@stigmer/server 3.30.0 → 3.32.0

package/src/domain/iampolicy/__tests__/steps.test.ts

@@ -16,6 +16,14 @@
  * Grant and Revoke are proven for the one thing a step adds over the
  * grant path: the result they leave under POLICY_RESULT_KEY (the revoke
  * of an absent triple leaves the default instance, Java's contract).
+ *
+ * The two owner steps: a change that grants, revokes or removes an
+ * organization's owner role asks `can_assign_roles` there and refuses with
+ * the owner copy when it is denied; any other role, any other kind and the
+ * `internal` caller ask nothing; `revokeOrgAccess` asks exactly when the
+ * account holds owner; and the last owner is never revoked or removed,
+ * while one of two may be. Both read the organization's owners once per
+ * request.
  */
 import { Code, ConnectError } from "@connectrpc/connect";
 import { describe, expect, it } from "vitest";
@@ -26,11 +34,20 @@ import { IamPolicySpecSchema } from "@stigmer/protos/ai/stigmer/iam/iampolicy/v1
 import type { IamPolicySpec } from "@stigmer/protos/ai/stigmer/iam/iampolicy/v1/spec_pb";
 import { IamRole } from "@stigmer/protos/ai/stigmer/iam/v1/enum_pb";
 
+import { create } from "@bufbuild/protobuf";
+
+import { RevokeOrgAccessInputSchema } from "@stigmer/protos/ai/stigmer/iam/iampolicy/v1/io_pb";
+import { IamPermission } from "@stigmer/protos/ai/stigmer/iam/v1/enum_pb";
+
 import { createLogger } from "../../../boot/logger.js";
+import type { Authorizer, AuthzCheck } from "../../../extensions/authorizer.js";
+import type { CallerIdentity } from "../../../extensions/identity.js";
 import type { PolicyGrantScope } from "../../../extensions/policy-grant-scope.js";
 import { trustedLocalIdentityFor } from "../../../pipeline/interceptors/auth.js";
 import { RequestContext } from "../../../pipeline/request-context.js";
 import {
+  LAST_OWNER_MESSAGE,
+  OWNER_ASSIGNMENT_DENIED_MESSAGE,
   PER_RESOURCE_GRANTS_UNIMPLEMENTED_MESSAGE,
   noGrantableRolesMessage,
   personQualifierMessage,
@@ -46,9 +63,13 @@ import { newIamPolicyGrantPath } from "../grant-path.js";
 import { newOrganizationOnlyGrantScope } from "../grant-scope.js";
 import {
   POLICY_RESULT_KEY,
+  newAuthorizeOwnerAssignmentStep,
   newGrantStep,
+  newKeepOneOwnerStep,
   newRevokeStep,
   newValidateGrantableRoleStep,
+  orgAccessOwnerRoleChange,
+  specOwnerRoleChange,
 } from "../steps.js";
 import { fakeIamPolicyStore, orgRole, triple } from "./support.js";
 
