@stigmer/server 3.40.0 → 3.41.0

package/src/domain/workflowinstance/controller.ts

@@ -6,9 +6,12 @@
  * direction of the mutual edge) and enforces the same-org rule; Update
  * enforces spec.workflow_id immutability (oss#646); UpdateVisibility
  * rejects default instances (oss#556, the FAILED_PRECONDITION wins over
- * the level check as in Cloud); UpdateExecutionVisibility persists the
- * run-observability axis faithfully (no FGA in OSS — the Cloud edition
- * reconciles the execution_viewer relation); Delete deliberately does NOT
+ * the level check as in Cloud); UpdateExecutionVisibility is the one door
+ * that changes the run-observability axis after create (Update and Apply
+ * keep the stored level) and tells a composed tuple driver the audience it
+ * names, as create does — open source derives `execution_viewer` from the
+ * row at check time, an edition that stores tuples writes it
+ * (stigmer-cloud#720); Delete deliberately does NOT
  * cascade executions (oss#582 — run history survives its instance).
  *
  * Pipeline per RPC mirrors the Go step chains character-for-character.
@@ -108,8 +111,11 @@ import { ResourceNotFoundError } from "../../store/interface.js";
 import type { Store } from "../../store/interface.js";
 import { workflowInstanceSearchExtractor } from "./search-extractor.js";
 import {
+  newCreateExecutionVisibilityTuplesStep,
   newLoadParentWorkflowStep,
+  newPreserveExecutionVisibilityStep,
   newRejectDefaultWorkflowInstanceVisibilityUpdateStep,
+  newUpdateExecutionVisibilityTuplesStep,
   newValidateInstanceUpdateStep,
   newValidateSameOrgBusinessRuleStep,
   resolveWorkflowInstanceCreateTargets,
@@ -208,6 +214,9 @@ async function createInstance(
         deps.logger,
       ),
     )
+    .addStep(
+      newCreateExecutionVisibilityTuplesStep(deps.authorizationLifecycle),
+    )
     .addStep(
       newIndexSearchStep(
         deps.store,
@@ -247,6 +256,7 @@ async function update(
     .addStep(newLoadExistingStep(deps.store))
     .addStep(newValidateInstanceUpdateStep())
     .addStep(newBuildUpdateStateStep())
+    .addStep(newPreserveExecutionVisibilityStep())
     .addStep(newGuardReservedLabelsStep(deps.authorizer))
     .addStep(newNormalizeReferencesStep())
     .addStep(newValidateReferencesStep(deps.store))
@@ -468,12 +478,14 @@ function newSetInstanceVisibilityStep(): PipelineStep<UpdateVisibilityDesc> {
 
 // ---------------------------------------------------------------------------
 // updateExecutionVisibility — update_execution_visibility.go: a targeted
-// spec update (only spec.execution_visibility changes). In this edition
-// there is a single local user and no fine-grained authorization engine,
-// so run observability has no multi-user effect: the setting persists
-// faithfully (the shared web/desktop UI reads it back) with no
-// authorization tuples. Deliberately NOT guarded for default instances —
-// cloud allows it on them too; do not "fix" that.
+// spec update (only spec.execution_visibility changes), and the one door
+// that changes it after create. Open source authorizes run reads from the
+// row itself (authorization/model/execution-viewer.ts), so the persisted
+// level is the grant; a composed tuple driver hears the audience the new
+// level names after the persist (UpdateExecutionVisibilityTuples,
+// stigmer-cloud#720) and makes its stored tuples match. Deliberately NOT
+// guarded for default instances — cloud allows it on them too; do not
+// "fix" that.
 // ---------------------------------------------------------------------------
 
 const UPDATE_EXECUTION_VISIBILITY_INSTANCE_KEY =
@@ -520,6 +532,12 @@ async function updateExecutionVisibility(
         "PersistInstanceForExecutionVisibilityUpdate",
       ),
     )
+    .addStep(
+      newUpdateExecutionVisibilityTuplesStep(
+        deps.authorizationLifecycle,
+        UPDATE_EXECUTION_VISIBILITY_INSTANCE_KEY,
+      ),
+    )
     .addStep(
       newIndexInstanceStep(
         deps.store,

