@stigmer/server 3.22.1-dev.20260922095755 → 3.23.0

package/src/authorization/__tests__/fixtures/fga/agent-instance-creation.fga.yaml

@@ -0,0 +1,185 @@
+# Pinned copy of stigmer-cloud backend/services/stigmer-server/fga/tests/agent-instance-creation.fga.yaml
+# at commit 4c03c38d2 (the OpenFGA store test the cloud runs against its live model).
+# The body below is byte-identical to the source; the cloud re-runs the LIVE
+# file against this evaluator at the re-pin, so a stale copy is caught there.
+# Store tests for agent-instance creation: two halves, asked together by
+# the create since stigmer#1209 (v3.22.0). The agent half is the agent's
+# can_create_instance (can_execute, so the viewer set: whoever may run the
+# agent may instantiate it). The organization half is
+# can_create_agent_instance: member on the organization the instance is
+# created IN, which is the caller's own, not the agent's: a personal
+# instance of another organization's public agent lives in the caller's
+# organization (the marketplace case), so the agent's permission alone
+# would let a row be planted in any organization named on the request.
+#
+# What these pin: owners, admins and members hold the organization half;
+# a viewer-role account may run an org-visible agent (the agent half) and
+# still lacks the organization half; a guest holds neither; an outsider
+# holds neither; and the marketplace case passes on the caller's own
+# organization while the agent half comes from the public wildcard.
+#
+# Run: fga model test --tests agent-instance-creation.fga.yaml
+
+name: agent-instance-creation
+model_file: ../model/fga.mod
+
+tuples:
+  # Org acme: olivia owns it, oscar administers, dave is a plain member,
+  # vera a read-only viewer, greta the share-link guest account.
+  - user: identity_account:olivia
+    relation: owner
+    object: organization:acme
+  - user: identity_account:oscar
+    relation: admin
+    object: organization:acme
+  - user: identity_account:dave
+    relation: member
+    object: organization:acme
+  - user: identity_account:vera
+    relation: viewer
+    object: organization:acme
+  - user: identity_account:greta
+    relation: guest
+    object: organization:acme
+
+  # Org consumer: mia is a plain member there and holds no role in acme.
+  - user: identity_account:mia
+    relation: member
+    object: organization:consumer
+
+  # An ORG-visible agent in acme, authored by oscar.
+  - user: organization:acme
+    relation: organization
+    object: agent:team-bot
+  - user: identity_account:oscar
+    relation: owner
+    object: agent:team-bot
+  - user: organization:acme#viewer
+    relation: viewer
+    object: agent:team-bot
+
+  # A PRIVATE agent in acme, authored by oscar (no visibility tuple).
+  - user: organization:acme
+    relation: organization
+    object: agent:secret-bot
+  - user: identity_account:oscar
+    relation: owner
+    object: agent:secret-bot
+
+  # A PUBLIC marketplace agent in acme (the conditional wildcard plus the
+  # org floor tuple the visibility writer emits).
+  - user: organization:acme
+    relation: organization
+    object: agent:open-bot
+  - user: identity_account:oscar
+    relation: owner
+    object: agent:open-bot
+  - user: identity_account:*
+    relation: viewer
+    object: agent:open-bot
+    condition:
+      name: allow_public
+      context: {}
+  - user: organization:acme#viewer
+    relation: viewer
+    object: agent:open-bot
+
+tests:
+  - name: owners, admins and members hold the organization half
+    check:
+      - user: identity_account:olivia
+        object: organization:acme
+        assertions:
+          can_create_agent_instance: true
+      - user: identity_account:oscar
+        object: organization:acme
+        assertions:
+          can_create_agent_instance: true
+      - user: identity_account:dave
+        object: organization:acme
+        assertions:
+          can_create_agent_instance: true
+
+  - name: a viewer, a guest and an outsider do not
+    check:
+      - user: identity_account:vera
+        object: organization:acme
+        assertions:
+          can_create_agent_instance: false
+          can_create_session: false
+      - user: identity_account:greta
+        object: organization:acme
+        assertions:
+          can_create_agent_instance: false
+          can_create_session: true
+      - user: identity_account:mia
+        object: organization:acme
+        assertions:
+          can_create_agent_instance: false
+
+  - name: a member instantiates an org-visible agent, both halves held
+    check:
+      - user: identity_account:dave
+        object: agent:team-bot
+        context:
+          allow: false
+        assertions:
+          can_create_instance: true
+          can_execute: true
+
+  - name: a viewer may run the org-visible agent and still cannot instantiate it here
+    check:
+      - user: identity_account:vera
+        object: agent:team-bot
+        context:
+          allow: false
+        assertions:
+          can_create_instance: true
+      - user: identity_account:vera
+        object: organization:acme
+        assertions:
+          can_create_agent_instance: false
+
+  - name: a private agent gives the agent half to its author and the admins only
+    check:
+      - user: identity_account:oscar
+        object: agent:secret-bot
+        context:
+          allow: false
+        assertions:
+          can_create_instance: true
+      - user: identity_account:olivia
+        object: agent:secret-bot
+        context:
+          allow: false
+        assertions:
+          can_create_instance: true
+      - user: identity_account:dave
+        object: agent:secret-bot
+        context:
+          allow: false
+        assertions:
+          can_create_instance: false
+      - user: identity_account:mia
+        object: agent:secret-bot
+        context:
+          allow: false
+        assertions:
+          can_create_instance: false
+
+  - name: the marketplace case, the agent half from the wildcard and the organization half at home
+    check:
+      - user: identity_account:mia
+        object: agent:open-bot
+        context:
+          allow: true
+        assertions:
+          can_create_instance: true
+      - user: identity_account:mia
+        object: organization:consumer
+        assertions:
+          can_create_agent_instance: true
+      - user: identity_account:mia
+        object: organization:acme
+        assertions:
+          can_create_agent_instance: false

