@stigmer/server 3.27.2 → 3.29.0

package/dist/authorization/store-test-kit.js

@@ -1,265 +0,0 @@
-/**
- * The OpenFGA store-test kit — runs a `.fga.yaml` store test (the format
- * `fga model test` reads: fixture tuples, then named tests with `check`
- * and `list_objects` assertions) against the built-in evaluator, so the
- * cloud's own model tests — written by the model's authors and run
- * against real OpenFGA in the cloud's CI — are the proof that this
- * evaluator answers the same model the same way. Open source runs the
- * kit over pinned copies of those documents (authorization/__tests__/
- * fixtures/fga/); the cloud runs it over the LIVE documents at the
- * re-pin, which is what makes the copies safe to hold.
- *
- * Shape: the port-contract kits' (store/port-contract.ts) — vitest-free,
- * node:assert, cases the consumer's framework iterates — because a
- * composition consumes it through the published barrel and vitest is a
- * devDependency that must not enter the barrel's runtime graph.
- *
- * What is run and what is reported. One case per named test; a case
- * asserts every `check` in the test whose object's kind the model
- * declares, relation by relation, and FAILS on the first disagreement
- * (the message names the check in the document's own words). Assertions
- * the kit does not run are returned as `skipped`, each with its reason,
- * so a consumer pins the list and a document that gains a scenario, or a
- * declaration that lands, is a visible diff and never a quietly smaller
- * proof. Three reasons: a check whose TARGET kind the model does not
- * declare (`undeclared-kind`) and every `list_objects` assertion
- * (`list-objects`, the list scope's proof) are known when the kit is
- * built; the third is known only from the walk. A document may grant
- * through a type the model does not declare — the cloud's platform
- * tenancy reaches people through `identity_provider:<idp>#platform_user`,
- * a kind this edition does not serve — and OpenFGA answers `true` where
- * a model without that type resolves the userset to nobody. The kit runs
- * every assertion over a recording view of the document's tuples, and an
- * assertion whose walk READ a tuple naming an undeclared type is
- * reported as `undeclared-subject-type` (the types named) instead of
- * being asserted, whatever it would have answered: decided from the
- * model and the data, per assertion, so the sibling arms of the same
- * check block still run and a union that is settled before it reaches
- * such a tuple runs too. Over a model that declares every type in the
- * file (the cloud's drift test, built from the live model) nothing is
- * recorded and everything runs — the same kit, no edition branch.
- * `skipped` is therefore complete once every case has run; a consumer
- * pins it after the cases, which is the order a test file declares them.
- *
- * The parser is strict on purpose: an unknown key anywhere is a thrown
- * fault, so a change to the format upstream is loud here rather than
- * half-run. The model declares no condition, so the format's `condition`
- * on a tuple and `context` on a check are among the keys refused: a
- * document that still carries them is written against a model this
- * evaluator does not answer, and saying so beats running it half-blind.
- */
-import assert from "node:assert/strict";
-import { checkRelation } from "./evaluator.js";
-import { ACCOUNT_TYPE, newInMemoryTupleSource, parseObjectRef, parseSubject, } from "./tuples.js";
-/**
- * Parses a loaded YAML value into a document, refusing anything the
- * format the cloud's files use does not carry (`sourceName` names the
- * file in every message).
