@stigmer/server 3.40.1 → 3.41.0

package/src/domain/environment/__tests__/environment.test.ts

@@ -38,6 +38,7 @@ import type { ComposedServer } from "../../../boot/compose.js";
 import { createLogger } from "../../../boot/logger.js";
 import { ENCRYPTED_PREFIX, isCiphertextShaped } from "../../../encryption/encryption.js";
 import { REDACTED_MARKER } from "../constants.js";
+import { seedOrganizations } from "../../organization/__tests__/support.js";
 
 const silentLogger = createLogger({ level: "error", pretty: false, write: () => {} });
 
@@ -84,6 +85,18 @@ async function startServer(env: Record<string, string>): Promise<TestServer> {
   const transport: Transport = createGrpcTransport({
     baseUrl: `http://127.0.0.1:${port}`,
   });
+  await seedOrganizations(transport, [
+    ORG,
+    "other-org",
+    "personal-org-a",
+    "personal-org-b",
+    "personal-org-c",
+    "personal-org-d",
+    "read-org",
+    "vis-org-a",
+    "vis-org-b",
+    "list-org",
+  ]);
   return {
     server,
     command: createClient(EnvironmentCommandController, transport),

package/src/domain/executioncontext/__tests__/executioncontext.test.ts

@@ -61,6 +61,7 @@ import {
   deleteExecutionContextForExecution,
 } from "../temporal/delete-execution-context.js";
 import { executionContextSearchExtractor } from "../search-extractor.js";
+import { seedOrganizations } from "../../organization/__tests__/support.js";
 
 const silentLogger = createLogger({
   level: "error",
@@ -112,6 +113,7 @@ async function startServer(env: Record<string, string>): Promise<TestServer> {
   const transport: Transport = createGrpcTransport({
     baseUrl: `http://127.0.0.1:${port}`,
   });
+  await seedOrganizations(transport, [ORG, "test-org"]);
   return {
     server,
     command: createClient(ExecutionContextCommandController, transport),

package/src/domain/executioncontext/steps.ts

@@ -229,7 +229,8 @@ export function newLoadByExecutionIdStep(
  * Ordered before the duplicate check so an unauthorized caller learns
  * nothing about which execution ids exist.
  *
- * OSS byte-identity: the permissive authorizer allows every check, so the
+ * OSS byte-identity: the trusted-local authorizer allows every check on
+ * an Organization that exists (trusted-local-authorizer.ts), so the
  * single-user posture is unchanged (the rosters prove it).
  */
 export function newAuthorizeExecutionContextCreateStep(

package/src/domain/iampolicy/__tests__/access-lists.test.ts

@@ -350,3 +350,82 @@ describe("buildPrincipalAccessList", () => {
     ]);
   });
 });
+
+describe("buildPrincipalAccessList: only the organization's people", () => {
+  /** An agent in acme: alice (a member) and dave (no role in acme) each hold a viewer grant. */
+  async function sharedAgent() {
+    const store = fakeIamPolicyStore();
+    await store.save(
+      row(
+        scopeLink(
+          { kind: "agent", id: "a1" },
+          { kind: "organization", id: "acme" },
+        ),
+      ),
+    );
+    await store.save(row(orgRole("ida_alice", "member", "acme")));
+    await store.save(row(orgRole("ida_dave", "member", "globex")));
+    for (const account of ["ida_alice", "ida_dave"]) {
+      await store.save(
+        row(
+          triple({ kind: "identity_account", id: account }, "viewer", {
+            kind: "agent",
+            id: "a1",
+          }),
+        ),
+      );
+    }
+    await store.save(
+      row(
+        triple({ kind: "team", id: "tm_1", relation: "member" }, "viewer", {
+          kind: "agent",
+          id: "a1",
+        }),
+      ),
+    );
+    return store;
+  }
+
+  it("leaves out a person who holds no role in the resource's organization, and keeps teams", async () => {
+    const store = await sharedAgent();
+    const entries = await buildPrincipalAccessList(store, nobody, undefined, [
+      { kind: "agent", id: "a1" },
+    ]);
+    expect(
+      entries.map((e) => `${e.principal?.kind}:${e.principal?.id}`),
+    ).toEqual(["identity_account:ida_alice", "team:tm_1"]);
+  });
+
+  it("reads the organization from the walked hierarchy the same way", async () => {
+    const store = await sharedAgent();
+    const entries = await buildPrincipalAccessList(store, nobody, undefined, [
+      { kind: "agent", id: "a1" },
+      { kind: "organization", id: "acme" },
+    ]);
+    expect(entries.map((e) => e.principal?.id)).toEqual(["ida_alice", "tm_1"]);
+  });
+
+  it("an organization's own list is its roles and is never filtered", async () => {
+    const store = await sharedAgent();
+    const entries = await buildPrincipalAccessList(store, nobody, undefined, [
+      { kind: "organization", id: "globex" },
+    ]);
+    expect(entries.map((e) => e.principal?.id)).toEqual(["ida_dave"]);
+  });
+
+  it("a resource no organization holds is listed as its rows say", async () => {
+    const store = fakeIamPolicyStore();
+    await store.save(
+      row(
+        triple({ kind: "identity_account", id: "ida_dave" }, "viewer", {
+          kind: "agent",
+          id: "loose",
+        }),
+      ),
+    );
+    const entries = await buildPrincipalAccessList(store, nobody, undefined, [
+      { kind: "agent", id: "loose" },
+    ]);
+    expect(entries.map((e) => e.principal?.id)).toEqual(["ida_dave"]);
+  });
+});