package/src/domain/workflowinstance/steps.ts

@@ -3,7 +3,12 @@
  * pkg/domain/workflowinstance/controller: parent-workflow load through the
  * in-process workflow client (the other direction of the mutual edge),
  * the same-org business rule, the spec.workflow_id immutability guard
- * (oss#646), and the default-instance visibility guard (oss#556). Proven by
+ * (oss#646), the default-instance visibility guard (oss#556), and the run
+ * audience's lifecycle: `spec.execution_visibility` is set at create and
+ * changed only by updateExecutionVisibility (Update and Apply keep the
+ * stored level, the oss#573 rule for metadata.visibility), and both doors
+ * tell a composed tuple driver the audience the level names
+ * (stigmer-cloud#720). Proven by
  * workflowinstance.conformance.test.ts (CONFORMANCE_TARGET=local) and
  * the family test ../workflow/__tests__/workflow.test.ts (the mutual edge
  * makes the two domains one testable unit).
@@ -15,10 +20,15 @@ import { WorkflowSchema } from "@stigmer/protos/ai/stigmer/agentic/workflow/v1/a
 import type { Workflow } from "@stigmer/protos/ai/stigmer/agentic/workflow/v1/api_pb";
 import { WorkflowInstanceSchema } from "@stigmer/protos/ai/stigmer/agentic/workflowinstance/v1/api_pb";
 import type { WorkflowInstance } from "@stigmer/protos/ai/stigmer/agentic/workflowinstance/v1/api_pb";
+import { WorkflowExecutionVisibility } from "@stigmer/protos/ai/stigmer/agentic/workflowinstance/v1/spec_pb";
 import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
 import { IamPermission } from "@stigmer/protos/ai/stigmer/iam/v1/enum_pb";
 
 import type { Logger } from "../../boot/logger.js";
+import type {
+  ExecutionVisibilityChangedEvent,
+  ResourceAuthorizationLifecycle,
+} from "../../extensions/resource-authorization.js";
 import { isServerComposedRequest } from "../../extensions/identity.js";
 import { isDefaultInstance } from "../../pipeline/apiresource-labels.js";
 import {
@@ -30,6 +40,10 @@ import {
 import type { PipelineStep } from "../../pipeline/pipeline.js";
 import type { RequestContext } from "../../pipeline/request-context.js";
 import type { AuthorizationTarget } from "../../pipeline/steps/authorize.js";
+import {
+  executionAudienceShapes,
+  notifyExecutionVisibilityChanged,
+} from "../../pipeline/steps/authorization-tuples.js";
 import { EXISTING_RESOURCE_KEY } from "../../pipeline/steps/load-existing.js";
 import { rejectDefaultInstanceVisibilityUpdate } from "../../pipeline/steps/validate-visibility.js";
 import { ResourceNotFoundError } from "../../store/interface.js";
@@ -211,6 +225,114 @@ export function newValidateInstanceUpdateStep(): PipelineStep<InstanceDesc> {
   };
 }
 