@@ -398,3 +419,161 @@ describe("Grant and Revoke leave their result under POLICY_RESULT_KEY", () => {
     ).toBe("");
   });
 });
+
+describe("owner is assigned by owners", () => {
+  const admin: CallerIdentity = { ...caller, identityId: "ida_ana", callerClass: "user" };
+  const internal: CallerIdentity = { ...caller, callerClass: "internal" };
+
+  /** An Authorizer that records every question and answers `can_assign_roles` as told. */
+  function authorizer(ownsAcme: boolean): Authorizer & { readonly asked: AuthzCheck[] } {
+    const asked: AuthzCheck[] = [];
+    return {
+      asked,
+      authorize: (_identity, check) => {
+        asked.push(check);
+        return Promise.resolve(
+          ownsAcme ? { kind: "allow" } : { kind: "deny", reason: "" },
+        );
+      },
+    };
+  }
+
+  const ASSIGN_ROLES_ON_ACME: AuthzCheck = {
+    permission: IamPermission.can_assign_roles,
+    resourceKind: ApiResourceKind.organization,
+    resourceId: "acme",
+  };
+
+  function specContext(
+    spec: IamPolicySpec,
+    identity: CallerIdentity = admin,
+  ): RequestContext<typeof IamPolicySpecSchema> {
+    return new RequestContext(IamPolicySpecSchema, spec, identity, ApiResourceKind.iam_policy);
+  }
+
+  function removalContext(
+    accountId: string,
+    identity: CallerIdentity = admin,
+  ): RequestContext<typeof RevokeOrgAccessInputSchema> {
+    return new RequestContext(
+      RevokeOrgAccessInputSchema,
+      create(RevokeOrgAccessInputSchema, { identityAccountId: accountId, organizationId: "acme" }),
+      identity,
+      ApiResourceKind.iam_policy,
+    );
+  }
+
+  /** A store holding acme's roles, the owners' read counted. */
+  async function storeWith(
+    roles: ReadonlyArray<readonly [string, string]>,
+  ): Promise<ReturnType<typeof fakeIamPolicyStore> & { readonly ownerReads: () => number }> {
+    const store = fakeIamPolicyStore();
+    const path = newIamPolicyGrantPath({ policies: store, lifecycle: undefined, logger: silent });
+    for (const [account, role] of roles) {
+      await path.grant(orgRole(account, role, "acme"), caller);
+    }
+    let reads = 0;
+    const read = store.findByResourceWithRelations.bind(store);
+    return Object.assign(store, {
+      findByResourceWithRelations: (...args: Parameters<typeof read>) => {
+        reads += 1;
+        return read(...args);
+      },
+      ownerReads: () => reads,
+    });
+  }
+
+  describe("AuthorizeOwnerAssignment", () => {
+    it("refuses an admin granting or revoking owner on an organization, with the owner copy", async () => {
+      const denied = authorizer(false);
+      const step = newAuthorizeOwnerAssignmentStep(denied, specOwnerRoleChange);
+      const error = await refusal(() => step.execute(specContext(orgRole("ida_bob", "owner", "acme"))));
+      expect(error.code).toBe(Code.PermissionDenied);
+      expect(error.rawMessage).toBe(OWNER_ASSIGNMENT_DENIED_MESSAGE);
+      expect(denied.asked).toEqual([ASSIGN_ROLES_ON_ACME]);
+    });
+
+    it("lets an owner grant owner", async () => {
+      const allowed = authorizer(true);
+      await newAuthorizeOwnerAssignmentStep(allowed, specOwnerRoleChange).execute(
+        specContext(orgRole("ida_bob", "owner", "acme")),
+      );
+      expect(allowed.asked).toEqual([ASSIGN_ROLES_ON_ACME]);
+    });
+
+    it("asks nothing for a role below owner, for owner on another kind, or for the internal caller", async () => {
+      const denied = authorizer(false);
+      const step = newAuthorizeOwnerAssignmentStep(denied, specOwnerRoleChange);
+      await step.execute(specContext(orgRole("ida_bob", "admin", "acme")));
+      await step.execute(
+        specContext(triple({ kind: "identity_account", id: "ida_bob" }, "owner", { kind: "agent", id: "agt_1" })),
+      );
+      await step.execute(specContext(orgRole("ida_bob", "owner", "acme"), internal));
+      expect(denied.asked).toEqual([]);
+    });
+
+    it("asks when revokeOrgAccess removes an owner, and not when it removes anyone else", async () => {
+      const store = await storeWith([["ida_root", "owner"], ["ida_dave", "member"]]);
+      const denied = authorizer(false);
+      const step = newAuthorizeOwnerAssignmentStep(denied, orgAccessOwnerRoleChange(store));
+
+      await step.execute(removalContext("ida_dave"));
+      expect(denied.asked).toEqual([]);
+
+      const error = await refusal(() => step.execute(removalContext("ida_root")));
+      expect(error.code).toBe(Code.PermissionDenied);
+      expect(error.rawMessage).toBe(OWNER_ASSIGNMENT_DENIED_MESSAGE);
+      expect(denied.asked).toEqual([ASSIGN_ROLES_ON_ACME]);
+    });
+  });
+
+  describe("KeepOneOwner", () => {
+    it("refuses revoking the last owner's role, and lets one of two go", async () => {
+      const sole = await storeWith([["ida_root", "owner"]]);
+      const error = await refusal(() =>
+        newKeepOneOwnerStep(sole, specOwnerRoleChange).execute(
+          specContext(orgRole("ida_root", "owner", "acme")),
+        ),
+      );
+      expect(error.code).toBe(Code.FailedPrecondition);
+      expect(error.rawMessage).toBe(LAST_OWNER_MESSAGE);
+
+      const two = await storeWith([["ida_root", "owner"], ["ida_rhea", "owner"]]);
+      await newKeepOneOwnerStep(two, specOwnerRoleChange).execute(
+        specContext(orgRole("ida_root", "owner", "acme")),
+      );
+    });
+
+    it("lets a revoke through when the account does not hold owner, whoever the last owner is", async () => {
+      const store = await storeWith([["ida_root", "owner"]]);
+      await newKeepOneOwnerStep(store, specOwnerRoleChange).execute(
+        specContext(orgRole("ida_bob", "owner", "acme")),
+      );
+    });
+
+    it("refuses removing the last owner from the organization, and lets any other member go", async () => {
+      const store = await storeWith([["ida_root", "owner"], ["ida_dave", "member"]]);
+      const step = newKeepOneOwnerStep(store, orgAccessOwnerRoleChange(store));
+      await step.execute(removalContext("ida_dave"));
+      const error = await refusal(() => step.execute(removalContext("ida_root")));
+      expect(error.code).toBe(Code.FailedPrecondition);
+      expect(error.rawMessage).toBe(LAST_OWNER_MESSAGE);
+    });
+
+    it("leaves the internal caller alone", async () => {
+      const store = await storeWith([["ida_root", "owner"]]);
+      await newKeepOneOwnerStep(store, orgAccessOwnerRoleChange(store)).execute(
+        removalContext("ida_root", internal),
+      );
+    });
+  });
+
+  it("reads the organization's owners once for both steps of one request", async () => {
+    const store = await storeWith([["ida_root", "owner"], ["ida_rhea", "owner"]]);
+    const change = orgAccessOwnerRoleChange(store);
+    const ctx = removalContext("ida_root");
+    await newAuthorizeOwnerAssignmentStep(authorizer(true), change).execute(ctx);
+    await newKeepOneOwnerStep(store, change).execute(ctx);
+    expect(store.ownerReads()).toBe(1);
+  });
+});

