@stigmer/server 3.37.0 → 3.38.0

package/src/domain/organization/__tests__/organization-delete.test.ts

@@ -0,0 +1,266 @@
+/**
+ * Pins the organization delete's order through a composed server in the
+ * trusted-local posture: everything that names the organization goes
+ * before its row, and a fault stops the delete with the organization in
+ * place. An organization's id is its slug and the delete frees the slug for
+ * anyone, so a row left behind would belong to the slug's next holder.
+ *
+ *   - the `org-delete:pre-delete` slot runs with the organization loaded
+ *     and still stored, and its rows still in place;
+ *   - a slot step's refusal answers its own code and copy, and leaves the
+ *     organization and its rows;
+ *   - the organization's policy rows are revoked before its row, as
+ *     principal and as resource: a revocation fault answers Internal with
+ *     fixed copy, leaves the organization and its owner row, and a retry
+ *     completes the delete;
+ *   - a slug freed by the delete and created again carries none of the old
+ *     organization's rows.
+ *
+ * The policy store is the library's in-memory double, composed as the
+ * IamPolicy store driver so a test can make one row's delete fault; the
+ * grant path, the role lifecycle and the chain are the library's own.
+ */
+import { mkdtempSync, rmSync } from "node:fs";
+import { tmpdir } from "node:os";
+import path from "node:path";
+
+import type { DescMessage } from "@bufbuild/protobuf";
+import { Code, ConnectError, createClient } from "@connectrpc/connect";
+import type { Client, Transport } from "@connectrpc/connect";
+import { createGrpcTransport } from "@connectrpc/connect-node";
+import { afterAll, beforeAll, beforeEach, describe, expect, it } from "vitest";
+
+import { IamPolicyCommandController } from "@stigmer/protos/ai/stigmer/iam/iampolicy/v1/command_pb";
+import type { IamPolicy } from "@stigmer/protos/ai/stigmer/iam/iampolicy/v1/api_pb";
+import type { Organization } from "@stigmer/protos/ai/stigmer/tenancy/organization/v1/api_pb";
+import { OrganizationCommandController } from "@stigmer/protos/ai/stigmer/tenancy/organization/v1/command_pb";
+import { OrganizationQueryController } from "@stigmer/protos/ai/stigmer/tenancy/organization/v1/query_pb";
+
+import { loadConfig } from "../../../boot/config.js";
+import { composeServer } from "../../../boot/compose.js";
+import type { ComposedServer } from "../../../boot/compose.js";
+import { createLogger } from "../../../boot/logger.js";
+import type { GateSlotName } from "../../../extensions/gate-slots.js";
+import type { ServerExtension } from "../../../extensions/registry.js";
+import type { PipelineStep } from "../../../pipeline/pipeline.js";
+import { EXISTING_RESOURCE_KEY } from "../../../pipeline/steps/load-existing.js";
+import {
+  resetOperatorIdentityForTests,
+  setOperatorIdentity,
+} from "../../../pipeline/steps/defaults.js";
+import {
+  fakeIamPolicyStore,
+  orgRole,
+  triple,
+} from "../../iampolicy/__tests__/support.js";
+
+const OPERATOR_EMAIL = "operator@example.com";
+const REFUSED_SLUG = "delete-refused";
+const OUTSIDER = "ida_0byc5k14t1e7b7kdxft7hwz1f7";
+const AGENT = "agt_01hzzzzzzzzzzzzzzzzzzzzzzz";
+
+async function grpcError(run: () => Promise<unknown>): Promise<ConnectError> {
+  try {
+    await run();
+  } catch (error) {
+    if (error instanceof ConnectError) {
+      return error;
+    }
+    throw error;
+  }
+  throw new Error("expected the call to fail");
+}
+
+describe("organization delete (composed server, trusted-local posture)", () => {