+/**
+ * PreserveExecutionVisibility — the run audience is update-immutable: the
+ * stored `spec.execution_visibility` replaces whatever the request carried,
+ * after BuildUpdateState's full spec replacement. updateExecutionVisibility
+ * is its one door after create, so a manifest re-applied without the field,
+ * or with a stale level, never silently narrows who can observe the runs;
+ * ignored rather than rejected for the reason BuildUpdateState ignores a
+ * request-carried metadata.visibility (oss#573): the level has a legitimate
+ * second door, so a stale value is routine and must not fail the update.
+ * Runs after LoadExisting; Apply delegates to Update, so the apply door is
+ * covered too, and Update needs no run-audience event.
+ */
+export function newPreserveExecutionVisibilityStep(): PipelineStep<InstanceDesc> {
+  return {
+    name: "PreserveExecutionVisibility",
+    execute(ctx: RequestContext<InstanceDesc>): void {
+      const existing = ctx.get(EXISTING_RESOURCE_KEY) as
+        | WorkflowInstance
+        | undefined;
+      if (existing === undefined) {
+        throw internalError(
+          new Error("existing workflow instance not found in context"),
+          "existing workflow instance not found in context",
+        );
+      }
+      const merged = ctx.newState;
+      if (merged.spec !== undefined) {
+        merged.spec.executionVisibility =
+          existing.spec?.executionVisibility ??
+          WorkflowExecutionVisibility.unspecified;
+      }
+    },
+  };
+}
+
+/** The run-audience event for a persisted instance: the audience its stored level names. */
+function executionVisibilityEventOf(
+  instance: WorkflowInstance,
+): ExecutionVisibilityChangedEvent {
+  return {
+    instanceKind: ApiResourceKind.workflow_instance,
+    instanceId: instance.metadata?.id ?? "",
+    orgId: instance.metadata?.org ?? "",
+    shapes: [
+      ...executionAudienceShapes(
+        instance.spec?.executionVisibility ??
+          WorkflowExecutionVisibility.unspecified,
+      ),
+    ],
+  };
+}
+
+/**
+ * CreateExecutionVisibilityTuples — post-persist in the create chain,
+ * beside CreateAuthorizationTuples: an instance created with a level that
+ * names an audience (ORGANIZATION) tells the driver, which writes the
+ * `execution_viewer` tuple the run history is read through. A private or
+ * unset create names nobody and fires nothing (there is no tuple to
+ * remove). The failure copy is the create lane's own.
+ */
+export function newCreateExecutionVisibilityTuplesStep(
+  lifecycle: ResourceAuthorizationLifecycle | undefined,
+): PipelineStep<InstanceDesc> {
+  return {
+    name: "CreateExecutionVisibilityTuples",
+    async execute(ctx: RequestContext<InstanceDesc>): Promise<void> {
+      const event = executionVisibilityEventOf(ctx.newState);
+      if (event.shapes.length === 0) {
+        return;
+      }
+      await notifyExecutionVisibilityChanged(
+        lifecycle,
+        event,
+        "failed to create authorization tuples",
+      );
+    },
+  };
+}
+
+/**
+ * UpdateExecutionVisibilityTuples — post-persist in the
+ * updateExecutionVisibility chain: fires the audience the new level names,
+ * the empty one included, every time. The event is the target state, so a
+ * repeat of the same level converges and a transition away from
+ * ORGANIZATION removes the tuple without knowing the old level.
+ */
+export function newUpdateExecutionVisibilityTuplesStep<
+  Desc extends DescMessage,
+>(
+  lifecycle: ResourceAuthorizationLifecycle | undefined,
+  instanceKey: string,
+): PipelineStep<Desc> {
+  return {
+    name: "UpdateExecutionVisibilityTuples",
+    async execute(ctx: RequestContext<Desc>): Promise<void> {
+      const instance = ctx.get(instanceKey) as WorkflowInstance | undefined;
+      if (instance?.metadata === undefined || instance.metadata.id === "") {
+        return;
+      }
+      await notifyExecutionVisibilityChanged(
+        lifecycle,
+        executionVisibilityEventOf(instance),
+        "failed to update execution visibility tuples",
+      );
+    },
+  };
+}
+
 /**
  * RejectDefaultInstanceVisibilityUpdate — update_visibility.go: rejects
  * visibility updates on a workflow's system-managed default instance — the

