@stigmer/server 3.22.1 → 3.23.1-dev.20260923075205

package/src/pipeline/steps/__tests__/visibility-gates.test.ts

@@ -1,187 +0,0 @@
-/**
- * Pins the PUBLIC-visibility operator gates (C2 Stage 3, the Java
- * PublicVisibilityEscalationPolicy port): the create door fires only on a
- * new state declaring PUBLIC, the update door only on an ESCALATION to
- * public (re-asserting stored public passes), both answer the Java deny
- * copy on denial and pass under the permissive default (OSS
- * byte-identity), internal callers skip, and a missing loaded target is
- * a loud wiring fault.
- */
-import { describe, expect, it } from "vitest";
-import { Code, ConnectError } from "@connectrpc/connect";
-import { create } from "@bufbuild/protobuf";
-
-import { AgentSchema } from "@stigmer/protos/ai/stigmer/agentic/agent/v1/api_pb";
-import { AgentCommandController } from "@stigmer/protos/ai/stigmer/agentic/agent/v1/command_pb";
-import { UpdateVisibilityInputSchema } from "@stigmer/protos/ai/stigmer/commons/apiresource/io_pb";
-import { ApiResourceVisibility } from "@stigmer/protos/ai/stigmer/commons/apiresource/enum_pb";
-import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
-import { IamPermission } from "@stigmer/protos/ai/stigmer/iam/v1/enum_pb";
-
-import type { Authorizer, AuthzCheck } from "../../../extensions/authorizer.js";
-import type { CallerIdentity } from "../../../extensions/identity.js";
-import { RequestContext } from "../../request-context.js";
-import { newPermissiveSingleTeamAuthorizer } from "../authorize.js";
-import {
-  newAuthorizeVisibilityTransitionStep,
-  newGuardPublicVisibilityStep,
-  PUBLIC_VISIBILITY_DENY_MESSAGE,
-} from "../visibility-gates.js";
-
-const USER: CallerIdentity = {
-  identityId: "ida_alice",
-  callerClass: "user",
-  issuer: "stigmer",
-  rawToken: "tok",
-};
-
-const TARGET_KEY = "updateVisibilityAgent";
-
-function denying(observed?: AuthzCheck[]): Authorizer {
-  return {
-    authorize: (_caller, check) => {
-      observed?.push(check);
-      return Promise.resolve({ kind: "deny", reason: "" });
-    },
-  };
-}
-
-function createCtx(
-  visibility: ApiResourceVisibility,
-): RequestContext<typeof AgentSchema> {
-  return new RequestContext(
-    AgentSchema,
-    create(AgentSchema, { metadata: { name: "a", visibility } }),
-    USER,
-    ApiResourceKind.agent,
-  );
-}
-
-type UvDesc = typeof AgentCommandController.method.updateVisibility.input;
-
-function updateCtx(
-  requested: ApiResourceVisibility,
-  stored: ApiResourceVisibility | undefined,
-): RequestContext<UvDesc> {
-  const ctx = new RequestContext(
-    AgentCommandController.method.updateVisibility.input,
-    create(UpdateVisibilityInputSchema, {
-      resourceId: "agt_1",
-      visibility: requested,
-    }),
-    USER,
-    ApiResourceKind.agent,
-  );
-  if (stored !== undefined) {
-    ctx.set(
-      TARGET_KEY,
-      create(AgentSchema, { metadata: { visibility: stored } }),
-    );
-  }
-  return ctx;
-}
-
-describe("GuardPublicVisibility (the create door)", () => {
-  it("denies a PUBLIC create for non-operators with the Java copy", async () => {
-    const step = newGuardPublicVisibilityStep<typeof AgentSchema>(denying());
-    const error = await step
-      .execute(createCtx(ApiResourceVisibility.visibility_public))
-      ?.catch((e: unknown) => e);
-    expect((error as ConnectError).code).toBe(Code.PermissionDenied);
-    expect((error as ConnectError).rawMessage).toBe(
-      PUBLIC_VISIBILITY_DENY_MESSAGE,
-    );
-  });
-
-  it("non-public creates never reach the Authorizer (the lazy contract)", async () => {
-    const observed: AuthzCheck[] = [];
-    const step = newGuardPublicVisibilityStep<typeof AgentSchema>(
-      denying(observed),
-    );
-    await step.execute(createCtx(ApiResourceVisibility.visibility_org));
-    expect(observed).toEqual([]);
-  });
-
-  it("the permissive default allows public creates (OSS byte-identity)", async () => {
-    const step = newGuardPublicVisibilityStep<typeof AgentSchema>(
-      newPermissiveSingleTeamAuthorizer(),
-    );
-    await expect(
-      Promise.resolve(
-        step.execute(createCtx(ApiResourceVisibility.visibility_public)),
-      ),
-    ).resolves.toBeUndefined();
-  });
-});
-
-describe("AuthorizeVisibilityTransition (the update door)", () => {
-  it("denies escalation to public with the operator check", async () => {
