@stigmer/server 3.27.2 → 3.29.0

package/src/authorization/__tests__/fixtures/fga/session-personal-resource.fga.yaml

@@ -1,117 +0,0 @@
-# Pinned copy of stigmer-cloud backend/services/stigmer-server/fga/tests/session-personal-resource.fga.yaml
-# at commit b87dd1170 (the OpenFGA store test the cloud runs against its live model).
-# The body below is byte-identical to the source; the cloud re-runs the LIVE
-# file against this evaluator at the re-pin, so a stale copy is caught there.
-# Store tests for the session personal-resource model, including owner
-# deletability (2026-07-08-owner-session-delete changelog entry).
-#
-# Sessions are always private: no visibility tuples are ever written, so
-# access is owner + explicit viewer grants only. Org admins have no implicit
-# access, and platform operators have no session-delete override — the
-# platform-level can_delete_session relation was removed in favor of
-# `can_delete: owner` on the session itself (deletion no longer threatens
-# the billing trail; usage records are immutable and denormalized).
-#
-# Agent executions inherit ALL access from their parent session
-# (`owner from session`), so the execution assertions here pin the
-# inheritance that session cascade-delete relies on.
-#
-# Run with:
-#   fga model test --tests session-personal-resource.fga.yaml
-#
-# Scenario: org "acme" has admin alice, member bob (session creator), and
-# member carol. dana is a platform operator with no relation to the session.
-name: session-personal-resource
-model_file: ../model/fga.mod
-
-tuples:
-  # --- Org roles ---
-  - user: identity_account:alice
-    relation: admin
-    object: organization:acme
-  - user: identity_account:bob
-    relation: member
-    object: organization:acme
-  - user: identity_account:carol
-    relation: member
-    object: organization:acme
-
-  # --- Platform operator (no relation to the session) ---
-  - user: identity_account:dana
-    relation: operator
-    object: platform:stigmer
-
-  # --- bob's session (tuples written on create) ---
-  - user: organization:acme
-    relation: organization
-    object: session:bobs-chat
-  - user: identity_account:bob
-    relation: owner
-    object: session:bobs-chat
-
-  # --- carol holds an explicit viewer grant on the session ---
-  - user: identity_account:carol
-    relation: viewer
-    object: session:bobs-chat
-
-  # --- an execution inside the session ---
-  - user: session:bobs-chat
-    relation: session
-    object: agent_execution:run-1
-
-tests:
-  - name: owner has full control including delete
-    check:
-      - user: identity_account:bob
-        object: session:bobs-chat
-        assertions:
-          can_view: true
-          can_edit: true
-          can_delete: true
-          can_create_execution_in: true
-          can_grant_access: true
-
-  - name: explicit viewer can view and run, but not edit or delete
-    check:
-      - user: identity_account:carol
-        object: session:bobs-chat
-        assertions:
-          can_view: true
-          can_create_execution_in: true
-          can_edit: false
-          can_delete: false
-          can_grant_access: false
-
-  - name: org admin has no implicit access to a personal session
-    check:
-      - user: identity_account:alice
-        object: session:bobs-chat
-        assertions:
-          can_view: false
-          can_edit: false
-          can_delete: false
-
-  - name: platform operator has no session-delete override
-    check:
-      - user: identity_account:dana
-        object: session:bobs-chat
-        assertions:
-          can_view: false
-          can_delete: false
-
-  - name: execution access is inherited from the parent session
-    check:
-      - user: identity_account:bob
-        object: agent_execution:run-1
-        assertions:
-          can_view: true
-          can_edit: true
-      - user: identity_account:carol
-        object: agent_execution:run-1
-        assertions:
-          can_view: true
-          can_edit: false
-      - user: identity_account:alice
-        object: agent_execution:run-1
-        assertions:
-          can_view: false

package/src/authorization/__tests__/fixtures/fga/workflow-execution-sharing.fga.yaml

