@stigmer/server 3.23.0 → 3.23.1-dev.20260923075205

package/src/authorization/__tests__/evaluator.test.ts

@@ -1,11 +1,10 @@
 /**
  * Pins the evaluator's semantics the store tests cannot express (the
  * cloud's `.fga.yaml` documents prove the model's answers; this file
- * proves the machinery under them): how a person matches a tuple, what
- * the `allow_public` context does, that a direct tuple outside the line's
- * type restriction is ignored (model drift fails closed), how far a
- * resolution may walk, and that a declaration cycle or an undeclared
- * target is a thrown fault and never a silent deny.
+ * proves the machinery under them): how a person matches a tuple, that a
+ * direct tuple outside the line's type restriction is ignored (model drift
+ * fails closed), how far a resolution may walk, and that a declaration
+ * cycle or an undeclared target is a thrown fault and never a silent deny.
  *
  * The fixture source is the in-memory one the store-test kit uses, so the
  * two proofs share one tuple vocabulary. Where a case needs a shape the
@@ -30,7 +29,6 @@ import {
   direct,
   from,
   objectOf,
-  publicWith,
   union,
   usersetOf,
 } from "../model/rewrite.js";
@@ -56,22 +54,17 @@ function person(accountId: string, ...aliases: string[]): Person {
   return { accountId, aliases: new Set([accountId, ...aliases]) };
 }
 
-const RESOLVE = { allow: true };
-const LIST = { allow: false };
-
 async function allowed(
   source: TupleSource,
   object: string,
   relation: string,
   who: Person,
-  context = RESOLVE,
 ): Promise<boolean> {
   return checkRelation(
     { model: builtInModel, source },
     parseObjectRef(object),
     relation,
     who,
-    context,
   );
 }
 
@@ -100,67 +93,17 @@ describe("a person against a direct tuple", () => {
   });
 });
 
-describe("the public wildcard and its condition", () => {
-  const publicViewer = (object: string): Tuple => ({
-    object: parseObjectRef(object),
-    relation: "viewer",
-    subject: {
-      form: "wildcard",
-      type: "identity_account",
-      condition: "allow_public",
-    },
-  });
-  const source = newInMemoryTupleSource([
-    tuple("agent:open#organization@organization:acme"),
-    publicViewer("agent:open"),
-  ]);
-  const stranger = person("ida_mallory");
-
-  it("reads for anyone on a point check (the cloud's `allow: true`) and for nobody in a listing (`allow: false`)", async () => {
+describe("a stranger against a row with no grant that names them", () => {
+  it("reads nothing: no subject form reaches every account, so a stranger holds no relation on a row they were not granted", async () => {
+    const source = newInMemoryTupleSource([
+      tuple("agent:open#organization@organization:acme"),
+      tuple("agent:open#owner@identity_account:ida_carol"),
+      tuple("agent:open#viewer@organization:acme#viewer"),
+    ]);
+    const stranger = person("ida_mallory");
     expect(await allowed(source, "agent:open", "can_view", stranger)).toBe(
-      true,
+      false,
     );
-    expect(
-      await allowed(source, "agent:open", "can_view", stranger, LIST),
-    ).toBe(false);
-  });
-
-  it("ignores a wildcard tuple that carries no condition where the line demands one — a tuple the cloud could never have written", async () => {
-    const bare = newInMemoryTupleSource([
-      tuple("agent:open#viewer@identity_account:*"),
-    ]);
-    expect(await allowed(bare, "agent:open", "can_view", stranger)).toBe(false);
-  });
-
-  it("is a thrown fault under a condition the transcript names but the evaluator does not know — a model that grew a condition", async () => {
-    const grown = declareKind({
-      kind: ApiResourceKind.agent,
-      schema: AgentSchema,
-      source: "test/grown.fga",
-      relations: [
-        ["viewer", direct(publicWith("identity_account", "after_hours"))],
-      ],
-    });
-    const afterHours = newInMemoryTupleSource([
-      {
-        object: parseObjectRef("agent:open"),
-        relation: "viewer",
-        subject: {
-          form: "wildcard",
-          type: "identity_account",
-          condition: "after_hours",
-        },
-      },
-    ]);
-    await expect(
-      checkRelation(
-        { model: newModel([grown]), source: afterHours },
-        parseObjectRef("agent:open"),
-        "viewer",
-        stranger,
-        RESOLVE,
-      ),
-    ).rejects.toMatchObject({ reason: "unknown-condition" });
   });
 });
 
