@stigmer/server 3.27.1 → 3.28.0

package/src/authorization/__tests__/fixtures/fga/agent-instance-creation.fga.yaml

@@ -1,177 +0,0 @@
-# Pinned copy of stigmer-cloud backend/services/stigmer-server/fga/tests/agent-instance-creation.fga.yaml
-# as changed by stigmer-cloud#765 (the OpenFGA store test the cloud runs against its live model).
-# The body below is byte-identical to the source; the cloud re-runs the LIVE
-# file against this evaluator at the re-pin, so a stale copy is caught there.
-# Store tests for agent-instance creation: two halves, asked together by
-# the create since stigmer#1209 (v3.22.0). The agent half is the agent's
-# can_create_instance (can_execute, so the viewer set: whoever may run the
-# agent may instantiate it). The organization half is
-# can_create_agent_instance: member on the organization the instance is
-# created IN, which is the caller's own, not the agent's: a personal
-# instance of another organization's platform-visible agent lives in the
-# caller's organization (the tenant-family case), so the agent's permission
-# alone would let a row be planted in any organization named on the request.
-#
-# What these pin: owners, admins and members hold the organization half;
-# a viewer-role account may run an org-visible agent (the agent half) and
-# still lacks the organization half; a guest holds neither; an outsider
-# holds neither; and the tenant-family case passes on the caller's own
-# organization while the agent half comes from the platform_viewer grant.
-#
-# Run: fga model test --tests agent-instance-creation.fga.yaml
-
-name: agent-instance-creation
-model_file: ../model/fga.mod
-
-tuples:
-  # Org acme: olivia owns it, oscar administers, dave is a plain member,
-  # vera a read-only viewer, greta the share-link guest account.
-  - user: identity_account:olivia
-    relation: owner
-    object: organization:acme
-  - user: identity_account:oscar
-    relation: admin
-    object: organization:acme
-  - user: identity_account:dave
-    relation: member
-    object: organization:acme
-  - user: identity_account:vera
-    relation: viewer
-    object: organization:acme
-  - user: identity_account:greta
-    relation: guest
-    object: organization:acme
-
-  # Org consumer: mia is a plain member there and holds no role in acme.
-  - user: identity_account:mia
-    relation: member
-    object: organization:consumer
-
-  # acme owns identity_provider:idp1, which manages consumer: the two are
-  # one tenant family, the audience a platform-visible agent reaches.
-  - user: organization:acme
-    relation: organization
-    object: identity_provider:idp1
-  - user: organization:consumer
-    relation: managed_org
-    object: identity_provider:idp1
-
-  # An ORG-visible agent in acme, authored by oscar.
-  - user: organization:acme
-    relation: organization
-    object: agent:team-bot
-  - user: identity_account:oscar
-    relation: owner
-    object: agent:team-bot
-  - user: organization:acme#viewer
-    relation: viewer
-    object: agent:team-bot
-
-  # A PRIVATE agent in acme, authored by oscar (no visibility tuple).
-  - user: organization:acme
-    relation: organization
-    object: agent:secret-bot
-  - user: identity_account:oscar
-    relation: owner
-    object: agent:secret-bot
-
-  # A PLATFORM-visible agent in acme (the platform_viewer grant plus the
-  # org floor tuple the visibility writer emits).
-  - user: organization:acme
-    relation: organization
-    object: agent:open-bot
-  - user: identity_account:oscar
-    relation: owner
-    object: agent:open-bot
-  - user: identity_provider:idp1#platform_user
-    relation: platform_viewer
-    object: agent:open-bot
-  - user: organization:acme#viewer
-    relation: viewer
-    object: agent:open-bot
-
-tests:
-  - name: owners, admins and members hold the organization half
-    check:
-      - user: identity_account:olivia
-        object: organization:acme
-        assertions:
-          can_create_agent_instance: true
-      - user: identity_account:oscar
-        object: organization:acme
-        assertions:
-          can_create_agent_instance: true
-      - user: identity_account:dave
-        object: organization:acme
-        assertions:
-          can_create_agent_instance: true
-
-  - name: a viewer, a guest and an outsider do not
-    check:
-      - user: identity_account:vera
-        object: organization:acme
-        assertions:
-          can_create_agent_instance: false
-          can_create_session: false
-      - user: identity_account:greta
-        object: organization:acme
-        assertions:
-          can_create_agent_instance: false
-          can_create_session: true
-      - user: identity_account:mia
-        object: organization:acme
-        assertions:
-          can_create_agent_instance: false
-
-  - name: a member instantiates an org-visible agent, both halves held
-    check:
-      - user: identity_account:dave
-        object: agent:team-bot
-        assertions:
-          can_create_instance: true
-          can_execute: true
-
-  - name: a viewer may run the org-visible agent and still cannot instantiate it here
-    check:
-      - user: identity_account:vera
-        object: agent:team-bot
-        assertions:
-          can_create_instance: true
-      - user: identity_account:vera
-        object: organization:acme
-        assertions:
-          can_create_agent_instance: false
-
-  - name: a private agent gives the agent half to its author and the admins only
-    check:
-      - user: identity_account:oscar
-        object: agent:secret-bot
-        assertions:
-          can_create_instance: true
-      - user: identity_account:olivia
-        object: agent:secret-bot
-        assertions:
-          can_create_instance: true
-      - user: identity_account:dave
-        object: agent:secret-bot
-        assertions:
-          can_create_instance: false
-      - user: identity_account:mia
-        object: agent:secret-bot
-        assertions:
-          can_create_instance: false
-
-  - name: the tenant-family case, the agent half from platform_viewer and the organization half at home
-    check:
-      - user: identity_account:mia
-        object: agent:open-bot
-        assertions:
-          can_create_instance: true
-      - user: identity_account:mia
-        object: organization:consumer
-        assertions:
-          can_create_agent_instance: true
-      - user: identity_account:mia
-        object: organization:acme
-        assertions:
-          can_create_agent_instance: false

