@stigmer/server 3.35.0 → 3.37.0

package/src/authorization/model/data/authorization-model.json

@@ -465,13 +465,7 @@
               }
             ]
           },
-          "owner": {
-            "directly_related_user_types": [
-              {
-                "type": "identity_account"
-              }
-            ]
-          },
+          "owner": {},
           "viewer": {
             "directly_related_user_types": [
               {
@@ -514,7 +508,14 @@
           "this": {}
         },
         "owner": {
-          "this": {}
+          "tupleToUserset": {
+            "computedUserset": {
+              "relation": "admin"
+            },
+            "tupleset": {
+              "relation": "organization"
+            }
+          }
         },
         "viewer": {
           "union": {
@@ -526,16 +527,6 @@
                 "computedUserset": {
                   "relation": "owner"
                 }
-              },
-              {
-                "tupleToUserset": {
-                  "computedUserset": {
-                    "relation": "admin"
-                  },
-                  "tupleset": {
-                    "relation": "organization"
-                  }
-                }
               }
             ]
           }
@@ -559,13 +550,7 @@
               }
             ]
           },
-          "owner": {
-            "directly_related_user_types": [
-              {
-                "type": "identity_account"
-              }
-            ]
-          },
+          "owner": {},
           "viewer": {
             "directly_related_user_types": [
               {
@@ -608,7 +593,14 @@
           "this": {}
         },
         "owner": {
-          "this": {}
+          "tupleToUserset": {
+            "computedUserset": {
+              "relation": "admin"
+            },
+            "tupleset": {
+              "relation": "organization"
+            }
+          }
         },
         "viewer": {
           "union": {
@@ -620,16 +612,6 @@
                 "computedUserset": {
                   "relation": "owner"
                 }
-              },
-              {
-                "tupleToUserset": {
-                  "computedUserset": {
-                    "relation": "admin"
-                  },
-                  "tupleset": {
-                    "relation": "organization"
-                  }
-                }
               }
             ]
           }

package/src/domain/agentexecution/__tests__/agentexecution.test.ts

@@ -66,7 +66,6 @@ import { loadConfig } from "../../../boot/config.js";
 import { composeServer } from "../../../boot/compose.js";
 import type { ComposedServer } from "../../../boot/compose.js";
 import { createLogger } from "../../../boot/logger.js";
-import { executionUsageReportNotFoundMessage } from "../constants.js";
 import type { AgentExecutionStatusTransition } from "../../../extensions/status-hooks.js";
 import type {
   ConnectedExecutionEngine,
@@ -485,7 +484,7 @@ describe("update / delete over the wire", () => {
 });
 
 describe("usage reports over the wire", () => {
-  it("getExecutionUsageReport pins the mangled NotFound copy byte-for-byte (DD-001)", async () => {
+  it("getExecutionUsageReport answers the domain's NotFound copy for an unknown execution (#859)", async () => {
     await expectCode(
       () => query.getExecutionUsageReport({ executionId: "" }),
       Code.InvalidArgument,
@@ -495,12 +494,7 @@ describe("usage reports over the wire", () => {
       () => query.getExecutionUsageReport({ executionId: "aexec_missing" }),
       Code.NotFound,
     );
-    expect(err.rawMessage).toBe(
-      executionUsageReportNotFoundMessage("aexec_missing"),
-    );
-    expect(err.rawMessage).toBe(
-      "agent execution '%s' not found not found: aexec_missing",
-    );
+    expect(err.rawMessage).toBe("agent_execution not found: aexec_missing");
   });
 
   it("getExecutionUsageReport answers the zero aggregate for a seeded execution", async () => {

