@stigmer/server 3.40.0 → 3.41.0

package/src/domain/iampolicy/steps.ts

@@ -115,6 +115,7 @@ import {
   teamQualifierMessage,
   teamRoleNotGrantableMessage,
 } from "./constants.js";
+import type { PolicyChangeCause } from "./change.js";
 import type { IamPolicyGrantPath } from "./grant-path.js";
 import type { IamPolicyStore } from "./store.js";
 import {
@@ -231,22 +232,27 @@ function requireTeamGrant(
   }
 }
 
-/** Grant the spec as the chain's caller; the row (fresh or held) is the result. */
+/** Grant the spec as the chain's caller, through the chain's door; the row (fresh or held) is the result. */
 export function newGrantStep(
   grantPath: IamPolicyGrantPath,
+  cause: PolicyChangeCause,
 ): PipelineStep<typeof IamPolicySpecSchema> {
   return {
     name: "Grant",
     async execute(
       ctx: RequestContext<typeof IamPolicySpecSchema>,
     ): Promise<void> {
-      const { policy } = await grantPath.grant(ctx.input, ctx.callerIdentity);
+      const { policy } = await grantPath.grant(
+        ctx.input,
+        ctx.callerIdentity,
+        cause,
+      );
       ctx.set(POLICY_RESULT_KEY, policy);
     },
   };
 }
 
-/** Revoke the spec's row; absent, the default instance is the result (Java's idempotent delete). */
+/** Revoke the spec's row as the chain's caller; absent, the default instance is the result (Java's idempotent delete). */
 export function newRevokeStep(
   grantPath: IamPolicyGrantPath,
 ): PipelineStep<typeof IamPolicySpecSchema> {
@@ -255,7 +261,10 @@ export function newRevokeStep(
     async execute(
       ctx: RequestContext<typeof IamPolicySpecSchema>,
     ): Promise<void> {
-      const revoked = await grantPath.revokeBySpec(ctx.input);
+      const revoked = await grantPath.revokeBySpec(
+        ctx.input,
+        ctx.callerIdentity,
+      );
       ctx.set(POLICY_RESULT_KEY, revoked ?? create(IamPolicySchema));
     },
   };
@@ -273,6 +282,7 @@ export function newRevokeOrgAccessStep(
       return grantPath.revokeOrgAccess(
         ctx.input.identityAccountId,
         ctx.input.organizationId,
+        ctx.callerIdentity,
       );
     },
   };
@@ -286,7 +296,7 @@ export function newCleanupResourceStep(
     name: "CleanupResource",
     execute(ctx: RequestContext<typeof ApiResourceRefSchema>): Promise<void> {
       const ref: ApiResourceRef = ctx.input;
-      return grantPath.cleanupResource(ref);
+      return grantPath.cleanupResource(ref, ctx.callerIdentity);
     },
   };
 }

package/src/domain/iampolicy/store-contract.ts

@@ -18,7 +18,10 @@
  *
  * The corners A12 taught are cases from the start, not later additions:
  * every relation on a pair; distinct principals, not rows; the scope-tuple
- * exclusions verbatim; unknown-id delete a no-op; a held id refused.
+ * exclusions verbatim; unknown-id delete a no-op; a held id refused. A
+ * change record changes nothing about the row; what a store that keeps a
+ * history writes with it is that store's own test, since the port lets an
+ * implementation keep none.
  *
  * What the kit deliberately does not carry: open source's derived-id
  * refusal and its primary-key read, the cloud's column layout and SQLSTATE
@@ -51,6 +54,7 @@ import type {
   PortContractDeclaration,
   PortContractFixture,
 } from "../../store/port-contract.js";
+import type { PolicyChangeRecord } from "./change.js";
 import {
   IAM_POLICY_API_VERSION,
   IAM_POLICY_KIND,
@@ -378,6 +382,38 @@ const CASES: ReadonlyArray<PortContractDeclaration<IamPolicyStore>> = [
       );
     },
   ],
+  [
+    "a change record changes nothing about the row: save and deleteById behave as without one",
+    async ({ store }) => {
+      const record: PolicyChangeRecord = {
+        actor: { id: BOB, callerClass: "user" },
+        cause: "grant",
+        organizationId: "acme",
+      };
+      const policy = policyRow(orgRole(ALICE, "admin", "acme"));
+      await store.save(policy, record);
+      const found = await store.findById(idOf(policy));
+      assert.ok(
+        found !== undefined && equals(IamPolicySchema, found, policy),
+        "a policy saved with a record must read back exactly as saved",
+      );
+      await assert.rejects(
+        store.save(policyRow(orgRole(ALICE, "admin", "acme"), BOB), record),
+        DuplicatePolicyError,
+        "a held id with a record must still raise DuplicatePolicyError",
+      );
+      await store.deleteById(idOf(policy), { ...record, cause: "revoke" });
+      assert.equal(
+        await store.findById(idOf(policy)),
+        undefined,
+        "a policy deleted with a record must be gone",
+      );
+      await assert.doesNotReject(
+        store.deleteById(idOf(policy), { ...record, cause: "revoke" }),
+        "deleting an id that is not held, with a record, must resolve",
+      );
+    },
+  ],
   [
     "deleteById of an unknown id resolves",
     async ({ store }) => {

