@stigmer/server 3.40.0 → 3.41.0

package/src/domain/channelapp/controller.ts

@@ -17,10 +17,12 @@
  * Every chain opens with Authorize; create and delete run the shared
  * tuple-lifecycle steps against the composed lifecycle; getByReference
  * loads, then authorizes the loaded app exactly as `get` would
- * (AuthorizeResolvedTarget). listByOrg does not yet narrow through the
- * list read scope, although the model restricts viewing to owners,
- * explicit grants and organization admins
- * (fga/model/agentic/channel_app.fga, stigmer/stigmer#1384). Per-RPC
+ * (AuthorizeResolvedTarget). listByOrg narrows the organization's apps
+ * through the composed list read scope to the ones a `get` would return:
+ * the model shows a channel app to the organization's admins and explicit
+ * grants, never to plain members or viewers, and never to a creator who is
+ * no longer an admin (fga/model/agentic/channel_app.fga,
+ * stigmer/stigmer#1384, #1409). Per-RPC
  * posture: docs/authorization-coverage.md §13.
  *
  * Proven by channelapp.conformance.test.ts (CONFORMANCE_TARGET=local)
@@ -47,6 +49,8 @@ import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/
 
 import type { Logger } from "../../boot/logger.js";
 import type { Authorizer } from "../../extensions/authorizer.js";
+import type { ListReadScope } from "../../extensions/list-read-scope.js";
+import { restrictListByReadScope } from "../../extensions/list-read-scope.js";
 import type { ResourceAuthorizationLifecycle } from "../../extensions/resource-authorization.js";
 import type { SecretService } from "../../encryption/encryption.js";
 import { apiResourceKindKey } from "../../pipeline/interceptors/apiresource.js";
@@ -111,6 +115,8 @@ export interface ChannelAppControllerDeps {
   /** The composed tuple-lifecycle driver — undefined = the shared steps no-op (C2). */
   readonly authorizationLifecycle: ResourceAuthorizationLifecycle | undefined;
   readonly secretService: SecretService;
+  /** The composed list read scope — listByOrg narrows through it; undefined = the OSS full scan (stigmer/stigmer#1384). */
+  readonly listReadScope: ListReadScope | undefined;
 }
 
 /** Registers both channelapp services on the router (routes stage). */
@@ -394,8 +400,8 @@ async function getByReference(
 const LIST_RESULT_KEY = "listResult";
 
 /**
- * ListByOrg — all ChannelApps of an organization, newest-first, every
- * entry redacted. No pagination — the set is small by nature (typically
+ * ListByOrg — the ChannelApps of an organization the caller may view,
+ * newest-first, every entry redacted. No pagination — the set is small by nature (typically
  * one app per provider per org), the OAuthApp listByOrg posture.
  */
 async function listByOrg(
@@ -420,7 +426,7 @@ async function listByOrg(
       ),
     )
     .addStep(newValidateProtoStep())
-    .addStep(newListByOrgStep(deps.store, deps.logger))
+    .addStep(newListByOrgStep(deps.store, deps.listReadScope, deps.logger))
     .build()
     .execute(reqCtx);
 
@@ -436,12 +442,19 @@ async function listByOrg(
 
 /**
  * ListByOrg — Go list_by_org.go's domain step: full scan, malformed rows
- * skipped with a warning, org equality filter, per-item redaction, sorted
- * by spec-audit created_at descending (seconds then nanos; timestamped
- * entries before untimestamped ones).
+ * skipped with a warning, org equality filter, narrowed to the caller's
+ * apps, per-item redaction, sorted by spec-audit created_at descending
+ * (seconds then nanos; timestamped entries before untimestamped ones).
+ * The org predicate stays the step's own because with no scope composed
+ * the helper returns its input unchanged and never reads the org (the
+ * trusted-local full scan); with one, the scope is the last per-row
+ * predicate, so a composed driver is asked about the org's apps, never
+ * every tenant's, and only the kept apps are redacted (the OAuthApp
+ * list's order).
  */
 function newListByOrgStep(
   store: Store,
+  listReadScope: ListReadScope | undefined,
   logger: Logger,
 ): PipelineStep<typeof ChannelAppQueryController.method.listByOrg.input> {
   return {
@@ -460,7 +473,7 @@ function newListByOrgStep(
         throw internalError(error, "failed to list ChannelApps");
       }
 
