@stigmer/server 3.22.1-dev.20260922095755 → 3.22.1

package/src/authorization/__tests__/fixtures/fga/blueprint-private-visibility.fga.yaml

@@ -1,5 +1,5 @@
 # Pinned copy of stigmer-cloud backend/services/stigmer-server/fga/tests/blueprint-private-visibility.fga.yaml
-# as changed by stigmer-cloud#765 (the OpenFGA store test the cloud runs against its live model).
+# at commit 2ec420161 (the OpenFGA store test the cloud runs against its live model).
 # The body below is byte-identical to the source; the cloud re-runs the LIVE
 # file against this evaluator at the re-pin, so a stale copy is caught there.
 # Store tests for real blueprint privacy (Phase 3 of the visibility model).
@@ -14,6 +14,7 @@
 #             viewers; pre-cloud#257 tuples carried #member, which excluded
 #             viewer-role users — still honored until backfilled, see the
 #             legacy-bot fixture)
+#   PUBLIC    viewer@identity_account:* (allow_public)  +  the ORG tuple
 #   PLATFORM  platform_viewer@identity_provider:<idp>#platform_user  +  the ORG tuple
 #
 # Read vs spend: an org viewer-role user READS org-visible blueprints (and, at
@@ -22,8 +23,9 @@
 # can_create_execution_in permissions, which require member-or-guest. The
 # vera assertions pin both halves of that contract.
 #
-# The ORG tuple rides along on PLATFORM (the "org floor") so a shared
-# blueprint stays listable in its own org.
+# The ORG tuple rides along on PUBLIC/PLATFORM (the "org floor") so a shared
+# blueprint stays listable in its own org — org-scoped ListObjects runs with
+# {"allow": false}, which suppresses the public wildcard.
 #
 # T08 exception: org ADMINS (and org owners, via the role hierarchy) are
 # composed into blueprint `owner` and therefore see, list, and manage
@@ -37,8 +39,8 @@
 # Scenario: org "acme" has owner-creator carol, org admin oscar, plain
 # member dave, and read-only viewer vera (the role SSO auto-provisioning
 # grants by default); mallory belongs to an unrelated org. Carol authors one
-# blueprint of each kind at PRIVATE, plus an ORG agent and a legacy ORG
-# agent whose tuple still carries the pre-cloud#257 shape.
+# blueprint of each kind at PRIVATE, plus an ORG agent, a PUBLIC agent, and
+# a legacy ORG agent whose tuple still carries the pre-cloud#257 shape.
 name: blueprint-private-visibility
 model_file: ../model/fga.mod
 
@@ -112,6 +114,22 @@ tuples:
     relation: viewer
     object: agent:legacy-bot
 
+  # --- PUBLIC agent (wildcard + org floor tuple) ---
+  - user: organization:acme
+    relation: organization
+    object: agent:open-bot
+  - user: identity_account:carol
+    relation: owner
+    object: agent:open-bot
+  - user: identity_account:*
+    relation: viewer
+    object: agent:open-bot
+    condition:
+      name: allow_public
+  - user: organization:acme#viewer
+    relation: viewer
+    object: agent:open-bot
+
   # --- PRIVATE agent with an explicit individual viewer grant ---
   - user: organization:acme
     relation: organization
@@ -128,6 +146,8 @@ tests:
     check:
       - user: identity_account:dave
         object: agent:secret-bot
+        context:
+          allow: false
         assertions:
           can_view: false
           can_execute: false
@@ -135,16 +155,22 @@ tests:
           can_clone: false
       - user: identity_account:dave
         object: skill:secret-notes
+        context:
+          allow: false
         assertions:
           can_view: false
           can_use: false
       - user: identity_account:dave
         object: workflow:secret-flow
+        context:
+          allow: false
         assertions:
           can_view: false
           can_execute: false
       - user: identity_account:dave
         object: mcp_server:secret-tools
+        context:
+          allow: false
         assertions:
           can_view: false
           can_use: false
@@ -154,6 +180,8 @@ tests:
     check:
       - user: identity_account:oscar
         object: agent:secret-bot
+        context:
+          allow: false
         assertions:
           can_view: true
           can_edit: true
@@ -161,11 +189,15 @@ tests:
           can_execute: true
       - user: identity_account:oscar
         object: skill:secret-notes
+        context:
+          allow: false
         assertions:
           can_view: true
           can_edit: true
       - user: identity_account:oscar
         object: workflow:secret-flow
+        context:
+          allow: false
         assertions:
           can_view: true
           can_edit: true
@@ -173,6 +205,8 @@ tests:
       # four private-blueprint kinds are pinned to the same rule.
       - user: identity_account:oscar
         object: mcp_server:secret-tools
+        context:
+          allow: false
         assertions:
           can_view: true
           can_edit: true
@@ -181,17 +215,22 @@ tests:
     list_objects:
       - user: identity_account:oscar
         type: agent
+        context:
+          allow: false
         assertions:
           can_view:
             - agent:secret-bot
             - agent:team-bot
             - agent:legacy-bot
+            - agent:open-bot
             - agent:shared-secret
 
