@stigmer/server 3.22.0 → 3.22.1-dev.20260922095755

package/src/authorization/model/rewrite.ts

@@ -6,12 +6,17 @@
  *   define organization: [organization]                      → direct(objectOf("organization"))
  *   define owner: [identity_account] or admin from organization
  *                → union(direct(objectOf("identity_account")), from("admin", "organization"))
- *   define viewer: [identity_account, identity_account:* with allow_public,
- *                   organization#member, organization#viewer] or owner or platform_viewer
- *                → union(direct(objectOf(...), publicWith(...), usersetOf(...), usersetOf(...)),
+ *   define viewer: [identity_account, organization#member, organization#viewer]
+ *                   or owner or platform_viewer
+ *                → union(direct(objectOf(...), usersetOf(...), usersetOf(...)),
  *                        computed("owner"), computed("platform_viewer"))
  *   define can_view: viewer                                   → computed("viewer")
  *
+ * A subject type is an object type or a userset; the model admits no
+ * wildcard (`type:*`) and declares no condition, so neither has a form
+ * here. The day a line needs one, the transcript cannot be written and
+ * the gap is a design act.
+ *
  * A declaration file (model/<kind>.ts) is a TRANSCRIPT of its `.fga`
  * file: the same relations, in the file's order, each line rewritten in
  * these builders so a reader with the model open sees the same text, and
@@ -53,12 +58,6 @@ export type SubjectType =
       readonly form: "userset";
       readonly type: string;
       readonly relation: string;
-    }
-  /** `[identity_account:* with allow_public]` — every object of the type, under the condition. */
-  | {
-      readonly form: "wildcard";
-      readonly type: string;
-      readonly condition: string;
     };
 
 export type Rewrite =
@@ -87,10 +86,6 @@ export function usersetOf(type: string, relation: string): SubjectType {
   return { form: "userset", type, relation };
 }
 
-export function publicWith(type: string, condition: string): SubjectType {
-  return { form: "wildcard", type, condition };
-}
-
 export function direct(...subjects: ReadonlyArray<SubjectType>): Rewrite {
   return { node: "this", subjects };
 }

package/src/authorization/model/skill.ts

@@ -14,7 +14,6 @@ import {
   direct,
   from,
   objectOf,
-  publicWith,
   union,
   usersetOf,
 } from "./rewrite.js";
@@ -41,7 +40,6 @@ export const skillDeclaration = declareKind({
       union(
         direct(
           objectOf("identity_account"),
-          publicWith("identity_account", "allow_public"),
           usersetOf("organization", "member"),
           usersetOf("organization", "viewer"),
         ),

package/src/authorization/model/workflow.ts

@@ -14,7 +14,6 @@ import {
   direct,
   from,
   objectOf,
-  publicWith,
   union,
   usersetOf,
 } from "./rewrite.js";
@@ -41,7 +40,6 @@ export const workflowDeclaration = declareKind({
       union(
         direct(
           objectOf("identity_account"),
-          publicWith("identity_account", "allow_public"),
           usersetOf("organization", "member"),
           usersetOf("organization", "viewer"),
         ),

package/src/authorization/model/workflow_instance.ts

@@ -30,7 +30,6 @@ import {
   direct,
   from,
   objectOf,
-  publicWith,
   union,
   usersetOf,
 } from "./rewrite.js";
@@ -84,7 +83,6 @@ export const workflowInstanceDeclaration = declareKind({
       union(
         direct(
           objectOf("identity_account"),
-          publicWith("identity_account", "allow_public"),
           usersetOf("organization", "member"),
           usersetOf("organization", "viewer"),
         ),

package/src/authorization/organization-directory.ts

@@ -32,8 +32,7 @@
  * annotation, which is why this driver meets that caller at all: a
  * skip lane hands the directory the identity the interceptor stamped,
  * and no Authorize arm ran before it. Every other caller gets the
- * evaluated list. The listing context (`allow: false`) is the cloud's,
- * though no organization line admits a wildcard.
+ * evaluated list.
  * The controller loads each id it is handed and skips the ones whose row
  * is gone (grants can outlive rows); the source has already loaded the
  * row once for the evaluation — two primary-key reads per organization,
@@ -102,7 +101,6 @@ export function newBuiltInOrganizationDirectory(
             { type: ORGANIZATION, id },
             "can_view",
             person,
-            { allow: false },
           )
         ) {
           visible.push(id);

