@stigmer/server 3.21.0 → 3.22.1-dev.20260922095755

package/src/authorization/derived-tuples.ts

@@ -12,7 +12,6 @@
  *   - owner SELF:     <row>#owner@identity_account:<row id>
  *   - creator:        <row>#creator@identity_account:<creator stamp>   (kinds flagged requires_creator_tuple)
  *   - org-viewer:     <row>#viewer@organization:<org>#viewer          (visibility_org; cloud#257's shape)
- *   - public-viewer:  <row>#viewer@identity_account:* with allow_public
  *   - platform-viewer: none — it fans out over identity providers, a kind this edition does not serve
  *
  * Two facts are this edition's own and are stated here, nowhere else:
@@ -91,11 +90,7 @@ import type {
   Tuple,
   TupleSource,
 } from "./tuples.js";
-import {
-  ACCOUNT_TYPE,
-  ALLOW_PUBLIC_CONDITION,
-  formatObjectRef,
-} from "./tuples.js";
+import { ACCOUNT_TYPE, formatObjectRef } from "./tuples.js";
 
 /**
  * Kinds whose `[identity_account]` owner is recorded as an IamPolicy row
@@ -184,12 +179,6 @@ function visibilitySubject(
             object: { type: "organization", id: org },
             relation: "viewer",
           };
-    case "public-viewer":
-      return {
-        form: "wildcard",
-        type: ACCOUNT_TYPE,
-        condition: ALLOW_PUBLIC_CONDITION,
-      };
     case "platform-viewer":
       return undefined;
     default: {
@@ -361,24 +350,18 @@ function tupleOfRow(row: IamPolicy): Tuple {
     type: principal?.kind ?? "",
     id: principal?.id ?? "",
   };
-  let subject: Subject;
-  if (principal !== undefined && principal.relation !== "") {
-    subject = {
-      form: "userset",
-      object: principalObject,
-      relation: principal.relation,
-    };
-  } else if (principalObject.id === "*") {
-    // A wildcard row carries no condition of its own; the evaluator
-    // honours it only where a line admits an unconditioned wildcard,
-    // which no line in the model does.
-    subject = {
-      form: "wildcard",
-      type: principalObject.type,
-      condition: undefined,
-    };
-  } else {
-    subject = { form: "object", object: principalObject };
-  }
+  // A principal id of `*` (a wildcard row a cloud database may still hold
+  // from the retired public level) is read as an ordinary object id here:
+  // no person carries `*` among their aliases, so the row matches nobody
+  // and reads as the inert grant it is, never as a fault that would turn
+  // the resource unreadable.
+  const subject: Subject =
+    principal !== undefined && principal.relation !== ""
+      ? {
+          form: "userset",
+          object: principalObject,
+          relation: principal.relation,
+        }
+      : { form: "object", object: principalObject };
   return { object, relation: spec?.relation ?? "", subject };
 }

package/src/authorization/evaluator.ts

@@ -1,10 +1,11 @@
 /**
  * The evaluator — OpenFGA's check, over the built-in model and a tuple
  * source, small because the model uses four rewrite forms and nothing
- * else (model/rewrite.ts). `checkRelation(object, relation, person, context)`
+ * else (model/rewrite.ts). `checkRelation(object, relation, person)`
  * answers "does this person hold this relation on this object" the way
  * the cloud's engine answers it over stored tuples, so the two editions
- * share one meaning of authorization.
+ * share one meaning of authorization. There is no context parameter: the
+ * model declares no condition, so a check has no posture to state.
  *
  * The walk, in the order a `.fga` line reads:
  *   - `this`: the tuples on (object, relation). A tuple counts only if
@@ -12,9 +13,7 @@
  *     OpenFGA makes at write time, made here at read time, so a derived
  *     tuple the model no longer admits denies instead of allowing. An
  *     object subject matches when it names one of the person's aliases;
- *     a userset subject is resolved on its own object; the wildcard is
- *     honoured only under its condition (`allow_public` reads the
- *     context's `allow`; an unknown condition is a fault).
+ *     a userset subject is resolved on its own object.
  *   - `computed`: the same object, another relation.
  *   - `from`: every object the tupleset relation links to (again within
  *     the tupleset line's type restriction), resolved for the relation.
@@ -44,19 +43,8 @@
  */
 import type { Model } from "./model/index.js";
 import type { Rewrite, SubjectType } from "./model/rewrite.js";
-import type {
-  CheckContext,
-  ObjectRef,
-  Person,
-  Subject,
-  TupleSource,
-} from "./tuples.js";
-import {
-  ACCOUNT_TYPE,
-  ALLOW_PUBLIC_CONDITION,
-  formatObjectRef,
-  pairKey,
-} from "./tuples.js";
+import type { ObjectRef, Person, Subject, TupleSource } from "./tuples.js";
+import { ACCOUNT_TYPE, formatObjectRef, pairKey } from "./tuples.js";
 