@@ -1,190 +0,0 @@
-# Pinned copy of stigmer-cloud backend/services/stigmer-server/fga/tests/workflow-execution-sharing.fga.yaml
-# as changed by stigmer-cloud#765 (the OpenFGA store test the cloud runs against its live model).
-# The body below is byte-identical to the source; the cloud re-runs the LIVE
-# file against this evaluator at the re-pin, so a stale copy is caught there.
-# Store tests for workflow_execution sharing and run observability.
-#
-# Two independent axes govern who can read a run's inputs/outputs:
-#
-#   1. Per-execution sharing — the triggerer (owner) grants viewer on a single
-#      workflow_execution. Enabled by the new can_grant_access / can_view_access
-#      relations (mirrors session.fga).
-#   2. Instance-level run observability — opt-in via the workflow_instance's
-#      `execution_viewer` relation, inherited by every execution through
-#      `viewer = ... or execution_viewer from workflow_instance`.
-#
-# The critical invariant: making an instance org-RUNNABLE (instance#viewer for
-# org members) must NOT leak run history. Only execution_viewer does that.
-#
-# Run with:
-#   fga model test --tests workflow-execution-sharing.fga.yaml
-#
-# Scenario: org "acme" with members alice (triggerer), bob, carol; outsider
-# org with member mallory. inst1 is org-runnable but keeps runs private; inst2
-# opts into org-wide run observability.
-name: workflow-execution-sharing
-model_file: ../model/fga.mod
-
-tuples:
-  # --- Org memberships ---
-  - user: identity_account:alice
-    relation: member
-    object: organization:acme
-  - user: identity_account:bob
-    relation: member
-    object: organization:acme
-  - user: identity_account:carol
-    relation: member
-    object: organization:acme
-  - user: identity_account:vera
-    relation: viewer
-    object: organization:acme
-  - user: identity_account:mallory
-    relation: member
-    object: organization:outsider
-
-  # --- inst1: ORG-RUNNABLE instance, runs stay PRIVATE (no execution_viewer) ---
-  - user: organization:acme
-    relation: organization
-    object: workflow_instance:inst1
-  - user: identity_account:alice
-    relation: owner
-    object: workflow_instance:inst1
-  # Everyone in the org can SEE the instance (cloud#257 viewer shape;
-  # RUNNING it is additionally gated in Java on can_create_execution_in)...
-  - user: organization:acme#viewer
-    relation: viewer
-    object: workflow_instance:inst1
-  # ...but NO execution_viewer tuple, so run history is not shared.
-
-  # run1: alice's run on inst1, no explicit grants.
-  - user: organization:acme
-    relation: organization
-    object: workflow_execution:run1
-  - user: workflow_instance:inst1
-    relation: workflow_instance
-    object: workflow_execution:run1
-  - user: identity_account:alice
-    relation: owner
-    object: workflow_execution:run1
-
-  # run1b: alice's run on inst1, explicitly shared with bob (per-execution).
-  - user: organization:acme
-    relation: organization
-    object: workflow_execution:run1b
-  - user: workflow_instance:inst1
-    relation: workflow_instance
-    object: workflow_execution:run1b
-  - user: identity_account:alice
-    relation: owner
-    object: workflow_execution:run1b
-  - user: identity_account:bob
-    relation: viewer
-    object: workflow_execution:run1b
-
-  # --- inst2: opts into ORG-WIDE run observability (execution_viewer) ---
-  - user: organization:acme
-    relation: organization
-    object: workflow_instance:inst2
-  - user: identity_account:alice
-    relation: owner
-    object: workflow_instance:inst2
-  - user: organization:acme#viewer
-    relation: execution_viewer
-    object: workflow_instance:inst2
-
-  # run2: alice's run on inst2.
-  - user: organization:acme
-    relation: organization
-    object: workflow_execution:run2
-  - user: workflow_instance:inst2
-    relation: workflow_instance
-    object: workflow_execution:run2
-  - user: identity_account:alice
-    relation: owner
-    object: workflow_execution:run2
-
-tests:
-  - name: triggerer always sees and can manage sharing of their own run
-    check:
-      - user: identity_account:alice
-        object: workflow_execution:run1
-        assertions:
-          can_view: true
-          can_grant_access: true
-          can_view_access: true
-
-  - name: org-runnable instance does NOT leak run history to teammates
-    check:
-      # bob and carol can see/run inst1, but cannot read alice's run1.
-      - user: identity_account:bob
-        object: workflow_execution:run1
-        assertions:
-          can_view: false
-          can_view_access: false
-      - user: identity_account:carol
-        object: workflow_execution:run1
-        assertions:
-          can_view: false
-
-  - name: per-execution share grants exactly the named teammate
-    check:
-      - user: identity_account:bob
-        object: workflow_execution:run1b
-        assertions:
-          can_view: true
-          can_view_access: true
-      # A viewer cannot re-share (only the owner can grant).
-      - user: identity_account:bob
-        object: workflow_execution:run1b
-        assertions:
-          can_grant_access: false
-      # Another org member not on the grant sees nothing.
-      - user: identity_account:carol
-        object: workflow_execution:run1b
-        assertions:
-          can_view: false
-
-  - name: instance execution_viewer opt-in shares all runs org-wide
-    check:
-      - user: identity_account:bob
-        object: workflow_execution:run2
-        assertions:
-          can_view: true
-      - user: identity_account:carol
-        object: workflow_execution:run2
-        assertions:
-          can_view: true
-      # cloud#257: run observability is a pure read grant, so the org's
-      # read-only viewers are exactly its audience.
-      - user: identity_account:vera
-        object: workflow_execution:run2
-        assertions:
-          can_view: true
-      # Outsiders never gain access through org-scoped observability.
-      - user: identity_account:mallory
-        object: workflow_execution:run2
-        assertions:
-          can_view: false
-
-  - name: run privacy holds against org viewers exactly as against members
-    check:
-      # No execution_viewer opt-in on inst1 → vera reads the instance but
-      # never alice's run history.
-      - user: identity_account:vera
-        object: workflow_instance:inst1
-        assertions:
-          can_view: true
-      - user: identity_account:vera
-        object: workflow_execution:run1
-        assertions:
-          can_view: false
-
-  - name: list a teammate's viewable runs reflects both sharing axes
-    list_objects:
-      - user: identity_account:bob
-        type: workflow_execution
-        assertions:
-          can_view:
-            - workflow_execution:run1b
-            - workflow_execution:run2

