@stigmer/server 3.40.1 → 3.41.0

package/src/domain/iampolicy/__tests__/iampolicy.test.ts

@@ -20,7 +20,8 @@
  *     on the in-process transport (the `internal` class);
  *   - checkMyPermission's three arms: an enterprise-tiered kind is false
  *     with the Authorizer never consulted (the settings navigation stays
- *     hidden); can_grant_access outside the scope is false; an
+ *     hidden); can_grant_access outside the scope is false, while
+ *     can_manage_audience is the Authorizer's answer on every kind; an
  *     organization permission is the composed Authorizer's answer; an
  *     unknown permission is INVALID_ARGUMENT;
  *   - the tuple-half queries are UNIMPLEMENTED with the edition named;
@@ -65,6 +66,7 @@ import {
   roleNotGrantableMessage,
   unknownPermissionMessage,
 } from "../constants.js";
+import { seedOrganizations } from "../../organization/__tests__/support.js";
 import { orgRole, triple } from "./support.js";
 
 const OPERATOR_EMAIL = "operator@example.com";
@@ -115,6 +117,7 @@ describe("iampolicy domain (composed server, trusted-local posture)", () => {
     });
     const port = await server.start();
     transport = createGrpcTransport({ baseUrl: `http://127.0.0.1:${port}` });
+    await seedOrganizations(transport, ["acme"]);
     command = createClient(IamPolicyCommandController, transport);
     query = createClient(IamPolicyQueryController, transport);
     organizations = createClient(OrganizationCommandController, transport);
@@ -191,7 +194,21 @@ describe("iampolicy domain (composed server, trusted-local posture)", () => {
     it("deleting the organization cleans its rows", async () => {
       const org = await newOrganization();
       await organizations.delete({ value: org });
-      const count = await query.getPrincipalsCount({
+      // The wire now refuses a count of an Organization that is gone
+      // (stigmer#1163), so the rows are counted by the server itself: the
+      // in-process caller skips authorization.
+      const wire = await grpcError(() =>
+        query.getPrincipalsCount({
+          orgId: org,
+          principalKind: "identity_account",
+        }),
+      );
+      expect(wire.code).toBe(Code.NotFound);
+      expect(wire.rawMessage).toBe(`Organization not found: ${org}`);
+      const count = await createClient(
+        IamPolicyQueryController,
+        server.inProcessTransport,
+      ).getPrincipalsCount({
         orgId: org,
         principalKind: "identity_account",
       });
@@ -468,6 +485,20 @@ describe("iampolicy domain (composed server, trusted-local posture)", () => {
       expect(viewAgent.isAuthorized).toBe(true);
     });
 
+    it("can_manage_audience is the Authorizer's answer on every kind, where can_grant_access is false outside the scope — the console's audience controls stay the owner's on open source (stigmer#1495)", async () => {
+      for (const [kind, id] of [
+        ["agent", "agt_01hzzzzzzzzzzzzzzzzzzzzzzz"],
+        ["workflow_instance", "win_01hzzzzzzzzzzzzzzzzzzzzzzz"],
+      ] as const) {
+        const resource = create(ApiResourceRefSchema, { kind, id });
+        const audience = await query.checkMyPermission({ resource, relation: "can_manage_audience" });
+        const grant = await query.checkMyPermission({ resource, relation: "can_grant_access" });
+        // The permissive single-team Authorizer allows everything it is asked.
+        expect(audience.isAuthorized, kind).toBe(true);
+        expect(grant.isAuthorized, kind).toBe(false);
+      }
+    });
+
     it("an unknown permission is INVALID_ARGUMENT, quoted", async () => {
       const error = await grpcError(() =>
         query.checkMyPermission({