 /**
  * OpenFGA's default resolution-depth limit (its `resolveNodeLimit`), so
@@ -67,11 +55,17 @@ import {
  */
 export const MAX_RESOLUTION_DEPTH = 25;
 
+/**
+ * The faults an evaluation can raise. Two are consumer bugs by the seam
+ * contracts (a kind the model does not declare; the `internal` class
+ * offered to the list scope's restrict verb, which the shared helper
+ * answers before any driver); the rest are the model's own.
+ */
 export type EvaluationFault =
   | "undeclared-target-kind"
+  | "internal-caller-offered"
   | "resolution-depth-exceeded"
-  | "resolution-cycle"
-  | "unknown-condition";
+  | "resolution-cycle";
 
 /** A fault in the model or its evaluation — never a denial; the driver maps it to `unavailable`. */
 export class AuthorizationEvaluationError extends Error {
@@ -94,7 +88,6 @@ export async function checkRelation(
   object: ObjectRef,
   relation: string,
   person: Person,
-  context: CheckContext,
 ): Promise<boolean> {
   if (deps.model.byType(object.type) === undefined) {
     throw new AuthorizationEvaluationError(
@@ -102,7 +95,7 @@ export async function checkRelation(
       `no declaration for kind '${object.type}' (target ${formatObjectRef(object)})`,
     );
   }
-  return new Walk(deps, person, context).resolve(object, relation, 0);
+  return new Walk(deps, person).resolve(object, relation, 0);
 }
 
 /** One check's state: the memo and the in-progress set, over one source. */
@@ -113,7 +106,6 @@ class Walk {
   constructor(
     private readonly deps: EvaluationDeps,
     private readonly person: Person,
-    private readonly context: CheckContext,
   ) {}
 
   resolve(
@@ -227,15 +219,6 @@ class Walk {
               allowed.relation === subject.relation,
           ) && (await this.resolve(subject.object, subject.relation, depth + 1))
         );
-      case "wildcard": {
-        const allowed = restriction.some(
-          (entry) =>
-            entry.form === "wildcard" &&
-            entry.type === subject.type &&
-            entry.condition === subject.condition,
-        );
-        return allowed && this.conditionHolds(subject.condition);
-      }
       default: {
         const exhaustive: never = subject;
         throw new Error(`unknown subject form: ${JSON.stringify(exhaustive)}`);
@@ -243,18 +226,6 @@ class Walk {
     }
   }
 
-  private conditionHolds(condition: string | undefined): boolean {
-    switch (condition) {
-      case ALLOW_PUBLIC_CONDITION:
-        return this.context.allow;
-      default:
-        throw new AuthorizationEvaluationError(
-          "unknown-condition",
-          `the model declares no condition '${String(condition)}'`,
-        );
-    }
-  }
-
   /** The object types the tupleset line admits — `[organization]`, `[session]` — from its `this` nodes. */
   private objectTypesOf(
     object: ObjectRef,