package/src/authorization/model/agent.ts

@@ -1,64 +0,0 @@
-/**
- * Transcript of fga/model/agentic/agent.fga — a blueprint: owned by its
- * creator and by the organization's admins (`admin from organization`),
- * read by whoever the visibility axis lets in. The `organization#member`
- * and `organization#viewer` usersets on `viewer` are the org-visibility
- * tuple's two shapes (the cloud writes `#viewer` since cloud#257; `#member`
- * is the legacy shape it still honours), and `platform_viewer` is an
- * identity-provider userset no open-source tuple ever names. `team#member`
- * is the Enterprise team grant; open source serves no team, so no tuple
- * here ever names one.
- */
-import { AgentSchema } from "@stigmer/protos/ai/stigmer/agentic/agent/v1/api_pb";
-import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
-
-import {
-  computed,
-  declareKind,
-  direct,
-  from,
-  objectOf,
-  union,
-  usersetOf,
-} from "./rewrite.js";
-
-export const agentDeclaration = declareKind({
-  kind: ApiResourceKind.agent,
-  schema: AgentSchema,
-  source: "fga/model/agentic/agent.fga",
-  relations: [
-    ["organization", direct(objectOf("organization"))],
-    [
-      "owner",
-      union(
-        direct(objectOf("identity_account")),
-        from("admin", "organization"),
-      ),
-    ],
-    [
-      "platform_viewer",
-      direct(usersetOf("identity_provider", "platform_user")),
-    ],
-    [
-      "viewer",
-      union(
-        direct(
-          objectOf("identity_account"),
-          usersetOf("organization", "member"),
-          usersetOf("organization", "viewer"),
-          usersetOf("team", "member"),
-        ),
-        computed("owner"),
-        computed("platform_viewer"),
-      ),
-    ],
-    ["can_view", computed("viewer")],
-    ["can_edit", computed("owner")],
-    ["can_delete", computed("owner")],
-    ["can_execute", computed("viewer")],
-    ["can_create_instance", computed("can_execute")],
-    ["can_clone", computed("viewer")],
-    ["can_grant_access", computed("owner")],
-    ["can_view_access", computed("viewer")],
-  ],
-});