package/src/authorization/__tests__/fixtures/fga/agent-share-owner.fga.yaml

@@ -1,109 +0,0 @@
-# Pinned copy of stigmer-cloud backend/services/stigmer-server/fga/tests/agent-share-owner.fga.yaml
-# at commit b87dd1170 (the OpenFGA store test the cloud runs against its live model).
-# The body below is byte-identical to the source; the cloud re-runs the LIVE
-# file against this evaluator at the re-pin, so a stale copy is caught there.
-# Agent shares are owner-scoped channel config (decision 011, D1):
-# the creator owns the share; view/edit/delete/rotate require ownership or
-# an explicit grant. Plain org members get NO implicit access, and —
-# critically — no visitor-facing tuples exist at all: guest/member
-# admission to the hosted chat is app-level (shared-profile, mint, and
-# create-time gates), never FGA.
-#
-# T08: org ADMINS inherit owner (consistent with agents — an admin who can
-# edit the agent can manage its channels). The narrowness these tests pin
-# is now: owner + admins have control, granted viewers read, plain members
-# have nothing.
-
-name: agent-share-owner
-model_file: ../model/fga.mod
-
-tuples:
-  # Org membership for both accounts — proving membership grants nothing.
-  - user: identity_account:alice
-    relation: member
-    object: organization:acme
-  - user: identity_account:mallory
-    relation: member
-    object: organization:acme
-
-  # Org admin — proving T08 inheritance reaches shares.
-  - user: identity_account:ana
-    relation: admin
-    object: organization:acme
-
-  # The share, created by alice (the config-driven create tuples).
-  - user: organization:acme
-    relation: organization
-    object: agent_share:support-bot-share
-  - user: identity_account:alice
-    relation: owner
-    object: agent_share:support-bot-share
-
-  # An explicit viewer grant to carol (not even an org member).
-  - user: identity_account:carol
-    relation: viewer
-    object: agent_share:support-bot-share
-
-tests:
-  - name: owner has full control including grant management
-    check:
-      - user: identity_account:alice
-        object: agent_share:support-bot-share
-        assertions:
-          can_view: true
-          can_edit: true
-          can_delete: true
-          can_grant_access: true
-          can_view_access: true
-
-  - name: explicitly granted viewer can read but not mutate
-    check:
-      - user: identity_account:carol
-        object: agent_share:support-bot-share
-        assertions:
-          can_view: true
-          can_edit: false
-          can_delete: false
-          can_grant_access: false
-          can_view_access: true
-
-  - name: fellow org member has no implicit access
-    check:
-      - user: identity_account:mallory
-        object: agent_share:support-bot-share
-        assertions:
-          can_view: false
-          can_edit: false
-          can_delete: false
-          can_grant_access: false
-          can_view_access: false
-
-  - name: org admin inherits share management (T08)
-    check:
-      - user: identity_account:ana
-        object: agent_share:support-bot-share
-        assertions:
-          can_view: true
-          can_edit: true
-          can_delete: true
-          can_grant_access: true
-
-  - name: listing shares reflects ownership and grants, not membership
-    list_objects:
-      - user: identity_account:alice
-        type: agent_share
-        assertions:
-          can_view:
-            - agent_share:support-bot-share
-          can_edit:
-            - agent_share:support-bot-share
-      - user: identity_account:carol
-        type: agent_share
-        assertions:
-          can_view:
-            - agent_share:support-bot-share
-          can_edit: []
-      - user: identity_account:mallory
-        type: agent_share
-        assertions:
-          can_view: []