package/src/domain/iampolicy/__tests__/membership.test.ts

@@ -21,7 +21,11 @@
  *   - `member` otherwise;
  *   - nothing for a non-`user` caller class; nothing on an organization
  *     the account already holds a row on (idempotent by construction), so
- *     a run that faulted midway converges on the next.
+ *     a run that faulted midway converges on the next;
+ *   - nothing, in the reconciliation, for a federated account, whose
+ *     subject and email its identity provider chose: one asserting a
+ *     founder's subject and the operator's email earns neither `owner`
+ *     nor `admin`, nor `member` anywhere.
  *
  *   ensureOperatorOwnership(operator): `owner` on every organization that
  *   has NO owner row (Q-S4-3: a boot-time write never overrides a recorded
@@ -60,6 +64,7 @@ import { TimestampSchema } from "@bufbuild/protobuf/wkt";
 import { AgentSchema } from "@stigmer/protos/ai/stigmer/agentic/agent/v1/api_pb";
 import { SessionSchema } from "@stigmer/protos/ai/stigmer/agentic/session/v1/api_pb";
 import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
+import { ApiResourceReferenceSchema } from "@stigmer/protos/ai/stigmer/commons/apiresource/io_pb";
 import type { IdentityAccount } from "@stigmer/protos/ai/stigmer/iam/identityaccount/v1/api_pb";
 import { IdentityAccountSchema } from "@stigmer/protos/ai/stigmer/iam/identityaccount/v1/api_pb";
 import { IdentityAccountProvisioningMode } from "@stigmer/protos/ai/stigmer/iam/identityaccount/v1/enum_pb";
@@ -81,7 +86,7 @@ import {
 } from "../membership.js";
 import type { MembershipRules, ScannedResource } from "../membership.js";
 import type { IamPolicyStore } from "../store.js";
-import { fakeIamPolicyStore } from "./support.js";
+import { NO_RECORDED_CREATORS, fakeIamPolicyStore } from "./support.js";
 import type { FakeIamPolicyStore } from "./support.js";
 
 const OPERATOR_EMAIL = "operator@example.com";
@@ -124,6 +129,7 @@ describe("membership rules", () => {
   ): MembershipRules {
     return newMembershipRules({
       grantPath: newIamPolicyGrantPath({
+        creators: NO_RECORDED_CREATORS,
         policies: port,
         lifecycle: undefined,
         logger: silentLogger,
@@ -139,6 +145,7 @@ describe("membership rules", () => {
     store = temp.store;
     policies = fakeIamPolicyStore();
     grantPath = newIamPolicyGrantPath({
+      creators: NO_RECORDED_CREATORS,
       policies,
       lifecycle: undefined,
       logger: silentLogger,
@@ -242,10 +249,18 @@ describe("membership rules", () => {
     sub: string,
     email: string,
     createdAtSeconds: number,
-    overrides: { isMachineAccount?: boolean } = {},
+    overrides: { isMachineAccount?: boolean; federated?: boolean } = {},
   ): Promise<IdentityAccount> {
     const row = account(sub, email);
     row.spec!.isMachineAccount = overrides.isMachineAccount ?? false;
+    if (overrides.federated === true) {
+      row.spec!.provisioningMode = IdentityAccountProvisioningMode.federated;
+      row.spec!.identityProviderRef = create(ApiResourceReferenceSchema, {
+        org: "acme",
+        kind: ApiResourceKind.identity_provider,
+        slug: "acme-okta",
+      });
+    }
     row.status = create(IdentityAccountSchema, {
       status: {
         audit: {
@@ -321,7 +336,11 @@ describe("membership rules", () => {
       const alice = account("auth0|alice", "alice@example.com");
       await rules.onAccountCreated(alice, userCaller(alice.metadata!.id));
       // The organization was bootstrapped; its owner is then revoked.
-      await grantPath.revokeOrgAccess(alice.metadata!.id, "acme");
+      await grantPath.revokeOrgAccess(
+        alice.metadata!.id,
+        "acme",
+        userCaller(alice.metadata!.id),
+      );
       expect(policies.rows.size).toBe(0);
       // A second creator stamp keeps the "no other person created anything here" arm from firing on its own.
       await seedAgent("agt_alice", "acme", alice.metadata!.id);
@@ -336,7 +355,11 @@ describe("membership rules", () => {
       await seedOrg("acme", "auth0|alice");
       const alice = account("auth0|alice", "alice@example.com");
       await rules.onAccountCreated(alice, userCaller(alice.metadata!.id));
-      await grantPath.revokeOrgAccess(alice.metadata!.id, "acme");
+      await grantPath.revokeOrgAccess(
+        alice.metadata!.id,
+        "acme",
+        userCaller(alice.metadata!.id),
+      );
       expect(policies.rows.size).toBe(0);
       // No blueprint at all: only the organization's own creator stamp stands between mallory and admin.
       const mallory = account("auth0|mallory", "mallory@example.com");
@@ -646,6 +669,13 @@ describe("membership rules", () => {
         IdentityAccountProvisioningMode.platform_client;
       expect(isPersonAccount(endUser)).toBe(false);
     });
+
+    it("a federated account is not: its subject and its email are the ones its identity provider asserted", () => {
+      const federated = account("okta|00u1", OPERATOR_EMAIL);
+      federated.spec!.provisioningMode =
+        IdentityAccountProvisioningMode.federated;
+      expect(isPersonAccount(federated)).toBe(false);
+    });
   });
 