   - name: owner retains full access to private blueprints
     check:
       - user: identity_account:carol
         object: agent:secret-bot
+        context:
+          allow: false
         assertions:
           can_view: true
           can_execute: true
@@ -200,6 +239,8 @@ tests:
           can_delete: true
       - user: identity_account:carol
         object: workflow:secret-flow
+        context:
+          allow: false
         assertions:
           can_view: true
           can_execute: true
@@ -209,6 +250,8 @@ tests:
     check:
       - user: identity_account:dave
         object: agent:team-bot
+        context:
+          allow: false
         assertions:
           can_view: true
           can_execute: true
@@ -217,10 +260,33 @@ tests:
           can_delete: false
       - user: identity_account:mallory
         object: agent:team-bot
+        context:
+          allow: false
         assertions:
           can_view: false
           can_execute: false
 
+  - name: public agent is reachable by everyone with allow context, and by org members without it
+    check:
+      # Outsider resolves through the conditional wildcard ({"allow": true}).
+      - user: identity_account:mallory
+        object: agent:open-bot
+        context:
+          allow: true
+        assertions:
+          can_view: true
+          can_execute: true
+      # Org member resolves through the org floor tuple even with the
+      # wildcard suppressed — this is what keeps public blueprints in
+      # org-scoped listings.
+      - user: identity_account:dave
+        object: agent:open-bot
+        context:
+          allow: false
+        assertions:
+          can_view: true
+          can_execute: true
+
   - name: explicit individual viewer grant on a private agent conveys view and run
     check:
       # Run-what-you-can-read: can_execute derives from viewer, so an
@@ -228,30 +294,38 @@ tests:
       # which checks can_view).
       - user: identity_account:dave
         object: agent:shared-secret
+        context:
+          allow: false
         assertions:
           can_view: true
           can_execute: true
           can_edit: false
 
-  - name: org member's listable agents exclude private ones
+  - name: org member's listable agents exclude private ones (wildcard suppressed)
     list_objects:
       - user: identity_account:dave
         type: agent
+        context:
+          allow: false
         assertions:
           can_view:
             - agent:team-bot
             - agent:legacy-bot
+            - agent:open-bot
             - agent:shared-secret
 
   - name: owner's listable agents include everything they authored
     list_objects:
       - user: identity_account:carol
         type: agent
+        context:
+          allow: false
         assertions:
           can_view:
             - agent:secret-bot
             - agent:team-bot
             - agent:legacy-bot
+            - agent:open-bot
             - agent:shared-secret
 
   # ── cloud#257: the viewer-role cell (previously untested) ──────────────
@@ -262,16 +336,27 @@ tests:
       # spend refusal is pinned separately on the org permissions below.
       - user: identity_account:vera
         object: agent:team-bot
+        context:
+          allow: false
         assertions:
           can_view: true
           can_clone: true
           can_execute: true
           can_edit: false
           can_delete: false
+      # The org floor of a PUBLIC blueprint reaches viewers the same way.
+      - user: identity_account:vera
+        object: agent:open-bot
+        context:
+          allow: false
+        assertions:
+          can_view: true
       # Private stays private — the viewer role grants nothing beyond the
       # explicit visibility tuples.
       - user: identity_account:vera
         object: agent:secret-bot
+        context:
+          allow: false
         assertions:
           can_view: false
           can_execute: false
@@ -297,6 +382,8 @@ tests:
     check:
       - user: identity_account:dave
         object: agent:legacy-bot
+        context:
+          allow: false
         assertions:
           can_view: true
           can_execute: true
@@ -305,6 +392,8 @@ tests:
       # organization#member. The boot backfill converges these tuples.
       - user: identity_account:vera
         object: agent:legacy-bot
+        context:
+          allow: false
         assertions:
           can_view: false
           can_execute: false
@@ -313,6 +402,9 @@ tests:
     list_objects:
       - user: identity_account:vera
         type: agent
+        context:
+          allow: false
         assertions:
           can_view:
             - agent:team-bot
+            - agent:open-bot

package/src/authorization/__tests__/fixtures/fga/cross-org-share-creation.fga.yaml