- */
-export function parseStoreTestDocument(value, sourceName) {
-    const root = record(value, sourceName, [
-        "name",
-        "model_file",
-        "tuples",
-        "tests",
-    ]);
-    return {
-        name: text(root["name"], `${sourceName}: name`),
-        tuples: list(root["tuples"], `${sourceName}: tuples`).map((entry, index) => parseTuple(entry, `${sourceName}: tuples[${index}]`)),
-        tests: list(root["tests"], `${sourceName}: tests`).map((entry, index) => parseTest(entry, `${sourceName}: tests[${index}]`)),
-    };
-}
-function parseTuple(value, where) {
-    const entry = record(value, where, ["user", "relation", "object"]);
-    return {
-        user: text(entry["user"], `${where}.user`),
-        relation: text(entry["relation"], `${where}.relation`),
-        object: text(entry["object"], `${where}.object`),
-    };
-}
-function parseTest(value, where) {
-    const entry = record(value, where, ["name", "check", "list_objects"]);
-    return {
-        name: text(entry["name"], `${where}.name`),
-        check: optionalList(entry["check"], `${where}.check`).map((item, index) => parseCheck(item, `${where}.check[${index}]`)),
-        list_objects: optionalList(entry["list_objects"], `${where}.list_objects`).map((item, index) => parseListObjects(item, `${where}.list_objects[${index}]`)),
-    };
-}
-function parseCheck(value, where) {
-    const entry = record(value, where, ["user", "object", "assertions"]);
-    const assertions = record(entry["assertions"], `${where}.assertions`);
-    const parsed = {};
-    for (const [relation, expected] of Object.entries(assertions)) {
-        if (typeof expected !== "boolean") {
-            throw new Error(`${where}.assertions.${relation}: expected a boolean`);
-        }
-        parsed[relation] = expected;
-    }
-    return {
-        user: text(entry["user"], `${where}.user`),
-        object: text(entry["object"], `${where}.object`),
-        assertions: parsed,
-    };
-}
-function parseListObjects(value, where) {
-    const entry = record(value, where, ["user", "type", "assertions"]);
-    const assertions = record(entry["assertions"], `${where}.assertions`);
-    const parsed = {};
-    for (const [relation, expected] of Object.entries(assertions)) {
-        parsed[relation] = list(expected, `${where}.assertions.${relation}`).map((item, index) => text(item, `${where}.assertions.${relation}[${index}]`));
-    }
-    return {
-        user: text(entry["user"], `${where}.user`),
-        type: text(entry["type"], `${where}.type`),
-        assertions: parsed,
-    };
-}
-function record(value, where, allowedKeys) {
-    if (value === null || typeof value !== "object" || Array.isArray(value)) {
-        throw new Error(`${where}: expected a mapping`);
-    }
-    const entry = value;
-    if (allowedKeys !== undefined) {
-        for (const key of Object.keys(entry)) {
-            if (!allowedKeys.includes(key)) {
-                throw new Error(`${where}: unknown key '${key}'`);
-            }
-        }
-    }
-    return entry;
-}
-function list(value, where) {
-    if (!Array.isArray(value)) {
-        throw new Error(`${where}: expected a list`);
-    }
-    return value;
-}
-function optionalList(value, where) {
-    return value === undefined ? [] : list(value, where);
-}
-function text(value, where) {
-    if (typeof value !== "string") {
-        throw new Error(`${where}: expected a string`);
-    }
-    return value;
-}
-/**
- * The document's tests as runnable cases over `model`, plus every
- * assertion group the kit does not run.
- */
-export function storeTestCases(document, model) {
-    const source = newInMemoryTupleSource(document.tuples.map(tupleOf));
-    const skipped = [];
-    const cases = [];
-    for (const test of document.tests) {
-        const runnable = [];
-        for (const item of test.check) {
-            const object = parseObjectRef(item.object);
-            if (model.byType(object.type) === undefined) {
-                skipped.push({
-                    document: document.name,
-                    test: test.name,
-                    subject: item.user,
-                    object: item.object,
-                    reason: "undeclared-kind",
-                });
-            }
-            else {
-                runnable.push(item);
-            }
-        }
-        for (const item of test.list_objects) {
-            skipped.push({
-                document: document.name,
-                test: test.name,
-                subject: item.user,
-                object: `<${item.type}>`,
-                reason: "list-objects",
-            });
-        }
-        if (runnable.length === 0) {
-            continue;
-        }
-        cases.push({
-            name: `${document.name} :: ${test.name}`,
-            async run() {
-                for (const item of runnable) {
-                    const object = parseObjectRef(item.object);
-                    const person = personOf(item.user);
-                    for (const [relation, expected] of Object.entries(item.assertions)) {
-                        const recording = recordUndeclaredTypes(source, model);
-                        const actual = await checkRelation({ model, source: recording }, object, relation, person);
-                        if (recording.reached.size > 0) {
-                            skipped.push({
-                                document: document.name,
-                                test: test.name,
-                                subject: item.user,
-                                object: item.object,
-                                relation,
-                                reason: "undeclared-subject-type",
-                                types: [...recording.reached].sort(),
-                            });
-                            continue;
-                        }
-                        assert.equal(actual, expected, `${document.name} :: ${test.name}: ${item.user} ${relation} ${item.object} expected ${String(expected)}, got ${String(actual)}`);
-                    }
-                }
-            },
-        });
-    }
-    return { cases, skipped };
-}
-/**
- * A view of `inner` that records, for one walk, every subject type the
- * evaluator read that `model` does not declare. A person
- * (`identity_account:<id>`) is a subject the evaluator compares, never a
- * type it resolves, so it is not a "reach" whatever the model declares; a
- * userset or a parent object of an undeclared type is.
