@stigmer/server 3.21.0 → 3.22.1-dev.20260922095755

package/src/authorization/__tests__/derived-tuples.test.ts

@@ -3,8 +3,7 @@
  * built-in authorizer: which tuples a stored row stands for, in exactly
  * the shapes the cloud's tuple driver writes (stigmer-cloud
  * iam/tuple-lifecycle.ts: `organization:<org>#viewer` for the org level,
- * the conditional `identity_account:*` for public, the owner by the
- * kind's attribution, the parent links by `kind_meta`). Two facts are the
+ * the owner by the kind's attribution, the parent links by `kind_meta`). Two facts are the
  * OSS edition's own and are pinned here by name: the organization's owner
  * is a ROW (2b's role lifecycle), never derived from its creator stamp,
  * or a revoked founder would stay owner; and a stamp that names no person
@@ -96,7 +95,7 @@ describe("deriveTuples — the cloud driver's shapes, from the row", () => {
     ]);
   });
 
-  it("a public blueprint adds the conditional wildcard AND keeps the org floor", () => {
+  it("a row that still carries the retired public level derives no viewer tuple at all — no shape reaches every account, and the level's own org floor left with it", () => {
     expect(
       derivedFor("skill", {
         visibility: ApiResourceVisibility.visibility_public,
@@ -104,8 +103,6 @@ describe("deriveTuples — the cloud driver's shapes, from the row", () => {
     ).toEqual([
       "skill:skill-1#organization@organization:acme",
       "skill:skill-1#owner@identity_account:ida_carol",
-      "skill:skill-1#viewer@identity_account:* with allow_public",
-      "skill:skill-1#viewer@organization:acme#viewer",
     ]);
   });
 
@@ -166,7 +163,7 @@ describe("deriveTuples — the cloud driver's shapes, from the row", () => {
     ).toEqual(["memory:memory-1#organization@organization:acme"]);
   });
 
-  it("an environment carries its creator tuple, an org-viewer at org level, and NO public wildcard (the kind's ceiling)", () => {
+  it("an environment carries its creator tuple and an org-viewer at org level, and nothing beyond its org ceiling", () => {
     expect(
       derivedFor("environment", {
         visibility: ApiResourceVisibility.visibility_org,
@@ -179,7 +176,7 @@ describe("deriveTuples — the cloud driver's shapes, from the row", () => {
     ]);
     expect(
       derivedFor("environment", {
-        visibility: ApiResourceVisibility.visibility_public,
+        visibility: ApiResourceVisibility.visibility_platform,
       }),
     ).toEqual([
       "environment:environment-1#organization@organization:acme",
@@ -509,9 +506,6 @@ describe.each(driverFixtures(SEEDED_KINDS))(
             object,
             "can_view",
             DAVE,
-            {
-              allow: false,
-            },
           ),
         ).toBe(true);
         expect(rowReads).toBe(1);
@@ -707,7 +701,6 @@ describe.each(driverFixtures(SEEDED_KINDS))(
           parseObjectRef(object),
           relation,
           person,
-          { allow: true },
         );
       }
 

package/src/authorization/__tests__/evaluator.test.ts

@@ -1,11 +1,10 @@
 /**
  * Pins the evaluator's semantics the store tests cannot express (the
  * cloud's `.fga.yaml` documents prove the model's answers; this file
- * proves the machinery under them): how a person matches a tuple, what
- * the `allow_public` context does, that a direct tuple outside the line's
- * type restriction is ignored (model drift fails closed), how far a
- * resolution may walk, and that a declaration cycle or an undeclared
- * target is a thrown fault and never a silent deny.
+ * proves the machinery under them): how a person matches a tuple, that a
+ * direct tuple outside the line's type restriction is ignored (model drift
+ * fails closed), how far a resolution may walk, and that a declaration
+ * cycle or an undeclared target is a thrown fault and never a silent deny.
  *
  * The fixture source is the in-memory one the store-test kit uses, so the
  * two proofs share one tuple vocabulary. Where a case needs a shape the
@@ -30,7 +29,6 @@ import {
   direct,
   from,
   objectOf,
-  publicWith,
   union,
   usersetOf,
 } from "../model/rewrite.js";
@@ -56,22 +54,17 @@ function person(accountId: string, ...aliases: string[]): Person {
   return { accountId, aliases: new Set([accountId, ...aliases]) };
 }
 
