@stigmer/server 3.35.0 → 3.36.0

package/dist/authorization/model/data/authorization-model.json

@@ -465,13 +465,7 @@
                             }
                         ]
                     },
-                    "owner": {
-                        "directly_related_user_types": [
-                            {
-                                "type": "identity_account"
-                            }
-                        ]
-                    },
+                    "owner": {},
                     "viewer": {
                         "directly_related_user_types": [
                             {
@@ -514,7 +508,14 @@
                     "this": {}
                 },
                 "owner": {
-                    "this": {}
+                    "tupleToUserset": {
+                        "computedUserset": {
+                            "relation": "admin"
+                        },
+                        "tupleset": {
+                            "relation": "organization"
+                        }
+                    }
                 },
                 "viewer": {
                     "union": {
@@ -526,16 +527,6 @@
                                 "computedUserset": {
                                     "relation": "owner"
                                 }
-                            },
-                            {
-                                "tupleToUserset": {
-                                    "computedUserset": {
-                                        "relation": "admin"
-                                    },
-                                    "tupleset": {
-                                        "relation": "organization"
-                                    }
-                                }
                             }
                         ]
                     }
@@ -559,13 +550,7 @@
                             }
                         ]
                     },
-                    "owner": {
-                        "directly_related_user_types": [
-                            {
-                                "type": "identity_account"
-                            }
-                        ]
-                    },
+                    "owner": {},
                     "viewer": {
                         "directly_related_user_types": [
                             {
@@ -608,7 +593,14 @@
                     "this": {}
                 },
                 "owner": {
-                    "this": {}
+                    "tupleToUserset": {
+                        "computedUserset": {
+                            "relation": "admin"
+                        },
+                        "tupleset": {
+                            "relation": "organization"
+                        }
+                    }
                 },
                 "viewer": {
                     "union": {
@@ -620,16 +612,6 @@
                                 "computedUserset": {
                                     "relation": "owner"
                                 }
-                            },
-                            {
-                                "tupleToUserset": {
-                                    "computedUserset": {
-                                        "relation": "admin"
-                                    },
-                                    "tupleset": {
-                                        "relation": "organization"
-                                    }
-                                }
                             }
                         ]
                     }

package/dist/domain/oauthapp/controller.d.ts

@@ -22,9 +22,9 @@
  * loads, then authorizes the loaded app exactly as `get` would
  * (AuthorizeResolvedTarget); listByOrg narrows through the list read
  * scope, so a caller who may not `get` an app does not see it listed
- * either: the model shows an app to its creator and the organization's
- * admins, never to members or viewers (fga/model/iam/oauth_app.fga,
- * stigmer/stigmer#1257). OAuthApp is deliberately not search-indexed (a
+ * either: the model shows an app to the organization's admins, who manage
+ * it whoever created it, and never to members or viewers
+ * (fga/model/iam/oauth_app.fga, stigmer/stigmer#1257, #1329). OAuthApp is deliberately not search-indexed (a
  * configuration resource; `not_search_indexed` in the kind registry).
  */
 import type { ConnectRouter } from "@connectrpc/connect";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@stigmer/server",
-  "version": "3.35.0",
+  "version": "3.36.0",
   "description": "The Stigmer OSS control plane as a composable library: composeServer, the extension registry and the driver seams a composition builds on. The self-contained deployable of the same server is @stigmer/server-slim.",
   "license": "Apache-2.0",
   "type": "module",
@@ -63,11 +63,11 @@
     "@connectrpc/connect-node": "^2.0.0",
     "@kubernetes/client-node": "2.0.0",
     "@opentelemetry/api": "^1.9.0",
-    "@stigmer/outbound": "3.35.0",
-    "@stigmer/plugin-package": "3.35.0",
-    "@stigmer/protos": "3.35.0",
-    "@stigmer/temporal-codecs": "3.35.0",
-    "@stigmer/zip-structure": "3.35.0",
+    "@stigmer/outbound": "3.36.0",
+    "@stigmer/plugin-package": "3.36.0",
+    "@stigmer/protos": "3.36.0",
+    "@stigmer/temporal-codecs": "3.36.0",
+    "@stigmer/zip-structure": "3.36.0",
     "@temporalio/activity": "1.16.2",
     "@temporalio/client": "1.16.2",
     "@temporalio/common": "1.16.2",

package/src/authorization/__tests__/authorizer.test.ts

@@ -365,10 +365,11 @@ describe.each(driverFixtures(SEEDED_KINDS))(
           });
         });
 