   describe("ensureRolesForExistingAccounts", () => {
@@ -671,6 +701,18 @@ describe("membership rules", () => {
       );
     });
 
+    it("a federated account earns no role, though its provider asserted the founder's subject and the operator's email", async () => {
+      await seedOrg("acme", "auth0|alice");
+      await seedOrg("globex", "auth0|carol");
+      const federated = await seedAccount("auth0|alice", OPERATOR_EMAIL, 100, {
+        federated: true,
+      });
+
+      await rules.ensureRolesForExistingAccounts();
+
+      expect(rolesOf(federated.metadata!.id)).toEqual([]);
+    });
+
     it("a second call is a no-op — the marker short-circuits before any read", async () => {
       await seedOrg("acme", "auth0|alice");
       await seedAccount("auth0|alice", "alice@example.com", 100);

package/src/domain/iampolicy/__tests__/resource-store.test.ts

@@ -52,6 +52,7 @@ const CONTRACT_CASE_NAMES = [
   "countDistinctPrincipalsByResource counts (kind, id) pairs, not rows, optionally by principal kind",
   "findScopeTuple skips identity_account and team principals and owner and creator relations",
   "deleteById removes the row; the triple is free to be granted again",
+  "a change record changes nothing about the row: save and deleteById behave as without one",
   "deleteById of an unknown id resolves",
   "a disconnected store is an infrastructure fault, never 'not found'",
   "two concurrent saves of one triple end in one row and DuplicatePolicyErrors only",

package/src/domain/iampolicy/__tests__/role-lifecycle.test.ts

@@ -61,7 +61,12 @@ import { policyIdFor } from "../constants.js";
 import { newIamPolicyGrantPath } from "../grant-path.js";
 import { newBuiltInRoleLifecycle } from "../role-lifecycle.js";
 import type { IamPolicyStore } from "../store.js";
-import { fakeIamPolicyStore, orgRole, triple } from "./support.js";
+import {
+  NO_RECORDED_CREATORS,
+  fakeIamPolicyStore,
+  orgRole,
+  triple,
+} from "./support.js";
 import type { RecordedEvent } from "./support.js";
 