-      const apps: ChannelApp[] = [];
+      const requested: ChannelApp[] = [];
       for (const bytes of rows) {
         let app: ChannelApp;
         try {
@@ -472,8 +485,18 @@ function newListByOrgStep(
         if ((app.metadata?.org ?? "") !== org) {
           continue;
         }
+        requested.push(app);
+      }
+
+      const apps = await restrictListByReadScope(
+        listReadScope,
+        ctx.callerIdentity,
+        ApiResourceKind.channel_app,
+        requested,
+        "",
+      );
+      for (const app of apps) {
         redactChannelApp(app);
-        apps.push(app);
       }
 
       apps.sort((a, b) =>

package/src/domain/environment/__tests__/environment.test.ts

@@ -38,6 +38,7 @@ import type { ComposedServer } from "../../../boot/compose.js";
 import { createLogger } from "../../../boot/logger.js";
 import { ENCRYPTED_PREFIX, isCiphertextShaped } from "../../../encryption/encryption.js";
 import { REDACTED_MARKER } from "../constants.js";
+import { seedOrganizations } from "../../organization/__tests__/support.js";
 
 const silentLogger = createLogger({ level: "error", pretty: false, write: () => {} });
 
@@ -84,6 +85,18 @@ async function startServer(env: Record<string, string>): Promise<TestServer> {
   const transport: Transport = createGrpcTransport({
     baseUrl: `http://127.0.0.1:${port}`,
   });
+  await seedOrganizations(transport, [
+    ORG,
+    "other-org",
+    "personal-org-a",
+    "personal-org-b",
+    "personal-org-c",
+    "personal-org-d",
+    "read-org",
+    "vis-org-a",
+    "vis-org-b",
+    "list-org",
+  ]);
   return {
     server,
     command: createClient(EnvironmentCommandController, transport),

package/src/domain/executioncontext/__tests__/executioncontext.test.ts

@@ -61,6 +61,7 @@ import {
   deleteExecutionContextForExecution,
 } from "../temporal/delete-execution-context.js";
 import { executionContextSearchExtractor } from "../search-extractor.js";
+import { seedOrganizations } from "../../organization/__tests__/support.js";
 
 const silentLogger = createLogger({
   level: "error",
@@ -112,6 +113,7 @@ async function startServer(env: Record<string, string>): Promise<TestServer> {
   const transport: Transport = createGrpcTransport({
     baseUrl: `http://127.0.0.1:${port}`,
   });
+  await seedOrganizations(transport, [ORG, "test-org"]);
   return {
     server,
     command: createClient(ExecutionContextCommandController, transport),

package/src/domain/executioncontext/steps.ts

@@ -229,7 +229,8 @@ export function newLoadByExecutionIdStep(
  * Ordered before the duplicate check so an unauthorized caller learns
  * nothing about which execution ids exist.
  *
- * OSS byte-identity: the permissive authorizer allows every check, so the
+ * OSS byte-identity: the trusted-local authorizer allows every check on
+ * an Organization that exists (trusted-local-authorizer.ts), so the
  * single-user posture is unchanged (the rosters prove it).
  */
 export function newAuthorizeExecutionContextCreateStep(