package/src/authorization/__tests__/fixtures/fga/blueprint-private-visibility.fga.yaml

@@ -1,5 +1,5 @@
 # Pinned copy of stigmer-cloud backend/services/stigmer-server/fga/tests/blueprint-private-visibility.fga.yaml
-# as changed by stigmer-cloud#765 (the OpenFGA store test the cloud runs against its live model).
+# at commit 2ec420161 (the OpenFGA store test the cloud runs against its live model).
 # The body below is byte-identical to the source; the cloud re-runs the LIVE
 # file against this evaluator at the re-pin, so a stale copy is caught there.
 # Store tests for real blueprint privacy (Phase 3 of the visibility model).
@@ -14,6 +14,7 @@
 #             viewers; pre-cloud#257 tuples carried #member, which excluded
 #             viewer-role users — still honored until backfilled, see the
 #             legacy-bot fixture)
+#   PUBLIC    viewer@identity_account:* (allow_public)  +  the ORG tuple
 #   PLATFORM  platform_viewer@identity_provider:<idp>#platform_user  +  the ORG tuple
 #
 # Read vs spend: an org viewer-role user READS org-visible blueprints (and, at
@@ -22,8 +23,9 @@
 # can_create_execution_in permissions, which require member-or-guest. The
 # vera assertions pin both halves of that contract.
 #
-# The ORG tuple rides along on PLATFORM (the "org floor") so a shared
-# blueprint stays listable in its own org.
+# The ORG tuple rides along on PUBLIC/PLATFORM (the "org floor") so a shared
+# blueprint stays listable in its own org — org-scoped ListObjects runs with
+# {"allow": false}, which suppresses the public wildcard.
 #
 # T08 exception: org ADMINS (and org owners, via the role hierarchy) are
 # composed into blueprint `owner` and therefore see, list, and manage
@@ -37,8 +39,8 @@
 # Scenario: org "acme" has owner-creator carol, org admin oscar, plain
 # member dave, and read-only viewer vera (the role SSO auto-provisioning
 # grants by default); mallory belongs to an unrelated org. Carol authors one
-# blueprint of each kind at PRIVATE, plus an ORG agent and a legacy ORG
-# agent whose tuple still carries the pre-cloud#257 shape.
+# blueprint of each kind at PRIVATE, plus an ORG agent, a PUBLIC agent, and
+# a legacy ORG agent whose tuple still carries the pre-cloud#257 shape.
 name: blueprint-private-visibility
 model_file: ../model/fga.mod
 