package/src/domain/iampolicy/store.ts

@@ -38,10 +38,24 @@
  *     editions' filters read alike);
  *   - a typed not-found reads as `undefined`; any other storage failure
  *     propagates as the infrastructure fault it is (the ratified
- *     store-fault mapping — an outage must never read as "no grant").
+ *     store-fault mapping — an outage must never read as "no grant");
+ *   - a change record (change.ts) never changes what happens to the row:
+ *     `save` and `deleteById` behave identically with and without one.
+ *
+ * The change record. The grant path hands one to `save` and `deleteById`
+ * for every access row it writes or deletes. An implementation that keeps
+ * a permission history writes exactly one entry for it in the SAME atomic
+ * unit as the row change, and none when the row did not change: a held id
+ * raises DuplicatePolicyError before anything is written, and deleting an
+ * id that is not held records nothing. History equals the row changes
+ * exactly, with nothing to filter or heal. An implementation may keep no
+ * history and ignore the record; open source's adapter does. A driver
+ * written against the one-argument methods still satisfies this interface.
  */
 import type { IamPolicy } from "@stigmer/protos/ai/stigmer/iam/iampolicy/v1/api_pb";
 
+import type { PolicyChangeRecord } from "./change.js";
+
 /**
  * Raised by `save` when the id is already held, so the grant path runs its
  * race arm (re-read the winner by triple; answer it as the duplicate).
@@ -56,10 +70,10 @@ export class DuplicatePolicyError extends Error {
 }
 
 export interface IamPolicyStore {
-  /** Insert; a held id raises DuplicatePolicyError. */
-  save(policy: IamPolicy): Promise<void>;
-  /** Removes the row; no error when it does not exist. */
-  deleteById(id: string): Promise<void>;
+  /** Insert; a held id raises DuplicatePolicyError. `record`: the change to keep, when the row grants access. */
+  save(policy: IamPolicy, record?: PolicyChangeRecord): Promise<void>;
+  /** Removes the row; no error when it does not exist. `record`: as for `save`, kept only when a row was removed. */
+  deleteById(id: string, record?: PolicyChangeRecord): Promise<void>;
   findById(id: string): Promise<IamPolicy | undefined>;
   /** Every row naming the principal — the cleanup's principal-side arm. */
   findByPrincipal(