+  const policies = fakeIamPolicyStore();
+  /** A policy id whose delete faults while set: the store answering an error mid-revocation. */
+  let faultingDelete: string | undefined;
+  const faultablePolicies = {
+    ...policies,
+    async deleteById(id: string): Promise<void> {
+      if (id === faultingDelete) {
+        throw new Error("policy store unavailable");
+      }
+      await policies.deleteById(id);
+    },
+  };
+
+  /** What the slot's step saw, per organization, while it ran. */
+  const seenBySlot = new Map<string, { loaded: string; rowsNaming: number }>();
+  const slotStep: PipelineStep<DescMessage> = {
+    name: "FakeOrgDeleteStep",
+    execute: (ctx) => {
+      const organization = ctx.get(EXISTING_RESOURCE_KEY) as
+        | Organization
+        | undefined;
+      const id = organization?.metadata?.id ?? "";
+      seenBySlot.set(id, { loaded: id, rowsNaming: rowsNaming(id).length });
+      if (id === REFUSED_SLUG) {
+        throw new ConnectError(
+          "fake edition keeps something for this organization",
+          Code.FailedPrecondition,
+        );
+      }
+    },
+  };
+  const unit: ServerExtension = {
+    name: "fake-org-delete",
+    gateSteps: new Map<GateSlotName, ReadonlyArray<PipelineStep<DescMessage>>>([
+      ["org-delete:pre-delete", [slotStep]],
+    ]),
+    drivers: { iamPolicyStore: faultablePolicies },
+  };
+
+  let dir: string;
+  let server: ComposedServer;
+  let transport: Transport;
+  let organizations: Client<typeof OrganizationCommandController>;
+  let organizationQuery: Client<typeof OrganizationQueryController>;
+  /** The platform's own pipeline: the in-process transport's `internal` caller. */
+  let platform: Client<typeof IamPolicyCommandController>;
+
+  function rowsNaming(org: string): IamPolicy[] {
+    return [...policies.rows.values()].filter(
+      (policy) =>
+        (policy.spec?.resource?.kind === "organization" &&
+          policy.spec.resource.id === org) ||
+        (policy.spec?.principal?.kind === "organization" &&
+          policy.spec.principal.id === org),
+    );
+  }
+
+  /** An organization with its creator's owner row, an outsider's member row, and an agent's scope link to it. */
+  async function organizationWithRows(slug: string): Promise<void> {
+    await organizations.create({
+      apiVersion: "tenancy.stigmer.ai/v1",
+      kind: "Organization",
+      metadata: { name: slug, slug, org: "" },
+      spec: { description: "created by the organization delete test" },
+    });
+    await platform.bootstrapPolicy(orgRole(OUTSIDER, "member", slug));
+    await platform.bootstrapPolicy(
+      triple({ kind: "organization", id: slug }, "organization", {
+        kind: "agent",
+        id: AGENT,
+      }),
+    );
+  }
+
+  beforeAll(async () => {
+    dir = mkdtempSync(path.join(tmpdir(), "organization-delete-test-"));
+    setOperatorIdentity(OPERATOR_EMAIL, "The Operator");
+    server = await composeServer({
+      config: loadConfig({
+        STIGMER_MODEL_REGISTRY_REFRESH: "off",
+        TEMPORAL_HOST_PORT: "127.0.0.1:1",
+        DB_PATH: path.join(dir, "stigmer.db"),
+        STORAGE_PATH: path.join(dir, "storage"),
+        ARTIFACT_LOCAL_BASE_PATH: path.join(dir, "artifacts"),
+        STIGMER_OPERATOR_EMAIL: OPERATOR_EMAIL,
+      }),
+      logger: createLogger({ level: "error", pretty: false, write: () => {} }),
+      extensions: [unit],
+      portOverride: 0,
+      host: "127.0.0.1",
+    });
+    const port = await server.start();