-    const observed: AuthzCheck[] = [];
-    const step = newAuthorizeVisibilityTransitionStep<UvDesc>(
-      TARGET_KEY,
-      denying(observed),
-    );
-    const error = await step
-      .execute(
-        updateCtx(
-          ApiResourceVisibility.visibility_public,
-          ApiResourceVisibility.visibility_org,
-        ),
-      )
-      ?.catch((e: unknown) => e);
-    expect((error as ConnectError).code).toBe(Code.PermissionDenied);
-    expect((error as ConnectError).rawMessage).toBe(
-      PUBLIC_VISIBILITY_DENY_MESSAGE,
-    );
-    expect(observed).toEqual([
-      {
-        permission: IamPermission.can_set_public_visibility,
-        resourceKind: ApiResourceKind.platform,
-        resourceId: "stigmer",
-      },
-    ]);
-  });
-
-  it("re-asserting a stored PUBLIC is not an escalation", async () => {
-    const step = newAuthorizeVisibilityTransitionStep<UvDesc>(
-      TARGET_KEY,
-      denying(),
-    );
-    await expect(
-      Promise.resolve(
-        step.execute(
-          updateCtx(
-            ApiResourceVisibility.visibility_public,
-            ApiResourceVisibility.visibility_public,
-          ),
-        ),
-      ),
-    ).resolves.toBeUndefined();
-  });
-
-  it("non-public targets never reach the Authorizer", async () => {
-    const observed: AuthzCheck[] = [];
-    const step = newAuthorizeVisibilityTransitionStep<UvDesc>(
-      TARGET_KEY,
-      denying(observed),
-    );
-    await step.execute(
-      updateCtx(
-        ApiResourceVisibility.visibility_org,
-        ApiResourceVisibility.visibility_public,
-      ),
-    );
-    expect(observed).toEqual([]);
-  });
-
-  it("a missing loaded target is a loud wiring fault, never a silent pass", async () => {
-    const step = newAuthorizeVisibilityTransitionStep<UvDesc>(
-      TARGET_KEY,
-      denying(),
-    );
-    const error = await step
-      .execute(updateCtx(ApiResourceVisibility.visibility_public, undefined))
-      ?.catch((e: unknown) => e);
-    expect((error as ConnectError).code).toBe(Code.Internal);
-  });
-});

package/src/pipeline/steps/visibility-gates.ts

@@ -1,174 +0,0 @@
-/**
- * The PUBLIC-visibility operator gates — the two write doors a resource
- * can become public through, both consulting the ONE composed Authorizer
- * with the same platform-scoped check (the Java
- * PublicVisibilityEscalationPolicy port; C2 Stage 3, 20260827.10).
- *
- * PUBLIC is the only level that crosses every org boundary (one flip
- * lists a resource in every tenant's cross-org catalog), so entering it
- * is a curation decision: the owner requests, the platform team grants.
- * The answer is `can_set_public_visibility` on `platform:stigmer` — a
- * named operator capability, never a bare operator lookup.
- *
- *   - GuardPublicVisibility: the CREATE door, in the create chains of
- *     the kinds whose VisibilityConfig supports PUBLIC (agent, workflow,
- *     mcp_server, agent_instance, workflow_instance). After
- *     BuildNewState — it inspects the state that will persist — which
- *     keeps the pinned INVALID_ARGUMENT level-support rejections (the
- *     earlier ValidateVisibility) their precedence over this
- *     PERMISSION_DENIED.
- *   - AuthorizeVisibilityTransition: the UPDATE door, in every
- *     updateVisibility chain after ValidateVisibilityUpdate (the pinned
- *     FAILED_PRECONDITION default-instance rejection keeps precedence,
- *     the Java ordering the conformance suite depends on). Gates only
- *     the ESCALATION to public (stored level is anything else).
- *
- * Both run LAZILY — only requests that actually involve the PUBLIC level
- * reach the Authorizer — and both pass for internal callers (server-side
- * flows publish platform resources by design). The OSS permissive
- * default allows, so the local posture keeps today's behavior
- * byte-identically; the cloud's FGA Authorizer supplies the gate.
- *
- * DELIBERATE partial port, recorded owner-visibly (Stage-3 execution
- * record): Java's transition step additionally lets operators WITHOUT
- * resource can_edit publish and take down (its updateVisibility chains
- * authorize post-load, transition-aware); this edition's position-1
- * Authorize enforces can_edit on updateVisibility before any step here
- * runs, so those operator-without-edit lanes require can_edit until the
- * Stage-4 chain disposition addresses them. No conformance lane pins
- * them.
