@stigmer/server 3.22.1-dev.20260922095755 → 3.23.0

package/src/authorization/__tests__/fixtures/fga/default-instance-inheritance.fga.yaml

@@ -1,5 +1,5 @@
 # Pinned copy of stigmer-cloud backend/services/stigmer-server/fga/tests/default-instance-inheritance.fga.yaml
-# as changed by stigmer-cloud#765 (the OpenFGA store test the cloud runs against its live model).
+# at commit b87dd1170 (the OpenFGA store test the cloud runs against its live model).
 # The body below is byte-identical to the source; the cloud re-runs the LIVE
 # file against this evaluator at the re-pin, so a stale copy is caught there.
 # Store tests for default-instance structural inheritance (default_of).
@@ -7,8 +7,8 @@
 # A blueprint's system-managed default instance carries a single
 #   instance#default_of@<blueprint>:<id>
 # tuple and inherits the blueprint's ENTIRE viewer set through
-# `viewer from default_of` — org members and platform users
-# (identity_provider#platform_user). No enum-derived
+# `viewer from default_of` — org members, public users (allow_public), and
+# platform users (identity_provider#platform_user). No enum-derived
 # visibility tuples are ever written on default instances, so their access
 # can never drift from the template's.
 #
@@ -20,7 +20,8 @@
 # visibility level; each has a default instance linked via default_of.
 # Alice (acme member) reaches default instances of platform-shared
 # blueprints; planton members reach default instances of org-visible ones;
-# personal instances never leak.
+# everyone reaches default instances of public ones; personal instances
+# never leak.
 name: default-instance-inheritance
 model_file: ../model/fga.mod
 
@@ -114,6 +115,35 @@ tuples:
     relation: default_of
     object: agent_instance:internal-default
 
+  # --- Public agent + its default instance ---
+  # PUBLIC carries the org floor tuple too (viewer@org#viewer).
+  - user: organization:planton
+    relation: organization
+    object: agent:public-bot
+  - user: identity_account:swarup
+    relation: owner
+    object: agent:public-bot
+  - user: identity_account:*
+    relation: viewer
+    object: agent:public-bot
+    condition:
+      name: allow_public
+  - user: organization:planton#viewer
+    relation: viewer
+    object: agent:public-bot
+  - user: organization:planton
+    relation: organization
+    object: agent_instance:public-bot-default
+  - user: agent:public-bot
+    relation: agent
+    object: agent_instance:public-bot-default
+  - user: identity_account:swarup
+    relation: owner
+    object: agent_instance:public-bot-default
+  - user: agent:public-bot
+    relation: default_of
+    object: agent_instance:public-bot-default
+
   # --- Platform-shared workflow + its default instance ---
   - user: organization:planton
     relation: organization
@@ -145,6 +175,8 @@ tests:
     check:
       - user: identity_account:alice
         object: agent_instance:sara-default
+        context:
+          allow: false
         assertions:
           can_view: true
           can_execute: true
@@ -155,6 +187,8 @@ tests:
     check:
       - user: identity_account:mallory
         object: agent_instance:sara-default
+        context:
+          allow: false
         assertions:
           can_view: false
           can_execute: false
@@ -165,10 +199,14 @@ tests:
       # default_of tuple — only she (its owner) can reach it.
       - user: identity_account:swarup
         object: agent_instance:alice-personal
+        context:
+          allow: false
         assertions:
           can_view: false
       - user: identity_account:alice
         object: agent_instance:alice-personal
+        context:
+          allow: false
         assertions:
           can_view: true
           can_edit: true
@@ -177,6 +215,8 @@ tests:
     check:
       - user: identity_account:priya
         object: agent_instance:internal-default
+        context:
+          allow: false
         assertions:
           can_view: true
           can_execute: true
@@ -186,19 +226,34 @@ tests:
       # read audience, and the default instance inherits it structurally.
       - user: identity_account:veda
         object: agent_instance:internal-default
+        context:
+          allow: false
         assertions:
           can_view: true
           can_edit: false
       # Managed-org membership grants nothing on non-platform-shared agents.
       - user: identity_account:alice
         object: agent_instance:internal-default
+        context:
+          allow: false
         assertions:
           can_view: false
 