@@ -277,7 +220,6 @@ describe("the walk itself", () => {
         parseObjectRef("agent:n0"),
         "next",
         person("ida_nobody"),
-        RESOLVE,
       ),
     ).rejects.toMatchObject({ reason: "resolution-depth-exceeded" });
   });
@@ -298,7 +240,6 @@ describe("the walk itself", () => {
         parseObjectRef("agent:x"),
         "a",
         person("ida_nobody"),
-        RESOLVE,
       ),
     ).rejects.toBeInstanceOf(AuthorizationEvaluationError);
   });
@@ -332,7 +273,7 @@ describe("declareKind validates a transcript at load", () => {
         source: "test/bad.fga",
         relations: [
           ["viewer", direct(objectOf("identity_account"))],
-          ["viewer", direct(publicWith("identity_account", "allow_public"))],
+          ["viewer", direct(usersetOf("organization", "viewer"))],
         ],
       }),
     ).toThrow("declared twice");

package/src/authorization/__tests__/facts.test.ts

@@ -50,7 +50,7 @@ describe("rowFactsOf against the tuple lifecycle's own resolution", () => {
     for (const visibility of [
       ApiResourceVisibility.visibility_private,
       ApiResourceVisibility.visibility_org,
-      ApiResourceVisibility.visibility_public,
+      ApiResourceVisibility.visibility_platform,
     ]) {
       it(`${declaration.type} at ${ApiResourceVisibility[visibility]}: the same parent links and visibility shapes`, () => {
         const row = fixtureRow(declaration, {
@@ -133,7 +133,7 @@ describe("a list candidate against the loaded row — the facts' two producers",
     for (const visibility of [
       ApiResourceVisibility.visibility_private,
       ApiResourceVisibility.visibility_org,
-      ApiResourceVisibility.visibility_public,
+      ApiResourceVisibility.visibility_platform,
     ]) {
       it(`${declaration.type} at ${ApiResourceVisibility[visibility]}: the candidate the helper builds carries the facts the driver derives from`, async () => {
         const row = fixtureRow(declaration, {

package/src/authorization/__tests__/fixtures/fga/agent-instance-creation.fga.yaml

@@ -1,5 +1,5 @@
 # Pinned copy of stigmer-cloud backend/services/stigmer-server/fga/tests/agent-instance-creation.fga.yaml
-# at commit 4c03c38d2 (the OpenFGA store test the cloud runs against its live model).
+# as changed by stigmer-cloud#765 (the OpenFGA store test the cloud runs against its live model).
 # The body below is byte-identical to the source; the cloud re-runs the LIVE
 # file against this evaluator at the re-pin, so a stale copy is caught there.
 # Store tests for agent-instance creation: two halves, asked together by
@@ -8,15 +8,15 @@
 # agent may instantiate it). The organization half is
 # can_create_agent_instance: member on the organization the instance is
 # created IN, which is the caller's own, not the agent's: a personal
-# instance of another organization's public agent lives in the caller's
-# organization (the marketplace case), so the agent's permission alone
-# would let a row be planted in any organization named on the request.
+# instance of another organization's platform-visible agent lives in the
+# caller's organization (the tenant-family case), so the agent's permission
+# alone would let a row be planted in any organization named on the request.
 #
 # What these pin: owners, admins and members hold the organization half;
 # a viewer-role account may run an org-visible agent (the agent half) and
 # still lacks the organization half; a guest holds neither; an outsider
-# holds neither; and the marketplace case passes on the caller's own
-# organization while the agent half comes from the public wildcard.
+# holds neither; and the tenant-family case passes on the caller's own
+# organization while the agent half comes from the platform_viewer grant.
 #
 # Run: fga model test --tests agent-instance-creation.fga.yaml
 