package/src/domain/identityaccount/__tests__/resolve.test.ts

@@ -30,6 +30,35 @@
  *   - a caller whose credential names no subject (an opaque token) is
  *     `undefined` with NO second read — the store is never asked about "";
  *   - an idp-shaped caller with no account is `undefined`.
+ *
+ * And the question the API-key verifier asks of a stamp that resolved to
+ * nobody, `isPreSignInOperatorStamp` (stigmer/stigmer#1169): does it name
+ * the operator of the server's life before sign-in was turned on? Written
+ * failing before the export exists.
+ *
+ *   - the `"system"` placeholder does, with no read (it is only ever the
+ *     unconfigured laptop's operator);
+ *   - an email with a `local|<email>` account in the store does;
+ *   - an email with no such account does not (an issuer subject that
+ *     happens to look like an email);
+ *   - an account-id stamp and the empty stamp do not, with no read, so the
+ *     common key costs the verifier nothing;
+ *   - a store fault propagates as the same error.
+ *
+ * And provisionMyAccount's admission, `mayProvisionDirectAccount`: did the
+ * platform's own sign-in vouch for this caller? Over a store whose direct
+ * read answers no federated and no platform-client row, as the port says:
+ *
+ *   - the trusted-local operator (no issuer, no token) is admitted;
+ *   - an idp-shaped `user` caller (no account, identity = subject) is;
+ *   - a caller that is already its subject's direct account is;
+ *   - a caller whose account is a federated one is not, whether or not a
+ *     platform person holds the direct account of the subject its token
+ *     names: that subject is the provider's to choose;
+ *   - a platform client's user is not, nor a system lane's token (its
+ *     identity is its lane account, whose id no direct row carries as a
+ *     subject), nor any caller that is not of class `user`, nor a
+ *     credential naming no subject.
  */
 import { create } from "@bufbuild/protobuf";
 import { ConnectError } from "@connectrpc/connect";
@@ -40,8 +69,13 @@ import { IdentityAccountProvisioningMode } from "@stigmer/protos/ai/stigmer/iam/
 
 import type { CallerIdentity } from "../../../extensions/identity.js";
 import { accountIdFor, localIdpIdFor } from "../constants.js";
-import { accountForCaller, identityIdForSubject } from "../resolve.js";
-import type { AccountsBySubject } from "../resolve.js";
+import {
+  accountForCaller,
+  identityIdForSubject,
+  isPreSignInOperatorStamp,
+  mayProvisionDirectAccount,
+} from "../resolve.js";
+import type { AccountsByCaller, AccountsBySubject } from "../resolve.js";
 import { fakeIdentityAccountStore } from "./support.js";
 