@@ -0,0 +1,98 @@
+# Pinned copy of stigmer-cloud backend/services/stigmer-server/fga/tests/cross-org-share-creation.fga.yaml
+# at commit 2ec420161 (the OpenFGA store test the cloud runs against its live model).
+# The body below is byte-identical to the source; the cloud re-runs the LIVE
+# file against this evaluator at the re-pin, so a stale copy is caught there.
+# Cross-org share creation, the FGA half of the decision 013 D2 consent
+# bar. Creating a share of ANOTHER org's marketplace-public agent requires:
+#
+#   1. can_execute on the agent — granted to every authenticated account by
+#      the allow_public wildcard when the agent is public (checked here),
+#      and to nobody cross-org when it is not.
+#   2. can_create_agent_share on the SHARE's own org — admin-level: a
+#      public share spends the org's credits on the open internet. The
+#      per-kind can_create_* pattern, one more row.
+#
+# The same-org bar (agent can_edit) is untouched and pinned by
+# agent-share-owner.fga.yaml; the app-level halves of the contract
+# (visibility check, audience rule, dependency sweep, agent-id pin) are
+# handler logic outside FGA, pinned by the Java and Go unit tests.
+
+name: cross-org-share-creation
+model_file: ../model/fga.mod
+
+tuples:
+  # provider-org publishes a marketplace-public agent (the conditional
+  # wildcard viewer tuple visibility_public writes).
+  - user: organization:provider-org
+    relation: organization
+    object: agent:public-helper
+  - user: identity_account:paula
+    relation: owner
+    object: agent:public-helper
+  - user: identity_account:*
+    relation: viewer
+    object: agent:public-helper
+    condition:
+      name: allow_public
+      context: {}
+
+  # A private agent in the same provider org — the wildcard is absent.
+  - user: organization:provider-org
+    relation: organization
+    object: agent:private-helper
+  - user: identity_account:paula
+    relation: owner
+    object: agent:private-helper
+
+  # consumer-org: an admin and a plain member.
+  - user: identity_account:adam
+    relation: admin
+    object: organization:consumer-org
+  - user: identity_account:mia
+    relation: member
+    object: organization:consumer-org
+
+tests:
+  - name: consumer-org admin holds both halves of the cross-org bar
+    check:
+      - user: identity_account:adam
+        object: agent:public-helper
+        context:
+          allow: true
+        assertions:
+          can_execute: true
+          can_edit: false
+      - user: identity_account:adam
+        object: organization:consumer-org
+        assertions:
+          can_create_agent_share: true
+
+  - name: plain member lacks the org-side bar (spending is admin-level)
+    check:
+      - user: identity_account:mia
+        object: agent:public-helper
+        context:
+          allow: true
+        assertions:
+          can_execute: true
+      - user: identity_account:mia
+        object: organization:consumer-org
+        assertions:
+          can_create_agent_share: false
+
+  - name: nobody cross-org can execute a private agent
+    check:
+      - user: identity_account:adam
+        object: agent:private-helper
+        context:
+          allow: true
+        assertions:
+          can_execute: false
+          can_view: false
+
+  - name: the org-side bar does not leak across orgs
+    check:
+      - user: identity_account:paula
+        object: organization:consumer-org
+        assertions:
+          can_create_agent_share: false

package/src/authorization/__tests__/fixtures/fga/default-instance-inheritance.fga.yaml