package/src/extensions/__tests__/apikey-before-sign-in-composed.test.ts

@@ -0,0 +1,172 @@
+/**
+ * Pins stigmer/stigmer#1169 end to end: an API key created while the
+ * server trusted every caller is refused BY NAME once sign-in is turned
+ * on, and a key created after signing in works.
+ *
+ * Two boots over ONE data directory, the upgrade a self-hoster makes:
+ *   1. Trusted-local, with an operator email configured: the laptop
+ *      creates an Organization and an API key over the wire. The key's
+ *      creator stamp is the operator's email, the one principal that
+ *      posture has.
+ *   2. The same directory boots with the require-authentication posture
+ *      (a unit that vouches for unsigned JWT-shaped tokens and declares
+ *      the posture, composed-support.ts; the open-source OIDC self-host's
+ *      shape). The old key is refused UNAUTHENTICATED with the sentence
+ *      and the API_KEY_CREATED_BEFORE_SIGN_IN reason, not admitted as a
+ *      bare email that every later check would deny as "Permission
+ *      denied". The operator then signs in, which is a different account,
+ *      derived from the issuer's subject; creates a key; and that key
+ *      authenticates as the account that created it.
+ *
+ * The verifier's per-arm proofs (the "system" stamp, the email-shaped
+ * issuer subject, the read count) are domain/apikey/__tests__/verifier.test.ts;
+ * this file is the upgrade's definition of done at the wire.
+ */
+import { mkdtempSync, rmSync } from "node:fs";
+import { tmpdir } from "node:os";
+import path from "node:path";
+
+import { Code, ConnectError, createClient } from "@connectrpc/connect";
+import { afterAll, beforeAll, describe, expect, it } from "vitest";
+
+import { ApiKeyCommandController } from "@stigmer/protos/ai/stigmer/iam/apikey/v1/command_pb";
+import { IdentityAccountCommandController } from "@stigmer/protos/ai/stigmer/iam/identityaccount/v1/command_pb";
+import { IdentityAccountQueryController } from "@stigmer/protos/ai/stigmer/iam/identityaccount/v1/query_pb";
+import { OrganizationCommandController } from "@stigmer/protos/ai/stigmer/tenancy/organization/v1/command_pb";
+import { ErrorInfoSchema } from "@stigmer/protos/google/rpc/error_details_pb";
+
+import { loadConfig } from "../../boot/config.js";
+import { composeServer } from "../../boot/compose.js";
+import type { ComposedServer } from "../../boot/compose.js";
+import {
+  API_KEY_CREATED_BEFORE_SIGN_IN,
+  API_KEY_CREATED_BEFORE_SIGN_IN_MESSAGE,
+} from "../../domain/apikey/verifier.js";
+import { accountIdFor } from "../../domain/identityaccount/constants.js";
+import {
+  resetOperatorIdentityForTests,
+  setOperatorIdentity,
+} from "../../pipeline/steps/defaults.js";
+import type { ServerExtension } from "../registry.js";
+import {
+  baseConfig,
+  fakeJwt,
+  fakeVerifier,
+  silentLogger,
+  transportFor,
+} from "./composed-support.js";
+
+const OPERATOR_EMAIL = "operator@example.com";
+const OPERATOR_SUBJECT = "fake|operator";
+const ORG = "laptop-org";
+
+describe("an API key created before sign-in was turned on (composed server, two boots over one directory; stigmer/stigmer#1169)", () => {
+  let dir: string;
+  let server: ComposedServer;
+  let port: number;
+  let preSignInKey = "";
+
+  const signInOn: ServerExtension = {
+    name: "fake-oidc-only",
+    requireAuthentication: true,
+    identityVerifiers: [fakeVerifier],
+  };
+
+  async function boot(extensions: ServerExtension[]): Promise<void> {
+    server = await composeServer({
+      config: loadConfig({
+        ...baseConfig(dir),
+        STIGMER_OPERATOR_EMAIL: OPERATOR_EMAIL,
+        STIGMER_OPERATOR_NAME: "The Operator",
+      }),
+      logger: silentLogger,
+      extensions,
+      portOverride: 0,
+      host: "127.0.0.1",
+    });
+    port = await server.start();
+  }
+
+  function apiKeyInput(name: string) {
+    return {
+      apiVersion: "iam.stigmer.ai/v1",
+      kind: "ApiKey",
+      metadata: { name, org: ORG },
+      spec: { neverExpires: true },
+    };
+  }
+
+  beforeAll(async () => {
+    dir = mkdtempSync(path.join(tmpdir(), "apikey-before-sign-in-"));
+    setOperatorIdentity(OPERATOR_EMAIL, "The Operator");
+    await boot([]);
+  });
+
+  afterAll(async () => {
+    await server.shutdown();
+    resetOperatorIdentityForTests();
+    rmSync(dir, { recursive: true, force: true });
+  });
+
+  it("boot 1: the laptop creates an Organization and a key, stamped with the operator's email", async () => {
+    await createClient(
+      OrganizationCommandController,
+      transportFor(port),
+    ).create({
+      apiVersion: "tenancy.stigmer.ai/v1",
+      kind: "Organization",
+      metadata: { name: ORG, slug: ORG, org: "" },
+      spec: { description: ORG },
+    });
+    const created = await createClient(
+      ApiKeyCommandController,
+      transportFor(port),
+    ).create(apiKeyInput("runner"));
+
+    preSignInKey = created.spec?.keyHash ?? "";
+    expect(preSignInKey).toMatch(/^stk_/);
+    expect(created.status?.audit?.specAudit?.createdBy?.id).toBe(
+      OPERATOR_EMAIL,
+    );
+  });
+
+  it("boot 2: with sign-in on, that key is refused by name", async () => {
+    await server.shutdown();
+    await boot([signInOn]);
+
+    const refusal = await createClient(
+      IdentityAccountQueryController,
+      transportFor(port, preSignInKey),
+    )
+      .whoAmI({})
+      .then(
+        () => undefined,
+        (error: unknown) => ConnectError.from(error),
+      );
+
+    expect(refusal?.code).toBe(Code.Unauthenticated);
+    expect(refusal?.rawMessage).toBe(API_KEY_CREATED_BEFORE_SIGN_IN_MESSAGE);
+    const [info] = refusal?.findDetails(ErrorInfoSchema) ?? [];
+    expect(info?.reason).toBe(API_KEY_CREATED_BEFORE_SIGN_IN);
+    expect(info?.domain).toBe("stigmer.ai");
+  });
+
+  it("boot 2: a key created after signing in authenticates as the account that created it", async () => {
+    const operator = fakeJwt(OPERATOR_SUBJECT, OPERATOR_EMAIL);
+    await createClient(
+      IdentityAccountCommandController,
+      transportFor(port, operator),
+    ).provisionMyAccount({});
+    const created = await createClient(
+      ApiKeyCommandController,
+      transportFor(port, operator),
+    ).create(apiKeyInput("runner-after-sign-in"));
+
+    const me = await createClient(
+      IdentityAccountQueryController,
+      transportFor(port, created.spec?.keyHash ?? ""),
+    ).whoAmI({});
+
+    expect(me.metadata?.id).toBe(accountIdFor(OPERATOR_SUBJECT));
+  });
+});