package/src/domain/agentexecution/__tests__/execution-usage-report.test.ts

@@ -0,0 +1,78 @@
+/**
+ * Pins getExecutionUsageReport's store-fault mapping in LoadExecution — the
+ * composed suite (agentexecution.test.ts) reaches only the real store, which
+ * cannot fail selectively:
+ *
+ *   - a typed ResourceNotFoundError answers the domain's NotFound copy,
+ *     `agent_execution not found: <id>` (stigmer/stigmer#859);
+ *   - any other store failure is an infrastructure fault: a sanitized
+ *     Internal whose wire text never carries the cause, never a NotFound
+ *     that would tell a client the execution does not exist.
+ */
+import { create } from "@bufbuild/protobuf";
+import { Code, ConnectError } from "@connectrpc/connect";
+import { describe, expect, it } from "vitest";
+
+import { AgentExecutionQueryController } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/query_pb";
+
+import { createLogger } from "../../../boot/logger.js";
+import type { Authorizer } from "../../../extensions/authorizer.js";
+import { testCallerIdentity } from "../../../pipeline/__tests__/support.js";
+import { ResourceNotFoundError } from "../../../store/interface.js";
+import type { Store } from "../../../store/interface.js";
+
+import { getExecutionUsageReport } from "../usage.js";
+
+const silentLogger = createLogger({
+  level: "error",
+  pretty: false,
+  write: () => {},
+});
+
+const allowingAuthorizer: Authorizer = {
+  authorize: () => Promise.resolve({ kind: "allow" }),
+};
+
+/** A store whose one read the chain makes fails with the given error. */
+function failingStore(error: Error): Store {
+  return {
+    getResource: () => Promise.reject(error),
+  } as unknown as Store;
+}
+
+async function reportError(store: Store): Promise<ConnectError> {
+  const error = await getExecutionUsageReport(
+    {
+      store,
+      logger: silentLogger,
+      authorizer: allowingAuthorizer,
+      listReadScope: undefined,
+    },
+    create(AgentExecutionQueryController.method.getExecutionUsageReport.input, {
+      executionId: "aex_missing",
+    }),
+    testCallerIdentity(),
+  ).catch((e: unknown) => e);
+  expect(error).toBeInstanceOf(ConnectError);
+  return error as ConnectError;
+}
+
+describe("getExecutionUsageReport — LoadExecution store faults", () => {
+  it("a missing execution answers NotFound with the domain's copy", async () => {
+    const error = await reportError(
+      failingStore(new ResourceNotFoundError("agent_execution/aex_missing")),
+    );
+
+    expect(error.code).toBe(Code.NotFound);
+    expect(error.rawMessage).toBe("agent_execution not found: aex_missing");
+  });
+
+  it("any other store failure answers a sanitized Internal, never NotFound", async () => {
+    const error = await reportError(
+      failingStore(new Error("SQLITE_BUSY: database is locked")),
+    );
+
+    expect(error.code).toBe(Code.Internal);
+    expect(error.rawMessage).toBe("failed to load agent execution");
+  });
+});

package/src/domain/agentexecution/constants.ts

@@ -14,21 +14,6 @@
 export const ENGINE_UNAVAILABLE_MESSAGE =
   "The execution engine is temporarily unavailable. Please try again shortly.";
 
-/**
- * getExecutionUsageReport's unknown-execution refusal. Go
- * (get_execution_usage_report.go) calls
- * NotFoundError("agent execution '%s' not found", executionID) — but that
- * helper's signature is (resource, id) rendering "%s not found: %s", so
- * the literal '%s' and the doubled "not found" reach the wire. Ported
- * byte-faithfully per sub-project DD-001 (owner-ratified 2026-08-24);
- * the both-editions fix is stigmer/stigmer#859.
- */
-export function executionUsageReportNotFoundMessage(
-  executionId: string,
-): string {
-  return `agent execution '%s' not found not found: ${executionId}`;
-}
-
 /**
  * The run gate's deny copy per request shape (P1 sp.run-gate, ruling
  * Q-RG-4; wire once merged, asserted by the conformance run-gate suite).

package/src/domain/agentexecution/usage.ts

@@ -13,8 +13,6 @@
  * the ONE report that 404s (it verifies the execution exists).
  *
  * Faithful-port notes:
- *   - The unknown-execution message is Go's mangled helper output,
- *     byte-for-byte (constants.ts, sub-project DD-001).
  *   - Org matching is case-insensitive (Go strings.EqualFold); slug-shaped
  *     orgs make the exotic Unicode fold edges unreachable, so toLowerCase
  *     comparison sits inside Go's envelope.
@@ -26,7 +24,6 @@
 import { create, fromBinary } from "@bufbuild/protobuf";
 import type { Duration } from "@bufbuild/protobuf/wkt";
 import { DurationSchema } from "@bufbuild/protobuf/wkt";
-import { Code, ConnectError } from "@connectrpc/connect";
 