-const RESOLVE = { allow: true };
-const LIST = { allow: false };
-
 async function allowed(
   source: TupleSource,
   object: string,
   relation: string,
   who: Person,
-  context = RESOLVE,
 ): Promise<boolean> {
   return checkRelation(
     { model: builtInModel, source },
     parseObjectRef(object),
     relation,
     who,
-    context,
   );
 }
 
@@ -100,67 +93,17 @@ describe("a person against a direct tuple", () => {
   });
 });
 
-describe("the public wildcard and its condition", () => {
-  const publicViewer = (object: string): Tuple => ({
-    object: parseObjectRef(object),
-    relation: "viewer",
-    subject: {
-      form: "wildcard",
-      type: "identity_account",
-      condition: "allow_public",
-    },
-  });
-  const source = newInMemoryTupleSource([
-    tuple("agent:open#organization@organization:acme"),
-    publicViewer("agent:open"),
-  ]);
-  const stranger = person("ida_mallory");
-
-  it("reads for anyone on a point check (the cloud's `allow: true`) and for nobody in a listing (`allow: false`)", async () => {
+describe("a stranger against a row with no grant that names them", () => {
+  it("reads nothing: no subject form reaches every account, so a stranger holds no relation on a row they were not granted", async () => {
+    const source = newInMemoryTupleSource([
+      tuple("agent:open#organization@organization:acme"),
+      tuple("agent:open#owner@identity_account:ida_carol"),
+      tuple("agent:open#viewer@organization:acme#viewer"),
+    ]);
+    const stranger = person("ida_mallory");
     expect(await allowed(source, "agent:open", "can_view", stranger)).toBe(
-      true,
+      false,
     );
-    expect(
-      await allowed(source, "agent:open", "can_view", stranger, LIST),
-    ).toBe(false);
-  });
-
-  it("ignores a wildcard tuple that carries no condition where the line demands one — a tuple the cloud could never have written", async () => {
-    const bare = newInMemoryTupleSource([
-      tuple("agent:open#viewer@identity_account:*"),
-    ]);
-    expect(await allowed(bare, "agent:open", "can_view", stranger)).toBe(false);
-  });
-
-  it("is a thrown fault under a condition the transcript names but the evaluator does not know — a model that grew a condition", async () => {
-    const grown = declareKind({
-      kind: ApiResourceKind.agent,
-      schema: AgentSchema,
-      source: "test/grown.fga",
-      relations: [
-        ["viewer", direct(publicWith("identity_account", "after_hours"))],
-      ],
-    });
-    const afterHours = newInMemoryTupleSource([
-      {
-        object: parseObjectRef("agent:open"),
-        relation: "viewer",
-        subject: {
-          form: "wildcard",
-          type: "identity_account",
-          condition: "after_hours",
-        },
-      },
-    ]);
-    await expect(
-      checkRelation(
-        { model: newModel([grown]), source: afterHours },
-        parseObjectRef("agent:open"),
-        "viewer",
-        stranger,
-        RESOLVE,
-      ),
-    ).rejects.toMatchObject({ reason: "unknown-condition" });
   });
 });
 