+    transport = createGrpcTransport({ baseUrl: `http://127.0.0.1:${port}` });
+    organizations = createClient(OrganizationCommandController, transport);
+    organizationQuery = createClient(OrganizationQueryController, transport);
+    platform = createClient(
+      IamPolicyCommandController,
+      server.inProcessTransport,
+    );
+  });
+
+  afterAll(async () => {
+    await server.shutdown();
+    resetOperatorIdentityForTests();
+    rmSync(dir, { recursive: true, force: true });
+  });
+
+  beforeEach(() => {
+    faultingDelete = undefined;
+  });
+
+  it("runs the slot with the organization and its rows in place, then removes every row naming it", async () => {
+    await organizationWithRows("delete-clean");
+    expect(rowsNaming("delete-clean")).toHaveLength(3);
+
+    await organizations.delete({ value: "delete-clean" });
+
+    expect(seenBySlot.get("delete-clean")).toEqual({
+      loaded: "delete-clean",
+      rowsNaming: 3,
+    });
+    expect(rowsNaming("delete-clean")).toEqual([]);
+    const gone = await grpcError(() =>
+      organizationQuery.get({ value: "delete-clean" }),
+    );
+    expect(gone.code).toBe(Code.NotFound);
+  });
+
+  it("a slot step's refusal answers its own copy and leaves the organization and its rows", async () => {
+    await organizationWithRows(REFUSED_SLUG);
+
+    const refused = await grpcError(() =>
+      organizations.delete({ value: REFUSED_SLUG }),
+    );
+
+    expect(refused.code).toBe(Code.FailedPrecondition);
+    expect(refused.rawMessage).toBe(
+      "fake edition keeps something for this organization",
+    );
+    expect(
+      (await organizationQuery.get({ value: REFUSED_SLUG })).metadata?.id,
+    ).toBe(REFUSED_SLUG);
+    expect(rowsNaming(REFUSED_SLUG)).toHaveLength(3);
+  });
+
+  it("a revocation fault fails the delete with the organization and its owner in place, and the retry completes it", async () => {
+    await organizationWithRows("delete-faults");
+    const member = rowsNaming("delete-faults").find(
+      (row) => row.spec?.relation === "member",
+    );
+    faultingDelete = member?.metadata?.id;
+
+    const failed = await grpcError(() =>
+      organizations.delete({ value: "delete-faults" }),
+    );
+
+    expect(failed.code).toBe(Code.Internal);
+    expect(failed.rawMessage).toBe(
+      "failed to remove the organization's access policies",
+    );
+    expect(
+      (await organizationQuery.get({ value: "delete-faults" })).metadata?.id,
+    ).toBe("delete-faults");
+    // The agent's scope link went first; the revocation stopped at the
+    // member row, before the owner row the retry needs.
+    expect(
+      rowsNaming("delete-faults")
+        .map((row) => row.spec?.relation)
+        .sort(),
+    ).toEqual(["member", "owner"]);
+
+    faultingDelete = undefined;
+    await organizations.delete({ value: "delete-faults" });
+    expect(rowsNaming("delete-faults")).toEqual([]);
+  });
+
+  it("a slug freed by the delete and created again carries none of the old organization's rows", async () => {
+    await organizationWithRows("delete-reborn");
+    await organizations.delete({ value: "delete-reborn" });
+
+    await organizations.create({
+      apiVersion: "tenancy.stigmer.ai/v1",
+      kind: "Organization",
+      metadata: { name: "delete-reborn", slug: "delete-reborn", org: "" },
+      spec: { description: "the slug, taken again" },
+    });
+
+    expect(
+      rowsNaming("delete-reborn").map((row) => row.spec?.relation),
+    ).toEqual(["owner"]);
+  });
+});