- */
-import { Code, ConnectError } from "@connectrpc/connect";
-import type { DescMessage } from "@bufbuild/protobuf";
-
-import { ApiResourceVisibility } from "@stigmer/protos/ai/stigmer/commons/apiresource/enum_pb";
-import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
-import type { UpdateVisibilityInput } from "@stigmer/protos/ai/stigmer/commons/apiresource/io_pb";
-import { IamPermission } from "@stigmer/protos/ai/stigmer/iam/v1/enum_pb";
-
-import type { Authorizer, AuthzDecision } from "../../extensions/authorizer.js";
-import type { CallerIdentity } from "../../extensions/identity.js";
-import { internalError } from "../errors.js";
-import type { PipelineStep } from "../pipeline.js";
-import type { RequestContext } from "../request-context.js";
-import { metadataOf } from "./shapes.js";
-
-/**
- * The denial callers see at both doors (the Java policy copy verbatim).
- * Deliberately not byte-pinned by the OSS conformance suite; the cloud
- * gate itself is recorded via the clientPublicVisibilityWrites flag.
- */
-export const PUBLIC_VISIBILITY_DENY_MESSAGE =
-  "Public visibility is granted by the platform team. " +
-  "Ask a platform operator to publish this resource.";
-
-/** The CREATE door: a new state declaring PUBLIC needs the operator grant. */
-export function newGuardPublicVisibilityStep<Desc extends DescMessage>(
-  authorizer: Authorizer,
-): PipelineStep<Desc> {
-  return {
-    name: "GuardPublicVisibility",
-    async execute(ctx: RequestContext<Desc>): Promise<void> {
-      if (ctx.callerIdentity.callerClass === "internal") {
-        return;
-      }
-      if (
-        metadataOf(ctx.newState)?.visibility !==
-        ApiResourceVisibility.visibility_public
-      ) {
-        return;
-      }
-      await requireOperatorMaySetPublic(authorizer, ctx.callerIdentity);
-    },
-  };
-}
-
-/**
- * The UPDATE door: escalation to PUBLIC (the stored level is anything
- * else) needs the operator grant. Reads the loaded target from the
- * chain's own context key (every updateVisibility chain stores it —
- * the RecordVisibilityBeforeUpdate pattern).
- */
-export function newAuthorizeVisibilityTransitionStep<Desc extends DescMessage>(
-  targetKey: string,
-  authorizer: Authorizer,
-): PipelineStep<Desc> {
-  return {
-    name: "AuthorizeVisibilityTransition",
-    async execute(ctx: RequestContext<Desc>): Promise<void> {
-      if (ctx.callerIdentity.callerClass === "internal") {
-        return;
-      }
-      const requested = (ctx.input as unknown as UpdateVisibilityInput)
-        .visibility;
-      if (requested !== ApiResourceVisibility.visibility_public) {
-        return;
-      }
-      const target = ctx.get(targetKey);
-      if (target === undefined) {
-        // Wiring error, not a user error: without the loaded target there
-        // is no stored level, and a gate that silently passes un-guards
-        // the boundary it exists to protect.
-        throw internalError(
-          new Error(
-            "AuthorizeVisibilityTransition ran without a loaded target — step must be placed after the load step",
-          ),
-          "visibility authorization requires the loaded resource",
-        );
-      }
-      const stored = metadataOf(target as typeof ctx.newState)?.visibility;
-      if (stored === ApiResourceVisibility.visibility_public) {
-        return; // Re-asserting a stored PUBLIC is not an escalation.
-      }
-      await requireOperatorMaySetPublic(authorizer, ctx.callerIdentity);
-    },
-  };
-}
-
-/**
- * The single owner of "may this caller set public?" — both doors call it,
- * and so does the plugin push chain, whose requested level rides the
- * request (the level then flows to every member through the members' own
- * create and updateVisibility doors, which run this check again).
- */
-export async function requireOperatorMaySetPublic(
-  authorizer: Authorizer,
-  caller: CallerIdentity,
-): Promise<void> {
-  let decision: AuthzDecision;
-  try {
-    decision = await authorizer.authorize(caller, {
-      permission: IamPermission.can_set_public_visibility,
-      resourceKind: ApiResourceKind.platform,
-      resourceId: "stigmer",
-    });
-  } catch (error) {
-    throw publicVisibilityCheckFailure(error);
-  }
-  switch (decision.kind) {
-    case "allow":
-      return;
-    case "deny":
-    case "not-found":
-      throw new ConnectError(
-        PUBLIC_VISIBILITY_DENY_MESSAGE,
-        Code.PermissionDenied,
-      );
-    case "unavailable":
-      throw publicVisibilityCheckFailure(decision.cause);
-    default: {
-      const exhaustive: never = decision;
-      throw publicVisibilityCheckFailure(
-        new Error(`unknown decision ${JSON.stringify(exhaustive)}`),
-      );
-    }
-  }
-}
-
-/** Authorization infrastructure failure: fail closed, sanitized (#478). */
-function publicVisibilityCheckFailure(error: unknown): ConnectError {
-  return internalError(
-    error instanceof Error ? error : new Error(String(error)),
-    "public-visibility authorization could not be completed",
-  );
-}