@@ -277,7 +220,6 @@ describe("the walk itself", () => {
         parseObjectRef("agent:n0"),
         "next",
         person("ida_nobody"),
-        RESOLVE,
       ),
     ).rejects.toMatchObject({ reason: "resolution-depth-exceeded" });
   });
@@ -298,7 +240,6 @@ describe("the walk itself", () => {
         parseObjectRef("agent:x"),
         "a",
         person("ida_nobody"),
-        RESOLVE,
       ),
     ).rejects.toBeInstanceOf(AuthorizationEvaluationError);
   });
@@ -332,7 +273,7 @@ describe("declareKind validates a transcript at load", () => {
         source: "test/bad.fga",
         relations: [
           ["viewer", direct(objectOf("identity_account"))],
-          ["viewer", direct(publicWith("identity_account", "allow_public"))],
+          ["viewer", direct(usersetOf("organization", "viewer"))],
         ],
       }),
     ).toThrow("declared twice");

package/src/authorization/__tests__/facts.test.ts

@@ -50,7 +50,7 @@ describe("rowFactsOf against the tuple lifecycle's own resolution", () => {
     for (const visibility of [
       ApiResourceVisibility.visibility_private,
       ApiResourceVisibility.visibility_org,
-      ApiResourceVisibility.visibility_public,
+      ApiResourceVisibility.visibility_platform,
     ]) {
       it(`${declaration.type} at ${ApiResourceVisibility[visibility]}: the same parent links and visibility shapes`, () => {
         const row = fixtureRow(declaration, {
@@ -133,7 +133,7 @@ describe("a list candidate against the loaded row — the facts' two producers",
     for (const visibility of [
       ApiResourceVisibility.visibility_private,
       ApiResourceVisibility.visibility_org,
-      ApiResourceVisibility.visibility_public,
+      ApiResourceVisibility.visibility_platform,
     ]) {
       it(`${declaration.type} at ${ApiResourceVisibility[visibility]}: the candidate the helper builds carries the facts the driver derives from`, async () => {
         const row = fixtureRow(declaration, {

package/src/authorization/__tests__/fixtures/fga/blueprint-private-visibility.fga.yaml

@@ -1,5 +1,5 @@
 # Pinned copy of stigmer-cloud backend/services/stigmer-server/fga/tests/blueprint-private-visibility.fga.yaml
-# at commit 2ec420161 (the OpenFGA store test the cloud runs against its live model).
+# as changed by stigmer-cloud#765 (the OpenFGA store test the cloud runs against its live model).
 # The body below is byte-identical to the source; the cloud re-runs the LIVE
 # file against this evaluator at the re-pin, so a stale copy is caught there.
 # Store tests for real blueprint privacy (Phase 3 of the visibility model).
@@ -14,7 +14,6 @@
 #             viewers; pre-cloud#257 tuples carried #member, which excluded
 #             viewer-role users — still honored until backfilled, see the
 #             legacy-bot fixture)
-#   PUBLIC    viewer@identity_account:* (allow_public)  +  the ORG tuple
 #   PLATFORM  platform_viewer@identity_provider:<idp>#platform_user  +  the ORG tuple
 #
 # Read vs spend: an org viewer-role user READS org-visible blueprints (and, at
@@ -23,9 +22,8 @@
 # can_create_execution_in permissions, which require member-or-guest. The
 # vera assertions pin both halves of that contract.
 #
-# The ORG tuple rides along on PUBLIC/PLATFORM (the "org floor") so a shared
-# blueprint stays listable in its own org — org-scoped ListObjects runs with
-# {"allow": false}, which suppresses the public wildcard.
+# The ORG tuple rides along on PLATFORM (the "org floor") so a shared
+# blueprint stays listable in its own org.
 #
 # T08 exception: org ADMINS (and org owners, via the role hierarchy) are
 # composed into blueprint `owner` and therefore see, list, and manage
@@ -39,8 +37,8 @@
 # Scenario: org "acme" has owner-creator carol, org admin oscar, plain
 # member dave, and read-only viewer vera (the role SSO auto-provisioning
 # grants by default); mallory belongs to an unrelated org. Carol authors one
-# blueprint of each kind at PRIVATE, plus an ORG agent, a PUBLIC agent, and
-# a legacy ORG agent whose tuple still carries the pre-cloud#257 shape.
+# blueprint of each kind at PRIVATE, plus an ORG agent and a legacy ORG
+# agent whose tuple still carries the pre-cloud#257 shape.
 name: blueprint-private-visibility
 model_file: ../model/fga.mod
 