 import type { Agent } from "@stigmer/protos/ai/stigmer/agentic/agent/v1/api_pb";
 import { AgentSchema } from "@stigmer/protos/ai/stigmer/agentic/agent/v1/api_pb";
@@ -68,17 +65,21 @@ import type { Logger } from "../../boot/logger.js";
 import type { Authorizer } from "../../extensions/authorizer.js";
 import type { ListReadScope } from "../../extensions/list-read-scope.js";
 import { restrictListByReadScope } from "../../extensions/list-read-scope.js";
-import { internalError, invalidArgumentError } from "../../pipeline/errors.js";
+import {
+  internalError,
+  invalidArgumentError,
+  notFoundError,
+} from "../../pipeline/errors.js";
 import type { PipelineStep } from "../../pipeline/pipeline.js";
 import { newPipeline } from "../../pipeline/pipeline.js";
 import type { CallerIdentity } from "../../extensions/identity.js";
 import { RequestContext } from "../../pipeline/request-context.js";
 import { newAuthorizeStep } from "../../pipeline/steps/authorize.js";
+import { ResourceNotFoundError } from "../../store/interface.js";
 import type { Store } from "../../store/interface.js";
 import { listIndexInstantOfMillis } from "../../store/list-index.js";
 import type { ListIndexRow } from "../../store/list-index.js";
 
-import { executionUsageReportNotFoundMessage } from "./constants.js";
 import { agentExecutionListIndex } from "./list-index.js";
 import { EXECUTION_LIST_KEY, loadAllAgentExecutions } from "./steps.js";
 
@@ -457,9 +458,11 @@ export async function getExecutionUsageReport(
 }
 
 /**
- * LoadExecution — verifies existence; any load failure answers the
- * (mangled, DD-001) NotFound exactly as Go's step converts every
- * GetResource error.
+ * LoadExecution — verifies existence. A missing execution answers the
+ * domain's agent_execution NotFound (stigmer/stigmer#859); any other store
+ * failure is an infrastructure fault answered as a sanitized Internal, as
+ * the approval loads do (submit-approval.ts), never a NotFound that tells
+ * the client the execution does not exist.
  */
 function newLoadExecutionStep(store: Store): PipelineStep<ExecutionReportDesc> {
   return {
@@ -473,11 +476,11 @@ function newLoadExecutionStep(store: Store): PipelineStep<ExecutionReportDesc> {
           executionId,
           AgentExecutionSchema,
         );
-      } catch {
-        throw new ConnectError(
-          executionUsageReportNotFoundMessage(executionId),
-          Code.NotFound,
-        );
+      } catch (error) {
+        if (error instanceof ResourceNotFoundError) {
+          throw notFoundError("agent_execution", executionId);
+        }
+        throw internalError(error, "failed to load agent execution");
       }
       ctx.set(EXECUTION_KEY, execution);
     },

package/src/domain/oauthapp/controller.ts

@@ -22,9 +22,9 @@
  * loads, then authorizes the loaded app exactly as `get` would
  * (AuthorizeResolvedTarget); listByOrg narrows through the list read
  * scope, so a caller who may not `get` an app does not see it listed
- * either: the model shows an app to its creator and the organization's
- * admins, never to members or viewers (fga/model/iam/oauth_app.fga,
- * stigmer/stigmer#1257). OAuthApp is deliberately not search-indexed (a
+ * either: the model shows an app to the organization's admins, who manage
+ * it whoever created it, and never to members or viewers
+ * (fga/model/iam/oauth_app.fga, stigmer/stigmer#1257, #1329). OAuthApp is deliberately not search-indexed (a
  * configuration resource; `not_search_indexed` in the kind registry).
  */
 import type { ConnectRouter, HandlerContext } from "@connectrpc/connect";