 function seeded(sub: string, id: string = accountIdFor(sub)) {
@@ -223,3 +257,213 @@ describe("accountForCaller — the account a caller stands for", () => {
     expect(account).toBeUndefined();
   });
 });
+
+describe("isPreSignInOperatorStamp — a stamp from before sign-in was turned on (stigmer/stigmer#1169)", () => {
+  it('the "system" placeholder is the unconfigured laptop\'s operator, with no read', async () => {
+    const accounts = fakeIdentityAccountStore();
+    const bySubject = vi.spyOn(accounts, "findDirectByIdpId");
+
+    expect(await isPreSignInOperatorStamp(accounts, "system")).toBe(true);
+    expect(bySubject).not.toHaveBeenCalled();
+  });
+
+  it("an email with a local|<email> account is the configured operator's", async () => {
+    const accounts = seeded(localIdpIdFor("operator@example.com"));
+    const bySubject = vi.spyOn(accounts, "findDirectByIdpId");
+
+    expect(
+      await isPreSignInOperatorStamp(accounts, "operator@example.com"),
+    ).toBe(true);
+    expect(bySubject).toHaveBeenCalledTimes(1);
+    expect(bySubject).toHaveBeenCalledWith(
+      localIdpIdFor("operator@example.com"),
+    );
+  });
+
+  it("an email with no local|<email> account is not — an issuer subject may look like one", async () => {
+    const accounts = seeded(localIdpIdFor("operator@example.com"));
+
+    expect(
+      await isPreSignInOperatorStamp(accounts, "someone@example.com"),
+    ).toBe(false);
+  });
+
+  it("an account-id stamp and the empty stamp are not, and the store is never asked", async () => {
+    const accounts = seeded(localIdpIdFor("operator@example.com"));
+    const bySubject = vi.spyOn(accounts, "findDirectByIdpId");
+
+    expect(
+      await isPreSignInOperatorStamp(
+        accounts,
+        accountIdFor(localIdpIdFor("operator@example.com")),
+      ),
+    ).toBe(false);
+    expect(await isPreSignInOperatorStamp(accounts, "")).toBe(false);
+    expect(bySubject).not.toHaveBeenCalled();
+  });
+
+  it("a store fault propagates as the same error", async () => {
+    const fault = new Error("store is on fire");
+    const broken: AccountsBySubject = {
+      findDirectByIdpId: () => Promise.reject(fault),
+    };
+    await expect(
+      isPreSignInOperatorStamp(broken, "operator@example.com"),
+    ).rejects.toBe(fault);
+  });
+});
+
+describe("mayProvisionDirectAccount — provisionMyAccount's admission", () => {
+  const PERSON = "auth0|platform-person";
+
+  function row(
+    id: string,
+    idpId: string,
+    mode: IdentityAccountProvisioningMode,
+  ) {
+    return create(IdentityAccountSchema, {
+      metadata: { id },
+      spec: { idpId, provisioningMode: mode },
+    });
+  }
+
+  /** The port's semantics: the direct read answers no federated and no platform-client row. */
+  function accountsOf(...rows: ReturnType<typeof row>[]): AccountsByCaller {
+    return {
+      findById: (id) =>
+        Promise.resolve(rows.find((r) => r.metadata?.id === id)),
+      findDirectByIdpId: (idpId) =>
+        Promise.resolve(
+          rows.find(
+            (r) =>
+              r.spec?.idpId === idpId &&
+              r.spec.provisioningMode !==
+                IdentityAccountProvisioningMode.federated &&
+              r.spec.provisioningMode !==
+                IdentityAccountProvisioningMode.platform_client,
+          ),
+        ),
+    };
+  }
+
+  const direct = row(
+    accountIdFor(PERSON),
+    PERSON,
+    IdentityAccountProvisioningMode.direct,
+  );
+  const federated = row(
+    "ida_federated",
+    PERSON,
+    IdentityAccountProvisioningMode.federated,
+  );
+  const endUser = row(
+    accountIdFor("stgm_pc|acme|user-7"),
+    "stgm_pc|acme|user-7",
+    IdentityAccountProvisioningMode.platform_client,
+  );
+  const lane = row(
+    "ida_guestlane",
+    "stgm_guest|acme",
+    IdentityAccountProvisioningMode.identity_account_provisioning_mode_unspecified,
+  );
+  const token = (sub: string) => ({
+    issuer: "https://issuer.test",
+    rawToken: tokenFor(sub),
+  });
+
+  it.each([
+    [
+      "the trusted-local operator",
+      accountsOf(),
+      caller({ identityId: "operator@example.com" }),
+      localIdpIdFor("operator@example.com"),
+    ],
+    [
+      "an idp-shaped person before their first provisioning",
+      accountsOf(),
+      caller({ identityId: PERSON, ...token(PERSON) }),
+      PERSON,
+    ],
+    [
+      "a person who is already their subject's direct account",
+      accountsOf(direct),
+      caller({ identityId: direct.metadata!.id, ...token(PERSON) }),
+      PERSON,
+    ],
+  ])("admits %s", async (_name, accounts, who, subject) => {
+    expect(await mayProvisionDirectAccount(accounts, who, subject)).toBe(true);
+  });
+
+  it.each([
+    [
+      "a federated account whose provider minted a platform person's subject",
+      accountsOf(direct, federated),
+      caller({ identityId: federated.metadata!.id, ...token(PERSON) }),
+      PERSON,
+    ],
+    [
+      "a federated account whose subject no platform person holds",
+      accountsOf(federated),
+      caller({ identityId: federated.metadata!.id, ...token(PERSON) }),
+      PERSON,
+    ],
+    [
+      "a platform client's user",
+      accountsOf(endUser),
+      caller({
+        identityId: endUser.metadata!.id,
+        ...token("stgm_pc|acme|user-7"),
+      }),
+      "stgm_pc|acme|user-7",
+    ],
+    [
+      "a system lane's token, whose subject is its lane account's id",
+      accountsOf(lane),
+      caller({
+        identityId: lane.metadata!.id,
+        callerClass: "user",
+        ...token(lane.metadata!.id),
+      }),
+      lane.metadata!.id,
+    ],
+    [
+      "a caller of another class, idp-shaped",
+      accountsOf(),
+      caller({
+        identityId: "stgm_channel|acme",
+        callerClass: "channel",
+        ...token("stgm_channel|acme"),
+      }),
+      "stgm_channel|acme",
+    ],
+    [
+      "an identity that is neither its subject nor an account",
+      accountsOf(),
+      caller({ identityId: "someone-else", ...token(PERSON) }),
+      PERSON,
+    ],
+    [
+      "a credential naming no subject",
+      accountsOf(),
+      caller({ identityId: "", ...token("") }),
+      "",
+    ],
+  ])("refuses %s", async (_name, accounts, who, subject) => {
+    expect(await mayProvisionDirectAccount(accounts, who, subject)).toBe(false);
+  });
+
+  it("a store fault propagates as the same error", async () => {
+    const fault = new Error("store is on fire");
+    const broken: AccountsByCaller = {
+      findById: () => Promise.reject(fault),
+      findDirectByIdpId: () => Promise.reject(fault),
+    };
+    await expect(
+      mayProvisionDirectAccount(
+        broken,
+        caller({ identityId: PERSON, ...token(PERSON) }),
+        PERSON,
+      ),
+    ).rejects.toBe(fault);
+  });
+});