package/src/authorization/list-read-scope.ts

@@ -11,12 +11,10 @@
  * row a second time. A self-host's lists show a person exactly what a
  * `get` would let them read.
  *
- * Both verbs ask under the LISTING context, `allow: false` — the public
- * wildcard suppressed, the cloud's own posture (its Java
- * listAuthorizedResourceIds set it): a legacy PUBLIC row reads for any
- * signed-in person on a point check and never expands into an outsider's
- * listing; the organization's own people still reach it through the
- * org-viewer shape public also emits.
+ * Both verbs ask the same question a point check asks, `can_view` on the
+ * candidate: the model has no subject whose answer differs between a
+ * listing and a get, so a list is exactly the set of rows a get would
+ * read.
  *
  *   - `restrictListEntries`: one derived source for the caller, seeded
  *     with every candidate's facts; one `checkRelation` per unique id —
@@ -38,17 +36,25 @@
  *     lane can show it either.
  *
  * The `internal` class — the server acting as itself over the in-process
- * transport — keeps every offered id and enumerates every id of the kind:
- * the in-process authorization skip (pipeline/interceptors/auth.ts, ruling
- * Q4) applied to a list answer, as the built-in directory applies it to a
- * directory answer. No in-process edge reaches a list lane today; the arm
- * is pinned so a future one meets the same rule every other lane keeps.
+ * transport — is answered by the seam, not here: `restrictListByReadScope`
+ * returns the org-narrowed rows for the class before any driver is asked
+ * (extensions/list-read-scope.ts, the header's contract line), the
+ * Authorize step's trust-domain rule applied to a list answer. So this
+ * driver's `restrictListEntries` REFUSES the class (`internal-caller-offered`):
+ * being offered it means a caller reached the driver around the one
+ * consumption idiom, and evaluating the server as a person would return
+ * a quiet short list — the failure shape stigmer#1207 fixed. The
+ * enumeration verb has no helper in front of it and keeps its own arm:
+ * every id of the kind, as the built-in directory answers the class with
+ * every organization. No in-process edge reaches an enumeration lane
+ * today; the arm is pinned so a future one meets the rule.
  *
  * Faults THROW and are never an empty answer (the seam: an empty set means
  * "authorized to see nothing"; an outage is the pipeline's sanitized
- * INTERNAL). A kind the model does not declare is a consumer bug by the
- * seam's contract and faults through the evaluator, loud; the model
- * declares exactly the open-source tier, so no served lane can reach it.
+ * INTERNAL). A kind the model does not declare, like the internal class
+ * above, is a consumer bug by the seam's contract and faults through the
+ * evaluator, loud; the model declares exactly the open-source tier, so no
+ * served lane can reach it.
  *
  * Logging. One debug line per call — kind, offered, kept, elapsed — what
  * an operator needs to answer "why is Alice's list short" beside the
@@ -76,14 +82,11 @@ import { builtInModel } from "./model/index.js";
 import type { KindDeclaration } from "./model/rewrite.js";
 import type { AccountsByCaller } from "./person.js";
 import { resolvePerson } from "./person.js";
-import type { CheckContext, ObjectRef, Person } from "./tuples.js";
+import type { ObjectRef, Person } from "./tuples.js";
 
 /** The relation every list lane reads through (the cloud's LIST_RELATION). */
 const LIST_RELATION = "can_view";
 
-/** The listing context: the public wildcard suppressed (the module header). */
-const LISTING: CheckContext = { allow: false };
-
 export interface BuiltInListReadScopeDeps {
   readonly store: Store;
   /** The port the grant path writes through — the person's rows are read from the same instance. */
@@ -130,7 +133,6 @@ export function newBuiltInListReadScope(
           object,
           LIST_RELATION,
           person,
-          LISTING,
         );
         return allowed ? facts.id : undefined;
       }),
@@ -188,6 +190,12 @@ export function newBuiltInListReadScope(
       entries: ReadonlyArray<ListEntryMeta>,
     ): Promise<ReadonlySet<string>> {
       requireDeclared(kind);
+      if (caller.callerClass === "internal") {
+        throw new AuthorizationEvaluationError(
+          "internal-caller-offered",
+          `the internal caller class was offered to the list scope for kind '${kindEnumName(kind)}' — the shared helper answers that class before any driver; a list lane reached the driver around it`,
+        );
+      }
       // One candidate per unique id: a lane offers each row once, and a
       // duplicate would only spend a walk to learn the same answer.
       const unique = new Map<string, RowFacts>();
@@ -196,9 +204,6 @@ export function newBuiltInListReadScope(
           unique.set(entry.id, rowFactsOfEntry(kind, entry));
         }
       }
-      if (caller.callerClass === "internal") {
-        return new Set(unique.keys());
-      }
       return visibleAmong(caller, kind, [...unique.values()]);
     },
 

package/src/authorization/model/__tests__/registry.test.ts

@@ -104,6 +104,7 @@ const WIRE_PERMISSIONS_BY_TYPE: Readonly<
     "can_create_environment",
     "can_create_skill",
     "can_create_plugin",
+    "can_create_mcp_server",
     "can_create_idp",
     "can_create_identity_account",
     "can_create_oauth_app",
@@ -111,6 +112,7 @@ const WIRE_PERMISSIONS_BY_TYPE: Readonly<
     "can_create_channel_app",
     "can_create_execution_in",
     "can_create_agent_share",
+    "can_create_agent_instance",
     "can_grant_access",
     "can_view_access",
     "can_view_billing",