@@ -114,22 +112,6 @@ tuples:
     relation: viewer
     object: agent:legacy-bot
 
-  # --- PUBLIC agent (wildcard + org floor tuple) ---
-  - user: organization:acme
-    relation: organization
-    object: agent:open-bot
-  - user: identity_account:carol
-    relation: owner
-    object: agent:open-bot
-  - user: identity_account:*
-    relation: viewer
-    object: agent:open-bot
-    condition:
-      name: allow_public
-  - user: organization:acme#viewer
-    relation: viewer
-    object: agent:open-bot
-
   # --- PRIVATE agent with an explicit individual viewer grant ---
   - user: organization:acme
     relation: organization
@@ -146,8 +128,6 @@ tests:
     check:
       - user: identity_account:dave
         object: agent:secret-bot
-        context:
-          allow: false
         assertions:
           can_view: false
           can_execute: false
@@ -155,22 +135,16 @@ tests:
           can_clone: false
       - user: identity_account:dave
         object: skill:secret-notes
-        context:
-          allow: false
         assertions:
           can_view: false
           can_use: false
       - user: identity_account:dave
         object: workflow:secret-flow
-        context:
-          allow: false
         assertions:
           can_view: false
           can_execute: false
       - user: identity_account:dave
         object: mcp_server:secret-tools
-        context:
-          allow: false
         assertions:
           can_view: false
           can_use: false
@@ -180,8 +154,6 @@ tests:
     check:
       - user: identity_account:oscar
         object: agent:secret-bot
-        context:
-          allow: false
         assertions:
           can_view: true
           can_edit: true
@@ -189,15 +161,11 @@ tests:
           can_execute: true
       - user: identity_account:oscar
         object: skill:secret-notes
-        context:
-          allow: false
         assertions:
           can_view: true
           can_edit: true
       - user: identity_account:oscar
         object: workflow:secret-flow
-        context:
-          allow: false
         assertions:
           can_view: true
           can_edit: true
@@ -205,8 +173,6 @@ tests:
       # four private-blueprint kinds are pinned to the same rule.
       - user: identity_account:oscar
         object: mcp_server:secret-tools
-        context:
-          allow: false
         assertions:
           can_view: true
           can_edit: true
@@ -215,22 +181,17 @@ tests:
     list_objects:
       - user: identity_account:oscar
         type: agent
-        context:
-          allow: false
         assertions:
           can_view:
             - agent:secret-bot
             - agent:team-bot
             - agent:legacy-bot
-            - agent:open-bot
             - agent:shared-secret
 
   - name: owner retains full access to private blueprints
     check:
       - user: identity_account:carol
         object: agent:secret-bot
-        context:
-          allow: false
         assertions:
           can_view: true
           can_execute: true
@@ -239,8 +200,6 @@ tests:
           can_delete: true
       - user: identity_account:carol
         object: workflow:secret-flow
-        context:
-          allow: false
         assertions:
           can_view: true
           can_execute: true
@@ -250,8 +209,6 @@ tests:
     check:
       - user: identity_account:dave
         object: agent:team-bot
-        context:
-          allow: false
         assertions:
           can_view: true
           can_execute: true
@@ -260,33 +217,10 @@ tests:
           can_delete: false
       - user: identity_account:mallory
         object: agent:team-bot
-        context:
-          allow: false
         assertions:
           can_view: false
           can_execute: false
 