@@ -1,5 +1,5 @@
 # Pinned copy of stigmer-cloud backend/services/stigmer-server/fga/tests/default-instance-inheritance.fga.yaml
-# as changed by stigmer-cloud#765 (the OpenFGA store test the cloud runs against its live model).
+# at commit b87dd1170 (the OpenFGA store test the cloud runs against its live model).
 # The body below is byte-identical to the source; the cloud re-runs the LIVE
 # file against this evaluator at the re-pin, so a stale copy is caught there.
 # Store tests for default-instance structural inheritance (default_of).
@@ -7,8 +7,8 @@
 # A blueprint's system-managed default instance carries a single
 #   instance#default_of@<blueprint>:<id>
 # tuple and inherits the blueprint's ENTIRE viewer set through
-# `viewer from default_of` — org members and platform users
-# (identity_provider#platform_user). No enum-derived
+# `viewer from default_of` — org members, public users (allow_public), and
+# platform users (identity_provider#platform_user). No enum-derived
 # visibility tuples are ever written on default instances, so their access
 # can never drift from the template's.
 #
@@ -20,7 +20,8 @@
 # visibility level; each has a default instance linked via default_of.
 # Alice (acme member) reaches default instances of platform-shared
 # blueprints; planton members reach default instances of org-visible ones;
-# personal instances never leak.
+# everyone reaches default instances of public ones; personal instances
+# never leak.
 name: default-instance-inheritance
 model_file: ../model/fga.mod
 
@@ -114,6 +115,35 @@ tuples:
     relation: default_of
     object: agent_instance:internal-default
 
+  # --- Public agent + its default instance ---
+  # PUBLIC carries the org floor tuple too (viewer@org#viewer).
+  - user: organization:planton
+    relation: organization
+    object: agent:public-bot
+  - user: identity_account:swarup
+    relation: owner
+    object: agent:public-bot
+  - user: identity_account:*
+    relation: viewer
+    object: agent:public-bot
+    condition:
+      name: allow_public
+  - user: organization:planton#viewer
+    relation: viewer
+    object: agent:public-bot
+  - user: organization:planton
+    relation: organization
+    object: agent_instance:public-bot-default
+  - user: agent:public-bot
+    relation: agent
+    object: agent_instance:public-bot-default
+  - user: identity_account:swarup
+    relation: owner
+    object: agent_instance:public-bot-default
+  - user: agent:public-bot
+    relation: default_of
+    object: agent_instance:public-bot-default
+
   # --- Platform-shared workflow + its default instance ---
   - user: organization:planton
     relation: organization
@@ -145,6 +175,8 @@ tests:
     check:
       - user: identity_account:alice
         object: agent_instance:sara-default
+        context:
+          allow: false
         assertions:
           can_view: true
           can_execute: true
@@ -155,6 +187,8 @@ tests:
     check:
       - user: identity_account:mallory
         object: agent_instance:sara-default
+        context:
+          allow: false
         assertions:
           can_view: false
           can_execute: false
@@ -165,10 +199,14 @@ tests:
       # default_of tuple — only she (its owner) can reach it.
       - user: identity_account:swarup
         object: agent_instance:alice-personal
+        context:
+          allow: false
         assertions:
           can_view: false
       - user: identity_account:alice
         object: agent_instance:alice-personal
+        context:
+          allow: false
         assertions:
           can_view: true
           can_edit: true
@@ -177,6 +215,8 @@ tests:
     check:
       - user: identity_account:priya
         object: agent_instance:internal-default
+        context:
+          allow: false
         assertions:
           can_view: true
           can_execute: true
@@ -186,19 +226,34 @@ tests:
       # read audience, and the default instance inherits it structurally.
       - user: identity_account:veda
         object: agent_instance:internal-default
+        context:
+          allow: false
         assertions:
           can_view: true
           can_edit: false
       # Managed-org membership grants nothing on non-platform-shared agents.
       - user: identity_account:alice
         object: agent_instance:internal-default
+        context:
+          allow: false
         assertions:
           can_view: false
 
+  - name: everyone reaches the default instance of a public agent
+    check:
+      - user: identity_account:mallory
+        object: agent_instance:public-bot-default
+        context:
+          allow: true
+        assertions:
+          can_view: true
+
   - name: managed-org member reaches the default instance of a platform-shared workflow
     check:
       - user: identity_account:alice
         object: workflow_instance:onboarding-default
+        context:
+          allow: false
         assertions:
           can_view: true
           can_execute: true
@@ -208,6 +263,8 @@ tests:
     list_objects:
       - user: identity_account:alice
         type: agent_instance
+        context:
+          allow: false
         assertions:
           can_view:
             - agent_instance:sara-default