- */
-function recordUndeclaredTypes(inner, model) {
-    const reached = new Set();
-    return {
-        reached,
-        async tuplesOf(object, relation) {
-            const tuples = await inner.tuplesOf(object, relation);
-            for (const tuple of tuples) {
-                const type = resolvedTypeOf(tuple.subject);
-                if (type !== undefined && model.byType(type) === undefined) {
-                    reached.add(type);
-                }
-            }
-            return tuples;
-        },
-    };
-}
-/** The type the evaluator would resolve a subject on, or undefined for a person. */
-function resolvedTypeOf(subject) {
-    switch (subject.form) {
-        case "object":
-            return subject.object.type === ACCOUNT_TYPE
-                ? undefined
-                : subject.object.type;
-        case "userset":
-            return subject.object.type;
-        default: {
-            const exhaustive = subject;
-            throw new Error(`unknown subject form: ${JSON.stringify(exhaustive)}`);
-        }
-    }
-}
-function tupleOf(entry) {
-    return {
-        object: parseObjectRef(entry.object),
-        relation: entry.relation,
-        subject: parseSubject(entry.user),
-    };
-}
-/** The document's users are plain accounts; a user of another type is a format the kit does not run. */
-function personOf(user) {
-    const object = parseObjectRef(user);
-    if (object.type !== ACCOUNT_TYPE || object.id === "*") {
-        throw new Error(`store test users are accounts; got '${user}'`);
-    }
-    return { accountId: object.id, aliases: new Set([object.id]) };
-}
-//# sourceMappingURL=store-test-kit.js.map

package/dist/authorization/store-test-kit.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"store-test-kit.js","sourceRoot":"","sources":["../../src/authorization/store-test-kit.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiDG;AACH,OAAO,MAAM,MAAM,oBAAoB,CAAC;AAExC,OAAO,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAG/C,OAAO,EACL,YAAY,EACZ,sBAAsB,EACtB,cAAc,EACd,YAAY,GACb,MAAM,aAAa,CAAC;AAoCrB;;;;GAIG;AACH,MAAM,UAAU,sBAAsB,CACpC,KAAc,EACd,UAAkB;IAElB,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,EAAE,UAAU,EAAE;QACrC,MAAM;QACN,YAAY;QACZ,QAAQ;QACR,OAAO;KACR,CAAC,CAAC;IACH,OAAO;QACL,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,GAAG,UAAU,QAAQ,CAAC;QAC/C,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,GAAG,UAAU,UAAU,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CACzE,UAAU,CAAC,KAAK,EAAE,GAAG,UAAU,YAAY,KAAK,GAAG,CAAC,CACrD;QACD,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,GAAG,UAAU,SAAS,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CACtE,SAAS,CAAC,KAAK,EAAE,GAAG,UAAU,WAAW,KAAK,GAAG,CAAC,CACnD;KACF,CAAC;AACJ,CAAC;AAED,SAAS,UAAU,CAAC,KAAc,EAAE,KAAa;IAC/C,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,EAAE,KAAK,EAAE,CAAC,MAAM,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAC,CAAC;IACnE,OAAO;QACL,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,GAAG,KAAK,OAAO,CAAC;QAC1C,QAAQ,EAAE,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,GAAG,KAAK,WAAW,CAAC;QACtD,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,GAAG,KAAK,SAAS,CAAC;KACjD,CAAC;AACJ,CAAC;AAED,SAAS,SAAS,CAAC,KAAc,EAAE,KAAa;IAC9C,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,EAAE,KAAK,EAAE,CAAC,MAAM,EAAE,OAAO,EAAE,cAAc,CAAC,CAAC,CAAC;IACtE,OAAO;QACL,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,GAAG,KAAK,OAAO,CAAC;QAC1C,KAAK,EAAE,