 const ALICE_SUBJECT = "auth0|alice";
@@ -129,6 +134,7 @@ function lifecycleOver(
     }),
   );
   const grantPath = newIamPolicyGrantPath({
+    creators: NO_RECORDED_CREATORS,
     policies: store,
     lifecycle: undefined,
     logger: silentLogger,
@@ -230,17 +236,26 @@ describe("onResourceDeleted: the rows die with the resource", () => {
   it("an organization's deletion removes every row on it, as resource and as principal", async () => {
     const recorded: RecordedEvent[] = [];
     const { lifecycle, grantPath, store } = lifecycleOver(recorded);
-    await grantPath.grant(orgRole(ALICE, "owner", "acme"), caller(ALICE));
-    await grantPath.grant(orgRole(ALICE, "member", "acme"), caller(ALICE));
+    await grantPath.grant(
+      orgRole(ALICE, "owner", "acme"),
+      caller(ALICE),
+      "grant",
+    );
+    await grantPath.grant(
+      orgRole(ALICE, "member", "acme"),
+      caller(ALICE),
+      "grant",
+    );
     await grantPath.grant(
       triple({ kind: "organization", id: "acme" }, "organization", {
         kind: "agent",
         id: AGENT,
       }),
       caller(ALICE),
+      "structural",
     );
     const unrelated = orgRole(ALICE, "member", "globex");
-    await grantPath.grant(unrelated, caller(ALICE));
+    await grantPath.grant(unrelated, caller(ALICE), "grant");
     recorded.length = 0;
 
     await lifecycle.onResourceDeleted(
@@ -263,10 +278,22 @@ describe("onResourceDeleted: the rows die with the resource", () => {
   it("an identity account's deletion removes every row it holds anywhere", async () => {
     const recorded: RecordedEvent[] = [];
     const { lifecycle, grantPath, store } = lifecycleOver(recorded);
-    await grantPath.grant(orgRole(ALICE, "owner", "acme"), caller(ALICE));
-    await grantPath.grant(orgRole(ALICE, "member", "globex"), caller(ALICE));
+    await grantPath.grant(
+      orgRole(ALICE, "owner", "acme"),
+      caller(ALICE),
+      "grant",
+    );
+    await grantPath.grant(
+      orgRole(ALICE, "member", "globex"),
+      caller(ALICE),
+      "grant",
+    );
     const bob = accountIdFor("auth0|bob");
-    await grantPath.grant(orgRole(bob, "member", "acme"), caller(ALICE));
+    await grantPath.grant(
+      orgRole(bob, "member", "acme"),
+      caller(ALICE),
+      "grant",
+    );
     recorded.length = 0;
 
     await lifecycle.onResourceDeleted(
@@ -296,6 +323,7 @@ describe("onResourceDeleted: the rows die with the resource", () => {
           id: AGENT,
         }),
         caller(ALICE),
+        "grant",
       );
       recorded.length = 0;
 
@@ -315,6 +343,7 @@ describe("the rest of the contract", () => {
       kind: ApiResourceKind.agent,
       resourceId: AGENT,
       orgId: "acme",
+      caller: caller(ALICE),
       shapesToCreate: ["org-viewer"],
       shapesToDelete: [],
     });
@@ -349,7 +378,11 @@ describe("the rest of the contract", () => {
       deleteById: () => Promise.reject(new Error("disk full")),
     };
     const { lifecycle, grantPath } = lifecycleOver([], faulty);
-    await grantPath.grant(orgRole(ALICE, "owner", "acme"), caller(ALICE));
+    await grantPath.grant(
+      orgRole(ALICE, "owner", "acme"),
+      caller(ALICE),
+      "grant",
+    );
 
     await expect(
       lifecycle.onResourceDeleted(

package/src/domain/iampolicy/__tests__/roles.test.ts

@@ -1,5 +1,5 @@
 /**
- * Pins roles.ts (20260913.01 slice 5): the five assignable roles' display
+ * Pins roles.ts (20260913.01 slice 5): the six assignable roles' display
  * metadata and the allowlist that keeps structural relations out of every
  * access listing — moved from the cloud's iam/policy/roles.ts (the Java
  * IamRoleMetadata port). The allowlist is proven by construction here:
@@ -15,13 +15,14 @@ import {
 } from "../roles.js";
 