package/src/domain/iampolicy/constants.ts

@@ -38,7 +38,8 @@
  * unknown permission, the unknown principal kind (the resource sentence's
  * shape), the malformed triple, and the four principal refusals a team
  * grantee brought (a person's qualifier, a team's qualifier, a kind no
- * team may be granted, a role a team may not hold).
+ * team may be granted, a role a team may not hold), and the two owner
+ * refusals (a non-owner touching the owner role, the last owner's removal).
  */
 import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
 import type {
@@ -297,3 +298,16 @@ export function teamRoleNotGrantableMessage(
 export function malformedTripleMessage(field: string): string {
   return `policy ${field} must not contain ':', '#' or '@'`;
 }
+
+/**
+ * Granting, revoking or removing the owner role on an organization without
+ * `can_assign_roles` there (PERMISSION_DENIED). An admin grants every role
+ * up to admin; only an owner makes, or unmakes, an owner. An edition that
+ * serves invitations answers the same sentence for an owner invitation.
+ */
+export const OWNER_ASSIGNMENT_DENIED_MESSAGE =
+  "only an owner of the organization can grant, revoke or remove the owner role";
+
+/** Revoking or removing the last owner of an organization (FAILED_PRECONDITION). */
+export const LAST_OWNER_MESSAGE =
+  "an organization must keep at least one owner; make another member an owner first";