YAAY,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,GAAG,KAAK,QAAQ,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CACxE,UAAU,CAAC,IAAI,EAAE,GAAG,KAAK,UAAU,KAAK,GAAG,CAAC,CAC7C;QACD,YAAY,EAAE,YAAY,CACxB,KAAK,CAAC,cAAc,CAAC,EACrB,GAAG,KAAK,eAAe,CACxB,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CACpB,gBAAgB,CAAC,IAAI,EAAE,GAAG,KAAK,iBAAiB,KAAK,GAAG,CAAC,CAC1D;KACF,CAAC;AACJ,CAAC;AAED,SAAS,UAAU,CAAC,KAAc,EAAE,KAAa;IAC/C,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,EAAE,KAAK,EAAE,CAAC,MAAM,EAAE,QAAQ,EAAE,YAAY,CAAC,CAAC,CAAC;IACrE,MAAM,UAAU,GAAG,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,EAAE,GAAG,KAAK,aAAa,CAAC,CAAC;IACtE,MAAM,MAAM,GAA4B,EAAE,CAAC;IAC3C,KAAK,MAAM,CAAC,QAAQ,EAAE,QAAQ,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;QAC9D,IAAI,OAAO,QAAQ,KAAK,SAAS,EAAE,CAAC;YAClC,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,eAAe,QAAQ,sBAAsB,CAAC,CAAC;QACzE,CAAC;QACD,MAAM,CAAC,QAAQ,CAAC,GAAG,QAAQ,CAAC;IAC9B,CAAC;IACD,OAAO;QACL,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,GAAG,KAAK,OAAO,CAAC;QAC1C,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,GAAG,KAAK,SAAS,CAAC;QAChD,UAAU,EAAE,MAAM;KACnB,CAAC;AACJ,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAc,EAAE,KAAa;IACrD,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,EAAE,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,YAAY,CAAC,CAAC,CAAC;IACnE,MAAM,UAAU,GAAG,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,EAAE,GAAG,KAAK,aAAa,CAAC,CAAC;IACtE,MAAM,MAAM,GAA0C,EAAE,CAAC;IACzD,KAAK,MAAM,CAAC,QAAQ,EAAE,QAAQ,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;QAC9D,MAAM,CAAC,QAAQ,CAAC,GAAG,IAAI,CAAC,QAAQ,EAAE,GAAG,KAAK,eAAe,QAAQ,EAAE,CAAC,CAAC,GAAG,CACtE,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,KAAK,eAAe,QAAQ,IAAI,KAAK,GAAG,CAAC,CACzE,CAAC;IACJ,CAAC;IACD,OAAO;QACL,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,GAAG,KAAK,OAAO,CAAC;QAC1C,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,GAAG,KAAK,OAAO,CAAC;QAC1C,UAAU,EAAE,MAAM;KACnB,CAAC;AACJ,CAAC;AAED,SAAS,MAAM,CACb,KAAc,EACd,KAAa,EACb,WAAmC;IAEnC,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACxE,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,sBAAsB,CAAC,CAAC;IAClD,CAAC;IACD,MAAM,KAAK,GAAG,KAAgC,CAAC;IAC/C,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;QAC9B,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YACrC,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC/B,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,kBAAkB,GAAG,GAAG,CAAC,CAAC;YACpD,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,IAAI,CAAC,KAAc,EAAE,KAAa;IACzC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,mBAAmB,CAAC,CAAC;IAC/C,CAAC;IACD,OAAO,KAA+B,CAAC;AACzC,CAAC;AAED,SAAS,YAAY,CAAC,KAAc,EAAE,KAAa;IACjD,OAAO,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;AACvD,CAAC;AAED,SAAS,IAAI,CAAC,KAAc,EAAE,KAAa;IACzC,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,qBAAqB,CAAC,CAAC;IACjD,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAqCD;;;GAGG;AACH,MAAM,UAAU,cAAc,CAC5B,QAA2B,EAC3B,KAAY;IAEZ,MAAM,MAAM,GAAG,sBAAsB,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;IACpE,MAAM,OAAO,GAAoB,EAAE,CAAC;IACpC,MAAM,KAAK,GAAoB,EAAE,CAAC;IAElC,KAAK,MAAM,IAAI,IAAI,QAAQ,CAAC,KAAK,EAAE,CAAC;QAClC,MAAM,QAAQ,GAAqB,EAAE,CAAC;QACtC,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YAC9B,MAAM,MAAM,GAAG,cAAc,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YAC3C,IAAI,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,SAAS,EAAE,CAAC;gBAC5C,OAAO,CAAC,IAAI,CAAC;oBACX,QAAQ,EAAE,QAAQ,CAAC,IAAI;oBACvB,IAAI,EAAE,IAAI,CAAC,IAAI;oBACf,OAAO,EAAE,IAAI,CAAC,IAAI;oBAClB,MAAM,EAAE,IAAI,CAAC,MAAM;oBACnB,MAAM,EAAE,iBAAiB;iBAC1B,CAAC,CAAC;YACL,CAAC;iBAAM,CAAC;gBACN,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACtB,CAAC;QACH,CAAC;QACD,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;YACrC,OAAO,CAAC,IAAI,CAAC;gBACX,QAAQ,EAAE,QAAQ,CAAC,IAAI;gBACvB,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,OAAO,EAAE,IAAI,CAAC,IAAI;gBAClB,MAAM,EAAE,IAAI,IAAI,CAAC,IAAI,GAAG;gBACxB,MAAM,EAAE,cAAc;aACvB,CAAC,CAAC;QACL,CAAC;QACD,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC1B,SAAS;QACX,CAAC;QACD,KAAK,CAAC,IAAI,CAAC;YACT,IAAI,EAAE,GAAG,QAAQ,CAAC,IAAI,OAAO,IAAI,CAAC,IAAI,EAAE;YACxC,KAAK,CAAC,GAAG;gBACP,KAAK,MAAM,IAAI,IAAI,QAAQ,EAAE,CAAC;oBAC5B,MAAM,MAAM,GAAG,cAAc,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;oBAC3C,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;oBACnC,KAAK,MAAM,CAAC,QAAQ,EAAE,QAAQ,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;wBACnE,MAAM,SAAS,GAAG,qBAAqB,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;wBACvD,MAAM,MAAM,GAAG,MAAM,aAAa,CAChC,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,EAC5B,MAAM,EACN,QAAQ,EACR,MAAM,CACP,CAAC;wBACF,IAAI,SAAS,CAAC,OAAO,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;4BAC/B,OAAO,CAAC,IAAI,CAAC;gCACX,QAAQ,EAAE,QAAQ,CAAC,IAAI;gCACvB,IAAI,EAAE,IAAI,CAAC,IAAI;gCACf,OAAO,EAAE,IAAI,CAAC,IAAI;gCAClB,MAAM,EAAE,IAAI,CAAC,MAAM;gCACnB,QAAQ;gCACR,MAAM,EAAE,yBAAyB;gCACjC,KAAK,EAAE,CAAC,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE;6BACrC,CAAC,CAAC;4BACH,SAAS;wBACX,CAAC;wBACD,MAAM,CAAC,KAAK,CACV,MAAM,EACN,QAAQ,EACR,GAAG,QAAQ,CAAC,IAAI,OAAO,IAAI,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI,IAAI,QAAQ,IAAI,IAAI,CAAC,MAAM,aAAa,MAAM,CAAC,QAAQ,CAAC,SAAS,MAAM,CAAC,MAAM,CAAC,EAAE,CAChI,CAAC;oBACJ,CAAC;gBACH,CAAC;YACH,CAAC;SACF,CAAC,CAAC;IACL,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;AAC5B,CAAC;AAOD;;;;;;GAMG;AACH,SAAS,qBAAqB,CAC5B,KAAkB,EAClB,KAAY;IAEZ,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAClC,OAAO;QACL,OAAO;QACP,KAAK,CAAC,QAAQ,CAAC,MAAM,EAAE,QAAQ;YAC7B,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;YACtD,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;gBAC3B,MAAM,IAAI,GAAG,cAAc,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;gBAC3C,IAAI,IAAI,KAAK,SAAS,IAAI,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,SAAS,EAAE,CAAC;oBAC3D,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;gBACpB,CAAC;YACH,CAAC;YACD,OAAO,MAAM,CAAC;QAChB,CAAC;KACF,CAAC;AACJ,CAAC;AAED,oFAAoF;AACpF,SAAS,cAAc,CAAC,OAAgB;IACtC,QAAQ,OAAO,CAAC,IAAI,EAAE,CAAC;QACrB,KAAK,QAAQ;YACX,OAAO,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,YAAY;gBACzC,CAAC,CAAC,SAAS;gBACX,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC;QAC1B,KAAK,SAAS;YACZ,OAAO,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC;QAC7B,OAAO,CAAC,CAAC,CAAC;YACR,MAAM,UAAU,GAAU,OAAO,CAAC;YAClC,MAAM,IAAI,KAAK,CAAC,yBAAyB,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;QACzE,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,OAAO,CAAC,KAAqB;IACpC,OAAO;QACL,MAAM,EAAE,cAAc,CAAC,KAAK,CAAC,MAAM,CAAC;QACpC,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,OAAO,EAAE,YAAY,CAAC,KAAK,CAAC,IAAI,CAAC;KAClC,CAAC;AACJ,CAAC;AAED,wGAAwG;AACxG,SAAS,QAAQ,CAAC,IAAY;IAC5B,MAAM,MAAM,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;IACpC,IAAI,MAAM,CAAC,IAAI,KAAK,YAAY,IAAI,MAAM,CAAC,EAAE,KAAK,GAAG,EAAE,CAAC;QACtD,MAAM,IAAI,KAAK,CAAC,uCAAuC,IAAI,GAAG,CAAC,CAAC;IAClE,CAAC;IACD,OAAO,EAAE,SAAS,EAAE,MAAM,CAAC,EAAE,EAAE,OAAO,EAAE,IAAI,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;AACjE,CAAC"}