package/src/domain/iampolicy/__tests__/change.test.ts

@@ -0,0 +1,63 @@
+/**
+ * Pins the one definition of an access row and the one conversion from a
+ * caller to the actor a change record carries (change.ts). An access row
+ * names a person or an audience written as a userset; a row naming a
+ * resource with no relation is a structural link and is never recorded.
+ * The actor keeps the caller's id and class and drops everything else, so
+ * a permission history holds no email, display name or token.
+ */
+import { describe, expect, it } from "vitest";
+
+import type { CallerIdentity } from "../../../extensions/identity.js";
+import { grantsAccess, policyActorOf } from "../change.js";
+import { triple } from "./support.js";
+
+describe("grantsAccess", () => {
+  const agent = { kind: "agent", id: "agt_01hzzzzzzzzzzzzzzzzzzzzzzz" };
+
+  it.each([
+    ["a person", { kind: "identity_account", id: "ida_1" }, true],
+    [
+      "a team's members",
+      { kind: "team", id: "tm_1", relation: "member" },
+      true,
+    ],
+    [
+      "an organization's viewers",
+      { kind: "organization", id: "acme", relation: "viewer" },
+      true,
+    ],
+    [
+      "an identity provider's platform users",
+      { kind: "identity_provider", id: "idp_1", relation: "platform_user" },
+      true,
+    ],
+    ["a parent organization", { kind: "organization", id: "acme" }, false],
+    ["a blueprint (default instance)", { kind: "agent", id: "agt_2" }, false],
+    [
+      "an identity provider (managed organization)",
+      { kind: "identity_provider", id: "idp_1" },
+      false,
+    ],
+  ])("a row naming %s: %s", (_name, principal, expected) => {
+    expect(grantsAccess(triple(principal, "viewer", agent))).toBe(expected);
+  });
+});
+
+describe("policyActorOf", () => {
+  it("keeps the caller's id and class and nothing else", () => {
+    const caller: CallerIdentity = {
+      identityId: "ida_1",
+      callerClass: "internal",
+      issuer: "https://issuer.example.com",
+      rawToken: "secret",
+      email: "alice@example.com",
+      displayName: "Alice",
+      origin: "in-process",
+    };
+    expect(policyActorOf(caller)).toStrictEqual({
+      id: "ida_1",
+      callerClass: "internal",
+    });
+  });
+});

package/src/domain/iampolicy/__tests__/controller.test.ts

@@ -93,7 +93,12 @@ import {
 import { registerIamPolicyServices } from "../controller.js";
 import { newIamPolicyGrantPath } from "../grant-path.js";
 import { newOrganizationOnlyGrantScope } from "../grant-scope.js";
-import { fakeIamPolicyStore, orgRole, triple } from "./support.js";
+import {
+  NO_RECORDED_CREATORS,
+  fakeIamPolicyStore,
+  orgRole,
+  triple,
+} from "./support.js";
 
 const silent = createLogger({ level: "error", pretty: false, write: () => {} });
 
@@ -225,6 +230,7 @@ async function harness(options: {
   const authorizer = recordingAuthorizer();
   const engine = options.engine === true ? recordingEngine() : undefined;
   const grantPath = newIamPolicyGrantPath({
+    creators: NO_RECORDED_CREATORS,
     policies,
     lifecycle: undefined,
     logger: silent,
@@ -350,6 +356,31 @@ describe("the three system RPCs (Q-OR-7, Q-S5-10)", () => {
   });
 });
 
+describe("each lane hands the store its own door and its caller", () => {
+  const member = orgRole(OPERATOR_ID, "member", "acme");
+
+  it("create records a grant and delete a revoke, both as the chain's caller", async () => {
+    const h = await harness({ caller: alice });
+    await h.command.create(member);
+    await h.command.delete(member);
+    const actor = { id: alice.identityId, callerClass: "user" };
+    expect(h.policies.changes.map((change) => [change.op, change.record])).toEqual([
+      ["save", { actor, cause: "grant", organizationId: "acme" }],
+      ["delete", { actor, cause: "revoke", organizationId: "acme" }],
+    ]);
+  });
+
+  it("bootstrapPolicy records a structural change and cleanupResourcePolicies a deleted resource", async () => {
+    const h = await harness({ caller: machine });
+    await h.command.bootstrapPolicy(member);
+    await h.command.cleanupResourcePolicies(ref("organization", "acme"));
+    expect(h.policies.changes.map((change) => change.record?.cause)).toEqual([
+      "structural",
+      "resource_deleted",
+    ]);
+  });
+});
+
 describe("checkMyPermission (Q-OR-8, Q-S5-3)", () => {
   const platform = ref("platform", "stigmer");
   const acme = ref("organization", "acme");
@@ -957,9 +988,14 @@ describe("owner is assigned by owners, on the three caller lanes", () => {
     h: Harness,
     roles: ReadonlyArray<readonly [string, string]>,
   ): Promise<void> {
-    const path = newIamPolicyGrantPath({ policies: h.policies, lifecycle: undefined, logger: silent });
+    const path = newIamPolicyGrantPath({
+      creators: NO_RECORDED_CREATORS,
+      policies: h.policies,
+      lifecycle: undefined,
+      logger: silent,
+    });
     for (const [account, role] of roles) {
-      await path.grant(orgRole(account, role, "acme"), internal);
+      await path.grant(orgRole(account, role, "acme"), internal, "grant");
     }
   }