package/src/domain/iampolicy/__tests__/access-lists.test.ts

@@ -350,3 +350,82 @@ describe("buildPrincipalAccessList", () => {
     ]);
   });
 });
+
+describe("buildPrincipalAccessList: only the organization's people", () => {
+  /** An agent in acme: alice (a member) and dave (no role in acme) each hold a viewer grant. */
+  async function sharedAgent() {
+    const store = fakeIamPolicyStore();
+    await store.save(
+      row(
+        scopeLink(
+          { kind: "agent", id: "a1" },
+          { kind: "organization", id: "acme" },
+        ),
+      ),
+    );
+    await store.save(row(orgRole("ida_alice", "member", "acme")));
+    await store.save(row(orgRole("ida_dave", "member", "globex")));
+    for (const account of ["ida_alice", "ida_dave"]) {
+      await store.save(
+        row(
+          triple({ kind: "identity_account", id: account }, "viewer", {
+            kind: "agent",
+            id: "a1",
+          }),
+        ),
+      );
+    }
+    await store.save(
+      row(
+        triple({ kind: "team", id: "tm_1", relation: "member" }, "viewer", {
+          kind: "agent",
+          id: "a1",
+        }),
+      ),
+    );
+    return store;
+  }
+
+  it("leaves out a person who holds no role in the resource's organization, and keeps teams", async () => {
+    const store = await sharedAgent();
+    const entries = await buildPrincipalAccessList(store, nobody, undefined, [
+      { kind: "agent", id: "a1" },
+    ]);
+    expect(
+      entries.map((e) => `${e.principal?.kind}:${e.principal?.id}`),
+    ).toEqual(["identity_account:ida_alice", "team:tm_1"]);
+  });
+
+  it("reads the organization from the walked hierarchy the same way", async () => {
+    const store = await sharedAgent();
+    const entries = await buildPrincipalAccessList(store, nobody, undefined, [
+      { kind: "agent", id: "a1" },
+      { kind: "organization", id: "acme" },
+    ]);
+    expect(entries.map((e) => e.principal?.id)).toEqual(["ida_alice", "tm_1"]);
+  });
+
+  it("an organization's own list is its roles and is never filtered", async () => {
+    const store = await sharedAgent();
+    const entries = await buildPrincipalAccessList(store, nobody, undefined, [
+      { kind: "organization", id: "globex" },
+    ]);
+    expect(entries.map((e) => e.principal?.id)).toEqual(["ida_dave"]);
+  });
+
+  it("a resource no organization holds is listed as its rows say", async () => {
+    const store = fakeIamPolicyStore();
+    await store.save(
+      row(
+        triple({ kind: "identity_account", id: "ida_dave" }, "viewer", {
+          kind: "agent",
+          id: "loose",
+        }),
+      ),
+    );
+    const entries = await buildPrincipalAccessList(store, nobody, undefined, [
+      { kind: "agent", id: "loose" },
+    ]);
+    expect(entries.map((e) => e.principal?.id)).toEqual(["ida_dave"]);
+  });
+});

package/src/domain/iampolicy/__tests__/change.test.ts

@@ -0,0 +1,63 @@
+/**
+ * Pins the one definition of an access row and the one conversion from a
+ * caller to the actor a change record carries (change.ts). An access row
+ * names a person or an audience written as a userset; a row naming a
+ * resource with no relation is a structural link and is never recorded.
+ * The actor keeps the caller's id and class and drops everything else, so
+ * a permission history holds no email, display name or token.
+ */
+import { describe, expect, it } from "vitest";
+
+import type { CallerIdentity } from "../../../extensions/identity.js";
+import { grantsAccess, policyActorOf } from "../change.js";
+import { triple } from "./support.js";
+
+describe("grantsAccess", () => {
+  const agent = { kind: "agent", id: "agt_01hzzzzzzzzzzzzzzzzzzzzzzz" };
+
+  it.each([
+    ["a person", { kind: "identity_account", id: "ida_1" }, true],
+    [
+      "a team's members",
+      { kind: "team", id: "tm_1", relation: "member" },
+      true,
+    ],
+    [
+      "an organization's viewers",
+      { kind: "organization", id: "acme", relation: "viewer" },
+      true,
+    ],
+    [
+      "an identity provider's platform users",
+      { kind: "identity_provider", id: "idp_1", relation: "platform_user" },
+      true,
+    ],
+    ["a parent organization", { kind: "organization", id: "acme" }, false],
+    ["a blueprint (default instance)", { kind: "agent", id: "agt_2" }, false],
+    [
+      "an identity provider (managed organization)",
+      { kind: "identity_provider", id: "idp_1" },
+      false,
+    ],
+  ])("a row naming %s: %s", (_name, principal, expected) => {
+    expect(grantsAccess(triple(principal, "viewer", agent))).toBe(expected);
+  });
+});
+
+describe("policyActorOf", () => {
+  it("keeps the caller's id and class and nothing else", () => {
+    const caller: CallerIdentity = {
+      identityId: "ida_1",
+      callerClass: "internal",
+      issuer: "https://issuer.example.com",
+      rawToken: "secret",
+      email: "alice@example.com",
+      displayName: "Alice",
+      origin: "in-process",
+    };
+    expect(policyActorOf(caller)).toStrictEqual({
+      id: "ida_1",
+      callerClass: "internal",
+    });
+  });
+});