package/src/authorization/store-test-kit.ts

@@ -41,26 +41,18 @@
  * `skipped` is therefore complete once every case has run; a consumer
  * pins it after the cases, which is the order a test file declares them.
  *
- * Context. A check's `context.allow` is the `allow_public` parameter
- * (tuples.ts). A check without a context runs with `allow: false`, the
- * listing posture: OpenFGA itself would fault on a conditional tuple it
- * reached with the parameter missing, so the cloud's documents never do
- * that — their CI would already fail — and the choice cannot change an
- * answer the oracle gives. The parser is strict on purpose: an unknown
- * key anywhere is a thrown fault, so a change to the format upstream is
- * loud here rather than half-run.
+ * The parser is strict on purpose: an unknown key anywhere is a thrown
+ * fault, so a change to the format upstream is loud here rather than
+ * half-run. The model declares no condition, so the format's `condition`
+ * on a tuple and `context` on a check are among the keys refused: a
+ * document that still carries them is written against a model this
+ * evaluator does not answer, and saying so beats running it half-blind.
  */
 import assert from "node:assert/strict";
 
 import { checkRelation } from "./evaluator.js";
 import type { Model } from "./model/index.js";
-import type {
-  CheckContext,
-  Person,
-  Subject,
-  Tuple,
-  TupleSource,
-} from "./tuples.js";
+import type { Person, Subject, Tuple, TupleSource } from "./tuples.js";
 import {
   ACCOUNT_TYPE,
   newInMemoryTupleSource,
@@ -76,20 +68,17 @@ export interface StoreTestTuple {
   readonly user: string;
   readonly relation: string;
   readonly object: string;
-  readonly condition?: { readonly name: string };
 }
 
 export interface StoreTestCheck {
   readonly user: string;
   readonly object: string;
-  readonly context?: CheckContext;
   readonly assertions: Readonly<Record<string, boolean>>;
 }
 
 export interface StoreTestListObjects {
   readonly user: string;
   readonly type: string;
-  readonly context?: CheckContext;
   readonly assertions: Readonly<Record<string, ReadonlyArray<string>>>;
 }
 
@@ -132,28 +121,12 @@ export function parseStoreTestDocument(
 }
 
 function parseTuple(value: unknown, where: string): StoreTestTuple {
-  const entry = record(value, where, [
-    "user",
-    "relation",
-    "object",
-    "condition",
-  ]);
-  const tuple: StoreTestTuple = {
+  const entry = record(value, where, ["user", "relation", "object"]);
+  return {
     user: text(entry["user"], `${where}.user`),
     relation: text(entry["relation"], `${where}.relation`),
     object: text(entry["object"], `${where}.object`),
   };
-  if (entry["condition"] === undefined) {
-    return tuple;
-  }
-  const condition = record(entry["condition"], `${where}.condition`, [
-    "name",
-    "context",
-  ]);
-  return {
-    ...tuple,
-    condition: { name: text(condition["name"], `${where}.condition.name`) },
-  };
 }
 
 function parseTest(value: unknown, where: string): StoreTest {
@@ -173,12 +146,7 @@ function parseTest(value: unknown, where: string): StoreTest {
 }
 
 function parseCheck(value: unknown, where: string): StoreTestCheck {
-  const entry = record(value, where, [
-    "user",
-    "object",
-    "context",
-    "assertions",
-  ]);
+  const entry = record(value, where, ["user", "object", "assertions"]);
   const assertions = record(entry["assertions"], `${where}.assertions`);
   const parsed: Record<string, boolean> = {};
   for (const [relation, expected] of Object.entries(assertions)) {
@@ -187,17 +155,15 @@ function parseCheck(value: unknown, where: string): StoreTestCheck {
     }
     parsed[relation] = expected;
   }
-  const context = parseContext(entry["context"], `${where}.context`);
   return {
     user: text(entry["user"], `${where}.user`),
     object: text(entry["object"], `${where}.object`),
-    ...(context === undefined ? {} : { context }),
     assertions: parsed,
   };
 }
 
 function parseListObjects(value: unknown, where: string): StoreTestListObjects {
-  const entry = record(value, where, ["user", "type", "context", "assertions"]);
+  const entry = record(value, where, ["user", "type", "assertions"]);
   const assertions = record(entry["assertions"], `${where}.assertions`);
   const parsed: Record<string, ReadonlyArray<string>> = {};
   for (const [relation, expected] of Object.entries(assertions)) {
@@ -205,26 +171,13 @@ function parseListObjects(value: unknown, where: string): StoreTestListObjects {
       (item, index) => text(item, `${where}.assertions.${relation}[${index}]`),
     );
   }
-  const context = parseContext(entry["context"], `${where}.context`);
   return {
     user: text(entry["user"], `${where}.user`),
     type: text(entry["type"], `${where}.type`),
-    ...(context === undefined ? {} : { context }),
     assertions: parsed,
   };
 }
 