package/src/authorization/model/agent_channel.ts

@@ -1,57 +0,0 @@
-/**
- * Transcript of fga/model/agentic/agent_channel.fga — a channel binding,
- * admin-owned like a blueprint, with `participant` as the one relation
- * between owner and viewer: the conversation-participation role
- * (reply and takeover without configuration authority), grantable as a
- * role on this kind alone. Every owner participates; every participant
- * views. Both grantable relations may name an Enterprise team
- * (`team#member`), which no open-source tuple ever does.
- */
-import { AgentChannelSchema } from "@stigmer/protos/ai/stigmer/agentic/agentchannel/v1/api_pb";
-import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
-
-import {
-  computed,
-  declareKind,
-  direct,
-  from,
-  objectOf,
-  union,
-  usersetOf,
-} from "./rewrite.js";
-
-export const agentChannelDeclaration = declareKind({
-  kind: ApiResourceKind.agent_channel,
-  schema: AgentChannelSchema,
-  source: "fga/model/agentic/agent_channel.fga",
-  relations: [
-    ["organization", direct(objectOf("organization"))],
-    [
-      "owner",
-      union(
-        direct(objectOf("identity_account")),
-        from("admin", "organization"),
-      ),
-    ],
-    [
-      "participant",
-      union(
-        direct(objectOf("identity_account"), usersetOf("team", "member")),
-        computed("owner"),
-      ),
-    ],
-    [
-      "viewer",
-      union(
-        direct(objectOf("identity_account"), usersetOf("team", "member")),
-        computed("participant"),
-      ),
-    ],
-    ["can_view", computed("viewer")],
-    ["can_edit", computed("owner")],
-    ["can_delete", computed("owner")],
-    ["can_participate", computed("participant")],
-    ["can_grant_access", computed("owner")],
-    ["can_view_access", computed("viewer")],
-  ],
-});

package/src/authorization/model/agent_execution.ts

@@ -1,33 +0,0 @@
-/**
- * Transcript of fga/model/agentic/agent_execution.fga — a run is its
- * session's: no owner tuple of its own (`kind_meta` attribution
- * INHERITED), every relation a hop through `session`, which the
- * derivation writes from `spec.session_id`. `can_view: viewer or
- * can_view from session` walks a parent PERMISSION whose own arms include
- * the session's channel and schedule hops; the evaluator resolves those
- * on the session's declaration, so this file needs no knowledge of them.
- */
-import { AgentExecutionSchema } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/api_pb";
-import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
-
-import {
-  computed,
-  declareKind,
-  direct,
-  from,
-  objectOf,
-  union,
-} from "./rewrite.js";
-
-export const agentExecutionDeclaration = declareKind({
-  kind: ApiResourceKind.agent_execution,
-  schema: AgentExecutionSchema,
-  source: "fga/model/agentic/agent_execution.fga",
-  relations: [
-    ["session", direct(objectOf("session"))],
-    ["owner", from("owner", "session")],
-    ["viewer", union(from("viewer", "session"), computed("owner"))],
-    ["can_view", union(computed("viewer"), from("can_view", "session"))],
-    ["can_edit", computed("owner")],
-  ],
-});