package/src/extensions/__tests__/built-in-authorization-composed.test.ts

@@ -29,7 +29,12 @@
  *     nothing to separate; the laptop's rows are stamped `"system"`):
  *     tokenless reads and organization enumeration keep working, and
  *     the retired public level is refused here exactly as it is under
- *     every other posture (the level is gone, not gated).
+ *     every other posture (the level is gone, not gated). One question
+ *     is answered as under sign-in: a request naming an Organization the
+ *     server does not hold is NOT_FOUND with the same sentence, whether
+ *     it writes (a create, an apply, a session) or reads (a usage
+ *     report), so nothing is stored under a slug no Organization holds
+ *     (stigmer#1163). The OIDC arm pins the same sentence beside it.
  *   - a unit's own Authorizer: nothing built in is installed; the unit's
  *     answer stands even against the founder.
  *
@@ -67,6 +72,7 @@ import type { Agent } from "@stigmer/protos/ai/stigmer/agentic/agent/v1/api_pb";
 import { AgentExecutionQueryController } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/query_pb";
 import { EnvironmentCommandController } from "@stigmer/protos/ai/stigmer/agentic/environment/v1/command_pb";
 import { EnvironmentQueryController } from "@stigmer/protos/ai/stigmer/agentic/environment/v1/query_pb";
+import { SessionCommandController } from "@stigmer/protos/ai/stigmer/agentic/session/v1/command_pb";
 import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
 import { ApiResourceVisibility } from "@stigmer/protos/ai/stigmer/commons/apiresource/enum_pb";
 import { ApiKeyCommandController } from "@stigmer/protos/ai/stigmer/iam/apikey/v1/command_pb";
@@ -102,6 +108,10 @@ const VISITOR = "fake|visitor";
 const ORG = "built-in-org";
 /** Founded AFTER the member provisioned: the member holds no row on it. */
 const OTHER_ORG = "built-in-other-org";
+/** Never created on any server in this file: the phantom target of stigmer#1163. */
+const MISSING_ORG = "never-created-org";
+/** The load-first chain's copy for it, which every posture's Authorize step answers. */
+const MISSING_ORG_NOT_FOUND = `Organization not found: ${MISSING_ORG}`;
 