+  - name: everyone reaches the default instance of a public agent
+    check:
+      - user: identity_account:mallory
+        object: agent_instance:public-bot-default
+        context:
+          allow: true
+        assertions:
+          can_view: true
+
   - name: managed-org member reaches the default instance of a platform-shared workflow
     check:
       - user: identity_account:alice
         object: workflow_instance:onboarding-default
+        context:
+          allow: false
         assertions:
           can_view: true
           can_execute: true
@@ -208,6 +263,8 @@ tests:
     list_objects:
       - user: identity_account:alice
         type: agent_instance
+        context:
+          allow: false
         assertions:
           can_view:
             - agent_instance:sara-default

package/src/authorization/__tests__/fixtures/fga/mcp-server-authoring.fga.yaml

@@ -0,0 +1,143 @@
+# Pinned copy of stigmer-cloud backend/services/stigmer-server/fga/tests/mcp-server-authoring.fga.yaml
+# at commit 4c03c38d2 (the OpenFGA store test the cloud runs against its live model).
+# The body below is byte-identical to the source; the cloud re-runs the LIVE
+# file against this evaluator at the re-pin, so a stale copy is caught there.
+# Store tests for MCP-server authoring: an MCP server is an organization's
+# blueprint, so creating one takes the organization's admin bar
+# (can_create_mcp_server: admin), the bar agents, workflows and skills
+# already take. Until stigmer#1209 (v3.22.0) the create ran no check in
+# either edition and any member could author one; these pin the bar and
+# the story it leaves for members: an admin authors the server org-visible
+# and a member connects it (can_connect) with their own credentials, while
+# a private server stays the owner's and the admins'.
+#
+# Run: fga model test --tests mcp-server-authoring.fga.yaml
+
+name: mcp-server-authoring
+model_file: ../model/fga.mod
+
+tuples:
+  # Org acme: olivia owns it, oscar administers, dave is a plain member,
+  # vera a read-only viewer; mallory belongs to an unrelated org.
+  - user: identity_account:olivia
+    relation: owner
+    object: organization:acme
+  - user: identity_account:oscar
+    relation: admin
+    object: organization:acme
+  - user: identity_account:dave
+    relation: member
+    object: organization:acme
+  - user: identity_account:vera
+    relation: viewer
+    object: organization:acme
+  - user: identity_account:mallory
+    relation: member
+    object: organization:other
+
+  # An ORG-visible server oscar authored (the org viewer tuple the
+  # visibility writer emits).
+  - user: organization:acme
+    relation: organization
+    object: mcp_server:github
+  - user: identity_account:oscar
+    relation: owner
+    object: mcp_server:github
+  - user: organization:acme#viewer
+    relation: viewer
+    object: mcp_server:github
+
+  # A PRIVATE server oscar authored (no visibility tuple).
+  - user: organization:acme
+    relation: organization
+    object: mcp_server:vault
+  - user: identity_account:oscar
+    relation: owner
+    object: mcp_server:vault
+
+tests:
+  - name: authoring an MCP server is an admin act, the blueprint bar
+    check:
+      - user: identity_account:olivia
+        object: organization:acme
+        assertions:
+          can_create_mcp_server: true
+          can_create_agent: true
+      - user: identity_account:oscar
+        object: organization:acme
+        assertions:
+          can_create_mcp_server: true
+          can_create_agent: true
+
+  - name: a member, a viewer and an outsider cannot author one
+    check:
+      - user: identity_account:dave
+        object: organization:acme
+        assertions:
+          can_create_mcp_server: false
+      - user: identity_account:vera
+        object: organization:acme
+        assertions:
+          can_create_mcp_server: false
+      - user: identity_account:mallory
+        object: organization:acme
+        assertions:
+          can_create_mcp_server: false
+
+  - name: a member connects an admin-authored org-visible server with their own credentials
+    check:
+      - user: identity_account:dave
+        object: mcp_server:github
+        context:
+          allow: false
+        assertions:
+          can_view: true
+          can_connect: true
+          can_edit: false
+      - user: identity_account:vera
+        object: mcp_server:github
+        context:
+          allow: false
+        assertions:
+          can_view: true
+          can_connect: true
+          can_edit: false
+      - user: identity_account:mallory
+        object: mcp_server:github
+        context:
+          allow: false
+        assertions:
+          can_view: false
+          can_connect: false
+
+  - name: a private server stays with its author and the org admins
+    check:
+      - user: identity_account:oscar
+        object: mcp_server:vault
+        context:
+          allow: false
+        assertions:
+          can_view: true
+          can_connect: true
+          can_edit: true
+      - user: identity_account:olivia
+        object: mcp_server:vault
+        context:
+          allow: false
+        assertions:
+          can_view: true
+          can_edit: true
+      - user: identity_account:dave
+        object: mcp_server:vault
+        context:
+          allow: false
+        assertions:
+          can_view: false
+          can_connect: false
+      - user: identity_account:vera
+        object: mcp_server:vault
+        context:
+          allow: false
+        assertions:
+          can_view: false
+          can_connect: false

package/src/authorization/__tests__/fixtures/fga/org-admin-owner-inheritance.fga.yaml