package/src/domain/iampolicy/__tests__/controller.test.ts

@@ -93,7 +93,12 @@ import {
 import { registerIamPolicyServices } from "../controller.js";
 import { newIamPolicyGrantPath } from "../grant-path.js";
 import { newOrganizationOnlyGrantScope } from "../grant-scope.js";
-import { fakeIamPolicyStore, orgRole, triple } from "./support.js";
+import {
+  NO_RECORDED_CREATORS,
+  fakeIamPolicyStore,
+  orgRole,
+  triple,
+} from "./support.js";
 
 const silent = createLogger({ level: "error", pretty: false, write: () => {} });
 
@@ -225,6 +230,7 @@ async function harness(options: {
   const authorizer = recordingAuthorizer();
   const engine = options.engine === true ? recordingEngine() : undefined;
   const grantPath = newIamPolicyGrantPath({
+    creators: NO_RECORDED_CREATORS,
     policies,
     lifecycle: undefined,
     logger: silent,
@@ -350,6 +356,31 @@ describe("the three system RPCs (Q-OR-7, Q-S5-10)", () => {
   });
 });
 
+describe("each lane hands the store its own door and its caller", () => {
+  const member = orgRole(OPERATOR_ID, "member", "acme");
+
+  it("create records a grant and delete a revoke, both as the chain's caller", async () => {
+    const h = await harness({ caller: alice });
+    await h.command.create(member);
+    await h.command.delete(member);
+    const actor = { id: alice.identityId, callerClass: "user" };
+    expect(h.policies.changes.map((change) => [change.op, change.record])).toEqual([
+      ["save", { actor, cause: "grant", organizationId: "acme" }],
+      ["delete", { actor, cause: "revoke", organizationId: "acme" }],
+    ]);
+  });
+
+  it("bootstrapPolicy records a structural change and cleanupResourcePolicies a deleted resource", async () => {
+    const h = await harness({ caller: machine });
+    await h.command.bootstrapPolicy(member);
+    await h.command.cleanupResourcePolicies(ref("organization", "acme"));
+    expect(h.policies.changes.map((change) => change.record?.cause)).toEqual([
+      "structural",
+      "resource_deleted",
+    ]);
+  });
+});
+
 describe("checkMyPermission (Q-OR-8, Q-S5-3)", () => {
   const platform = ref("platform", "stigmer");
   const acme = ref("organization", "acme");
@@ -957,9 +988,14 @@ describe("owner is assigned by owners, on the three caller lanes", () => {
     h: Harness,
     roles: ReadonlyArray<readonly [string, string]>,
   ): Promise<void> {
-    const path = newIamPolicyGrantPath({ policies: h.policies, lifecycle: undefined, logger: silent });
+    const path = newIamPolicyGrantPath({
+      creators: NO_RECORDED_CREATORS,
+      policies: h.policies,
+      lifecycle: undefined,
+      logger: silent,
+    });
     for (const [account, role] of roles) {
-      await path.grant(orgRole(account, role, "acme"), internal);
+      await path.grant(orgRole(account, role, "acme"), internal, "grant");
     }
   }