package/src/authorization/__tests__/enterprise-model.ts

@@ -1,59 +0,0 @@
-/**
- * The Enterprise team type as the tests evaluate it: a transcript of
- * fga/model/iam/team.fga in the shape of every open-source transcript
- * (`../model/*.ts`), and a model that is the built-in one plus that
- * declaration. Open source serves no team — the kind's tier is
- * enterprise, so `builtInModel` declares none — yet its transcripts
- * already name the team grant (`agent`'s `viewer` accepts
- * `team#member`), and the derived tuple source reads the grants made to
- * a person's teams. These fixtures let the source's tests and the list
- * scope's cost measurement evaluate that path over real rows without
- * declaring the kind in the edition that does not serve it.
- *
- * The membership line is the model's one intersection: a member is a
- * person granted the role AND still one of the organization's viewers, so
- * leaving the organization ends every team-derived grant with no cleanup.
- * Guests hold `organization#guest`, never viewer, so a guest is never a
- * member.
- */
-import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
-import { TeamSchema } from "@stigmer/protos/ai/stigmer/iam/team/v1/api_pb";
-
-import type { Model } from "../model/index.js";
-import { builtInModel, newModel } from "../model/index.js";
-import {
-  computed,
-  declareKind,
-  direct,
-  from,
-  intersection,
-  objectOf,
-} from "../model/rewrite.js";
-
-export const teamDeclaration = declareKind({
-  kind: ApiResourceKind.team,
-  schema: TeamSchema,
-  source: "fga/model/iam/team.fga",
-  relations: [
-    ["organization", direct(objectOf("organization"))],
-    [
-      "member",
-      intersection(
-        direct(objectOf("identity_account")),
-        from("viewer", "organization"),
-      ),
-    ],
-    ["viewer", from("viewer", "organization")],
-    ["can_view", computed("viewer")],
-    ["can_edit", from("admin", "organization")],
-    ["can_delete", from("admin", "organization")],
-    ["can_grant_access", from("admin", "organization")],
-    ["can_view_access", computed("viewer")],
-  ],
-});
-
-/** The built-in declarations and the team type; the evaluator reaches them by kind and type, so their order carries nothing. */
-export const enterpriseModel: Model = newModel([
-  ...builtInModel.declarations,
-  teamDeclaration,
-]);

package/src/authorization/__tests__/fixtures/fga/agent-channel-owner.fga.yaml

@@ -1,112 +0,0 @@
-# Pinned copy of stigmer-cloud backend/services/stigmer-server/fga/tests/agent-channel-owner.fga.yaml
-# at commit b87dd1170 (the OpenFGA store test the cloud runs against its live model).
-# The body below is byte-identical to the source; the cloud re-runs the LIVE
-# file against this evaluator at the re-pin, so a stale copy is caught there.
-# Agent channels are owner-scoped connection config (channel-integrations
-# decision 001, cloned from the agent_share model): the creator owns the
-# channel; view/edit/delete/install require ownership or an explicit grant.
-# Plain org members get NO implicit access, and — critically — no
-# workspace-visitor tuples exist at all: workspace-user admission to the
-# channel runtime is app-level (webhook signature + channel caller identity
-# + per-turn gates), never FGA.