package/src/authorization/model/agent.ts

@@ -4,9 +4,8 @@
  * read by whoever the visibility axis lets in. The `organization#member`
  * and `organization#viewer` usersets on `viewer` are the org-visibility
  * tuple's two shapes (the cloud writes `#viewer` since cloud#257; `#member`
- * is the legacy shape it still honours), the conditional wildcard is the
- * public level, and `platform_viewer` is an identity-provider userset no
- * open-source tuple ever names.
+ * is the legacy shape it still honours), and `platform_viewer` is an
+ * identity-provider userset no open-source tuple ever names.
  */
 import { AgentSchema } from "@stigmer/protos/ai/stigmer/agentic/agent/v1/api_pb";
 import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
@@ -17,7 +16,6 @@ import {
   direct,
   from,
   objectOf,
-  publicWith,
   union,
   usersetOf,
 } from "./rewrite.js";
@@ -44,7 +42,6 @@ export const agentDeclaration = declareKind({
       union(
         direct(
           objectOf("identity_account"),
-          publicWith("identity_account", "allow_public"),
           usersetOf("organization", "member"),
           usersetOf("organization", "viewer"),
         ),

package/src/authorization/model/agent_instance.ts

@@ -19,7 +19,6 @@ import {
   direct,
   from,
   objectOf,
-  publicWith,
   union,
   usersetOf,
 } from "./rewrite.js";
@@ -38,7 +37,6 @@ export const agentInstanceDeclaration = declareKind({
       union(
         direct(
           objectOf("identity_account"),
-          publicWith("identity_account", "allow_public"),
           usersetOf("organization", "member"),
           usersetOf("organization", "viewer"),
         ),

package/src/authorization/model/mcp_server.ts

@@ -12,7 +12,6 @@ import {
   direct,
   from,
   objectOf,
-  publicWith,
   union,
   usersetOf,
 } from "./rewrite.js";
@@ -39,7 +38,6 @@ export const mcpServerDeclaration = declareKind({
       union(
         direct(
           objectOf("identity_account"),
-          publicWith("identity_account", "allow_public"),
           usersetOf("organization", "member"),
           usersetOf("organization", "viewer"),
         ),

package/src/authorization/model/organization.ts

@@ -39,6 +39,7 @@ export const organizationDeclaration = declareKind({
     ["can_create_environment", computed("member")],
     ["can_create_skill", computed("admin")],
     ["can_create_plugin", computed("admin")],
+    ["can_create_mcp_server", computed("admin")],
     ["can_create_idp", computed("admin")],
     ["can_create_identity_account", computed("admin")],
     ["can_create_oauth_app", computed("admin")],
@@ -46,6 +47,7 @@ export const organizationDeclaration = declareKind({
     ["can_create_channel_app", computed("admin")],
     ["can_create_execution_in", union(computed("member"), computed("guest"))],
     ["can_create_agent_share", computed("admin")],
+    ["can_create_agent_instance", computed("member")],
     ["can_grant_access", computed("admin")],
     ["can_view_access", computed("viewer")],
     ["can_view_billing", computed("viewer")],

package/src/authorization/model/plugin.ts

@@ -2,8 +2,7 @@
  * Transcript of fga/model/agentic/plugin.fga — the unit of install, shaped
  * exactly like a skill: an organization-owned blueprint whose owner is the
  * installer (and, through the organization, its admins), whose viewers are
- * the org's members and viewers, public readers when published, and the
- * platform viewer. Its verbs are the blueprint set: `can_view`, `can_edit`
+ * the org's members and viewers and the platform viewer. Its verbs are the blueprint set: `can_view`, `can_edit`
  * (visibility), `can_delete` (uninstall), `can_grant_access`,
  * `can_view_access`; `can_use` is carried as the model's word for
  * "install from" though no wire permission names it yet.
@@ -21,7 +20,6 @@ import {
   direct,
   from,
   objectOf,
-  publicWith,
   union,
   usersetOf,
 } from "./rewrite.js";
@@ -48,7 +46,6 @@ export const pluginDeclaration = declareKind({
       union(
         direct(
           objectOf("identity_account"),
-          publicWith("identity_account", "allow_public"),
           usersetOf("organization", "member"),
           usersetOf("organization", "viewer"),
         ),