@@ -1,5 +1,5 @@
 # Pinned copy of stigmer-cloud backend/services/stigmer-server/fga/tests/org-admin-owner-inheritance.fga.yaml
-# as changed by stigmer-cloud#765 (the OpenFGA store test the cloud runs against its live model).
+# as changed by stigmer-cloud#757 (the OpenFGA store test the cloud runs against its live model).
 # The body below is byte-identical to the source; the cloud re-runs the LIVE
 # file against this evaluator at the re-pin, so a stale copy is caught there.
 # Store tests for org-admin owner inheritance (T08).
@@ -131,6 +131,8 @@ tests:
     check:
       - user: identity_account:ana
         object: agent:carols-bot
+        context:
+          allow: false
         assertions:
           can_view: true
           can_edit: true
@@ -167,6 +169,8 @@ tests:
           can_grant_access: true
       - user: identity_account:ana
         object: skill:carols-notes
+        context:
+          allow: false
         assertions:
           can_view: true
           can_edit: true
@@ -174,6 +178,8 @@ tests:
           can_grant_access: true
       - user: identity_account:ana
         object: workflow:carols-flow
+        context:
+          allow: false
         assertions:
           can_view: true
           can_edit: true
@@ -191,6 +197,8 @@ tests:
     check:
       - user: identity_account:root
         object: agent:carols-bot
+        context:
+          allow: false
         assertions:
           can_edit: true
           can_delete: true
@@ -210,6 +218,8 @@ tests:
     check:
       - user: identity_account:dave
         object: agent:carols-bot
+        context:
+          allow: false
         assertions:
           can_view: false
           can_edit: false
@@ -240,6 +250,8 @@ tests:
     check:
       - user: identity_account:zara
         object: agent:carols-bot
+        context:
+          allow: false
         assertions:
           can_view: false
           can_edit: false
@@ -254,6 +266,8 @@ tests:
     check:
       - user: identity_account:ana
         object: agent_instance:carols-instance
+        context:
+          allow: false
         assertions:
           can_view: false
           can_edit: false
@@ -283,6 +297,8 @@ tests:
     check:
       - user: identity_account:carol
         object: agent:carols-bot
+        context:
+          allow: false
         assertions:
           can_view: true
           can_edit: true
@@ -293,6 +309,8 @@ tests:
     list_objects:
       - user: identity_account:ana
         type: agent
+        context:
+          allow: false
         assertions:
           can_view:
             - agent:carols-bot
@@ -300,6 +318,8 @@ tests:
             - agent:carols-bot
       - user: identity_account:ana
         type: agent_instance
+        context:
+          allow: false
         assertions:
           can_view: []
       - user: identity_account:ana

package/src/authorization/__tests__/fixtures/fga/platform-visibility.fga.yaml

@@ -1,5 +1,5 @@
 # Pinned copy of stigmer-cloud backend/services/stigmer-server/fga/tests/platform-visibility.fga.yaml
-# as changed by stigmer-cloud#765 (the OpenFGA store test the cloud runs against its live model).
+# at commit b87dd1170 (the OpenFGA store test the cloud runs against its live model).
 # The body below is byte-identical to the source; the cloud re-runs the LIVE
 # file against this evaluator at the re-pin, so a stale copy is caught there.
 # Store tests for platform visibility (visibility_platform).
@@ -102,6 +102,8 @@ tests:
     check:
       - user: identity_account:alice
         object: agent:sara
+        context:
+          allow: false
         assertions:
           can_view: true
           can_execute: true
@@ -110,6 +112,8 @@ tests:
           can_delete: false
       - user: identity_account:bob
         object: agent:sara
+        context:
+          allow: false
         assertions:
           can_view: true
           can_execute: true
@@ -118,6 +122,8 @@ tests:
     check:
       - user: identity_account:mallory
         object: agent:sara
+        context:
+          allow: false
         assertions:
           can_view: false
           can_execute: false
@@ -127,6 +133,8 @@ tests:
     check:
       - user: identity_account:priya
         object: agent:sara
+        context:
+          allow: false
         assertions:
           can_view: true
           can_execute: true
@@ -136,6 +144,8 @@ tests:
       # narrower: platform_user resolves member-from-managed_org.)
       - user: identity_account:veda
         object: agent:sara
+        context:
+          allow: false
         assertions:
           can_view: true
           can_edit: false
@@ -144,6 +154,8 @@ tests:
     check:
       - user: identity_account:alice
         object: agent:internal-bot
+        context:
+          allow: false
         assertions:
           can_view: false
           can_execute: false
@@ -151,6 +163,8 @@ tests:
       # without an explicit visibility tuple.
       - user: identity_account:priya
         object: agent:internal-bot
+        context:
+          allow: false
         assertions:
           can_view: false
           can_execute: false
@@ -159,6 +173,8 @@ tests:
     check:
       - user: identity_account:alice
         object: skill:research
+        context:
+          allow: false
         assertions:
           can_view: true
           can_use: true
@@ -168,6 +184,8 @@ tests:
     check:
       - user: identity_account:alice
         object: workflow:onboarding
+        context:
+          allow: false
         assertions:
           can_view: true
           can_execute: true
@@ -176,6 +194,8 @@ tests:
     check:
       - user: identity_account:alice
         object: mcp_server:github
+        context:
+          allow: false
         assertions:
           can_view: true
           can_use: true
@@ -185,6 +205,8 @@ tests:
     check:
       - user: identity_account:swarup
         object: agent:sara
+        context:
+          allow: false
         assertions:
           can_view: true
           can_edit: true
@@ -194,6 +216,8 @@ tests:
     list_objects:
       - user: identity_account:alice
         type: agent
+        context:
+          allow: false
         assertions:
           can_view:
             - agent:sara