-function parseContext(value: unknown, where: string): CheckContext | undefined {
-  if (value === undefined) {
-    return undefined;
-  }
-  const entry = record(value, where, ["allow"]);
-  if (typeof entry["allow"] !== "boolean") {
-    throw new Error(`${where}.allow: expected a boolean`);
-  }
-  return { allow: entry["allow"] };
-}
-
 function record(
   value: unknown,
   where: string,
@@ -297,9 +250,6 @@ export interface StoreTestKit {
   readonly skipped: ReadonlyArray<StoreTestSkip>;
 }
 
-/** The listing posture, for a check the document leaves without a context (the module header). */
-const CONTEXT_WHEN_ABSENT: CheckContext = { allow: false };
-
 /**
  * The document's tests as runnable cases over `model`, plus every
  * assertion group the kit does not run.
@@ -346,7 +296,6 @@ export function storeTestCases(
         for (const item of runnable) {
           const object = parseObjectRef(item.object);
           const person = personOf(item.user);
-          const context = item.context ?? CONTEXT_WHEN_ABSENT;
           for (const [relation, expected] of Object.entries(item.assertions)) {
             const recording = recordUndeclaredTypes(source, model);
             const actual = await checkRelation(
@@ -354,7 +303,6 @@ export function storeTestCases(
               object,
               relation,
               person,
-              context,
             );
             if (recording.reached.size > 0) {
               skipped.push({
@@ -371,7 +319,7 @@ export function storeTestCases(
             assert.equal(
               actual,
               expected,
-              `${document.name} :: ${test.name}: ${item.user} ${relation} ${item.object} (allow: ${String(context.allow)}) expected ${String(expected)}, got ${String(actual)}`,
+              `${document.name} :: ${test.name}: ${item.user} ${relation} ${item.object} expected ${String(expected)}, got ${String(actual)}`,
             );
           }
         }
@@ -389,10 +337,9 @@ interface RecordingTupleSource extends TupleSource {
 /**
  * A view of `inner` that records, for one walk, every subject type the
  * evaluator read that `model` does not declare. A person
- * (`identity_account:<id>`, the wildcard) is a subject the evaluator
- * compares, never a type it resolves, so it is not a "reach" whatever
- * the model declares; a userset or a parent object of an undeclared
- * type is.
+ * (`identity_account:<id>`) is a subject the evaluator compares, never a
+ * type it resolves, so it is not a "reach" whatever the model declares; a
+ * userset or a parent object of an undeclared type is.
  */
 function recordUndeclaredTypes(
   inner: TupleSource,
@@ -423,8 +370,6 @@ function resolvedTypeOf(subject: Subject): string | undefined {
         : subject.object.type;
     case "userset":
       return subject.object.type;
-    case "wildcard":
-      return undefined;
     default: {
       const exhaustive: never = subject;
       throw new Error(`unknown subject form: ${JSON.stringify(exhaustive)}`);
@@ -433,14 +378,10 @@ function resolvedTypeOf(subject: Subject): string | undefined {
 }
 
 function tupleOf(entry: StoreTestTuple): Tuple {
-  const subject = parseSubject(entry.user);
   return {
     object: parseObjectRef(entry.object),
     relation: entry.relation,
-    subject:
-      subject.form === "wildcard" && entry.condition !== undefined
-        ? { ...subject, condition: entry.condition.name }
-        : subject,
+    subject: parseSubject(entry.user),
   };
 }
 