package/src/domain/iampolicy/controller.ts

@@ -13,7 +13,9 @@
  * in-process RPCs (Q-OR-1), never through an exported constructor.
  *
  * Shape (Q-S5-1). The six command RPCs are pipeline chains, each
- * `Authorize → ValidateProto → <one domain step>` (steps.ts): the write is
+ * `Authorize → ValidateProto → <one domain step>` (steps.ts), with the two
+ * owner steps before the write on `create`, `delete` and `revokeOrgAccess`
+ * (owner is assigned by owners, steps.ts's last section): the write is
  * the grant path's, the annotation drives position 1, and the executor's
  * fault mapping covers a store fault from inside the path. The eight
  * query RPCs are direct handlers over `authorizeDirect` (the cloud's
@@ -181,11 +183,15 @@ import {
 } from "./roles.js";
 import {
   POLICY_RESULT_KEY,
+  newAuthorizeOwnerAssignmentStep,
   newCleanupResourceStep,
   newGrantStep,
+  newKeepOneOwnerStep,
   newRevokeOrgAccessStep,
   newRevokeStep,
   newValidateGrantableRoleStep,
+  orgAccessOwnerRoleChange,
+  specOwnerRoleChange,
 } from "./steps.js";
 import type { IamPolicyStore } from "./store.js";
 import {
@@ -243,7 +249,7 @@ export function registerIamPolicyServices(
       return cleanupResourcePolicies(deps, ref, ctx);
     },
     revokeOrgAccess: (input, ctx) =>
-      revokeOrgAccess(deps, command.revokeOrgAccess, input, ctx),
+      revokeOrgAccess(deps, command.revokeOrgAccess, input, ctx, true),
     bootstrapRevokeOrgAccess: (input, ctx) => {
       guardSystemRpc(command.bootstrapRevokeOrgAccess, callerIdentityOf(ctx));
       return revokeOrgAccess(
@@ -251,6 +257,7 @@ export function registerIamPolicyServices(
         command.bootstrapRevokeOrgAccess,
         input,
         ctx,
+        false,
       );
     },
   });
@@ -296,7 +303,8 @@ function guardSystemRpc(method: DescMethod, caller: CallerIdentity): void {
 
 /**
  * `create`: the wire refusal, then Authorize → ValidateProto →
- * ValidateGrantableRole → [iam-policy-create:pre-side-effect-gate] → Grant.
+ * ValidateGrantableRole → AuthorizeOwnerAssignment →
+ * [iam-policy-create:pre-side-effect-gate] → Grant.
  */
 function createPolicy(
   deps: IamPolicyControllerDeps,
@@ -315,8 +323,9 @@ function createPolicy(
 
 /**
  * The grant chain both `create` and `bootstrapPolicy` run; only the user
- * lane validates the role and runs the create gate slot — bootstrap writes
- * structural relations no scope would admit and no edition gates.
+ * lane validates the role, asks for an owner's authority when it grants
+ * owner, and runs the create gate slot — bootstrap writes structural
+ * relations no scope would admit and no edition gates.
  */
 async function grantThroughChain(
   deps: IamPolicyControllerDeps,
@@ -339,6 +348,9 @@ async function grantThroughChain(
     .addStep(newValidateProtoStep());
   if (validateRole) {
     pipeline.addStep(newValidateGrantableRoleStep(deps.grantScope));
+    pipeline.addStep(
+      newAuthorizeOwnerAssignmentStep(deps.authorizer, specOwnerRoleChange),
+    );
     for (const step of stepsForSlot<typeof IamPolicySpecSchema>(
       deps.gateSteps,
       "iam-policy-create:pre-side-effect-gate",
@@ -350,7 +362,11 @@ async function grantThroughChain(
   return policyResultOf(reqCtx, method);
 }
 