 describe("the assignable-role allowlist", () => {
-  it("is exactly the five roles a person can hold, in display order", () => {
+  it("is exactly the six roles a person can hold, in display order", () => {
     expect(assignableRelations()).toEqual([
       "owner",
       "admin",
       "member",
       "viewer",
       "participant",
+      "editor",
     ]);
   });
 

package/src/domain/iampolicy/__tests__/steps.test.ts

@@ -12,6 +12,9 @@
  * names no relation qualifier; a team is granted only its kind's team
  * roles (never ownership, never on a kind that lists none), always as its
  * members, and nothing at all under open source's organization-only scope.
+ * The editor role is granted on the three blueprints to a person or a team
+ * where the scope passes the proto through, refused on a kind that does not
+ * list it, and granted nowhere under open source's scope.
  *
  * Grant and Revoke are proven for the one thing a step adds over the
  * grant path: the result they leave under POLICY_RESULT_KEY (the revoke
@@ -44,6 +47,7 @@ import type { Authorizer, AuthzCheck } from "../../../extensions/authorizer.js";
 import type { CallerIdentity } from "../../../extensions/identity.js";
 import type { PolicyGrantScope } from "../../../extensions/policy-grant-scope.js";
 import { trustedLocalIdentityFor } from "../../../pipeline/interceptors/auth.js";
+import { grantableRolesFor } from "../../../pipeline/apiresource-meta.js";
 import { RequestContext } from "../../../pipeline/request-context.js";
 import {
   LAST_OWNER_MESSAGE,
@@ -71,7 +75,12 @@ import {
   orgAccessOwnerRoleChange,
   specOwnerRoleChange,
 } from "../steps.js";
-import { fakeIamPolicyStore, orgRole, triple } from "./support.js";
+import {
+  NO_RECORDED_CREATORS,
+  fakeIamPolicyStore,
+  orgRole,
+  triple,
+} from "./support.js";
 
 const caller = trustedLocalIdentityFor({
   email: "operator@example.com",
@@ -333,6 +342,60 @@ describe("ValidateGrantableRole", () => {
     });
   });
 