package/src/authorization/__tests__/fixtures/fga/artifact-org-and-owner.fga.yaml

@@ -1,128 +0,0 @@
-# Pinned copy of stigmer-cloud backend/services/stigmer-server/fga/tests/artifact-org-and-owner.fga.yaml
-# at commit b87dd1170 (the OpenFGA store test the cloud runs against its live model).
-# The body below is byte-identical to the source; the cloud re-runs the LIVE
-# file against this evaluator at the re-pin, so a stale copy is caught there.
-# Artifacts are org-scoped execution outputs with creator ownership on
-# top (cloud#216). The two access arms these tests pin:
-#
-# 1. Org inheritance — anyone who is at least a viewer of the owning org
-#    can view its artifacts ("if you can view resources in the org, you
-#    can view its artifacts"). Editing stays org-admin-only.
-# 2. Creator ownership — the identity whose execution produced the
-#    artifact can view it WITHOUT any org role. This is the guest-share /
-#    embedded-user case: org guests are not org viewers, but their
-#    sessions render artifact-backed review payloads and artifact tabs.
-#
-# The narrowness pinned: creator-owners read but never edit (all guests
-# of an org share one guest identity account — owner-edit would let one
-# guest soft-delete another's artifacts), and no arm crosses org
-# boundaries.
-#
-# Run: fga model test --tests artifact-org-and-owner.fga.yaml
-
-name: artifact-org-and-owner
-model_file: ../model/fga.mod
-
-tuples:
-  # Org roles: victor views, ana administers acme. Rival org for the
-  # cross-org boundary.
-  - user: identity_account:victor
-    relation: viewer
-    object: organization:acme
-  - user: identity_account:ana
-    relation: admin
-    object: organization:acme
-  - user: identity_account:eve
-    relation: member
-    object: organization:rival
-
-  # Guest identity: an org GUEST, deliberately not an org viewer.
-  - user: identity_account:acme-guest
-    relation: guest
-    object: organization:acme
-
-  # Artifact produced by a signed-in member's execution.
-  - user: organization:acme
-    relation: organization
-    object: artifact:art_report
-  - user: identity_account:victor
-    relation: owner
-    object: artifact:art_report
-
-  # Artifact produced by a guest-share execution: creator is the guest
-  # identity account (runner tokens carry the acting identity as sub).
-  - user: organization:acme
-    relation: organization
-    object: artifact:art_guest_plan
-  - user: identity_account:acme-guest
-    relation: owner
-    object: artifact:art_guest_plan
-
-tests:
-  - name: org viewer reads any org artifact but cannot edit
-    check:
-      - user: identity_account:victor
-        object: artifact:art_report
-        assertions:
-          can_view: true
-          can_edit: false
-      - user: identity_account:victor
-        object: artifact:art_guest_plan
-        assertions:
-          can_view: true
-          can_edit: false
-
-  - name: org admin views and edits org artifacts
-    check:
-      - user: identity_account:ana
-        object: artifact:art_report
-        assertions:
-          can_view: true
-          can_edit: true
-
-  - name: guest creator reads own execution's artifact via ownership, never edits
-    check:
-      - user: identity_account:acme-guest
-        object: artifact:art_guest_plan
-        assertions:
-          can_view: true
-          can_edit: false
-
-  - name: guest role alone grants nothing on other artifacts in the org
-    check:
-      - user: identity_account:acme-guest
-        object: artifact:art_report
-        assertions:
-          can_view: false
-          can_edit: false
-
-  - name: cross-org caller is denied everything
-    check:
-      - user: identity_account:eve
-        object: artifact:art_report
-        assertions:
-          can_view: false
-          can_edit: false
-      - user: identity_account:eve
-        object: artifact:art_guest_plan
-        assertions:
-          can_view: false
-          can_edit: false
-
-  - name: listing reflects org inheritance plus creator ownership
-    list_objects:
-      - user: identity_account:victor
-        type: artifact
-        assertions:
-          can_view:
-            - artifact:art_report
-            - artifact:art_guest_plan
-      - user: identity_account:acme-guest
-        type: artifact
-        assertions:
-          can_view:
-            - artifact:art_guest_plan
-      - user: identity_account:eve
-        type: artifact
-        assertions:
-          can_view: []