-/** `delete`: the wire refusal, then Authorize → ValidateProto → Revoke; the revoked row, or the default instance. */
+/**
+ * `delete`: the wire refusal, then Authorize → ValidateProto →
+ * AuthorizeOwnerAssignment → KeepOneOwner → Revoke; the revoked row, or the
+ * default instance.
+ */
 async function deletePolicy(
   deps: IamPolicyControllerDeps,
   spec: IamPolicySpec,
@@ -367,18 +383,29 @@ async function deletePolicy(
   await newPipeline<typeof IamPolicySpecSchema>("iampolicy-delete", deps.logger)
     .addStep(newAuthorizeStep(method, deps.authorizer))
     .addStep(newValidateProtoStep())
+    .addStep(
+      newAuthorizeOwnerAssignmentStep(deps.authorizer, specOwnerRoleChange),
+    )
+    .addStep(newKeepOneOwnerStep(deps.policies, specOwnerRoleChange))
     .addStep(newRevokeStep(deps.grantPath))
     .build()
     .execute(reqCtx);
   return policyResultOf(reqCtx, method);
 }
 
-/** `revokeOrgAccess` and its system twin share one chain; only the annotation differs. */
+/**
+ * `revokeOrgAccess` and its system twin share one chain: Authorize →
+ * ValidateProto → RevokeOrgAccess, and on the caller lane
+ * AuthorizeOwnerAssignment → KeepOneOwner before the revoke. The twin's
+ * platform-pipeline callers hold no organization role, and removing an
+ * account is theirs to decide.
+ */
 async function revokeOrgAccess(
   deps: IamPolicyControllerDeps,
   method: DescMethod,
   input: RevokeOrgAccessInput,
   ctx: HandlerContext,
+  guardOwners: boolean,
 ): Promise<Empty> {
   const reqCtx = new RequestContext(
     RevokeOrgAccessInputSchema,
@@ -386,12 +413,19 @@ async function revokeOrgAccess(
     callerIdentityOf(ctx),
     kindOf(ctx),
   );
-  await newPipeline<typeof RevokeOrgAccessInputSchema>(
+  const pipeline = newPipeline<typeof RevokeOrgAccessInputSchema>(
     `iampolicy-${method.localName}`,
     deps.logger,
   )
     .addStep(newAuthorizeStep(method, deps.authorizer))
-    .addStep(newValidateProtoStep())
+    .addStep(newValidateProtoStep());
+  if (guardOwners) {
+    const ownerRoleChange = orgAccessOwnerRoleChange(deps.policies);
+    pipeline
+      .addStep(newAuthorizeOwnerAssignmentStep(deps.authorizer, ownerRoleChange))
+      .addStep(newKeepOneOwnerStep(deps.policies, ownerRoleChange));
+  }
+  await pipeline
     .addStep(newRevokeOrgAccessStep(deps.grantPath))
     .build()
     .execute(reqCtx);

