@stigmer/server 3.37.1 → 3.38.0

package/src/domain/organization/steps.ts

@@ -10,16 +10,28 @@
  * uniqueness guarantee, mirroring cloud's OrganizationCreateHandler
  * (CheckDuplicate + CopySlugToId) step-for-step.
  *
- * Proven by organization.conformance.test.ts (CONFORMANCE_TARGET=local)
- * and __tests__/organization.test.ts.
+ * The same deviation shapes the delete: a freed slug is anyone's to take,
+ * so newRevokeOrganizationPoliciesStep revokes the organization's policy
+ * rows BEFORE its row is deleted, and fails the delete when it cannot.
+ *
+ * Proven by organization.conformance.test.ts (CONFORMANCE_TARGET=local),
+ * __tests__/organization.test.ts and __tests__/organization-delete.test.ts.
  */
+import { create } from "@bufbuild/protobuf";
+import type { DescMessage } from "@bufbuild/protobuf";
+
 import { ResourceNotFoundError } from "../../store/interface.js";
 import type { Store } from "../../store/interface.js";
 import { alreadyExistsError, internalError } from "../../pipeline/errors.js";
 import type { PipelineStep } from "../../pipeline/pipeline.js";
 import type { RequestContext } from "../../pipeline/request-context.js";
+import { EXISTING_RESOURCE_KEY } from "../../pipeline/steps/load-existing.js";
 import { metadataOf } from "../../pipeline/steps/shapes.js";
+import type { IamPolicyGrantPath } from "../iampolicy/grant-path.js";
 
+import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
+import { ApiResourceRefSchema } from "@stigmer/protos/ai/stigmer/iam/iampolicy/v1/spec_pb";
+import type { Organization } from "@stigmer/protos/ai/stigmer/tenancy/organization/v1/api_pb";
 import { OrganizationSchema } from "@stigmer/protos/ai/stigmer/tenancy/organization/v1/api_pb";
 
 /**
@@ -98,3 +110,55 @@ export function newCopySlugToIdStep(): PipelineStep<typeof OrganizationSchema> {
     },
   };
 }
+
+/**
+ * Revokes every policy row that names the organization, as principal or as
+ * resource, before the delete removes its row: the rows its members hold
+ * on it, and the scope link every organization-scoped resource holds to
+ * it. Runs after the `org-delete:pre-delete` slot and before
+ * DeleteResource.
+ *
+ * The generic delete chains clean up after the row and log a fault,
+ * because a deleted resource's rows grant nothing once it is gone. An
+ * organization is the exception: its id is its slug, the delete frees the
+ * slug, and a row left behind would grant whoever creates the slug next.
+ * So this step does not catch. A fault fails the delete with the
+ * organization in place, and a retry resumes where the revocation stopped
+ * (the grant path revokes the organization's owners last, so the owner
+ * who retries still can). The grant path fires the composed driver's
+ * `onPolicyRevoked` before each row, so a composition's tuples go with
+ * their rows. The post-delete CleanupIamPolicies still runs: it catches
+ * whatever a concurrent write named the organization with in between.
+ */
+export function newRevokeOrganizationPoliciesStep<Desc extends DescMessage>(
+  grantPath: IamPolicyGrantPath,
+): PipelineStep<Desc> {
+  return {
+    name: "RevokeOrganizationPolicies",
+    async execute(ctx: RequestContext<Desc>): Promise<void> {
+      const organization = ctx.get(EXISTING_RESOURCE_KEY) as
+        | Organization
+        | undefined;
+      const id = organization?.metadata?.id ?? "";
+      if (id === "") {
+        throw internalError(
+          new Error("organization delete reached RevokeOrganizationPolicies without its loaded row"),
+          "failed to remove the organization's access policies",
+        );
+      }
+      try {
+        await grantPath.cleanupResource(
+          create(ApiResourceRefSchema, {
+            kind: ApiResourceKind[ApiResourceKind.organization],
+            id,
+          }),
+        );
+      } catch (error) {
+        throw internalError(
+          error,
+          "failed to remove the organization's access policies",
+        );
+      }
+    },
+  };
+}

package/src/extensions/__tests__/registry.test.ts

@@ -491,6 +491,9 @@ describe("resolveExtensions — loud-fail throws (DD-006 §2b)", () => {
       // The ninth: the organization create chain before Persist, where a
       // limit on which organizations may exist refuses with nothing written.
       "org-create:pre-side-effect-gate",
+      // The tenth: the organization delete chain before any write, where an
+      // edition removes or refuses what it keeps for the organization.
+      "org-delete:pre-delete",
       "sandbox-acquisition:gate",
       "session-create:pre-side-effect-gate",
     ]);

package/src/extensions/gate-slots.ts

@@ -53,6 +53,19 @@
  * limit belongs here too. `apply` delegates to create on its create arm,
  * so the slot fires there as well.
  *
+ * The tenth, `org-delete:pre-delete`: the organization delete chain after
+ * LoadExistingForDelete and before any write, so the organization exists
+ * and is loaded (EXISTING_RESOURCE_KEY) while its steps run. An
+ * organization's id is its slug and its delete frees the slug for anyone,
+ * so whatever an edition keeps for the organization must go before the row
+ * does, or be refused: a row left behind would belong to whoever creates
+ * the slug next. Its steps may refuse (Enterprise refuses while an
+ * identity provider still signs in platform-managed organizations) or
+ * remove the edition's own rows; either way a throw fails the delete with
+ * the organization intact, and the retry re-runs every step, so each owns
+ * its idempotency. After the slot the chain revokes the organization's own
+ * policy rows, also before the row and also failing closed.
+ *
  * Two enforcement layers, deliberately redundant, both derived from the
  * ONE literal tuple below (lockstep by construction):
  *   - GateSlotName (compile time): the union of declared slot literals.
@@ -92,6 +105,7 @@ export const GATE_SLOT_NAMES = [
   "identity-account-provision:post-persist",
   "iam-policy-create:pre-side-effect-gate",
   "org-create:pre-side-effect-gate",
+  "org-delete:pre-delete",
 ] as const;
 
 /** The declared slot-name union — a registration outside it fails tsc. */

package/src/pipeline/steps/authorization-tuples.ts

@@ -330,8 +330,12 @@ export function newCreateAuthorizationTuplesStep<Desc extends DescMessage>(
 /**
  * CleanupIamPolicies — after the store delete in every delete chain.
  * Best-effort by contract: a driver failure is logged and the delete
- * succeeds (Java's DeleteOperationCleanupIamPoliciesStep swallows all —
- * the cloud side owns convergence for orphaned grants).
+ * succeeds (Java's DeleteOperationCleanupIamPoliciesStep swallows all),
+ * because a deleted resource's rows grant nothing once it is gone. The
+ * organization is the one kind whose id another caller can take next, so
+ * its chain revokes the organization's rows before the row, failing
+ * closed (RevokeOrganizationPolicies, domain/organization/steps.ts), and
+ * this step is only its backstop there.
  */
 export function newCleanupIamPoliciesStep<Desc extends DescMessage>(
   lifecycle: ResourceAuthorizationLifecycle | undefined,