package/src/domain/organization/controller.ts

@@ -9,7 +9,10 @@
  * __tests__/organization.test.ts.
  *
  * getByExternalOrgId is implemented ONLY when the composed
- * OrganizationDirectory provides the lookup (C2, ruling Q7) — with no
+ * OrganizationDirectory provides the lookup (C2, ruling Q7). It answers
+ * only a caller who may view the identity provider the request names,
+ * and resolves the external id within that provider alone (see the
+ * handler); with no
  * directory the method stays absent from the partial service
  * implementation and ConnectRPC answers Unimplemented (the SDK
  * capability-probes this and must see UNIMPLEMENTED, not NotFound;
@@ -32,6 +35,7 @@ import type { FindApiResourcesRequest } from "@stigmer/protos/ai/stigmer/commons
 import { OrganizationCommandController } from "@stigmer/protos/ai/stigmer/tenancy/organization/v1/command_pb";
 import { OrganizationQueryController } from "@stigmer/protos/ai/stigmer/tenancy/organization/v1/query_pb";
 import { OrganizationSchema } from "@stigmer/protos/ai/stigmer/tenancy/organization/v1/api_pb";
+import { IamPermission } from "@stigmer/protos/ai/stigmer/iam/v1/enum_pb";
 import type { Organization } from "@stigmer/protos/ai/stigmer/tenancy/organization/v1/api_pb";
 import {
   OrganizationListSchema,
@@ -61,7 +65,10 @@ import { newPipeline } from "../../pipeline/pipeline.js";
 import type { PipelineStep } from "../../pipeline/pipeline.js";
 import { callerIdentityOf } from "../../pipeline/interceptors/auth.js";
 import { RequestContext } from "../../pipeline/request-context.js";
-import { newAuthorizeStep } from "../../pipeline/steps/authorize.js";
+import {
+  authorizeResolvedResource,
+  newAuthorizeStep,
+} from "../../pipeline/steps/authorize.js";
 import { newGuardReservedLabelsStep } from "../../pipeline/steps/guard-reserved-labels.js";
 import { newBuildNewStateStep } from "../../pipeline/steps/defaults.js";
 import { newBuildUpdateStateStep } from "../../pipeline/steps/build-update-state.js";
@@ -129,7 +136,7 @@ export function registerOrganizationServices(
   // partial implementation and ConnectRPC answers Unimplemented (the
   // capability-probed pin; see the module header).
   const externalLookup =
-    deps.organizationDirectory?.getOrganizationIdByExternalOrgId?.bind(
+    deps.organizationDirectory?.lookupExternalOrganization?.bind(
       deps.organizationDirectory,
     );
   router.service(OrganizationQueryController, {
@@ -548,15 +555,22 @@ async function findMyOrganizations(
 
 /**
  * GetByExternalOrgId — registered only with a directory lookup composed
- * (ruling Q7). The chain stays controller-owned: Authorize → validate →
- * directory resolves the external id → LoadTarget-shaped store read.
- * Both miss arms (no mapping, mapped row gone) answer the same NotFound
- * — an external caller cannot distinguish a stale mapping from a
- * missing org.
+ * (ruling Q7). The chain stays controller-owned: Authorize (a no-op for
+ * this skip-annotated method) → validate → the directory resolves the
+ * named identity provider and the external id within it → `can_view` on
+ * that provider → LoadTarget-shaped store read.
+ *
+ * The contract's check is the provider's, so it runs here, on the id the
+ * directory resolved mid-chain (`authorizeResolvedResource`, the pattern
+ * for skip lanes the annotation cannot express), and before the answer
+ * says whether a mapping exists: a caller who may not view the provider
+ * learns nothing about its tenants. Every miss arm (no such provider, no
+ * mapping, mapped row gone) answers the same NotFound, so an external
+ * caller cannot tell a stale mapping from a missing org.
  */
 async function getByExternalOrgId(
   deps: OrganizationControllerDeps,
-  lookup: (externalOrgId: string) => Promise<string | undefined>,
+  lookup: NonNullable<OrganizationDirectory["lookupExternalOrganization"]>,
   input: OrganizationExternalLookup,
   ctx: HandlerContext,
 ): Promise<Organization> {
@@ -582,7 +596,27 @@ async function getByExternalOrgId(
   if (input.externalOrgId === "") {
     throw invalidArgumentError("external_org_id is required");
   }
-  const orgId = await lookup(input.externalOrgId);
+  const found = await lookup(
+    {
+      org: input.identityProviderRef?.org ?? "",
+      slug: input.identityProviderRef?.slug ?? "",
+    },
+    input.externalOrgId,
+  );
+  if (found.kind === "no-identity-provider") {
+    throw notFoundError("Organization", input.externalOrgId);
+  }
+  await authorizeResolvedResource(
+    deps.authorizer,
+    reqCtx.callerIdentity,
+    {
+      permission: IamPermission.can_view,
+      resourceKind: ApiResourceKind.identity_provider,
+      resourceId: found.identityProviderId,
+    },
+    EXTERNAL_LOOKUP_DENIED_MESSAGE,
+  );
+  const orgId = found.organizationId;
   if (orgId === undefined) {
     throw notFoundError("Organization", input.externalOrgId);
   }
@@ -599,3 +633,6 @@ async function getByExternalOrgId(
     throw internalError(error, "failed to load organization");
   }
 }
+
+/** The lookup's deny copy: the provider's own `get` annotation's words. */
+const EXTERNAL_LOOKUP_DENIED_MESSAGE = "unauthorized to view identity provider";