@@ -47,6 +47,15 @@ tuples:
     relation: member
     object: organization:consumer
 
+  # acme owns identity_provider:idp1, which manages consumer: the two are
+  # one tenant family, the audience a platform-visible agent reaches.
+  - user: organization:acme
+    relation: organization
+    object: identity_provider:idp1
+  - user: organization:consumer
+    relation: managed_org
+    object: identity_provider:idp1
+
   # An ORG-visible agent in acme, authored by oscar.
   - user: organization:acme
     relation: organization
@@ -66,7 +75,7 @@ tuples:
     relation: owner
     object: agent:secret-bot
 
-  # A PUBLIC marketplace agent in acme (the conditional wildcard plus the
+  # A PLATFORM-visible agent in acme (the platform_viewer grant plus the
   # org floor tuple the visibility writer emits).
   - user: organization:acme
     relation: organization
@@ -74,12 +83,9 @@ tuples:
   - user: identity_account:oscar
     relation: owner
     object: agent:open-bot
-  - user: identity_account:*
-    relation: viewer
+  - user: identity_provider:idp1#platform_user
+    relation: platform_viewer
     object: agent:open-bot
-    condition:
-      name: allow_public
-      context: {}
   - user: organization:acme#viewer
     relation: viewer
     object: agent:open-bot
@@ -121,8 +127,6 @@ tests:
     check:
       - user: identity_account:dave
         object: agent:team-bot
-        context:
-          allow: false
         assertions:
           can_create_instance: true
           can_execute: true
@@ -131,8 +135,6 @@ tests:
     check:
       - user: identity_account:vera
         object: agent:team-bot
-        context:
-          allow: false
         assertions:
           can_create_instance: true
       - user: identity_account:vera
@@ -144,35 +146,25 @@ tests:
     check:
       - user: identity_account:oscar
         object: agent:secret-bot
-        context:
-          allow: false
         assertions:
           can_create_instance: true
       - user: identity_account:olivia
         object: agent:secret-bot
-        context:
-          allow: false
         assertions:
           can_create_instance: true
       - user: identity_account:dave
         object: agent:secret-bot
-        context:
-          allow: false
         assertions:
           can_create_instance: false
       - user: identity_account:mia
         object: agent:secret-bot
-        context:
-          allow: false
         assertions:
           can_create_instance: false
 
-  - name: the marketplace case, the agent half from the wildcard and the organization half at home
+  - name: the tenant-family case, the agent half from platform_viewer and the organization half at home
     check:
       - user: identity_account:mia
         object: agent:open-bot
-        context:
-          allow: true
         assertions:
           can_create_instance: true
       - user: identity_account:mia

package/src/authorization/__tests__/fixtures/fga/blueprint-private-visibility.fga.yaml