package/src/authorization/__tests__/fixtures/fga/public-visibility-setter.fga.yaml

@@ -0,0 +1,52 @@
+# Pinned copy of stigmer-cloud backend/services/stigmer-server/fga/tests/public-visibility-setter.fga.yaml
+# at commit b87dd1170 (the OpenFGA store test the cloud runs against its live model).
+# The body below is byte-identical to the source; the cloud re-runs the LIVE
+# file against this evaluator at the re-pin, so a stale copy is caught there.
+# Store tests for the public-visibility permission (marketplace curation).
+#
+# can_set_public_visibility gates who may set a resource's visibility to
+# PUBLIC — the only level that crosses every org boundary. It derives
+# from the platform operator role: operators (human curators and the
+# seeding machine account) hold it; ordinary tenants — even org owners,
+# who can otherwise fully manage their resources — never do. Enforced by
+# PublicVisibilityEscalationPolicy at both write doors (updateVisibility
+# escalation and create-with-public).
+#
+# Run with:
+#   fga model test --tests public-visibility-setter.fga.yaml
+name: public-visibility-setter
+model_file: ../model/fga.mod
+
+tuples:
+  # The bootstrap machine account is the platform operator
+  # (BootstrapIdentitySeeder re-asserts this tuple on every boot).
+  - user: identity_account:machine
+    relation: operator
+    object: platform:stigmer
+
+  # A human operator granted the same platform role.
+  - user: identity_account:opal
+    relation: operator
+    object: platform:stigmer
+
+  # A tenant org owner — owns everything in their org, nothing on the
+  # platform.
+  - user: identity_account:mallory
+    relation: owner
+    object: organization:acme
+
+tests:
+  - name: operators may set public visibility, tenants may not
+    check:
+      - user: identity_account:machine
+        object: platform:stigmer
+        assertions:
+          can_set_public_visibility: true
+      - user: identity_account:opal
+        object: platform:stigmer
+        assertions:
+          can_set_public_visibility: true
+      - user: identity_account:mallory
+        object: platform:stigmer
+        assertions:
+          can_set_public_visibility: false

package/src/authorization/__tests__/fixtures/fga/workflow-execution-sharing.fga.yaml

@@ -1,5 +1,5 @@
 # Pinned copy of stigmer-cloud backend/services/stigmer-server/fga/tests/workflow-execution-sharing.fga.yaml
-# as changed by stigmer-cloud#765 (the OpenFGA store test the cloud runs against its live model).
+# at commit b87dd1170 (the OpenFGA store test the cloud runs against its live model).
 # The body below is byte-identical to the source; the cloud re-runs the LIVE
 # file against this evaluator at the re-pin, so a stale copy is caught there.
 # Store tests for workflow_execution sharing and run observability.
@@ -173,6 +173,8 @@ tests:
       # never alice's run history.
       - user: identity_account:vera
         object: workflow_instance:inst1
+        context:
+          allow: false
         assertions:
           can_view: true
       - user: identity_account:vera