package/src/domain/identityaccount/__tests__/resource-store.test.ts

@@ -53,7 +53,7 @@ const CONTRACT_CASE_NAMES = [
   "findByIds answers the present ones in request order and skips the unknown",
   "a disconnected store is an infrastructure fault, never 'not found'",
   "two concurrent saves of one subject end in fulfilments and DuplicateAccountErrors only, and the winner is readable by subject",
-  "findDirectByIdpId and findDirectByEmail never answer a federated account, while findByIdpId (any mode) does",
+  "no subject lookup answers a federated account: its subject is its identity provider's",
   "findDirectByIdpId and findDirectByEmail never answer a platform-client account, while findByIdpId (any mode) does",
   "findByIds answers one row per distinct id, in first-occurrence order; an empty request answers an empty list",
   "update of an unknown id is a no-op: no row appears",

package/src/domain/identityaccount/constants.ts

@@ -49,6 +49,16 @@ export function accountIdFor(idpId: string): string {
   return derivedId(ACCOUNT_ID_PREFIX, idpId);
 }
 
+/**
+ * Whether `id` has an account id's shape, `ida_<...>`: a derived id and a
+ * minted one share it (see the header). A shape test, not an existence
+ * check. Its one use is to skip a read that could only miss, since no
+ * account carries an account id as its subject (resolve.ts).
+ */
+export function isAccountIdShaped(id: string): boolean {
+  return id.startsWith(`${ACCOUNT_ID_PREFIX}_`);
+}
+
 /**
  * The subject namespace of the trusted-local posture. An OIDC subject is
  * `<connection>|<id>` by Auth0 convention; `local|` claims the same shape
@@ -142,6 +152,16 @@ export const ACCOUNT_NOT_FOUND_FOR_CALLER_MESSAGE =
 export const NO_IDP_ID_MESSAGE =
   "Cannot provision account: no IDP ID in authentication context";
 
+/**
+ * provisionMyAccount for a caller the platform's own sign-in did not vouch
+ * for (PERMISSION_DENIED): a person of an organization's identity provider,
+ * a platform client's user, a system lane's token, or any caller that is
+ * not a person. Names no account: the refusal answers before the store is
+ * asked about the credential's subject.
+ */
+export const NOT_A_DIRECT_SIGN_IN_MESSAGE =
+  "Cannot provision account: this RPC provisions a person signing in through this platform's own sign-in, and another lane vouched for this credential";
+
 /** provisionMyAccount when the issuer's userinfo cannot be read (UNAVAILABLE); the cause follows. */
 export const USERINFO_UNAVAILABLE_PREFIX =
   "Failed to fetch user profile from identity provider: ";