-        it("an OAuth app is read by its creator and the organization's admins, and changed by its creator alone — the one org-scoped kind whose owner has no admin arm", async () => {
-          // No pinned store document covers oauth_app (the security read's
-          // fact 11), so its distinctive line is pinned here: `viewer` has
-          // `admin from organization`, `can_edit` and `can_delete` do not.
+        it("an OAuth app is managed by its organization's current admins alone — a creator stamped on the row, now a plain member, holds nothing", async () => {
+          // The creator stamp derives no owner (kind_meta `owner_type` NONE),
+          // so the row a member created answers them as it answers any
+          // member; `owner` is `admin from organization` and nothing else
+          // (fga/tests/oauth-app-administration.fga.yaml pins the model).
           await seed("oauth_app", "oap_vendor", {
             org: "acme",
             visibility:
@@ -393,28 +394,17 @@ describe.each(driverFixtures(SEEDED_KINDS))(
           const auth = authorizer();
           for (const c of [view, edit, remove]) {
             expect(await auth.authorize(resolved(MEMBER), c)).toEqual({
+              kind: "deny",
+              reason: "",
+            });
+            expect(await auth.authorize(resolved(ADMIN), c)).toEqual({
+              kind: "allow",
+            });
+            // The organization's OWNER is an admin by the ladder.
+            expect(await auth.authorize(resolved(FOUNDER), c)).toEqual({
               kind: "allow",
             });
           }
-          expect(await auth.authorize(resolved(ADMIN), view)).toEqual({
-            kind: "allow",
-          });
-          expect(await auth.authorize(resolved(ADMIN), edit)).toEqual({
-            kind: "deny",
-            reason: "",
-          });
-          expect(await auth.authorize(resolved(ADMIN), remove)).toEqual({
-            kind: "deny",
-            reason: "",
-          });
-          // The organization's OWNER is an admin by the ladder: reads, does not change.
-          expect(await auth.authorize(resolved(FOUNDER), view)).toEqual({
-            kind: "allow",
-          });
-          expect(await auth.authorize(resolved(FOUNDER), edit)).toEqual({
-            kind: "deny",
-            reason: "",
-          });
           expect(await auth.authorize(resolved(OUTSIDER), view)).toEqual({
             kind: "deny",
             reason: "",

package/src/authorization/__tests__/store-tests.test.ts

@@ -62,10 +62,12 @@ const DOCUMENTS = [
   "license-issuer.fga.yaml",
   "mcp-server-authoring.fga.yaml",
   "memory-subject-only.fga.yaml",
+  "oauth-app-administration.fga.yaml",
   "org-admin-owner-inheritance.fga.yaml",
   "org-shared-environment.fga.yaml",
   "organization-role-assignment.fga.yaml",
   "plan-catalog-manager.fga.yaml",
+  "platform-client-administration.fga.yaml",
   "platform-visibility.fga.yaml",
   "plugin-owner.fga.yaml",
   "provider-standing-viewer.fga.yaml",

package/src/authorization/model/data/authorization-model.json

@@ -465,13 +465,7 @@
               }
             ]
           },
-          "owner": {
-            "directly_related_user_types": [
-              {
-                "type": "identity_account"
-              }
-            ]
-          },
+          "owner": {},
           "viewer": {
             "directly_related_user_types": [
               {
@@ -514,7 +508,14 @@
           "this": {}
         },
         "owner": {
-          "this": {}
+          "tupleToUserset": {
+            "computedUserset": {
+              "relation": "admin"
+            },
+            "tupleset": {
+              "relation": "organization"
+            }
+          }
         },
         "viewer": {
           "union": {
@@ -526,16 +527,6 @@
                 "computedUserset": {
                   "relation": "owner"
                 }
-              },
-              {
-                "tupleToUserset": {
-                  "computedUserset": {
-                    "relation": "admin"
-                  },
-                  "tupleset": {
-                    "relation": "organization"
-                  }
-                }
               }
             ]
           }
@@ -559,13 +550,7 @@
               }
             ]
           },
-          "owner": {
-            "directly_related_user_types": [
-              {
-                "type": "identity_account"
-              }
-            ]
-          },
+          "owner": {},
           "viewer": {
             "directly_related_user_types": [
               {
@@ -608,7 +593,14 @@
           "this": {}
         },
         "owner": {
-          "this": {}
+          "tupleToUserset": {
+            "computedUserset": {
+              "relation": "admin"
+            },
+            "tupleset": {
+              "relation": "organization"
+            }
+          }
         },
         "viewer": {
           "union": {
@@ -620,16 +612,6 @@
                 "computedUserset": {
                   "relation": "owner"
                 }
-              },
-              {
-                "tupleToUserset": {
-                  "computedUserset": {
-                    "relation": "admin"
-                  },
-                  "tupleset": {
-                    "relation": "organization"
-                  }
-                }
               }
             ]
           }

package/src/domain/oauthapp/controller.ts

@@ -22,9 +22,9 @@
  * loads, then authorizes the loaded app exactly as `get` would
  * (AuthorizeResolvedTarget); listByOrg narrows through the list read
  * scope, so a caller who may not `get` an app does not see it listed
- * either: the model shows an app to its creator and the organization's
- * admins, never to members or viewers (fga/model/iam/oauth_app.fga,
- * stigmer/stigmer#1257). OAuthApp is deliberately not search-indexed (a
+ * either: the model shows an app to the organization's admins, who manage
+ * it whoever created it, and never to members or viewers
+ * (fga/model/iam/oauth_app.fga, stigmer/stigmer#1257, #1329). OAuthApp is deliberately not search-indexed (a
  * configuration resource; `not_search_indexed` in the kind registry).
  */
 import type { ConnectRouter, HandlerContext } from "@connectrpc/connect";