchema } from "@stigmer/protos/ai/stigmer/agentic/schedule/v1/api_pb";
 import type { Schedule } from "@stigmer/protos/ai/stigmer/agentic/schedule/v1/api_pb";
 import type { ScheduleSpec } from "@stigmer/protos/ai/stigmer/agentic/schedule/v1/spec_pb";
 import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
+import { IamPermission } from "@stigmer/protos/ai/stigmer/iam/v1/enum_pb";
 
 import {
   failedPreconditionError,
@@ -21,6 +23,7 @@ import {
 } from "../../pipeline/errors.js";
 import type { PipelineStep } from "../../pipeline/pipeline.js";
 import type { RequestContext } from "../../pipeline/request-context.js";
+import type { AuthorizationTarget } from "../../pipeline/steps/authorize.js";
 import { findResourceBySlug } from "../../pipeline/steps/helpers.js";
 import { EXISTING_RESOURCE_KEY } from "../../pipeline/steps/load-existing.js";
 import type { Store } from "../../store/interface.js";
@@ -128,10 +131,47 @@ export function newResolveScheduleDefaultsStep(
       if (agentRef !== undefined) {
         agentRef.org = refOrg;
       }
+      ctx.set(REFERENCED_AGENT_KEY, found);
     },
   };
 }
 
+/**
+ * Context key for the agent ResolveScheduleDefaults resolved from
+ * spec.agent.agent_ref, read by the create lane's authorization step.
+ */
+export const REFERENCED_AGENT_KEY = "scheduleReferencedAgent";
+
+/** The deny copy of the create bar, the Java ScheduleCreateHandler's. */
+export const SCHEDULE_CREATE_DENIED_MESSAGE =
+  "You don't have permission to schedule this agent";
+
+/**
+ * The create lane's authorization question, for AuthorizeResolvedTarget
+ * after ResolveScheduleDefaults: can_edit on the REFERENCED AGENT. The RPC
+ * is is_skip_authorization because its target is that agent, resolved from
+ * a slug, not a request field; and there is deliberately no organization
+ * bar — a schedule is unattended spend on an agent, an editor's act, and
+ * the same-org invariant the resolve step enforces already binds the
+ * schedule's organization to the agent's (command.proto).
+ */
+export function resolveScheduleCreateTargets(
+  ctx: RequestContext<typeof ScheduleSchema>,
+): ReadonlyArray<AuthorizationTarget> {
+  const agent = ctx.get(REFERENCED_AGENT_KEY) as Agent | undefined;
+  if (agent === undefined) {
+    throw new Error("referenced agent not found in context");
+  }
+  return [
+    {
+      permission: IamPermission.can_edit,
+      resourceKind: ApiResourceKind.agent,
+      resourceId: agent.metadata?.id ?? "",
+      deniedMessage: SCHEDULE_CREATE_DENIED_MESSAGE,
+    },
+  ];
+}
+
 /**
  * Enforces the schedule-specific workspace constraint on the shared
  * AgentInvocation (DD-018 D-3): every workspace entry must be a git_repo
@@ -140,7 +180,9 @@ export function newResolveScheduleDefaultsStep(
  * deterministic provisioning failure at 3 AM. Copy is cross-edition
  * contract (Go validateScheduleWorkspace).
  */
-export function validateScheduleWorkspace(spec: ScheduleSpec | undefined): void {
+export function validateScheduleWorkspace(
+  spec: ScheduleSpec | undefined,
+): void {
   const entries =
     spec?.target.case === "agent" ? spec.target.value.workspaceEntries : [];
   for (const [i, entry] of entries.entries()) {
@@ -174,7 +216,8 @@ export function validateScheduleModelPinning(
   if (presence !== "") {
     throw invalidArgumentError(presence);
   }
-  const invocation = spec?.target.case === "agent" ? spec.target.value : undefined;
+  const invocation =
+    spec?.target.case === "agent" ? spec.target.value : undefined;
   const existence = unknownModelPinRefusal(
     modelRegistry,
     "spec.agent.run_config.model_name",

package/src/domain/session/__tests__/run-gate.test.ts

@@ -1,11 +1,11 @@
 /**
  * Pins the run gate's SPLICE in session-create over the real router (P1
- * sp.run-gate): the AuthorizeRunTarget step sits after
- * ResolveDefaultAgentInstance and before Persist, so (1) a denied caller
- * answers PERMISSION_DENIED with the domain's byte-pinned copy and leaves
- * no session row; (2) the check names the instance the CHAIN resolved,
- * not only the one the caller typed — the session-first shape (empty
- * spec) is checked against the platform default agent's default instance;
+ * sp.run-gate): the AuthorizeRunTarget step sits right after Authorize
+ * and before Persist, so (1) a denied caller answers PERMISSION_DENIED
+ * with the domain's byte-pinned copy and leaves no session row; (2) the
+ * built-in-assistant shape (empty spec) makes NO run-gate check and
+ * creates the session even under a denying run-gate authorizer — the
+ * organization's own create permission admitted it in the Authorize step;
  * (3) an allowed caller creates the session exactly as before. The
  * authorizer under test answers only run-gate checks (runGateOnlyAuthorizer),
  * so every refusal here is the run gate's and nobody else's.
@@ -20,11 +20,9 @@ import { Code, ConnectError, createClient } from "@connectrpc/connect";
 import { createGrpcTransport } from "@connectrpc/connect-node";
 