-#
-# Org ADMINS inherit owner (T08, consistent with agents and shares — an
-# admin who can edit the agent can manage its distribution channels). The
-# narrowness these tests pin: owner + admins have control, granted viewers
-# read, plain members have nothing.
-#
-# Run: fga model test --tests agent-channel-owner.fga.yaml
-
-name: agent-channel-owner
-model_file: ../model/fga.mod
-
-tuples:
-  # Org membership for both accounts — proving membership grants nothing.
-  - user: identity_account:alice
-    relation: member
-    object: organization:acme
-  - user: identity_account:mallory
-    relation: member
-    object: organization:acme
-
-  # Org admin — proving T08 inheritance reaches channels.
-  - user: identity_account:ana
-    relation: admin
-    object: organization:acme
-
-  # The channel, created by alice (the config-driven create tuples).
-  - user: organization:acme
-    relation: organization
-    object: agent_channel:support-bot-slack
-  - user: identity_account:alice
-    relation: owner
-    object: agent_channel:support-bot-slack
-
-  # An explicit viewer grant to carol (not even an org member).
-  - user: identity_account:carol
-    relation: viewer
-    object: agent_channel:support-bot-slack
-
-tests:
-  - name: owner has full control including grant management
-    check:
-      - user: identity_account:alice
-        object: agent_channel:support-bot-slack
-        assertions:
-          can_view: true
-          can_edit: true
-          can_delete: true
-          can_grant_access: true
-          can_view_access: true
-
-  - name: explicitly granted viewer can read but not mutate
-    check:
-      - user: identity_account:carol
-        object: agent_channel:support-bot-slack
-        assertions:
-          can_view: true
-          can_edit: false
-          can_delete: false
-          can_grant_access: false
-          can_view_access: true
-
-  - name: fellow org member has no implicit access
-    check:
-      - user: identity_account:mallory
-        object: agent_channel:support-bot-slack
-        assertions:
-          can_view: false
-          can_edit: false
-          can_delete: false
-          can_grant_access: false
-          can_view_access: false
-
-  - name: org admin inherits channel management (T08)
-    check:
-      - user: identity_account:ana
-        object: agent_channel:support-bot-slack
-        assertions:
-          can_view: true
-          can_edit: true
-          can_delete: true
-          can_grant_access: true
-
-  - name: listing channels reflects ownership and grants, not membership
-    list_objects:
-      - user: identity_account:alice
-        type: agent_channel
-        assertions:
-          can_view:
-            - agent_channel:support-bot-slack
-          can_edit:
-            - agent_channel:support-bot-slack
-      - user: identity_account:carol
-        type: agent_channel
-        assertions:
-          can_view:
-            - agent_channel:support-bot-slack
-          can_edit: []
-      - user: identity_account:mallory
-        type: agent_channel
-        assertions:
-          can_view: []

package/src/authorization/__tests__/fixtures/fga/agent-instance-creation.fga.yaml

@@ -1,177 +0,0 @@
-# Pinned copy of stigmer-cloud backend/services/stigmer-server/fga/tests/agent-instance-creation.fga.yaml
-# as changed by stigmer-cloud#765 (the OpenFGA store test the cloud runs against its live model).
-# The body below is byte-identical to the source; the cloud re-runs the LIVE
-# file against this evaluator at the re-pin, so a stale copy is caught there.
-# Store tests for agent-instance creation: two halves, asked together by
-# the create since stigmer#1209 (v3.22.0). The agent half is the agent's
-# can_create_instance (can_execute, so the viewer set: whoever may run the
-# agent may instantiate it). The organization half is
-# can_create_agent_instance: member on the organization the instance is
-# created IN, which is the caller's own, not the agent's: a personal
-# instance of another organization's platform-visible agent lives in the
-# caller's organization (the tenant-family case), so the agent's permission
-# alone would let a row be planted in any organization named on the request.
-#
-# What these pin: owners, admins and members hold the organization half;
-# a viewer-role account may run an org-visible agent (the agent half) and
-# still lacks the organization half; a guest holds neither; an outsider
-# holds neither; and the tenant-family case passes on the caller's own
-# organization while the agent half comes from the platform_viewer grant.
-#
-# Run: fga model test --tests agent-instance-creation.fga.yaml
-
-name: agent-instance-creation
-model_file: ../model/fga.mod
-
-tuples:
-  # Org acme: olivia owns it, oscar administers, dave is a plain member,
-  # vera a read-only viewer, greta the share-link guest account.