package/src/authorization/__tests__/fixtures/fga/mcp-server-authoring.fga.yaml

@@ -0,0 +1,143 @@
+# Pinned copy of stigmer-cloud backend/services/stigmer-server/fga/tests/mcp-server-authoring.fga.yaml
+# at commit 4c03c38d2 (the OpenFGA store test the cloud runs against its live model).
+# The body below is byte-identical to the source; the cloud re-runs the LIVE
+# file against this evaluator at the re-pin, so a stale copy is caught there.
+# Store tests for MCP-server authoring: an MCP server is an organization's
+# blueprint, so creating one takes the organization's admin bar
+# (can_create_mcp_server: admin), the bar agents, workflows and skills
+# already take. Until stigmer#1209 (v3.22.0) the create ran no check in
+# either edition and any member could author one; these pin the bar and
+# the story it leaves for members: an admin authors the server org-visible
+# and a member connects it (can_connect) with their own credentials, while
+# a private server stays the owner's and the admins'.
+#
+# Run: fga model test --tests mcp-server-authoring.fga.yaml
+
+name: mcp-server-authoring
+model_file: ../model/fga.mod
+
+tuples:
+  # Org acme: olivia owns it, oscar administers, dave is a plain member,
+  # vera a read-only viewer; mallory belongs to an unrelated org.
+  - user: identity_account:olivia
+    relation: owner
+    object: organization:acme
+  - user: identity_account:oscar
+    relation: admin
+    object: organization:acme
+  - user: identity_account:dave
+    relation: member
+    object: organization:acme
+  - user: identity_account:vera
+    relation: viewer
+    object: organization:acme
+  - user: identity_account:mallory
+    relation: member
+    object: organization:other
+
+  # An ORG-visible server oscar authored (the org viewer tuple the
+  # visibility writer emits).
+  - user: organization:acme
+    relation: organization
+    object: mcp_server:github
+  - user: identity_account:oscar
+    relation: owner
+    object: mcp_server:github
+  - user: organization:acme#viewer
+    relation: viewer
+    object: mcp_server:github
+
+  # A PRIVATE server oscar authored (no visibility tuple).
+  - user: organization:acme
+    relation: organization
+    object: mcp_server:vault
+  - user: identity_account:oscar
+    relation: owner
+    object: mcp_server:vault
+
+tests:
+  - name: authoring an MCP server is an admin act, the blueprint bar
+    check:
+      - user: identity_account:olivia
+        object: organization:acme
+        assertions:
+          can_create_mcp_server: true
+          can_create_agent: true
+      - user: identity_account:oscar
+        object: organization:acme
+        assertions:
+          can_create_mcp_server: true
+          can_create_agent: true
+
+  - name: a member, a viewer and an outsider cannot author one
+    check:
+      - user: identity_account:dave
+        object: organization:acme
+        assertions:
+          can_create_mcp_server: false
+      - user: identity_account:vera
+        object: organization:acme
+        assertions:
+          can_create_mcp_server: false
+      - user: identity_account:mallory
+        object: organization:acme
+        assertions:
+          can_create_mcp_server: false
+
+  - name: a member connects an admin-authored org-visible server with their own credentials
+    check:
+      - user: identity_account:dave
+        object: mcp_server:github
+        context:
+          allow: false
+        assertions:
+          can_view: true
+          can_connect: true
+          can_edit: false
+      - user: identity_account:vera
+        object: mcp_server:github
+        context:
+          allow: false
+        assertions:
+          can_view: true
+          can_connect: true
+          can_edit: false
+      - user: identity_account:mallory
+        object: mcp_server:github
+        context:
+          allow: false
+        assertions:
+          can_view: false
+          can_connect: false
+
+  - name: a private server stays with its author and the org admins
+    check:
+      - user: identity_account:oscar
+        object: mcp_server:vault
+        context:
+          allow: false
+        assertions:
+          can_view: true
+          can_connect: true
+          can_edit: true
+      - user: identity_account:olivia
+        object: mcp_server:vault
+        context:
+          allow: false
+        assertions:
+          can_view: true
+          can_edit: true
+      - user: identity_account:dave
+        object: mcp_server:vault
+        context:
+          allow: false
+        assertions:
+          can_view: false
+          can_connect: false
+      - user: identity_account:vera
+        object: mcp_server:vault
+        context:
+          allow: false
+        assertions:
+          can_view: false
+          can_connect: false