 import { AgentCommandController } from "@stigmer/protos/ai/stigmer/agentic/agent/v1/command_pb";
-import { AgentSchema } from "@stigmer/protos/ai/stigmer/agentic/agent/v1/api_pb";
 import { AgentQueryController } from "@stigmer/protos/ai/stigmer/agentic/agent/v1/query_pb";
 import { SessionCommandController } from "@stigmer/protos/ai/stigmer/agentic/session/v1/command_pb";
 import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
-import { ApiResourceVisibility } from "@stigmer/protos/ai/stigmer/commons/apiresource/enum_pb";
 import { IamPermission } from "@stigmer/protos/ai/stigmer/iam/v1/enum_pb";
 
 import { loadConfig } from "../../../boot/config.js";
@@ -33,10 +31,6 @@ import type { ComposedServer } from "../../../boot/compose.js";
 import { createLogger } from "../../../boot/logger.js";
 import type { AuthzDecision } from "../../../extensions/authorizer.js";
 import { runGateOnlyAuthorizer } from "../../../pipeline/__tests__/support.js";
-import {
-  DEFAULT_AGENT_LABEL,
-  DEFAULT_AGENT_LABEL_VALUE,
-} from "../../agent/defaultagent.js";
 import { runAgentInstanceDeniedMessage } from "../constants.js";
 
 const silentLogger = createLogger({
@@ -99,23 +93,6 @@ async function createAgent(name: string): Promise<string> {
   return agent.metadata!.id;
 }
 
-/** The default-agent label is operator-seeded state; stamp it on the row. */
-async function markDefaultAgent(agentId: string): Promise<void> {
-  const stored = await server.store.getResource(
-    ApiResourceKind.agent,
-    agentId,
-    AgentSchema,
-  );
-  stored.metadata!.labels[DEFAULT_AGENT_LABEL] = DEFAULT_AGENT_LABEL_VALUE;
-  stored.metadata!.visibility = ApiResourceVisibility.visibility_public;
-  await server.store.saveResource(
-    ApiResourceKind.agent,
-    agentId,
-    AgentSchema,
-    stored,
-  );
-}
-
 async function captureError(
   run: () => Promise<unknown>,
 ): Promise<ConnectError> {
@@ -154,33 +131,23 @@ describe("session-create run gate (composed server)", () => {
     expect(await sessionCount(), "no row behind a denial").toBe(before);
   });
 
-  it("checks the instance the chain RESOLVED for the session-first shape", async () => {
+  it("makes no check for the built-in assistant (empty spec) and creates the session", async () => {
     decision = { kind: "deny", reason: "" };
     gate.runGateChecks.length = 0;
-    const agentId = await createAgent("Default agent for the run gate");
-    await markDefaultAgent(agentId);
+    const before = await sessionCount();
 
-    const err = await captureError(() =>
-      sessionCommand.create({
-        apiVersion: API_VERSION,
-        kind: "Session",
-        metadata: { name: "Session-first", org: ORG },
-        spec: {},
-      }),
-    );
+    const session = await sessionCommand.create({
+      apiVersion: API_VERSION,
+      kind: "Session",
+      metadata: { name: "Session-first", org: ORG },
+      spec: {},
+    });
 
-    expect(err.code).toBe(Code.PermissionDenied);
-    // ResolveDefaultAgentInstance created (or found) the default agent's
-    // default instance BEFORE the gate — the inherited pre-gate side
-    // effect the slot table records — and the gate names exactly it.
-    const agent = await agentQuery.get({ value: agentId });
-    const resolvedInstanceId = agent.status?.defaultInstanceId ?? "";
-    expect(resolvedInstanceId).not.toBe("");
-    expect(gate.runGateChecks).toHaveLength(1);
-    expect(gate.runGateChecks[0].resourceId).toBe(resolvedInstanceId);
-    expect(err.rawMessage).toBe(
-      runAgentInstanceDeniedMessage(resolvedInstanceId),
-    );
+    // No instance, no blueprint to spend, no target: the gate is silent
+    // and the denying authorizer is never asked.
+    expect(gate.runGateChecks).toHaveLength(0);
+    expect(session.spec?.agentInstanceId).toBe("");
+    expect(await sessionCount()).toBe(before + 1);
   });
 
   it("not-found answers NOT_FOUND naming the instance (the stigmer#224 order)", async () => {