-  - user: identity_account:olivia
-    relation: owner
-    object: organization:acme
-  - user: identity_account:oscar
-    relation: admin
-    object: organization:acme
-  - user: identity_account:dave
-    relation: member
-    object: organization:acme
-  - user: identity_account:vera
-    relation: viewer
-    object: organization:acme
-  - user: identity_account:greta
-    relation: guest
-    object: organization:acme
-
-  # Org consumer: mia is a plain member there and holds no role in acme.
-  - user: identity_account:mia
-    relation: member
-    object: organization:consumer
-
-  # acme owns identity_provider:idp1, which manages consumer: the two are
-  # one tenant family, the audience a platform-visible agent reaches.
-  - user: organization:acme
-    relation: organization
-    object: identity_provider:idp1
-  - user: organization:consumer
-    relation: managed_org
-    object: identity_provider:idp1
-
-  # An ORG-visible agent in acme, authored by oscar.
-  - user: organization:acme
-    relation: organization
-    object: agent:team-bot
-  - user: identity_account:oscar
-    relation: owner
-    object: agent:team-bot
-  - user: organization:acme#viewer
-    relation: viewer
-    object: agent:team-bot
-
-  # A PRIVATE agent in acme, authored by oscar (no visibility tuple).
-  - user: organization:acme
-    relation: organization
-    object: agent:secret-bot
-  - user: identity_account:oscar
-    relation: owner
-    object: agent:secret-bot
-
-  # A PLATFORM-visible agent in acme (the platform_viewer grant plus the
-  # org floor tuple the visibility writer emits).
-  - user: organization:acme
-    relation: organization
-    object: agent:open-bot
-  - user: identity_account:oscar
-    relation: owner
-    object: agent:open-bot
-  - user: identity_provider:idp1#platform_user
-    relation: platform_viewer
-    object: agent:open-bot
-  - user: organization:acme#viewer
-    relation: viewer
-    object: agent:open-bot
-
-tests:
-  - name: owners, admins and members hold the organization half
-    check:
-      - user: identity_account:olivia
-        object: organization:acme
-        assertions:
-          can_create_agent_instance: true
-      - user: identity_account:oscar
-        object: organization:acme
-        assertions:
-          can_create_agent_instance: true
-      - user: identity_account:dave
-        object: organization:acme
-        assertions:
-          can_create_agent_instance: true
-
-  - name: a viewer, a guest and an outsider do not
-    check:
-      - user: identity_account:vera
-        object: organization:acme
-        assertions:
-          can_create_agent_instance: false
-          can_create_session: false
-      - user: identity_account:greta
-        object: organization:acme
-        assertions:
-          can_create_agent_instance: false
-          can_create_session: true
-      - user: identity_account:mia
-        object: organization:acme
-        assertions:
-          can_create_agent_instance: false
-
-  - name: a member instantiates an org-visible agent, both halves held
-    check:
-      - user: identity_account:dave
-        object: agent:team-bot
-        assertions:
-          can_create_instance: true
-          can_execute: true
-
-  - name: a viewer may run the org-visible agent and still cannot instantiate it here
-    check:
-      - user: identity_account:vera
-        object: agent:team-bot
-        assertions:
-          can_create_instance: true
-      - user: identity_account:vera
-        object: organization:acme
-        assertions:
-          can_create_agent_instance: false
-
-  - name: a private agent gives the agent half to its author and the admins only
-    check:
-      - user: identity_account:oscar
-        object: agent:secret-bot
-        assertions:
-          can_create_instance: true
-      - user: identity_account:olivia
-        object: agent:secret-bot
-        assertions:
-          can_create_instance: true
-      - user: identity_account:dave
-        object: agent:secret-bot
-        assertions:
-          can_create_instance: false
-      - user: identity_account:mia
-        object: agent:secret-bot
-        assertions:
-          can_create_instance: false
-
-  - name: the tenant-family case, the agent half from platform_viewer and the organization half at home
-    check:
-      - user: identity_account:mia
-        object: agent:open-bot
-        assertions:
-          can_create_instance: true
-      - user: identity_account:mia
-        object: organization:consumer
-        assertions:
-          can_create_agent_instance: true
-      - user: identity_account:mia
-        object: organization:acme
-        assertions:
-          can_create_agent_instance: false