package/src/domain/workflow/__tests__/version-audit-degradation.test.ts

@@ -0,0 +1,192 @@
+/**
+ * Pins SaveVersionAudit's safe-degradation arms at step level — the
+ * composed suite (workflow.test.ts) cannot make the real store fail
+ * selectively:
+ *
+ *   - archive (saveAudit) failure clears status.version_hash and
+ *     metadata.version.id, so the head never references an unresolvable
+ *     audit entry, and the tag is never assigned;
+ *   - tag assignment (setAuditTag) failure clears the live
+ *     metadata.version.tag, so the head never advertises a tag the audit
+ *     column cannot resolve (stigmer/stigmer#855);
+ *   - persistOnRevert flushes either revert to the stored row, because on
+ *     create no Persist step follows this one; without it (update) the
+ *     chain's own Persist flushes the revert and the step writes nothing;
+ *   - a failing re-persist is logged, never a failed apply.
+ */
+import { testCallerIdentity } from "../../../pipeline/__tests__/support.js";
+import { create } from "@bufbuild/protobuf";
+import { describe, expect, it } from "vitest";
+
+import { WorkflowSchema } from "@stigmer/protos/ai/stigmer/agentic/workflow/v1/api_pb";
+import type { Workflow } from "@stigmer/protos/ai/stigmer/agentic/workflow/v1/api_pb";
+import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
+
+import { createLogger } from "../../../boot/logger.js";
+import { RequestContext } from "../../../pipeline/request-context.js";
+import { AuditNotFoundError } from "../../../store/interface.js";
+import type { Store } from "../../../store/interface.js";
+import { newSaveVersionAuditStep } from "../steps.js";
+
+const silentLogger = createLogger({
+  level: "error",
+  pretty: false,
+  write: () => {},
+});
+
+const HASH = "c".repeat(64);
+
+/** What the stored row carried at each re-persist. */
+interface PersistedHead {
+  versionHash: string;
+  versionId: string;
+  tag: string;
+}
+
+interface FakeAuditStore {
+  saveAuditError: Error | undefined;
+  setAuditTagError: Error | undefined;
+  saveResourceError: Error | undefined;
+  setAuditTagCalls: number;
+  persisted: PersistedHead[];
+}
+
+/** A store exposing ONLY the members the step touches; the cast is the seam. */
+function fakeStore(overrides?: Partial<FakeAuditStore>): {
+  store: Store;
+  state: FakeAuditStore;
+} {
+  const state: FakeAuditStore = {
+    saveAuditError: undefined,
+    setAuditTagError: undefined,
+    saveResourceError: undefined,
+    setAuditTagCalls: 0,
+    persisted: [],
+    ...overrides,
+  };
+  const store = {
+    async getAuditByHash(): Promise<never> {
+      throw new AuditNotFoundError("not archived");
+    },
+    async saveAudit(): Promise<void> {
+      if (state.saveAuditError !== undefined) {
+        throw state.saveAuditError;
+      }
+    },
+    async setAuditTag(): Promise<void> {
+      state.setAuditTagCalls += 1;
+      if (state.setAuditTagError !== undefined) {
+        throw state.setAuditTagError;
+      }
+    },
+    async saveResource(
+      _k: unknown,
+      _id: unknown,
+      _schema: unknown,
+      wf: Workflow,
+    ): Promise<void> {
+      state.persisted.push({
+        versionHash: wf.status?.versionHash ?? "",
+        versionId: wf.metadata?.version?.id ?? "",
+        tag: wf.metadata?.version?.tag ?? "",
+      });
+      if (state.saveResourceError !== undefined) {
+        throw state.saveResourceError;
+      }
+    },
+  } as unknown as Store;
+  return { store, state };
+}
+
+function contextWithWorkflow(
+  tag: string,
+): RequestContext<typeof WorkflowSchema> {