+  describe("the editor role", () => {
+    // The hosted edition's scope narrows nothing: every role the proto lists
+    // is grantable (the cloud's policy grant scope).
+    const everyProtoRole = newValidateGrantableRoleStep({
+      grantableRoles: (kind) => grantableRolesFor(kind),
+    });
+    const person = { kind: "identity_account", id: "ida_bob" };
+    const team = { kind: "team", id: "tm_sre", relation: "member" };
+    const blueprints = [
+      ["agent", "agt_1"],
+      ["workflow", "wfl_1"],
+      ["mcp_server", "mcp_1"],
+    ] as const;
+
+    it("is granted on an agent, a workflow and an MCP server, to a person and to a team", () => {
+      for (const [kind, id] of blueprints) {
+        for (const principal of [person, team]) {
+          expect(
+            everyProtoRole.execute(
+              contextOf(triple(principal, "editor", { kind, id })),
+            ),
+            `${principal.kind} on ${kind}`,
+          ).toBeUndefined();
+        }
+      }
+    });
+
+    it("is refused on a kind that does not list it, with the kind's own roles named", async () => {
+      const error = await refusal(() =>
+        everyProtoRole.execute(
+          contextOf(triple(person, "editor", { kind: "skill", id: "skl_1" })),
+        ),
+      );
+      expect(error.code).toBe(Code.InvalidArgument);
+      expect(error.rawMessage).toBe(
+        roleNotGrantableMessage("editor", "skill", ["owner", "viewer"]),
+      );
+    });
+
+    it("is granted nowhere under open source's organization-only scope", async () => {
+      for (const [kind, id] of blueprints) {
+        const error = await refusal(() =>
+          organizationOnly.execute(
+            contextOf(triple(person, "editor", { kind, id })),
+          ),
+        );
+        expect(error.code, kind).toBe(Code.Unimplemented);
+        expect(error.rawMessage, kind).toBe(
+          PER_RESOURCE_GRANTS_UNIMPLEMENTED_MESSAGE,
+        );
+      }
+    });
+  });
+
   it("a scope can only NARROW the proto: a role it adds is clipped from the list", async () => {
     const widening = newValidateGrantableRoleStep(
       scopeOf(
@@ -382,6 +445,7 @@ describe("ValidateGrantableRole", () => {
 describe("Grant and Revoke leave their result under POLICY_RESULT_KEY", () => {
   function pathOverFreshStore() {
     return newIamPolicyGrantPath({
+      creators: NO_RECORDED_CREATORS,
       policies: fakeIamPolicyStore(),
       lifecycle: undefined,
       logger: silent,
@@ -392,9 +456,9 @@ describe("Grant and Revoke leave their result under POLICY_RESULT_KEY", () => {
     const path = pathOverFreshStore();
     const spec = orgRole("ida_bob", "member", "acme");
     const first = contextOf(spec);
-    await newGrantStep(path).execute(first);
+    await newGrantStep(path, "grant").execute(first);
     const second = contextOf(spec);
-    await newGrantStep(path).execute(second);
+    await newGrantStep(path, "grant").execute(second);
     expect((first.get(POLICY_RESULT_KEY) as IamPolicy).metadata?.id).toBe(
       policyIdFor(spec),
     );
@@ -406,7 +470,7 @@ describe("Grant and Revoke leave their result under POLICY_RESULT_KEY", () => {
   it("Revoke leaves the revoked row, or the default instance when there was none (Java's idempotent delete)", async () => {
     const path = pathOverFreshStore();
     const spec = orgRole("ida_bob", "member", "acme");
-    await path.grant(spec, caller);
+    await path.grant(spec, caller, "grant");
     const revoked = contextOf(spec);
     await newRevokeStep(path).execute(revoked);
     expect((revoked.get(POLICY_RESULT_KEY) as IamPolicy).metadata?.id).toBe(
@@ -468,9 +532,14 @@ describe("owner is assigned by owners", () => {
     roles: ReadonlyArray<readonly [string, string]>,
   ): Promise<ReturnType<typeof fakeIamPolicyStore> & { readonly ownerReads: () => number }> {
     const store = fakeIamPolicyStore();
-    const path = newIamPolicyGrantPath({ policies: store, lifecycle: undefined, logger: silent });
+    const path = newIamPolicyGrantPath({
+      creators: NO_RECORDED_CREATORS,
+      policies: store,
+      lifecycle: undefined,
+      logger: silent,
+    });
     for (const [account, role] of roles) {
-      await path.grant(orgRole(account, role, "acme"), caller);
+      await path.grant(orgRole(account, role, "acme"), caller, "grant");
     }
     let reads = 0;
     const read = store.findByResourceWithRelations.bind(store);

package/src/domain/iampolicy/__tests__/support.ts

@@ -16,9 +16,12 @@ import { IamPolicySpecSchema } from "@stigmer/protos/ai/stigmer/iam/iampolicy/v1
 
 import type {
   PolicyGrantedEvent,
+  OrganizationAffiliationEvent,
   PolicyRevokedEvent,
   ResourceAuthorizationLifecycle,
 } from "../../../extensions/resource-authorization.js";
+import type { PolicyChangeRecord } from "../change.js";
+import type { ResourceCreators } from "../grant-path.js";
 import { DuplicatePolicyError } from "../store.js";
 import type { IamPolicyStore } from "../store.js";
 