package/src/domain/organization/controller.ts

@@ -54,6 +54,7 @@ import type { ResolvedGateSteps } from "../../extensions/gate-slots.js";
 import { stepsForSlot } from "../../extensions/gate-slots.js";
 import { ALL_ORGANIZATIONS } from "../../extensions/organization-directory.js";
 import type { OrganizationDirectory } from "../../extensions/organization-directory.js";
+import type { IamPolicyGrantPath } from "../iampolicy/grant-path.js";
 import type { ResourceAuthorizationLifecycle } from "../../extensions/resource-authorization.js";
 import { apiResourceKindKey } from "../../pipeline/interceptors/apiresource.js";
 import {
@@ -105,15 +106,21 @@ import { newValidateVisibilityStep } from "../../pipeline/steps/validate-visibil
 import { ResourceNotFoundError } from "../../store/interface.js";
 import type { Store } from "../../store/interface.js";
 import { organizationSearchExtractor } from "./search-extractor.js";
-import { newCheckOrgDuplicateStep, newCopySlugToIdStep } from "./steps.js";
+import {
+  newCheckOrgDuplicateStep,
+  newCopySlugToIdStep,
+  newRevokeOrganizationPoliciesStep,
+} from "./steps.js";
 
 export interface OrganizationControllerDeps {
   readonly store: Store;
   readonly logger: Logger;
   /** The composed authorization seam — the Authorize step at position 1 of every chain calls it (O2, DD-007 §3). */
   readonly authorizer: Authorizer;
-  /** The composed slot registrations — this domain's post-persist slot (O4). */
+  /** The composed slot registrations — this domain's create and delete slots (O4). */
   readonly gateSteps: ResolvedGateSteps;
+  /** The one grant path: the delete revokes the organization's rows through it before its row goes. */
+  readonly grantPath: IamPolicyGrantPath;
   /** The composed tuple-lifecycle driver — undefined = the shared steps no-op (C2). */
   readonly authorizationLifecycle: ResourceAuthorizationLifecycle | undefined;
   /** The composed query directory — undefined = OSS single-tenant behavior (C2). */
@@ -319,22 +326,38 @@ async function apply(
     : update(deps, withResolvedApplyId(OrganizationSchema, org, reqCtx), ctx);
 }
 
-/** Delete — returns the deleted organization (gRPC audit-trail convention). */
+/**
+ * Delete — returns the deleted organization (gRPC audit-trail convention).
+ *
+ * Everything that names the organization goes before its row, and a fault
+ * stops the delete with the organization intact: an organization's id is
+ * its slug, the delete frees the slug for anyone, and whatever outlived
+ * the row would belong to the slug's next holder. So, after the load:
+ *
+ *   1. the `org-delete:pre-delete` slot, where an edition refuses or
+ *      removes the rows it keeps for the organization (empty in OSS);
+ *   2. RevokeOrganizationPolicies, every policy row naming the
+ *      organization, through the grant path, never caught;
+ *   3. the row;
+ *   4. CleanupIamPolicies, the lifecycle's post-delete event: best-effort
+ *      like every delete chain's, it revokes whatever a concurrent write
+ *      named the organization with after step 2, and runs a composed
+ *      driver's post-delete companions;
+ *   5. the search entry.
+ */
 async function deleteOrganization(
   deps: OrganizationControllerDeps,
   orgId: OrganizationId,
   ctx: HandlerContext,
 ): Promise<Organization> {
+  type DeleteInput = typeof OrganizationCommandController.method.delete.input;
   const reqCtx = new RequestContext(
     OrganizationCommandController.method.delete.input,
     orgId,
     callerIdentityOf(ctx),
     kindOf(ctx),
   );
-  await newPipeline<typeof OrganizationCommandController.method.delete.input>(
-    "organization-delete",
-    deps.logger,
-  )
+  const builder = newPipeline<DeleteInput>("organization-delete", deps.logger)
     .addStep(
       newAuthorizeStep(
         OrganizationCommandController.method.delete,
@@ -343,7 +366,16 @@ async function deleteOrganization(
     )
     .addStep(newValidateProtoStep())
     .addStep(newExtractResourceIdStep())
-    .addStep(newLoadExistingForDeleteStep(deps.store, OrganizationSchema))
+    .addStep(newLoadExistingForDeleteStep(deps.store, OrganizationSchema));
+  // The pre-delete gate slot (see the doc comment above). Empty in OSS.
+  for (const step of stepsForSlot<DeleteInput>(
+    deps.gateSteps,
+    "org-delete:pre-delete",
+  )) {
+    builder.addStep(step);
+  }
+  await builder
+    .addStep(newRevokeOrganizationPoliciesStep<DeleteInput>(deps.grantPath))
     .addStep(newDeleteResourceStep(deps.store))
     .addStep(
       newCleanupIamPoliciesStep(deps.authorizationLifecycle, deps.logger),

