@stigmer/server 3.31.0 → 3.32.0

package/src/domain/platformclient/verifier.ts

@@ -26,8 +26,12 @@
  * The identity is the account the token was minted for: `sub` IS the
  * account id (the mint signs it), so no account read is needed; class
  * `user`, issuer "stigmer", the token carried (the memory-capture gate and
- * the origin guard read its `platform_client_id`), and the email and name
- * the platform asserted, for display only.
+ * the origin guard read its `platform_client_id`, guards decoding their
+ * own skip logic from the raw token as extensions/caller-guards.ts
+ * prescribes), the email and name the platform asserted, for display
+ * only, and the minting client as `platformClientId` for the audit-actor
+ * seam, so every resource a minted user writes names the client they came
+ * through (stigmer/stigmer#1256).
  */
 import { Code, ConnectError } from "@connectrpc/connect";
 
@@ -100,6 +104,7 @@ export function newPlatformClientTokenVerifier(
         rawToken: token,
         ...(email !== undefined ? { email } : {}),
         ...(displayName !== undefined ? { displayName } : {}),
+        platformClientId,
       };
     },
   };

package/src/extensions/__tests__/role-reconciliation-composed.test.ts

@@ -17,10 +17,13 @@
  *      `owner`, the member `member` — each written AS the account it names
  *      (the audit actor), `findMyOrganizations` answers the organization
  *      to both, and the marker is set.
- *   3. The founder revokes everyone, the member first and then themself,
- *      and the directory boots once more: NO row returns. The marker, not
- *      "zero rows", is what makes the reconciliation one-shot — a revoked
- *      founder is not handed the organization back by a reboot.
+ *   3. The founder removes the member, and is refused removing themself
+ *      (an organization keeps its last owner on the member lanes); the
+ *      founder's row then goes from the store, the way boot 2 made its
+ *      shape, and the directory boots once more: NO row returns. The
+ *      marker, not "zero rows", is what makes the reconciliation one-shot
+ *      — a founder whose row is gone is not handed the organization back
+ *      by a reboot.
  *
  * The unit vouches for unsigned JWT-shaped tokens and declares the
  * require-authentication posture with no Authorizer (composed-support.ts;
@@ -35,7 +38,7 @@ import { tmpdir } from "node:os";
 import path from "node:path";
 
 import { fromBinary } from "@bufbuild/protobuf";
-import { createClient } from "@connectrpc/connect";
+import { Code, ConnectError, createClient } from "@connectrpc/connect";
 import { afterAll, beforeAll, describe, expect, it } from "vitest";
 
 import { AgentCommandController } from "@stigmer/protos/ai/stigmer/agentic/agent/v1/command_pb";
@@ -184,16 +187,21 @@ describe("role reconciliation (composed server, OIDC with no unit Authorizer, th
     ]);
   });
 
-  it("boot 3: every role revoked after the marker stays revoked — a reboot hands nothing back", async () => {
+  it("boot 3: every role removed after the marker stays removed — a reboot hands nothing back", async () => {
     const policies = createClient(IamPolicyCommandController, asFounder());
     await policies.revokeOrgAccess({
       identityAccountId: memberId,
       organizationId: ORG,
     });
-    await policies.revokeOrgAccess({
-      identityAccountId: founderId,
-      organizationId: ORG,
-    });
+    const lastOwner = await policies
+      .revokeOrgAccess({ identityAccountId: founderId, organizationId: ORG })
+      .then(
+        () => undefined,
+        (error: unknown) => ConnectError.from(error),
+      );
+    expect(lastOwner?.code).toBe(Code.FailedPrecondition);
+    // The founder's row, the one left, goes the way boot 2 made its shape.
+    await server.store.deleteResourcesByKind(ApiResourceKind.iam_policy);
     expect(await rolesIn(server.store)).toEqual([]);
     await server.shutdown();
 

package/src/extensions/identity.ts

@@ -74,6 +74,20 @@ export interface CallerIdentity {
    */
   readonly email?: string;
   readonly displayName?: string;
+  /**
+   * The PlatformClient whose minted user token this caller presented,
+   * carried for the audit-actor seam as `email` and `displayName` are:
+   * the audit actor records it (ApiResourceAuditActor.platform_client_id),
+   * and that server-owned record is what later readers key on, never this
+   * field (stigmer/stigmer#1256). Set ONLY by the PlatformClient
+   * user-token verifier (domain/platformclient/verifier.ts), from the
+   * claim it has just verified and whose client it has just found alive;
+   * absent on every other credential. It is provenance, not authorization
+   * data (the account the token names is still the principal), and not a
+   * guard vocabulary: caller guards decode their own skip logic from
+   * `rawToken` (extensions/caller-guards.ts).
+   */
+  readonly platformClientId?: string;
   /**
    * The transport the request entered through (C2 Stage 3, ruling R5).
    * Absent = the wire; the in-process interceptor stamps `in-process` on

package/src/index.ts

@@ -168,6 +168,11 @@ export type {
   IamPolicyStoreContractFixture,
 } from "./domain/iampolicy/store-contract.js";
 export { iamPolicyStoreContract } from "./domain/iampolicy/store-contract.js";
+// The owner rule's refusal, the one sentence every door that grants the
+// owner role answers when its caller is no owner: the IamPolicy lanes here,
+// and an edition's own lanes that grant a role on a person's behalf (an
+// owner invitation).
+export { OWNER_ASSIGNMENT_DENIED_MESSAGE } from "./domain/iampolicy/constants.js";
 export type { PolicyGrantScope } from "./extensions/policy-grant-scope.js";
 export type { AuthorizationQueryEngine } from "./extensions/authorization-queries.js";
 // How an access list names a grantee that is not a person