package/src/domain/iampolicy/steps.ts

@@ -5,8 +5,9 @@
  * calls the ONE grant and revoke path (grant-path.ts, which owns the
  * cloud#425 orderings, the by-triple read and the wire refusals) and leaves
  * its answer under POLICY_RESULT_KEY for the handler. The chains are
- * deliberately short: `Authorize → ValidateProto → <one of these>`, so the
- * pipeline executor's fault mapping (a step's ConnectError keeps its code;
+ * deliberately short: `Authorize → ValidateProto → <one of these>`, with
+ * only the owner steps (the last section) before the write on the three
+ * caller lanes, so the pipeline executor's fault mapping (a step's ConnectError keeps its code;
  * a raw store fault becomes the sanitized INTERNAL) covers the path's two
  * error shapes with no second idiom in the handlers.
  *
@@ -51,8 +52,34 @@
  * exists and belongs to the resource's organization needs a read, which
  * this synchronous step does not make: that is the
  * `iam-policy-create:pre-side-effect-gate` slot's, spliced after it.
+ *
+ * Owner is assigned by owners. Every caller of the member lanes holds
+ * `can_grant_access` (admin) already, so an admin grants every role up to
+ * admin; a change that touches an organization's `owner` role also needs
+ * `can_assign_roles` there, which only its owners hold. Two steps carry it,
+ * on the caller lanes only (`create`, `delete`, `revokeOrgAccess`; never
+ * the bootstrap twins, whose platform-pipeline callers hold no
+ * organization role):
+ *   - AuthorizeOwnerAssignment asks `can_assign_roles` when the spec grants
+ *     or revokes `owner` on an organization, or when the account
+ *     `revokeOrgAccess` removes holds it. It is Authorize's own evaluation
+ *     (`authorizeResolvedResource`), so the `internal` caller skips it as it
+ *     skips position 1;
+ *   - KeepOneOwner refuses a revoke or a removal that would leave the
+ *     organization with no owner. It is a product rule rather than
+ *     authorization, so it is its own step. It skips `internal` too. The
+ *     port has no transaction, so two owners removing each other at the
+ *     same instant can both pass; each still needed `can_assign_roles`.
+ * Both read the organization's owner rows once per request
+ * (`organizationOwners`). They do not govern the grants that follow
+ * configuration rather than a caller (the organization creator's row, the
+ * membership rules, the trusted-local operator), which call the grant path
+ * directly, nor an edition's in-process doors that grant a role on a
+ * person's behalf (an invitation's redemption, an identity provider's
+ * auto-grant), which run as `internal` and hold the same rule at their own
+ * sites.
  */
-import { create } from "@bufbuild/protobuf";
+import { create, type DescMessage } from "@bufbuild/protobuf";
 import { Code, ConnectError } from "@connectrpc/connect";
 
 import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
@@ -63,8 +90,9 @@ import type {
   ApiResourceRefSchema,
   IamPolicySpecSchema,
 } from "@stigmer/protos/ai/stigmer/iam/iampolicy/v1/spec_pb";
-import { IamRole } from "@stigmer/protos/ai/stigmer/iam/v1/enum_pb";
+import { IamPermission, IamRole } from "@stigmer/protos/ai/stigmer/iam/v1/enum_pb";
 