package/src/authorization/tuples.ts

@@ -1,9 +1,11 @@
 /**
  * The tuple vocabulary of the built-in authorizer — the OpenFGA notions
  * the cloud's model is written in (object, relation, subject; a subject
- * being an object, a userset `type:id#relation`, or the public wildcard
- * `type:*` under a condition), typed once so the evaluator, the
- * derivation and the store-test kit speak one language. Nothing here is
+ * being an object or a userset `type:id#relation`), typed once so the
+ * evaluator, the derivation and the store-test kit speak one language. The
+ * model declares no wildcard subject and no condition: every reader of a
+ * row is an account or the holder of a relation on an object, which is
+ * why a check needs no context parameter. Nothing here is
  * stored: open source derives every tuple from a row (derived-tuples.ts)
  * or reads it from an IamPolicy row, and this module only names what a
  * tuple IS.
@@ -18,28 +20,18 @@
  * The type is named here; the construction (`personFor`, `resolvePerson`)
  * is person.ts's, so this module stays vocabulary with no I/O.
  *
- * `CheckContext` is the FGA condition context. The one condition the
- * model declares is `allow_public(allow: bool)` on the public wildcard,
- * and the cloud's own posture (stigmer-cloud authorizer/fga-authorizer.ts,
- * the Java BuildCheckRequest) is `allow: true` on a point check — a public
- * resource reads for any authenticated caller — and `allow: false` in a
- * listing, which keeps a public wildcard from flooding an organization's
- * catalog. The parameter is required so a caller states which posture it
- * is in; there is no default because either one is wrong for the other.
- *
- * The string forms (`agent:x`, `organization:acme#viewer`,
- * `identity_account:*`) are the notation the cloud's store tests and the
- * IamPolicy proto both use; parse and format are here so the kit and the
- * tests never spell them a second way.
+ * The string forms (`agent:x`, `organization:acme#viewer`) are the
+ * notation the cloud's store tests and the IamPolicy proto both use; parse
+ * and format are here so the kit and the tests never spell them a second
+ * way. The wildcard notation `type:*` is refused by the parser: the model
+ * has no line that admits one, so a fixture or a policy that spells it is
+ * a mistake to surface, never a subject to carry.
  */
 import type { Message } from "@bufbuild/protobuf";
 
 /** The FGA type name of the kind every person is: `identity_account:<id>`. */
 export const ACCOUNT_TYPE = "identity_account";
 
-/** The one condition the model declares; it guards the public wildcard. */
-export const ALLOW_PUBLIC_CONDITION = "allow_public";
-
 /** `type:id` — an object of the model. */
 export interface ObjectRef {
   readonly type: string;
@@ -55,12 +47,6 @@ export type Subject =
       readonly form: "userset";
       readonly object: ObjectRef;
       readonly relation: string;
-    }
-  /** `type:*` — every object of the type, honoured only when its condition holds. */
-  | {
-      readonly form: "wildcard";
-      readonly type: string;
-      readonly condition: string | undefined;
     };
 
 export interface Tuple {
@@ -97,11 +83,6 @@ export interface Person {
   readonly aliases: ReadonlySet<string>;
 }
 
-/** The condition parameters of a check (the module header). */
-export interface CheckContext {
-  readonly allow: boolean;
-}
-
 // ---------------------------------------------------------------------------
 // The string notation.
 // ---------------------------------------------------------------------------
@@ -120,10 +101,8 @@ export function formatObjectRef(object: ObjectRef): string {
 }
 
 /**
- * `type:id`, `type:id#relation` or `type:*` → Subject. A wildcard parsed
- * from text carries no condition; the caller attaches one when its source
- * says so (the store tests carry it on the tuple, the derivation attaches
- * the model's).
+ * `type:id` or `type:id#relation` → Subject. `type:*` is refused (the
+ * module header): no line of the model admits a wildcard subject.
  */
 export function parseSubject(text: string): Subject {
   const hash = text.indexOf("#");
@@ -136,7 +115,9 @@ export function parseSubject(text: string): Subject {
   }
   const object = parseObjectRef(text);
   if (object.id === "*") {
-    return { form: "wildcard", type: object.type, condition: undefined };
+    throw new Error(
+      `wildcard subject '${text}' is not admitted: the model declares no wildcard line`,
+    );
   }
   return { form: "object", object };
 }
@@ -147,10 +128,6 @@ export function formatSubject(subject: Subject): string {
       return formatObjectRef(subject.object);
     case "userset":
       return `${formatObjectRef(subject.object)}#${subject.relation}`;
-    case "wildcard":
-      return subject.condition === undefined
-        ? `${subject.type}:*`
-        : `${subject.type}:* with ${subject.condition}`;
     default: {
       const exhaustive: never = subject;
       throw new Error(`unknown subject form: ${JSON.stringify(exhaustive)}`);