+  return new RequestContext(
+    WorkflowSchema,
+    create(WorkflowSchema, {
+      metadata: {
+        id: "wfl_test",
+        org: "acme",
+        version: { id: HASH, tag },
+      },
+      status: { versionHash: HASH },
+    }),
+    testCallerIdentity(),
+    ApiResourceKind.workflow,
+  );
+}
+
+/** The create chain's arguments: isCreate, and no Persist follows. */
+function createStep(store: Store) {
+  return newSaveVersionAuditStep(store, silentLogger, true, true);
+}
+
+describe("SaveVersionAudit — safe degradation", () => {
+  it("tag failure on create clears the live tag and re-persists the row tagless", async () => {
+    const { store, state } = fakeStore({
+      setAuditTagError: new Error("tag column locked"),
+    });
+    const ctx = contextWithWorkflow("stable");
+
+    await createStep(store).execute(ctx);
+
+    expect(ctx.newState.metadata?.version?.tag).toBe("");
+    expect(state.persisted).toEqual([
+      { versionHash: HASH, versionId: HASH, tag: "" },
+    ]);
+  });
+
+  it("tag failure without persistOnRevert clears the live tag and leaves the write to the chain's Persist", async () => {
+    const { store, state } = fakeStore({
+      setAuditTagError: new Error("tag column locked"),
+    });
+    const ctx = contextWithWorkflow("stable");
+
+    await newSaveVersionAuditStep(store, silentLogger, true, false).execute(
+      ctx,
+    );
+
+    expect(ctx.newState.metadata?.version?.tag).toBe("");
+    expect(state.persisted).toEqual([]);
+  });
+
+  it("archive failure on create clears the hash and version id, re-persists, and never assigns the tag", async () => {
+    const { store, state } = fakeStore({
+      saveAuditError: new Error("disk full"),
+    });
+    const ctx = contextWithWorkflow("stable");
+
+    await createStep(store).execute(ctx);
+
+    expect(ctx.newState.status?.versionHash).toBe("");
+    expect(ctx.newState.metadata?.version?.id).toBe("");
+    expect(state.setAuditTagCalls).toBe(0);
+    expect(state.persisted).toEqual([
+      { versionHash: "", versionId: "", tag: "stable" },
+    ]);
+  });
+
+  it("a failing re-persist after a tag failure is logged, and the step does not throw", async () => {
+    const { store, state } = fakeStore({
+      setAuditTagError: new Error("tag column locked"),
+      saveResourceError: new Error("connection reset"),
+    });
+    const ctx = contextWithWorkflow("stable");
+
+    await expect(createStep(store).execute(ctx)).resolves.toBeUndefined();
+
+    expect(ctx.newState.metadata?.version?.tag).toBe("");
+    expect(state.persisted).toHaveLength(1);
+  });
+
+  it("a clean archive and tag write nothing beyond the audit row", async () => {
+    const { store, state } = fakeStore();
+    const ctx = contextWithWorkflow("stable");
+
+    await createStep(store).execute(ctx);
+
+    expect(ctx.newState.metadata?.version?.tag).toBe("stable");
+    expect(state.setAuditTagCalls).toBe(1);
+    expect(state.persisted).toEqual([]);
+  });
+});

package/src/domain/workflow/controller.ts

@@ -217,7 +217,8 @@ function kindOf(ctx: HandlerContext): ApiResourceKind {
  * created via the in-process client AFTER Persist (children need the
  * parent's id), status.default_instance_id lands in an explicit second
  * persist, and v1 archives LAST so the snapshot captures it (the audit
- * step re-persists on revert because no Persist follows it here).
+ * step re-persists either of its reverts, a stripped hash or a cleared
+ * tag, because no Persist follows it here).
  */
 async function createWorkflow(
   deps: WorkflowControllerDeps,