+import type { Authorizer } from "../../extensions/authorizer.js";
 import type { PolicyGrantScope } from "../../extensions/policy-grant-scope.js";
 import {
   grantableRolesFor,
@@ -73,7 +101,10 @@ import {
 } from "../../pipeline/apiresource-meta.js";
 import type { PipelineStep } from "../../pipeline/pipeline.js";
 import type { RequestContext } from "../../pipeline/request-context.js";
+import { authorizeResolvedResource } from "../../pipeline/steps/authorize.js";
 import {
+  LAST_OWNER_MESSAGE,
+  OWNER_ASSIGNMENT_DENIED_MESSAGE,
   PER_RESOURCE_GRANTS_UNIMPLEMENTED_MESSAGE,
   TEAM_MEMBERS_RELATION,
   noGrantableRolesMessage,
@@ -85,6 +116,7 @@ import {
   teamRoleNotGrantableMessage,
 } from "./constants.js";
 import type { IamPolicyGrantPath } from "./grant-path.js";
+import type { IamPolicyStore } from "./store.js";
 import {
   requireKnownPrincipalKind,
   requireKnownResourceKind,
@@ -258,3 +290,131 @@ export function newCleanupResourceStep(
     },
   };
 }
+
+// ---------------------------------------------------------------------------
+// Owner is assigned by owners (the module header's last section)
+// ---------------------------------------------------------------------------
+
+/** The wire names the two owner steps compare against. */
+const ORGANIZATION_KIND_NAME = kindEnumName(ApiResourceKind.organization);
+const IDENTITY_ACCOUNT_KIND_NAME = kindEnumName(ApiResourceKind.identity_account);
+const OWNER_RELATION = IamRole[IamRole.owner];
+
+/** The context key the organization's owner rows are kept under for the rest of the request. */
+const ORGANIZATION_OWNERS_KEY = "organizationOwners";
+
+/** An organization owner role a request would grant or remove, and whose it is. */
+export interface OwnerRoleChange {
+  readonly organizationId: string;
+  readonly accountId: string;
+}
+
+/**
+ * The ids of the people holding `owner` on the organization, read once per
+ * request and shared by both owner steps: the organization's `owner` rows
+ * whose principal is a person, the only principal the model admits there.
+ */
+async function organizationOwners<Desc extends DescMessage>(
+  ctx: RequestContext<Desc>,
+  policies: IamPolicyStore,
+  organizationId: string,
+): Promise<ReadonlySet<string>> {
+  const held = ctx.get(ORGANIZATION_OWNERS_KEY);
+  if (held instanceof Set) {
+    return held as ReadonlySet<string>;
+  }
+  const rows = await policies.findByResourceWithRelations(
+    ORGANIZATION_KIND_NAME,
+    organizationId,
+    [OWNER_RELATION],
+  );
+  const owners = new Set(
+    rows
+      .map((row) => row.spec?.principal)
+      .filter((principal) => principal?.kind === IDENTITY_ACCOUNT_KIND_NAME)
+      .map((principal) => principal?.id ?? ""),
+  );
+  ctx.set(ORGANIZATION_OWNERS_KEY, owners);
+  return owners;
+}
+
+/** `create` and `delete`: the spec names the change; nothing is read. */
+export function specOwnerRoleChange(
+  ctx: RequestContext<typeof IamPolicySpecSchema>,
+): Promise<OwnerRoleChange | undefined> {
+  const { resource, principal, relation } = ctx.input;
+  if (resource?.kind !== ORGANIZATION_KIND_NAME || relation !== OWNER_RELATION) {
+    return Promise.resolve(undefined);
+  }
+  return Promise.resolve({
+    organizationId: resource.id,
+    accountId: principal?.id ?? "",
+  });
+}
+
+/** `revokeOrgAccess`: the removal touches owner exactly when the account holds it. */
+export function orgAccessOwnerRoleChange(
+  policies: IamPolicyStore,
+): (
+  ctx: RequestContext<typeof RevokeOrgAccessInputSchema>,
+) => Promise<OwnerRoleChange | undefined> {
+  return async (ctx) => {
+    const { identityAccountId, organizationId } = ctx.input;
+    const owners = await organizationOwners(ctx, policies, organizationId);
+    return owners.has(identityAccountId)
+      ? { organizationId, accountId: identityAccountId }
+      : undefined;
+  };
+}
+
+/** A change touching an organization's owner role needs `can_assign_roles` there; see the module header. */
+export function newAuthorizeOwnerAssignmentStep<Desc extends DescMessage>(
+  authorizer: Authorizer,
+  ownerRoleChange: (ctx: RequestContext<Desc>) => Promise<OwnerRoleChange | undefined>,
+): PipelineStep<Desc> {
+  return {
+    name: "AuthorizeOwnerAssignment",
+    async execute(ctx: RequestContext<Desc>): Promise<void> {
+      if (ctx.callerIdentity.callerClass === "internal") {
+        return;
+      }
+      const change = await ownerRoleChange(ctx);
+      if (change === undefined) {
+        return;
+      }
+      await authorizeResolvedResource(
+        authorizer,
+        ctx.callerIdentity,
+        {
+          permission: IamPermission.can_assign_roles,
+          resourceKind: ApiResourceKind.organization,
+          resourceId: change.organizationId,
+        },
+        OWNER_ASSIGNMENT_DENIED_MESSAGE,
+      );
+    },
+  };
+}
+
+/** A revoke or removal may not leave the organization with no owner; see the module header. */
+export function newKeepOneOwnerStep<Desc extends DescMessage>(
+  policies: IamPolicyStore,
+  ownerRoleChange: (ctx: RequestContext<Desc>) => Promise<OwnerRoleChange | undefined>,
+): PipelineStep<Desc> {
+  return {
+    name: "KeepOneOwner",
+    async execute(ctx: RequestContext<Desc>): Promise<void> {
+      if (ctx.callerIdentity.callerClass === "internal") {
+        return;
+      }
+      const change = await ownerRoleChange(ctx);
+      if (change === undefined) {
+        return;
+      }
+      const owners = await organizationOwners(ctx, policies, change.organizationId);
+      if (owners.has(change.accountId) && owners.size === 1) {
+        throw new ConnectError(LAST_OWNER_MESSAGE, Code.FailedPrecondition);
+      }
+    },
+  };
+}