package/src/authorization/model/rewrite.ts

@@ -6,12 +6,17 @@
  *   define organization: [organization]                      → direct(objectOf("organization"))
  *   define owner: [identity_account] or admin from organization
  *                → union(direct(objectOf("identity_account")), from("admin", "organization"))
- *   define viewer: [identity_account, identity_account:* with allow_public,
- *                   organization#member, organization#viewer] or owner or platform_viewer
- *                → union(direct(objectOf(...), publicWith(...), usersetOf(...), usersetOf(...)),
+ *   define viewer: [identity_account, organization#member, organization#viewer]
+ *                   or owner or platform_viewer
+ *                → union(direct(objectOf(...), usersetOf(...), usersetOf(...)),
  *                        computed("owner"), computed("platform_viewer"))
  *   define can_view: viewer                                   → computed("viewer")
  *
+ * A subject type is an object type or a userset; the model admits no
+ * wildcard (`type:*`) and declares no condition, so neither has a form
+ * here. The day a line needs one, the transcript cannot be written and
+ * the gap is a design act.
+ *
  * A declaration file (model/<kind>.ts) is a TRANSCRIPT of its `.fga`
  * file: the same relations, in the file's order, each line rewritten in
  * these builders so a reader with the model open sees the same text, and
@@ -53,12 +58,6 @@ export type SubjectType =
       readonly form: "userset";
       readonly type: string;
       readonly relation: string;
-    }
-  /** `[identity_account:* with allow_public]` — every object of the type, under the condition. */
-  | {
-      readonly form: "wildcard";
-      readonly type: string;
-      readonly condition: string;
     };
 
 export type Rewrite =
@@ -87,10 +86,6 @@ export function usersetOf(type: string, relation: string): SubjectType {
   return { form: "userset", type, relation };
 }
 
-export function publicWith(type: string, condition: string): SubjectType {
-  return { form: "wildcard", type, condition };
-}
-
 export function direct(...subjects: ReadonlyArray<SubjectType>): Rewrite {
   return { node: "this", subjects };
 }

package/src/authorization/model/skill.ts

@@ -14,7 +14,6 @@ import {
   direct,
   from,
   objectOf,
-  publicWith,
   union,
   usersetOf,
 } from "./rewrite.js";
@@ -41,7 +40,6 @@ export const skillDeclaration = declareKind({
       union(
         direct(
           objectOf("identity_account"),
-          publicWith("identity_account", "allow_public"),
           usersetOf("organization", "member"),
           usersetOf("organization", "viewer"),
         ),

package/src/authorization/model/workflow.ts

@@ -14,7 +14,6 @@ import {
   direct,
   from,
   objectOf,
-  publicWith,
   union,
   usersetOf,
 } from "./rewrite.js";
@@ -41,7 +40,6 @@ export const workflowDeclaration = declareKind({
       union(
         direct(
           objectOf("identity_account"),
-          publicWith("identity_account", "allow_public"),
           usersetOf("organization", "member"),
           usersetOf("organization", "viewer"),
         ),

package/src/authorization/model/workflow_instance.ts

@@ -30,7 +30,6 @@ import {
   direct,
   from,
   objectOf,
-  publicWith,
   union,
   usersetOf,
 } from "./rewrite.js";
@@ -84,7 +83,6 @@ export const workflowInstanceDeclaration = declareKind({
       union(
         direct(
           objectOf("identity_account"),
-          publicWith("identity_account", "allow_public"),
           usersetOf("organization", "member"),
           usersetOf("organization", "viewer"),
         ),

package/src/authorization/organization-directory.ts

@@ -32,8 +32,7 @@
  * annotation, which is why this driver meets that caller at all: a
  * skip lane hands the directory the identity the interceptor stamped,
  * and no Authorize arm ran before it. Every other caller gets the
- * evaluated list. The listing context (`allow: false`) is the cloud's,
- * though no organization line admits a wildcard.
+ * evaluated list.
  * The controller loads each id it is handed and skips the ones whose row
  * is gone (grants can outlive rows); the source has already loaded the
  * row once for the evaluation — two primary-key reads per organization,
@@ -102,7 +101,6 @@ export function newBuiltInOrganizationDirectory(
             { type: ORGANIZATION, id },
             "can_view",
             person,
-            { allow: false },
           )
         ) {
           visible.push(id);