-  - name: public agent is reachable by everyone with allow context, and by org members without it
-    check:
-      # Outsider resolves through the conditional wildcard ({"allow": true}).
-      - user: identity_account:mallory
-        object: agent:open-bot
-        context:
-          allow: true
-        assertions:
-          can_view: true
-          can_execute: true
-      # Org member resolves through the org floor tuple even with the
-      # wildcard suppressed — this is what keeps public blueprints in
-      # org-scoped listings.
-      - user: identity_account:dave
-        object: agent:open-bot
-        context:
-          allow: false
-        assertions:
-          can_view: true
-          can_execute: true
-
   - name: explicit individual viewer grant on a private agent conveys view and run
     check:
       # Run-what-you-can-read: can_execute derives from viewer, so an
@@ -294,38 +228,30 @@ tests:
       # which checks can_view).
       - user: identity_account:dave
         object: agent:shared-secret
-        context:
-          allow: false
         assertions:
           can_view: true
           can_execute: true
           can_edit: false
 
-  - name: org member's listable agents exclude private ones (wildcard suppressed)
+  - name: org member's listable agents exclude private ones
     list_objects:
       - user: identity_account:dave
         type: agent
-        context:
-          allow: false
         assertions:
           can_view:
             - agent:team-bot
             - agent:legacy-bot
-            - agent:open-bot
             - agent:shared-secret
 
   - name: owner's listable agents include everything they authored
     list_objects:
       - user: identity_account:carol
         type: agent
-        context:
-          allow: false
         assertions:
           can_view:
             - agent:secret-bot
             - agent:team-bot
             - agent:legacy-bot
-            - agent:open-bot
             - agent:shared-secret
 
   # ── cloud#257: the viewer-role cell (previously untested) ──────────────
@@ -336,27 +262,16 @@ tests:
       # spend refusal is pinned separately on the org permissions below.
       - user: identity_account:vera
         object: agent:team-bot
-        context:
-          allow: false
         assertions:
           can_view: true
           can_clone: true
           can_execute: true
           can_edit: false
           can_delete: false
-      # The org floor of a PUBLIC blueprint reaches viewers the same way.
-      - user: identity_account:vera
-        object: agent:open-bot
-        context:
-          allow: false
-        assertions:
-          can_view: true
       # Private stays private — the viewer role grants nothing beyond the
       # explicit visibility tuples.
       - user: identity_account:vera
         object: agent:secret-bot
-        context:
-          allow: false
         assertions:
           can_view: false
           can_execute: false
@@ -382,8 +297,6 @@ tests:
     check:
       - user: identity_account:dave
         object: agent:legacy-bot
-        context:
-          allow: false
         assertions:
           can_view: true
           can_execute: true
@@ -392,8 +305,6 @@ tests:
       # organization#member. The boot backfill converges these tuples.
       - user: identity_account:vera
         object: agent:legacy-bot
-        context:
-          allow: false
         assertions:
           can_view: false
           can_execute: false
@@ -402,9 +313,6 @@ tests:
     list_objects:
       - user: identity_account:vera
         type: agent
-        context:
-          allow: false
         assertions:
           can_view:
             - agent:team-bot
-            - agent:open-bot

package/src/authorization/__tests__/fixtures/fga/default-instance-inheritance.fga.yaml

@@ -1,5 +1,5 @@
 # Pinned copy of stigmer-cloud backend/services/stigmer-server/fga/tests/default-instance-inheritance.fga.yaml
-# at commit b87dd1170 (the OpenFGA store test the cloud runs against its live model).
+# as changed by stigmer-cloud#765 (the OpenFGA store test the cloud runs against its live model).
 # The body below is byte-identical to the source; the cloud re-runs the LIVE
 # file against this evaluator at the re-pin, so a stale copy is caught there.
 # Store tests for default-instance structural inheritance (default_of).
@@ -7,8 +7,8 @@
 # A blueprint's system-managed default instance carries a single
 #   instance#default_of@<blueprint>:<id>
 # tuple and inherits the blueprint's ENTIRE viewer set through
-# `viewer from default_of` — org members, public users (allow_public), and
-# platform users (identity_provider#platform_user). No enum-derived
+# `viewer from default_of` — org members and platform users
+# (identity_provider#platform_user). No enum-derived
 # visibility tuples are ever written on default instances, so their access
 # can never drift from the template's.
 #
@@ -20,8 +20,7 @@
 # visibility level; each has a default instance linked via default_of.
 # Alice (acme member) reaches default instances of platform-shared
 # blueprints; planton members reach default instances of org-visible ones;
-# everyone reaches default instances of public ones; personal instances
-# never leak.
+# personal instances never leak.
 name: default-instance-inheritance
 model_file: ../model/fga.mod
 