@@ -112,6 +114,22 @@ tuples:
     relation: viewer
     object: agent:legacy-bot
 
+  # --- PUBLIC agent (wildcard + org floor tuple) ---
+  - user: organization:acme
+    relation: organization
+    object: agent:open-bot
+  - user: identity_account:carol
+    relation: owner
+    object: agent:open-bot
+  - user: identity_account:*
+    relation: viewer
+    object: agent:open-bot
+    condition:
+      name: allow_public
+  - user: organization:acme#viewer
+    relation: viewer
+    object: agent:open-bot
+
   # --- PRIVATE agent with an explicit individual viewer grant ---
   - user: organization:acme
     relation: organization
@@ -128,6 +146,8 @@ tests:
     check:
       - user: identity_account:dave
         object: agent:secret-bot
+        context:
+          allow: false
         assertions:
           can_view: false
           can_execute: false
@@ -135,16 +155,22 @@ tests:
           can_clone: false
       - user: identity_account:dave
         object: skill:secret-notes
+        context:
+          allow: false
         assertions:
           can_view: false
           can_use: false
       - user: identity_account:dave
         object: workflow:secret-flow
+        context:
+          allow: false
         assertions:
           can_view: false
           can_execute: false
       - user: identity_account:dave
         object: mcp_server:secret-tools
+        context:
+          allow: false
         assertions:
           can_view: false
           can_use: false
@@ -154,6 +180,8 @@ tests:
     check:
       - user: identity_account:oscar
         object: agent:secret-bot
+        context:
+          allow: false
         assertions:
           can_view: true
           can_edit: true
@@ -161,11 +189,15 @@ tests:
           can_execute: true
       - user: identity_account:oscar
         object: skill:secret-notes
+        context:
+          allow: false
         assertions:
           can_view: true
           can_edit: true
       - user: identity_account:oscar
         object: workflow:secret-flow
+        context:
+          allow: false
         assertions:
           can_view: true
           can_edit: true
@@ -173,6 +205,8 @@ tests:
       # four private-blueprint kinds are pinned to the same rule.
       - user: identity_account:oscar
         object: mcp_server:secret-tools
+        context:
+          allow: false
         assertions:
           can_view: true
           can_edit: true
@@ -181,17 +215,22 @@ tests:
     list_objects:
       - user: identity_account:oscar
         type: agent
+        context:
+          allow: false
         assertions:
           can_view:
             - agent:secret-bot
             - agent:team-bot
             - agent:legacy-bot
+            - agent:open-bot
             - agent:shared-secret
 
   - name: owner retains full access to private blueprints
     check:
       - user: identity_account:carol
         object: agent:secret-bot
+        context:
+          allow: false
         assertions:
           can_view: true
           can_execute: true
@@ -200,6 +239,8 @@ tests:
           can_delete: true
       - user: identity_account:carol
         object: workflow:secret-flow
+        context:
+          allow: false
         assertions:
           can_view: true
           can_execute: true
@@ -209,6 +250,8 @@ tests:
     check:
       - user: identity_account:dave
         object: agent:team-bot
+        context:
+          allow: false
         assertions:
           can_view: true
           can_execute: true
@@ -217,10 +260,33 @@ tests:
           can_delete: false
       - user: identity_account:mallory
         object: agent:team-bot
+        context:
+          allow: false
         assertions:
           can_view: false
           can_execute: false
 
+  - name: public agent is reachable by everyone with allow context, and by org members without it
+    check:
+      # Outsider resolves through the conditional wildcard ({"allow": true}).
+      - user: identity_account:mallory
+        object: agent:open-bot
+        context:
+          allow: true
+        assertions:
+          can_view: true
+          can_execute: true
+      # Org member resolves through the org floor tuple even with the
+      # wildcard suppressed — this is what keeps public blueprints in
+      # org-scoped listings.
+      - user: identity_account:dave
+        object: agent:open-bot
+        context:
+          allow: false
+        assertions:
+          can_view: true
+          can_execute: true
+
   - name: explicit individual viewer grant on a private agent conveys view and run
     check:
       # Run-what-you-can-read: can_execute derives from viewer, so an
@@ -228,30 +294,38 @@ tests:
       # which checks can_view).
       - user: identity_account:dave
         object: agent:shared-secret
+        context:
+          allow: false
         assertions:
           can_view: true
           can_execute: true
           can_edit: false
 
-  - name: org member's listable agents exclude private ones
+  - name: org member's listable agents exclude private ones (wildcard suppressed)
     list_objects:
       - user: identity_account:dave
         type: agent
+        context:
+          allow: false
         assertions:
           can_view:
             - agent:team-bot
             - agent:legacy-bot
+            - agent:open-bot
             - agent:shared-secret
 
   - name: owner's listable agents include everything they authored
     list_objects:
       - user: identity_account:carol
         type: agent
+        context:
+          allow: false
         assertions:
           can_view:
             - agent:secret-bot
             - agent:team-bot
             - agent:legacy-bot
+            - agent:open-bot
             - agent:shared-secret
 