 function apiKeyInput(name: string) {
   return {
@@ -318,6 +328,20 @@ describe("built-in authorizer (composed server, OIDC with no unit Authorizer: th
     ).toBe(Code.NotFound);
   });
 
+  it("a create into an Organization that does not exist is NOT_FOUND with the load-first copy — the sentence the trusted-local arm pins too (stigmer#1163)", async () => {
+    const failure = await failureOf(
+      createClient(AgentCommandController, asFounder()).create(
+        agentInput(
+          "Phantom Agent",
+          ApiResourceVisibility.visibility_org,
+          MISSING_ORG,
+        ),
+      ),
+    );
+    expect(failure.code).toBe(Code.NotFound);
+    expect(failure.rawMessage).toBe(MISSING_ORG_NOT_FOUND);
+  });
+
   it("an outsider on an EXISTING organization and its agent hears PERMISSION_DENIED — the cloud's answer; NOT_FOUND is for what does not exist", async () => {
     expect(
       await codeOf(
@@ -646,6 +670,61 @@ describe("built-in authorizer (composed server, trusted-local: the permissive de
     });
     expect(search.entries.length).toBeGreaterThanOrEqual(2);
   });
+
+  it("a request naming an Organization that does not exist is NOT_FOUND, as under sign-in, and stores nothing (stigmer#1163)", async () => {
+    const anonymous = transportFor(port);
+    const agents = createClient(AgentCommandController, anonymous);
+    const phantom = agentInput(
+      "Phantom Laptop Agent",
+      ApiResourceVisibility.visibility_org,
+      MISSING_ORG,
+    );
+    const refusals = [
+      ["create", await failureOf(agents.create(phantom))],
+      ["apply", await failureOf(agents.apply(phantom))],
+      [
+        "a session",
+        await failureOf(
+          createClient(SessionCommandController, anonymous).create({
+            apiVersion: "agentic.stigmer.ai/v1",
+            kind: "Session",
+            metadata: { name: "Phantom Session", org: MISSING_ORG },
+            spec: {},
+          }),
+        ),
+      ],
+      [
+        "a usage report",
+        await failureOf(
+          createClient(
+            AgentExecutionQueryController,
+            anonymous,
+          ).getOrgUsageReport({
+            orgId: MISSING_ORG,
+            fromDate: "2026-09-01",
+            toDate: "2026-09-30",
+          }),
+        ),
+      ],
+    ] as const;
+    for (const [lane, failure] of refusals) {
+      expect(failure.code, lane).toBe(Code.NotFound);
+      expect(failure.rawMessage, lane).toBe(MISSING_ORG_NOT_FOUND);
+    }
+    // The search lane skips authorization and indexes on write, so a
+    // phantom row would surface here; the laptop's full scan finds none.
+    const search = await createClient(SearchService, anonymous).search({
+      kinds: [ApiResourceKind.agent],
+      org: MISSING_ORG,
+    });
+    expect(search.entries).toEqual([]);
+    // The positive beside it: the same agent, applied into the
+    // Organization the server holds, lands.
+    const landed = await agents.apply(
+      agentInput("Phantom Laptop Agent", ApiResourceVisibility.visibility_org),
+    );
+    expect(landed.metadata?.org).toBe(ORG);
+  });
 });
 
 /**