package/src/domain/organization/steps.ts

@@ -10,16 +10,28 @@
  * uniqueness guarantee, mirroring cloud's OrganizationCreateHandler
  * (CheckDuplicate + CopySlugToId) step-for-step.
  *
- * Proven by organization.conformance.test.ts (CONFORMANCE_TARGET=local)
- * and __tests__/organization.test.ts.
+ * The same deviation shapes the delete: a freed slug is anyone's to take,
+ * so newRevokeOrganizationPoliciesStep revokes the organization's policy
+ * rows BEFORE its row is deleted, and fails the delete when it cannot.
+ *
+ * Proven by organization.conformance.test.ts (CONFORMANCE_TARGET=local),
+ * __tests__/organization.test.ts and __tests__/organization-delete.test.ts.
  */
+import { create } from "@bufbuild/protobuf";
+import type { DescMessage } from "@bufbuild/protobuf";
+
 import { ResourceNotFoundError } from "../../store/interface.js";
 import type { Store } from "../../store/interface.js";
 import { alreadyExistsError, internalError } from "../../pipeline/errors.js";
 import type { PipelineStep } from "../../pipeline/pipeline.js";
 import type { RequestContext } from "../../pipeline/request-context.js";
+import { EXISTING_RESOURCE_KEY } from "../../pipeline/steps/load-existing.js";
 import { metadataOf } from "../../pipeline/steps/shapes.js";
+import type { IamPolicyGrantPath } from "../iampolicy/grant-path.js";
 
+import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
+import { ApiResourceRefSchema } from "@stigmer/protos/ai/stigmer/iam/iampolicy/v1/spec_pb";
+import type { Organization } from "@stigmer/protos/ai/stigmer/tenancy/organization/v1/api_pb";
 import { OrganizationSchema } from "@stigmer/protos/ai/stigmer/tenancy/organization/v1/api_pb";
 
 /**
@@ -98,3 +110,55 @@ export function newCopySlugToIdStep(): PipelineStep<typeof OrganizationSchema> {
     },
   };
 }
+
+/**
+ * Revokes every policy row that names the organization, as principal or as
+ * resource, before the delete removes its row: the rows its members hold
+ * on it, and the scope link every organization-scoped resource holds to
+ * it. Runs after the `org-delete:pre-delete` slot and before
+ * DeleteResource.
+ *
+ * The generic delete chains clean up after the row and log a fault,
+ * because a deleted resource's rows grant nothing once it is gone. An
+ * organization is the exception: its id is its slug, the delete frees the
+ * slug, and a row left behind would grant whoever creates the slug next.
+ * So this step does not catch. A fault fails the delete with the
+ * organization in place, and a retry resumes where the revocation stopped
+ * (the grant path revokes the organization's owners last, so the owner
+ * who retries still can). The grant path fires the composed driver's
+ * `onPolicyRevoked` before each row, so a composition's tuples go with
+ * their rows. The post-delete CleanupIamPolicies still runs: it catches
+ * whatever a concurrent write named the organization with in between.
+ */
+export function newRevokeOrganizationPoliciesStep<Desc extends DescMessage>(
+  grantPath: IamPolicyGrantPath,
+): PipelineStep<Desc> {
+  return {
+    name: "RevokeOrganizationPolicies",
+    async execute(ctx: RequestContext<Desc>): Promise<void> {
+      const organization = ctx.get(EXISTING_RESOURCE_KEY) as
+        | Organization
+        | undefined;
+      const id = organization?.metadata?.id ?? "";
+      if (id === "") {
+        throw internalError(
+          new Error("organization delete reached RevokeOrganizationPolicies without its loaded row"),
+          "failed to remove the organization's access policies",
+        );
+      }
+      try {
+        await grantPath.cleanupResource(
+          create(ApiResourceRefSchema, {
+            kind: ApiResourceKind[ApiResourceKind.organization],
+            id,
+          }),
+        );
+      } catch (error) {
+        throw internalError(
+          error,
+          "failed to remove the organization's access policies",
+        );
+      }
+    },
+  };
+}