   # ── cloud#257: the viewer-role cell (previously untested) ──────────────
@@ -262,16 +336,27 @@ tests:
       # spend refusal is pinned separately on the org permissions below.
       - user: identity_account:vera
         object: agent:team-bot
+        context:
+          allow: false
         assertions:
           can_view: true
           can_clone: true
           can_execute: true
           can_edit: false
           can_delete: false
+      # The org floor of a PUBLIC blueprint reaches viewers the same way.
+      - user: identity_account:vera
+        object: agent:open-bot
+        context:
+          allow: false
+        assertions:
+          can_view: true
       # Private stays private — the viewer role grants nothing beyond the
       # explicit visibility tuples.
       - user: identity_account:vera
         object: agent:secret-bot
+        context:
+          allow: false
         assertions:
           can_view: false
           can_execute: false
@@ -297,6 +382,8 @@ tests:
     check:
       - user: identity_account:dave
         object: agent:legacy-bot
+        context:
+          allow: false
         assertions:
           can_view: true
           can_execute: true
@@ -305,6 +392,8 @@ tests:
       # organization#member. The boot backfill converges these tuples.
       - user: identity_account:vera
         object: agent:legacy-bot
+        context:
+          allow: false
         assertions:
           can_view: false
           can_execute: false
@@ -313,6 +402,9 @@ tests:
     list_objects:
       - user: identity_account:vera
         type: agent
+        context:
+          allow: false
         assertions:
           can_view:
             - agent:team-bot
+            - agent:open-bot

package/src/authorization/__tests__/fixtures/fga/cross-org-share-creation.fga.yaml

@@ -0,0 +1,98 @@
+# Pinned copy of stigmer-cloud backend/services/stigmer-server/fga/tests/cross-org-share-creation.fga.yaml
+# at commit 2ec420161 (the OpenFGA store test the cloud runs against its live model).
+# The body below is byte-identical to the source; the cloud re-runs the LIVE
+# file against this evaluator at the re-pin, so a stale copy is caught there.
+# Cross-org share creation, the FGA half of the decision 013 D2 consent
+# bar. Creating a share of ANOTHER org's marketplace-public agent requires:
+#
+#   1. can_execute on the agent — granted to every authenticated account by
+#      the allow_public wildcard when the agent is public (checked here),
+#      and to nobody cross-org when it is not.
+#   2. can_create_agent_share on the SHARE's own org — admin-level: a
+#      public share spends the org's credits on the open internet. The
+#      per-kind can_create_* pattern, one more row.
+#
+# The same-org bar (agent can_edit) is untouched and pinned by
+# agent-share-owner.fga.yaml; the app-level halves of the contract
+# (visibility check, audience rule, dependency sweep, agent-id pin) are
+# handler logic outside FGA, pinned by the Java and Go unit tests.
+
+name: cross-org-share-creation
+model_file: ../model/fga.mod
+
+tuples:
+  # provider-org publishes a marketplace-public agent (the conditional
+  # wildcard viewer tuple visibility_public writes).
+  - user: organization:provider-org
+    relation: organization
+    object: agent:public-helper
+  - user: identity_account:paula
+    relation: owner
+    object: agent:public-helper
+  - user: identity_account:*
+    relation: viewer
+    object: agent:public-helper
+    condition:
+      name: allow_public
+      context: {}
+
+  # A private agent in the same provider org — the wildcard is absent.
+  - user: organization:provider-org
+    relation: organization
+    object: agent:private-helper
+  - user: identity_account:paula
+    relation: owner
+    object: agent:private-helper
+
+  # consumer-org: an admin and a plain member.
+  - user: identity_account:adam
+    relation: admin
+    object: organization:consumer-org
+  - user: identity_account:mia
+    relation: member
+    object: organization:consumer-org
+
+tests:
+  - name: consumer-org admin holds both halves of the cross-org bar
+    check:
+      - user: identity_account:adam
+        object: agent:public-helper
+        context:
+          allow: true
+        assertions:
+          can_execute: true
+          can_edit: false
+      - user: identity_account:adam
+        object: organization:consumer-org
+        assertions:
+          can_create_agent_share: true
+
+  - name: plain member lacks the org-side bar (spending is admin-level)
+    check:
+      - user: identity_account:mia
+        object: agent:public-helper
+        context:
+          allow: true
+        assertions:
+          can_execute: true
+      - user: identity_account:mia
+        object: organization:consumer-org
+        assertions:
+          can_create_agent_share: false
+
+  - name: nobody cross-org can execute a private agent
+    check:
+      - user: identity_account:adam
+        object: agent:private-helper
+        context:
+          allow: true
+        assertions:
+          can_execute: false
+          can_view: false
+
+  - name: the org-side bar does not leak across orgs
+    check:
+      - user: identity_account:paula
+        object: organization:consumer-org
+        assertions:
+          can_create_agent_share: false