package/src/domain/oauthapp/__tests__/oauthapp.test.ts

@@ -11,15 +11,17 @@
  *     ciphertext (no double encryption);
  *   - the keyless WARN-degrade path stores plaintext yet still redacts on
  *     read, and the enc:v<N>: shape rejection stays UNCONDITIONAL (oss#395);
- *   - the delete RPC returns the STORED secret unredacted — Go behavior
- *     ported byte-faithfully (delete is absent from RedactOAuthApp's
- *     response list) and disclosed in the PR;
+ *   - the delete RPC answers the removed app REDACTED, never the stored
+ *     secret: not the ciphertext on a keyed server, not the plaintext on
+ *     a keyless one (stigmer/stigmer#1257; the Go port returned it);
  *   - the referential delete guard's resolution semantics (stigmer#584),
  *     proven by seeding McpServer rows directly through the store — the
  *     McpServer RPC surface belongs to #9 and is not required here.
  *
  * Keys are injected via env (vi.stubEnv) so the ladder short-circuits
- * before its file steps — the real ~/.stigmer is never touched.
+ * before its file steps — the real ~/.stigmer is never touched. Who may
+ * read or list an app is the enforcing lane's conformance suite's
+ * (role-enforcement.conformance.test.ts).
  */
 import { mkdtempSync, rmSync } from "node:fs";
 import { tmpdir } from "node:os";
@@ -50,7 +52,7 @@ import {
   REDACTED_MARKER,
   deleteBlockedByMcpServerMessage,
 } from "../constants.js";
-import { resolveOAuthAppRef } from "../refresolution/refresolution.js";
+import { resolveOAuthAppRef } from "../refresolution.js";
 
 const silentLogger = createLogger({ level: "error", pretty: false, write: () => {} });
 
@@ -285,14 +287,12 @@ describe("oauthapp domain (encryption enabled)", () => {
     expect(listed.entries[1]?.metadata?.id).toBe(first.metadata?.id);
   });
 
-  it("delete returns the STORED resource unredacted — the ported Go behavior (disclosed)", async () => {
+  it("delete answers the removed app redacted — never the stored ciphertext", async () => {
     const created = await ts.command.create(appInput());
     const deleted = await ts.command.delete({ resourceId: created.metadata!.id });
 
-    // Go's delete path never calls RedactOAuthApp: the response carries the
-    // stored ciphertext (plaintext on a keyless server). Pinned so the
-    // faithful port cannot silently "fix" the divergence candidate.
-    expect(deleted.spec?.clientSecret.startsWith(ENCRYPTED_PREFIX)).toBe(true);
+    expect(deleted.metadata?.id).toBe(created.metadata?.id);
+    expect(deleted.spec?.clientSecret).toBe(REDACTED_MARKER);
 
     const err = await grpcError(() => ts.query.get({ value: created.metadata!.id }));
     expect(err.code).toBe(Code.NotFound);
@@ -405,6 +405,13 @@ describe("oauthapp domain (encryption disabled)", () => {
     expect(stored.spec?.clientSecret).toBe("test-client-secret");
   });
 
+  it("delete answers the removed app redacted — never the stored plaintext", async () => {
+    const created = await ts.command.create(appInput());
+    const deleted = await ts.command.delete({ resourceId: created.metadata!.id });
+
+    expect(deleted.spec?.clientSecret).toBe(REDACTED_MARKER);
+  });
+
   it("still rejects ciphertext-shaped secrets — the oss#395 boundary is not gated on key state", async () => {
     const err = await grpcError(() =>
       ts.command.create(appInput({ clientSecret: "enc:v1:c211Z2dsZWQ=" })),