package/src/domain/identityaccount/controller.ts

@@ -31,7 +31,9 @@
  * unprovisioned), getByEmail and getByIdpId (lookup FIRST, then
  * authorizeDirect on the FOUND id — the cloud's order; the annotation's
  * `field_path = "value"` would otherwise hand the Authorizer an email as a
- * resource id), getActorInfo, and provisionMyAccount (the provisioner,
+ * resource id), getActorInfo, and provisionMyAccount (PERMISSION_DENIED
+ * first for a caller the platform's own sign-in did not vouch for,
+ * resolve.ts `mayProvisionDirectAccount`; then the provisioner,
  * then — on the call that CREATED the row — the core AccountCreatedHook
  * (open source's membership rules, 20260913.01 slice 4), then the composed
  * post-persist gates; UNAUTHENTICATED with the cloud's copy for a
@@ -101,6 +103,7 @@ import {
   ACCOUNT_NOT_FOUND_FOR_CALLER_MESSAGE,
   CREATE_IS_INTERNAL_MESSAGE,
   NO_IDP_ID_MESSAGE,
+  NOT_A_DIRECT_SIGN_IN_MESSAGE,
   USERINFO_UNAVAILABLE_PREFIX,
   federationUnimplementedMessage,
   idpIdOf,
@@ -113,7 +116,7 @@ import type {
   DirectAccountProvisioner,
 } from "./provisioning.js";
 import { UserInfoFetchError } from "./provisioning.js";
-import { accountForCaller } from "./resolve.js";
+import { accountForCaller, mayProvisionDirectAccount } from "./resolve.js";
 import {
   accountNotFoundError,
   newAssignBackendFieldsStep,
@@ -509,7 +512,7 @@ async function getByEmail(
   );
 }
 
-/** getByIdpId — any provisioning mode; lookup first, authorize on the FOUND id. */
+/** getByIdpId — any provisioning mode but federated (a federated subject is its provider's: getByExternalSub); lookup first, authorize on the FOUND id. */
 async function getByIdpId(
   deps: IdentityAccountControllerDeps,
   idpId: IdpId,
@@ -548,8 +551,10 @@ async function lookupThenAuthorize(
 // ---------------------------------------------------------------------------
 
 /**
- * provisionMyAccount — the subject from the caller's credential, the
- * provisioner's flow, then two post-persist consumers with the caller
+ * provisionMyAccount — the subject from the caller's credential, admitted
+ * only for a caller the platform's own sign-in vouched for
+ * (`mayProvisionDirectAccount`), the provisioner's flow, then two
+ * post-persist consumers with the caller
  * RE-STAMPED as the account: the position-1 identity was idp-shaped
  * because no row existed when the verifier ran, and anything that
  * attributes ownership must name the account, never a principal no later
@@ -582,6 +587,16 @@ async function provisionMyAccount(
   if (idpId === "") {
     throw new ConnectError(NO_IDP_ID_MESSAGE, Code.Unauthenticated);
   }
+  // Before any read of the subject: a credential another lane vouched for
+  // names a subject that lane chose, and the direct account under it is a
+  // platform person's to hold, never that lane's to provision or read.
+  const admitted = await read(
+    () => mayProvisionDirectAccount(deps.accounts, caller, idpId),
+    "failed to resolve the caller's account",
+  );
+  if (!admitted) {
+    throw new ConnectError(NOT_A_DIRECT_SIGN_IN_MESSAGE, Code.PermissionDenied);
+  }
   let account: IdentityAccount;
   let created: boolean;
   try {

package/src/domain/identityaccount/resolve.ts

@@ -54,11 +54,45 @@
  * what "nobody" means (the fire caller's deterministic refusal, the
  * verifier's liveness sentence), so this function answers `undefined`
  * and never throws for it. The empty stamp is `undefined` with no read.
+ *
+ * The fourth reading asks of a stamp that named nobody whether it is the
+ * operator's from before sign-in was turned on:
+ * `isPreSignInOperatorStamp` (stigmer/stigmer#1169). Under the
+ * trusted-local posture every write is stamped with the operator's email,
+ * or with the "system" placeholder when no email is configured, and the
+ * operator's account carries the subject `local|<that stamp>`. After
+ * sign-in the operator signs in as a different account, one derived from
+ * the issuer's subject, which by construction never collides with a
+ * `local|` one (constants.ts). So such a stamp names a principal no
+ * signed-in person is. The API-key verifier asks this so it can refuse
+ * such a key by name instead of admitting a bare email. The answer is yes
+ * for "system" with no read, and for any other stamp when the store holds
+ * `local|<stamp>`, which is one direct-subject read. An account-id stamp
+ * and the empty stamp answer no with no read: the common key costs its
+ * verifier nothing.
+ *
+ * The fifth reading asks of a caller whether the platform's own sign-in
+ * vouched for it: `mayProvisionDirectAccount`, provisionMyAccount's
+ * admission. That RPC provisions the DIRECT account of the credential's
+ * subject, and a subject names a direct account only when the lane that
+ * admitted the caller is one of the platform's own. Every such lane
+ * resolves its caller through `identityIdForSubject` and stamps the `user`
+ * class, so its caller is either idp-shaped (no account, and the identity
+ * is the subject itself) or the direct account of that subject. Anything
+ * else was vouched for by another lane: an organization's identity
+ * provider stamps its own federated account, a platform client's user
+ * token its own account, a system lane its lane account or raw lane
+ * subject. Their `sub` is theirs to choose, so provisioning by it would
+ * hand them a platform person's row, or create one under the subject with
+ * a profile fetched from their own issuer. The trusted-local operator, who
+ * carries no issuer and no token, is the posture's own and is admitted.
+ * Two primary-key reads; faults propagate as they are.
  */
 import type { IdentityAccount } from "@stigmer/protos/ai/stigmer/iam/identityaccount/v1/api_pb";
 