@@ -1,5 +1,5 @@
 # Pinned copy of stigmer-cloud backend/services/stigmer-server/fga/tests/blueprint-private-visibility.fga.yaml
-# at commit 2ec420161 (the OpenFGA store test the cloud runs against its live model).
+# as changed by stigmer-cloud#765 (the OpenFGA store test the cloud runs against its live model).
 # The body below is byte-identical to the source; the cloud re-runs the LIVE
 # file against this evaluator at the re-pin, so a stale copy is caught there.
 # Store tests for real blueprint privacy (Phase 3 of the visibility model).
@@ -14,7 +14,6 @@
 #             viewers; pre-cloud#257 tuples carried #member, which excluded
 #             viewer-role users — still honored until backfilled, see the
 #             legacy-bot fixture)
-#   PUBLIC    viewer@identity_account:* (allow_public)  +  the ORG tuple
 #   PLATFORM  platform_viewer@identity_provider:<idp>#platform_user  +  the ORG tuple
 #
 # Read vs spend: an org viewer-role user READS org-visible blueprints (and, at
@@ -23,9 +22,8 @@
 # can_create_execution_in permissions, which require member-or-guest. The
 # vera assertions pin both halves of that contract.
 #
-# The ORG tuple rides along on PUBLIC/PLATFORM (the "org floor") so a shared
-# blueprint stays listable in its own org — org-scoped ListObjects runs with
-# {"allow": false}, which suppresses the public wildcard.
+# The ORG tuple rides along on PLATFORM (the "org floor") so a shared
+# blueprint stays listable in its own org.
 #
 # T08 exception: org ADMINS (and org owners, via the role hierarchy) are
 # composed into blueprint `owner` and therefore see, list, and manage
@@ -39,8 +37,8 @@
 # Scenario: org "acme" has owner-creator carol, org admin oscar, plain
 # member dave, and read-only viewer vera (the role SSO auto-provisioning
 # grants by default); mallory belongs to an unrelated org. Carol authors one
-# blueprint of each kind at PRIVATE, plus an ORG agent, a PUBLIC agent, and
-# a legacy ORG agent whose tuple still carries the pre-cloud#257 shape.
+# blueprint of each kind at PRIVATE, plus an ORG agent and a legacy ORG
+# agent whose tuple still carries the pre-cloud#257 shape.
 name: blueprint-private-visibility
 model_file: ../model/fga.mod
 
@@ -114,22 +112,6 @@ tuples:
     relation: viewer
     object: agent:legacy-bot
 
-  # --- PUBLIC agent (wildcard + org floor tuple) ---
-  - user: organization:acme
-    relation: organization
-    object: agent:open-bot
-  - user: identity_account:carol
-    relation: owner
-    object: agent:open-bot
-  - user: identity_account:*
-    relation: viewer
-    object: agent:open-bot
-    condition:
-      name: allow_public
-  - user: organization:acme#viewer
-    relation: viewer
-    object: agent:open-bot
-
   # --- PRIVATE agent with an explicit individual viewer grant ---
   - user: organization:acme
     relation: organization
@@ -146,8 +128,6 @@ tests:
     check:
       - user: identity_account:dave
         object: agent:secret-bot
-        context:
-          allow: false
         assertions:
           can_view: false
           can_execute: false
@@ -155,22 +135,16 @@ tests:
           can_clone: false
       - user: identity_account:dave
         object: skill:secret-notes
-        context:
-          allow: false
         assertions:
           can_view: false
           can_use: false
       - user: identity_account:dave
         object: workflow:secret-flow
-        context:
-          allow: false
         assertions:
           can_view: false
           can_execute: false
       - user: identity_account:dave
         object: mcp_server:secret-tools
-        context:
-          allow: false
         assertions:
           can_view: false
           can_use: false
@@ -180,8 +154,6 @@ tests:
     check:
       - user: identity_account:oscar
         object: agent:secret-bot
-        context:
-          allow: false
         assertions:
           can_view: true
           can_edit: true
@@ -189,15 +161,11 @@ tests:
           can_execute: true
       - user: identity_account:oscar
         object: skill:secret-notes
-        context:
-          allow: false
         assertions:
           can_view: true
           can_edit: true
       - user: identity_account:oscar
         object: workflow:secret-flow
-        context:
-          allow: false
         assertions:
           can_view: true
           can_edit: true
@@ -205,8 +173,6 @@ tests:
       # four private-blueprint kinds are pinned to the same rule.
       - user: identity_account:oscar
         object: mcp_server:secret-tools
-        context:
-          allow: false
         assertions:
           can_view: true
           can_edit: true
@@ -215,22 +181,17 @@ tests:
     list_objects:
       - user: identity_account:oscar
         type: agent
-        context:
-          allow: false
         assertions:
           can_view:
             - agent:secret-bot
             - agent:team-bot
             - agent:legacy-bot
-            - agent:open-bot
             - agent:shared-secret
 