@@ -115,35 +114,6 @@ tuples:
     relation: default_of
     object: agent_instance:internal-default
 
-  # --- Public agent + its default instance ---
-  # PUBLIC carries the org floor tuple too (viewer@org#viewer).
-  - user: organization:planton
-    relation: organization
-    object: agent:public-bot
-  - user: identity_account:swarup
-    relation: owner
-    object: agent:public-bot
-  - user: identity_account:*
-    relation: viewer
-    object: agent:public-bot
-    condition:
-      name: allow_public
-  - user: organization:planton#viewer
-    relation: viewer
-    object: agent:public-bot
-  - user: organization:planton
-    relation: organization
-    object: agent_instance:public-bot-default
-  - user: agent:public-bot
-    relation: agent
-    object: agent_instance:public-bot-default
-  - user: identity_account:swarup
-    relation: owner
-    object: agent_instance:public-bot-default
-  - user: agent:public-bot
-    relation: default_of
-    object: agent_instance:public-bot-default
-
   # --- Platform-shared workflow + its default instance ---
   - user: organization:planton
     relation: organization
@@ -175,8 +145,6 @@ tests:
     check:
       - user: identity_account:alice
         object: agent_instance:sara-default
-        context:
-          allow: false
         assertions:
           can_view: true
           can_execute: true
@@ -187,8 +155,6 @@ tests:
     check:
       - user: identity_account:mallory
         object: agent_instance:sara-default
-        context:
-          allow: false
         assertions:
           can_view: false
           can_execute: false
@@ -199,14 +165,10 @@ tests:
       # default_of tuple — only she (its owner) can reach it.
       - user: identity_account:swarup
         object: agent_instance:alice-personal
-        context:
-          allow: false
         assertions:
           can_view: false
       - user: identity_account:alice
         object: agent_instance:alice-personal
-        context:
-          allow: false
         assertions:
           can_view: true
           can_edit: true
@@ -215,8 +177,6 @@ tests:
     check:
       - user: identity_account:priya
         object: agent_instance:internal-default
-        context:
-          allow: false
         assertions:
           can_view: true
           can_execute: true
@@ -226,34 +186,19 @@ tests:
       # read audience, and the default instance inherits it structurally.
       - user: identity_account:veda
         object: agent_instance:internal-default
-        context:
-          allow: false
         assertions:
           can_view: true
           can_edit: false
       # Managed-org membership grants nothing on non-platform-shared agents.
       - user: identity_account:alice
         object: agent_instance:internal-default
-        context:
-          allow: false
         assertions:
           can_view: false
 
-  - name: everyone reaches the default instance of a public agent
-    check:
-      - user: identity_account:mallory
-        object: agent_instance:public-bot-default
-        context:
-          allow: true
-        assertions:
-          can_view: true
-
   - name: managed-org member reaches the default instance of a platform-shared workflow
     check:
       - user: identity_account:alice
         object: workflow_instance:onboarding-default
-        context:
-          allow: false
         assertions:
           can_view: true
           can_execute: true
@@ -263,8 +208,6 @@ tests:
     list_objects:
       - user: identity_account:alice
         type: agent_instance
-        context:
-          allow: false
         assertions:
           can_view:
             - agent_instance:sara-default