 import type { CallerIdentity } from "../../extensions/identity.js";
-import { idpIdOf } from "./constants.js";
+import { SYSTEM_OPERATOR_IDENTITY_ID } from "../../pipeline/interceptors/auth.js";
+import { idpIdOf, isAccountIdShaped, localIdpIdFor } from "./constants.js";
 import type { IdentityAccountStore } from "./store.js";
 
 /** The one read a verifier needs from the domain: the direct account for a subject. */
@@ -124,3 +158,48 @@ export async function accountForStamp(
     (await accounts.findDirectByIdpId(stamp))
   );
 }
+
+/**
+ * Whether a creator stamp is the operator's from before sign-in was turned
+ * on: the "system" placeholder, or an email whose `local|<email>` account
+ * the store holds. Faults propagate as they are.
+ */
+export async function isPreSignInOperatorStamp(
+  accounts: AccountsBySubject,
+  stamp: string,
+): Promise<boolean> {
+  if (stamp === SYSTEM_OPERATOR_IDENTITY_ID) {
+    return true;
+  }
+  if (stamp === "" || isAccountIdShaped(stamp)) {
+    return false;
+  }
+  return (await accounts.findDirectByIdpId(localIdpIdFor(stamp))) !== undefined;
+}
+
+/**
+ * Whether provisionMyAccount may provision the direct account of
+ * `subject` (the caller's `idpIdOf`) for `caller`: the trusted-local
+ * operator; or a `user`-class caller that is idp-shaped (no account under
+ * its identity, which is the subject itself) or is already that subject's
+ * direct account. Faults propagate as they are.
+ */
+export async function mayProvisionDirectAccount(
+  accounts: AccountsByCaller,
+  caller: CallerIdentity,
+  subject: string,
+): Promise<boolean> {
+  if (caller.issuer === "" && caller.rawToken === "") {
+    return true;
+  }
+  if (caller.callerClass !== "user" || subject === "") {
+    return false;
+  }
+  const standing = await accounts.findById(caller.identityId);
+  if (standing === undefined) {
+    return caller.identityId === subject;
+  }
+  const standingId = standing.metadata?.id ?? "";
+  const direct = await accounts.findDirectByIdpId(subject);
+  return standingId !== "" && direct?.metadata?.id === standingId;
+}

package/src/domain/identityaccount/resource-store.ts

@@ -103,7 +103,12 @@ export function newResourceIdentityAccountStore(
 
     findById: readById,
 
-    findByIdpId: readBySubject,
+    async findByIdpId(idpId): Promise<IdentityAccount | undefined> {
+      const account = await readBySubject(idpId);
+      return account !== undefined && !isFederated(account)
+        ? account
+        : undefined;
+    },
 
     async findDirectByIdpId(idpId): Promise<IdentityAccount | undefined> {
       const account = await readBySubject(idpId);
@@ -151,6 +156,14 @@ export function newResourceIdentityAccountStore(
  * asserted, so no direct lookup — a verifier's subject resolve, getByEmail —
  * may answer it.
  */
+/** A row an identity provider vouches for: its subject is the provider's, reached only by the natural key. */
+function isFederated(account: IdentityAccount): boolean {
+  return (
+    account.spec?.identityProviderRef !== undefined ||
+    account.spec?.provisioningMode === IdentityAccountProvisioningMode.federated
+  );
+}
+
 function isDirect(account: IdentityAccount): boolean {
   const mode = account.spec?.provisioningMode;
   return (