package/src/authorization/model/agent_instance.ts

@@ -1,66 +0,0 @@
-/**
- * Transcript of fga/model/agentic/agent_instance.fga — a person's
- * configuration of an agent: owner-only in every write (no admin arm,
- * unlike the blueprint), readable through its own visibility axis or, for
- * the system-managed default instance, through the blueprint's whole
- * viewer set (`viewer from default_of`; default-of.ts). `agent` is the
- * parent link written on every instance for tracking and walked by
- * nothing; `default_of` is the derived link written on the default
- * instance alone. `team#member` on `viewer` is the Enterprise team grant,
- * which no open-source tuple ever names.
- */
-import { AgentSchema } from "@stigmer/protos/ai/stigmer/agentic/agent/v1/api_pb";
-import { AgentInstanceSchema } from "@stigmer/protos/ai/stigmer/agentic/agentinstance/v1/api_pb";
-import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
-
-import { defaultOfBlueprint } from "./default-of.js";
-import {
-  computed,
-  declareKind,
-  direct,
-  from,
-  objectOf,
-  union,
-  usersetOf,
-} from "./rewrite.js";
-
-export const agentInstanceDeclaration = declareKind({
-  kind: ApiResourceKind.agent_instance,
-  schema: AgentInstanceSchema,
-  source: "fga/model/agentic/agent_instance.fga",
-  relations: [
-    ["organization", direct(objectOf("organization"))],
-    ["agent", direct(objectOf("agent"))],
-    ["default_of", direct(objectOf("agent"))],
-    ["owner", direct(objectOf("identity_account"))],
-    [
-      "viewer",
-      union(
-        direct(
-          objectOf("identity_account"),
-          usersetOf("organization", "member"),
-          usersetOf("organization", "viewer"),
-          usersetOf("team", "member"),
-        ),
-        computed("owner"),
-        from("viewer", "default_of"),
-      ),
-    ],
-    ["can_view", computed("viewer")],
-    ["can_execute", computed("can_view")],
-    ["can_edit", computed("owner")],
-    ["can_delete", computed("owner")],
-    ["can_grant_access", computed("owner")],
-    ["can_view_access", computed("viewer")],
-  ],
-  derived: [
-    [
-      "default_of",
-      defaultOfBlueprint({
-        kind: ApiResourceKind.agent,
-        schema: AgentSchema,
-        defaultInstanceIdOf: (agent) => agent.status?.defaultInstanceId ?? "",
-      }),
-    ],
-  ],
-});

package/src/authorization/model/agent_share.ts

@@ -1,40 +0,0 @@
-/**
- * Transcript of fga/model/agentic/agent_share.fga — a share link's
- * configuration row, admin-owned; its anonymous visitors are the cloud's
- * `guest` credential on the organization, a class no open-source lane
- * mints, so on this edition a share is visible to its owners and explicit
- * grantees only.
- */
-import { AgentShareSchema } from "@stigmer/protos/ai/stigmer/agentic/agentshare/v1/api_pb";
-import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
-
-import {
-  computed,
-  declareKind,
-  direct,
-  from,
-  objectOf,
-  union,
-} from "./rewrite.js";
-
-export const agentShareDeclaration = declareKind({
-  kind: ApiResourceKind.agent_share,
-  schema: AgentShareSchema,
-  source: "fga/model/agentic/agent_share.fga",
-  relations: [
-    ["organization", direct(objectOf("organization"))],
-    [
-      "owner",
-      union(
-        direct(objectOf("identity_account")),
-        from("admin", "organization"),
-      ),
-    ],
-    ["viewer", union(direct(objectOf("identity_account")), computed("owner"))],
-    ["can_view", computed("viewer")],
-    ["can_edit", computed("owner")],
-    ["can_delete", computed("owner")],
-    ["can_grant_access", computed("owner")],
-    ["can_view_access", computed("viewer")],
-  ],
-});