package/src/authorization/__tests__/list-read-scope.test.ts

@@ -1,15 +1,15 @@
 /**
  * Pins the built-in list read scope on both store drivers as the twin of
  * the cloud's driver (stigmer-cloud iam/list-read-scope.ts): every
- * candidate a list lane offers is answered by `can_view` through the same
- * evaluator the Authorizer uses, over tuples derived from the facts the
- * candidate carries — no candidate row is read twice.
+ * candidate a list lane offers is answered by `can_view` under the
+ * LISTING context (`allow: false`, the public wildcard suppressed) through
+ * the same evaluator the Authorizer uses, over tuples derived from the
+ * facts the candidate carries — no candidate row is read twice.
  *
  * The adversarial cells come first, because until slice 5's sibling
  * cells this file and the composed proof are the only proof that a
- * member's list is a member's list: the outsider sees nothing (a row
- * still carrying the retired public level included); the viewer rung sees
- * the org-visible blueprints
+ * member's list is a member's list: the outsider sees nothing (a legacy
+ * PUBLIC row included); the viewer rung sees the org-visible blueprints
  * and nothing personal; the founder — an admin — sees the organization's
  * blueprints and NOT its members' sessions, keys, environments or
  * memories (the model's own line, now list-visible); an execution is its session's and
@@ -280,10 +280,9 @@ describe.each(driverFixtures(SEEDED_KINDS))(
           await grant(orgRole(VIEWER, "viewer", ORG));
 
           // Blueprints: the founder's private and org-visible agents, a
-          // member's private one, one still carrying the retired public
-          // level (a row the store migration has not met, which derives no
-          // viewer grant and so reads as its owner's alone), and one
-          // stamped by the 3.14 verifiers' raw subject.
+          // member's private one, a legacy PUBLIC one (nobody can set public
+          // under the built-in posture; a row from before it can carry it),
+          // and one stamped by the 3.14 verifiers' raw subject.
           await save("agent", {
             id: "agt_private",
             org: ORG,
@@ -428,7 +427,7 @@ describe.each(driverFixtures(SEEDED_KINDS))(
         });
 
         describe("the adversarial cells", () => {
-          it("an OUTSIDER lists nothing of the organization's — a row still carrying the retired public level included", async () => {
+          it("an OUTSIDER lists nothing of the organization's — not even the legacy PUBLIC blueprint, which the listing context suppresses", async () => {
             for (const kind of SEEDED_KINDS.filter(
               (k) =>
                 k !== ApiResourceKind.iam_policy &&
@@ -442,13 +441,13 @@ describe.each(driverFixtures(SEEDED_KINDS))(
             }
           });
 
-          it("a VIEWER lists the org-visible blueprint and nothing private; a MEMBER adds their own private one; the retired level grants neither anything", async () => {
+          it("a VIEWER lists the org-visible and the public blueprints and nothing private; a MEMBER adds their own private one", async () => {
             expect(
               await listAs(resolved(VIEWER), ApiResourceKind.agent),
-            ).toEqual(["agt_org"]);
+            ).toEqual(["agt_org", "agt_public"]);
             expect(
               await listAs(resolved(MEMBER), ApiResourceKind.agent),
-            ).toEqual(["agt_org", "agt_member_private"]);
+            ).toEqual(["agt_org", "agt_member_private", "agt_public"]);
           });
 
           it("the FOUNDER and the ADMIN list every blueprint (`owner: … or admin from organization`), including a member's private one", async () => {
@@ -543,7 +542,7 @@ describe.each(driverFixtures(SEEDED_KINDS))(
             const offered = [
               entryOf(
                 ApiResourceKind.agent,
-                rows.get(ApiResourceKind.agent)!.get("agt_member_private")!,
+                rows.get(ApiResourceKind.agent)!.get("agt_public")!,
               ),
               entryOf(
                 ApiResourceKind.agent,
@@ -563,15 +562,15 @@ describe.each(driverFixtures(SEEDED_KINDS))(
               ApiResourceKind.agent,
               offered,
             );
-            expect([...kept]).toEqual(["agt_member_private", "agt_org"]);
+            expect([...kept]).toEqual(["agt_public", "agt_org"]);
             // The lane's order is the lane's: the helper filters its own
             // array by the kept set.
             expect(
               await listAs(resolved(MEMBER), ApiResourceKind.agent, [
-                rows.get(ApiResourceKind.agent)!.get("agt_member_private")!,
+                rows.get(ApiResourceKind.agent)!.get("agt_public")!,
                 rows.get(ApiResourceKind.agent)!.get("agt_org")!,
               ]),
-            ).toEqual(["agt_member_private", "agt_org"]);
+            ).toEqual(["agt_public", "agt_org"]);
           });
 
           it("no candidates: the empty set, with no read of any kind", async () => {