   - name: owner retains full access to private blueprints
     check:
       - user: identity_account:carol
         object: agent:secret-bot
-        context:
-          allow: false
         assertions:
           can_view: true
           can_execute: true
@@ -239,8 +200,6 @@ tests:
           can_delete: true
       - user: identity_account:carol
         object: workflow:secret-flow
-        context:
-          allow: false
         assertions:
           can_view: true
           can_execute: true
@@ -250,8 +209,6 @@ tests:
     check:
       - user: identity_account:dave
         object: agent:team-bot
-        context:
-          allow: false
         assertions:
           can_view: true
           can_execute: true
@@ -260,33 +217,10 @@ tests:
           can_delete: false
       - user: identity_account:mallory
         object: agent:team-bot
-        context:
-          allow: false
         assertions:
           can_view: false
           can_execute: false
 
-  - name: public agent is reachable by everyone with allow context, and by org members without it
-    check:
-      # Outsider resolves through the conditional wildcard ({"allow": true}).
-      - user: identity_account:mallory
-        object: agent:open-bot
-        context:
-          allow: true
-        assertions:
-          can_view: true
-          can_execute: true
-      # Org member resolves through the org floor tuple even with the
-      # wildcard suppressed — this is what keeps public blueprints in
-      # org-scoped listings.
-      - user: identity_account:dave
-        object: agent:open-bot
-        context:
-          allow: false
-        assertions:
-          can_view: true
-          can_execute: true
-
   - name: explicit individual viewer grant on a private agent conveys view and run
     check:
       # Run-what-you-can-read: can_execute derives from viewer, so an
@@ -294,38 +228,30 @@ tests:
       # which checks can_view).
       - user: identity_account:dave
         object: agent:shared-secret
-        context:
-          allow: false
         assertions:
           can_view: true
           can_execute: true
           can_edit: false
 
-  - name: org member's listable agents exclude private ones (wildcard suppressed)
+  - name: org member's listable agents exclude private ones
     list_objects:
       - user: identity_account:dave
         type: agent
-        context:
-          allow: false
         assertions:
           can_view:
             - agent:team-bot
             - agent:legacy-bot
-            - agent:open-bot
             - agent:shared-secret
 
   - name: owner's listable agents include everything they authored
     list_objects:
       - user: identity_account:carol
         type: agent
-        context:
-          allow: false
         assertions:
           can_view:
             - agent:secret-bot
             - agent:team-bot
             - agent:legacy-bot
-            - agent:open-bot
             - agent:shared-secret
 
   # ── cloud#257: the viewer-role cell (previously untested) ──────────────
@@ -336,27 +262,16 @@ tests:
       # spend refusal is pinned separately on the org permissions below.
       - user: identity_account:vera
         object: agent:team-bot
-        context:
-          allow: false
         assertions:
           can_view: true
           can_clone: true
           can_execute: true
           can_edit: false
           can_delete: false
-      # The org floor of a PUBLIC blueprint reaches viewers the same way.
-      - user: identity_account:vera
-        object: agent:open-bot
-        context:
-          allow: false
-        assertions:
-          can_view: true
       # Private stays private — the viewer role grants nothing beyond the
       # explicit visibility tuples.
       - user: identity_account:vera
         object: agent:secret-bot
-        context:
-          allow: false
         assertions:
           can_view: false
           can_execute: false
@@ -382,8 +297,6 @@ tests:
     check:
       - user: identity_account:dave
         object: agent:legacy-bot
-        context:
-          allow: false
         assertions:
           can_view: true
           can_execute: true
@@ -392,8 +305,6 @@ tests:
       # organization#member. The boot backfill converges these tuples.
       - user: identity_account:vera
         object: agent:legacy-bot
-        context:
-          allow: false
         assertions:
           can_view: false
           can_execute: false
@@ -402,9 +313,6 @@ tests:
     list_objects:
       - user: identity_account:vera
         type: agent
-        context:
-          allow: false
         assertions:
           can_view:
             - agent:team-bot
-            - agent:open-bot