package/src/authorization/model/api_key.ts

@@ -1,28 +0,0 @@
-/**
- * Transcript of fga/model/iam/api_key.fga — a credential, owner-only in
- * every verb: no organization link (`kind_meta` scope OWNER_ONLY) and no
- * admin arm, so the key a person minted is theirs to view, rotate, revoke
- * and use, and nobody else's. `can_rotate`, `can_revoke` and `can_use` are
- * the file's own verbs; the wire vocabulary names only the first three.
- */
-import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
-import { ApiKeySchema } from "@stigmer/protos/ai/stigmer/iam/apikey/v1/api_pb";
-
-import { computed, declareKind, direct, objectOf } from "./rewrite.js";
-
-export const apiKeyDeclaration = declareKind({
-  kind: ApiResourceKind.api_key,
-  schema: ApiKeySchema,
-  source: "fga/model/iam/api_key.fga",
-  relations: [
-    ["owner", direct(objectOf("identity_account"))],
-    ["can_view", computed("owner")],
-    ["can_edit", computed("owner")],
-    ["can_delete", computed("owner")],
-    ["can_rotate", computed("owner")],
-    ["can_revoke", computed("owner")],
-    ["can_use", computed("owner")],
-    ["can_grant_access", computed("owner")],
-    ["can_view_access", computed("owner")],
-  ],
-});

package/src/authorization/model/artifact.ts

@@ -1,38 +0,0 @@
-/**
- * Transcript of fga/model/agentic/artifact.fga — an organization's shared
- * output: read by its creator and by every organization viewer (`viewer
- * from organization`, no visibility tuple involved — the kind has no
- * visibility axis), edited by the organization's admins alone (the
- * creator does NOT edit through `owner`), and with no `can_delete` line
- * at all. The wire annotates only `can_view` and `can_edit` on it.
- */
-import { ArtifactSchema } from "@stigmer/protos/ai/stigmer/agentic/artifact/v1/api_pb";
-import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
-
-import {
-  computed,
-  declareKind,
-  direct,
-  from,
-  objectOf,
-  union,
-} from "./rewrite.js";
-
-export const artifactDeclaration = declareKind({
-  kind: ApiResourceKind.artifact,
-  schema: ArtifactSchema,
-  source: "fga/model/agentic/artifact.fga",
-  relations: [
-    ["organization", direct(objectOf("organization"))],
-    ["owner", direct(objectOf("identity_account"))],
-    [
-      "viewer",
-      union(
-        direct(objectOf("identity_account")),
-        from("viewer", "organization"),
-      ),
-    ],
-    ["can_view", union(computed("owner"), computed("viewer"))],
-    ["can_edit", from("admin", "organization")],
-  ],
-});

package/src/authorization/model/channel_app.ts

@@ -1,39 +0,0 @@
-/**
- * Transcript of fga/model/agentic/channel_app.fga — a messaging-platform
- * app registration, admin-owned, viewable by its owners and explicit
- * grantees: the same shape as agent_share, kept as its own file so the
- * drift compare reads this file's lines.
- */
-import { ChannelAppSchema } from "@stigmer/protos/ai/stigmer/agentic/channelapp/v1/api_pb";
-import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
-
-import {
-  computed,
-  declareKind,
-  direct,
-  from,
-  objectOf,
-  union,
-} from "./rewrite.js";
-
-export const channelAppDeclaration = declareKind({
-  kind: ApiResourceKind.channel_app,
-  schema: ChannelAppSchema,
-  source: "fga/model/agentic/channel_app.fga",
-  relations: [
-    ["organization", direct(objectOf("organization"))],
-    [
-      "owner",
-      union(
-        direct(objectOf("identity_account")),
-        from("admin", "organization"),
-      ),
-    ],
-    ["viewer", union(direct(objectOf("identity_account")), computed("owner"))],
-    ["can_view", computed("viewer")],
-    ["can_edit", computed("owner")],
-    ["can_delete", computed("owner")],
-    ["can_grant_access", computed("owner")],
-    ["can_view_access", computed("viewer")],
-  ],
-});