package/src/domain/agent/__tests__/agent.test.ts

@@ -131,8 +131,10 @@ function agentInput(overrides?: {
 }
 
 /**
- * Seeds an MCP server straight into the store — the mcpserver controller
- * arrives with sub-project #9, and the agent pipelines only need the row.
+ * Seeds an MCP server straight into the store — the agent pipelines only
+ * need the row. Org-visible, the level the mcpserver create chain would
+ * have stamped: an org-visible agent may reference it under the reference
+ * floor, as it would a server created through the API.
  */
 async function seedMcpServer(opts: {
   id: string;
@@ -155,6 +157,7 @@ async function seedMcpServer(opts: {
       name: opts.slug,
       slug: opts.slug,
       org: opts.org ?? ORG,
+      visibility: ApiResourceVisibility.visibility_org,
     },
     spec: { env: opts.env ?? {} },
     status: connected
@@ -309,11 +312,11 @@ describe("agent enabled-tools validation (#402)", () => {
 });
 
 describe("agent cascade delete (oss#611)", () => {
-  it("sweeps ALL instances by spec.agent_id (cross-org included), deletes same-org shares, keeps cross-org shares", async () => {
+  it("sweeps ALL instances by spec.agent_id (cross-org included), deletes same-org shares, keeps a stored cross-org share", async () => {
     const agent = await command.create(
       agentInput({
         name: "Cascade Target",
-        visibility: ApiResourceVisibility.visibility_public,
+        visibility: ApiResourceVisibility.visibility_org,
       }),
     );
     const agentId = agent.metadata!.id;
@@ -355,6 +358,10 @@ describe("agent cascade delete (oss#611)", () => {
       AgentShareSchema,
       sameOrgShare,
     );
+    // A share in another organization is a row no create admits any more
+    // (a share's agent lives in the share's organization); one written
+    // before that rule is still another organization's row, and the
+    // cascade leaves it as it always did.
     const crossOrgShare = create(AgentShareSchema, {
       metadata: { id: "ash_cross_org", name: "cross-org-share", org: "globex" },
       spec: {

package/src/domain/agent/controller.ts

@@ -42,10 +42,6 @@ import {
   newAuthorizeResolvedTargetStep,
 } from "../../pipeline/steps/authorize-resolved-target.js";
 import { newGuardReservedLabelsStep } from "../../pipeline/steps/guard-reserved-labels.js";
-import {
-  newAuthorizeVisibilityTransitionStep,
-  newGuardPublicVisibilityStep,
-} from "../../pipeline/steps/visibility-gates.js";
 import {
   newBuildNewStateStep,
   setAuditFieldsForUpdate,
@@ -77,6 +73,8 @@ import {
   newLoadTargetStep,
 } from "../../pipeline/steps/load-target.js";
 import {
+  collectSpecReferences,
+  newGuardReferenceFloorOnEscalationStep,
   newNormalizeReferencesStep,
   newValidateReferencesStep,
 } from "../../pipeline/steps/references.js";
@@ -168,7 +166,6 @@ async function createAgent(
     .addStep(newResolveSlugStep())
     .addStep(newCheckDuplicateStep(deps.store))
     .addStep(newBuildNewStateStep())
-    .addStep(newGuardPublicVisibilityStep(deps.authorizer))
     .addStep(newGuardReservedLabelsStep(deps.authorizer))
     .addStep(newNormalizeReferencesStep())
     .addStep(newValidateReferencesStep(deps.store))
@@ -361,10 +358,13 @@ async function updateVisibility(
     )
     .addStep(newRecordVisibilityBeforeUpdateStep(UPDATE_VISIBILITY_AGENT_KEY))
     .addStep(newValidateVisibilityUpdateStep())
+    // The reference floor's second door: an agent may not be raised above
+    // the skills and MCP servers it runs with.
     .addStep(
-      newAuthorizeVisibilityTransitionStep(
+      newGuardReferenceFloorOnEscalationStep(
+        deps.store,
         UPDATE_VISIBILITY_AGENT_KEY,
-        deps.authorizer,
+        [(row) => collectSpecReferences(AgentSchema, row)],
       ),
     )
     .addStep(newSetAgentVisibilityStep())