package/src/pipeline/__tests__/steps.test.ts

@@ -5,7 +5,10 @@
  * state building (status clearing, ULID minting, audit slots #540,
  * visibility default + oss#573 immutability), the loaders' error copy, the
  * best-effort search indexing, visibility validation with cloud-identical
- * copy, reference normalization/validation, and operator identity (#400).
+ * copy, reference normalization/validation, operator identity (#400), and
+ * the PlatformClient provenance the audit actor records for a minted
+ * caller (#1256): stamped from the verified identity only, never from the
+ * request, and kept through an update by anyone else.
  *
  * Uses the organization resource (the vertical slice) and agent (whose
  * spec carries ApiResourceReference fields) as vehicles.
@@ -248,6 +251,74 @@ describe("operator identity (#400) → audit-actor derivation (O2 ruling Q5)", (
   });
 });
 
+describe("PlatformClient provenance on the audit actor (#1256)", () => {
+  const minted = testCallerIdentity({
+    identityId: "ida_pat",
+    issuer: "stigmer",
+    platformClientId: "pcl_dashboard",
+  });
+
+  it("a minted caller's actor names the client; every other identity stamps it empty", () => {
+    expect(auditActorFor(minted).platformClientId).toBe("pcl_dashboard");
+    expect(auditActorFor(minted).id).toBe("ida_pat");
+    expect(auditActorFor(trustedLocalIdentity()).platformClientId).toBe("");
+    expect(auditActorFor(testCallerIdentity()).platformClientId).toBe("");
+  });
+
+  it("BuildNewState stamps the caller's client and discards a client the request claimed", async () => {
+    const forged = create(OrganizationSchema, {
+      apiVersion: "tenancy.stigmer.ai/v1",
+      kind: "Organization",
+      metadata: { name: "Acme" },
+      spec: { description: "a test organization" },
+      status: {
+        audit: {
+          specAudit: {
+            createdBy: { id: "ida_pat", platformClientId: "pcl_forged" },
+          },
+        },
+      },
+    });
+    const byMinted = new RequestContext(
+      OrganizationSchema,
+      clone(OrganizationSchema, forged),
+      minted,
+      ORG,
+    );
+    await newBuildNewStateStep<typeof OrganizationSchema>().execute(byMinted);
+    expect(
+      byMinted.newState.status?.audit?.specAudit?.createdBy?.platformClientId,
+    ).toBe("pcl_dashboard");
+
+    const byOther = orgCtx(clone(OrganizationSchema, forged));
+    await newBuildNewStateStep<typeof OrganizationSchema>().execute(byOther);
+    expect(
+      byOther.newState.status?.audit?.specAudit?.createdBy?.platformClientId,
+    ).toBe("");
+  });
+
+  it("an update by another caller keeps the creator's client and stamps its own actor", async () => {
+    const createCtx = new RequestContext(
+      OrganizationSchema,
+      org({ name: "Acme" }),
+      minted,
+      ORG,
+    );
+    await newResolveSlugStep<typeof OrganizationSchema>().execute(createCtx);
+    await newBuildNewStateStep<typeof OrganizationSchema>().execute(createCtx);
+    const existing = createCtx.newState;
+
+    const ctx = orgCtx(org({ id: existing.metadata!.id, name: "Acme Renamed" }));
+    ctx.set(EXISTING_RESOURCE_KEY, clone(OrganizationSchema, existing));
+    await newBuildUpdateStateStep<typeof OrganizationSchema>().execute(ctx);
+
+    const audit = ctx.newState.status?.audit?.specAudit;
+    expect(audit?.createdBy?.platformClientId).toBe("pcl_dashboard");
+    expect(audit?.updatedBy?.id).toBe("test-caller");
+    expect(audit?.updatedBy?.platformClientId).toBe("");
+  });
+});
+
 describe("BuildUpdateState", () => {
   it("preserves id/slug/org/visibility (oss#573), replaces spec, keeps creation audit", async () => {
     // The stored resource, created through the real create steps.

package/src/pipeline/steps/defaults.ts

@@ -237,13 +237,18 @@ export function operatorIdentitySnapshot(): {
  * unconfigured → the "system" placeholder, which the runner deliberately
  * demotes to anonymous (SYSTEM_CREATOR_SENTINEL). Verifier-produced
  * identities (O3's OIDC claims onward) stamp their own email/displayName
- * when present, identityId alone otherwise.
+ * when present, identityId alone otherwise. A PlatformClient-minted
+ * caller also stamps the client it came through (platform_client_id):
+ * the account alone cannot say, and the execution-context builder keys
+ * the PlatformClient environment layer on this record (#1256). Every
+ * other identity stamps it empty, so local-posture bytes are unchanged.
  */
 export function auditActorFor(identity: CallerIdentity): ApiResourceAuditActor {
   return create(ApiResourceAuditActorSchema, {
     id: identity.identityId,
     email: identity.email ?? "",
     displayName: identity.displayName ?? "",
+    platformClientId: identity.platformClientId ?? "",
   });
 }