@@ -52,6 +55,24 @@ export function triple(
   });
 }
 
+/** A server that stores no resource rows: nothing the sweep meets is anyone's authorship. */
+export const NO_RECORDED_CREATORS: ResourceCreators = {
+  async creatorOf() {
+    return undefined;
+  },
+};
+
+/** Recorded creators by `kind:id`, the removal sweep's authorship read. */
+export function recordedCreators(
+  creators: Readonly<Record<string, string>>,
+): ResourceCreators {
+  return {
+    async creatorOf(kind, id) {
+      return creators[`${kind}:${id}`];
+    },
+  };
+}
+
 /** What a recording fixture saw, in order. */
 export type RecordedEvent =
   | { readonly kind: "row-save"; readonly id: string }
@@ -65,10 +86,23 @@ export type RecordedEvent =
       readonly kind: "revoked";
       readonly id: string | undefined;
       readonly relation: string;
+    }
+  | {
+      readonly kind: "affiliation-changing" | "affiliation-changed";
+      readonly pair: string;
     };
 
+/** A change record the fake store was handed, beside the write it came with. */
+export interface RecordedChange {
+  readonly op: "save" | "delete";
+  readonly id: string;
+  readonly record: PolicyChangeRecord | undefined;
+}
+
 export interface FakeIamPolicyStore extends IamPolicyStore {
   readonly rows: Map<string, IamPolicy>;
+  /** Every save and delete that changed a row, with the record it carried. */
+  readonly changes: RecordedChange[];
 }
 
 /** An in-memory store with the adapter's primary-key semantics; writes are recorded when a log is given. */
@@ -76,6 +110,7 @@ export function fakeIamPolicyStore(
   recorded?: RecordedEvent[],
 ): FakeIamPolicyStore {
   const rows = new Map<string, IamPolicy>();
+  const changes: RecordedChange[] = [];
   const all = (): IamPolicy[] => [...rows.values()];
   const matches = (
     policy: IamPolicy,
@@ -92,16 +127,20 @@ export function fakeIamPolicyStore(
     (resourceId === undefined || policy.spec?.resource?.id === resourceId);
   return {
     rows,
-    async save(policy) {
+    changes,
+    async save(policy, record) {
       const id = policy.metadata?.id ?? "";
       if (rows.has(id)) {
         throw new DuplicatePolicyError(`IAM policy '${id}' already exists`);
       }
       rows.set(id, policy);
+      changes.push({ op: "save", id, record });
       recorded?.push({ kind: "row-save", id });
     },
-    async deleteById(id) {
-      rows.delete(id);
+    async deleteById(id, record) {
+      if (rows.delete(id)) {
+        changes.push({ op: "delete", id, record });
+      }
       recorded?.push({ kind: "row-delete", id });
     },
     async findById(id) {
@@ -165,9 +204,34 @@ export function fakeIamPolicyStore(
 /** A lifecycle that records the two policy hooks and can be told to fail either. */
 export function recordingLifecycle(
   recorded: RecordedEvent[],
-  faults: { readonly granted?: Error; readonly revoked?: Error } = {},
+  faults: {
+    readonly granted?: Error;
+    readonly revoked?: Error;
+    readonly changing?: Error;
+  } = {},
+  options: { readonly affiliation?: boolean } = {},
 ): ResourceAuthorizationLifecycle {
+  const pair = (event: OrganizationAffiliationEvent): string =>
+    `${event.identityAccountId}@${event.organizationId}`;
+  const affiliation: Pick<
+    ResourceAuthorizationLifecycle,
+    "onOrganizationAffiliationChanging" | "onOrganizationAffiliationChanged"
+  > =
+    options.affiliation === true
+      ? {
+          async onOrganizationAffiliationChanging(event) {
+            if (faults.changing !== undefined) {
+              throw faults.changing;
+            }
+            recorded.push({ kind: "affiliation-changing", pair: pair(event) });
+          },
+          async onOrganizationAffiliationChanged(event) {
+            recorded.push({ kind: "affiliation-changed", pair: pair(event) });
+          },
+        }
+      : {};
   return {
+    ...affiliation,
     async onResourceCreated() {},
     async onResourceDeleted() {},
     async onVisibilityChanged() {},