@stigmer/server 3.40.1 → 3.41.0

package/src/extensions/__tests__/identity-account-composed.test.ts

@@ -24,7 +24,12 @@
  *       verifier + the store driver — the cloud composition's exact shape:
  *       provisionMyAccount lands the row in the driver, and an API key the
  *       subject minted resolves through the OSS API-key lane to the
- *       driver's account. This is the lane the cloud actually runs over its
+ *       driver's account. A second verifier of the unit's stands for a lane
+ *       that vouches for its own accounts (an organization's identity
+ *       provider): its caller is refused PERMISSION_DENIED before the
+ *       subject its token names is read, whether a platform person already
+ *       holds that subject's direct account or nobody does, and nothing is
+ *       created. This is the lane the cloud actually runs over its
  *       driver; an OSS adapter over the cloud's generic store would miss
  *       every lookup and no other test would notice.
  *   (C) the same posture and verifier + the provision slot registered by
@@ -62,13 +67,17 @@ import { ApiKeyCommandController } from "@stigmer/protos/ai/stigmer/iam/apikey/v
 import type { IdentityAccount } from "@stigmer/protos/ai/stigmer/iam/identityaccount/v1/api_pb";
 import { IdentityAccountSchema } from "@stigmer/protos/ai/stigmer/iam/identityaccount/v1/api_pb";
 import { IdentityAccountCommandController } from "@stigmer/protos/ai/stigmer/iam/identityaccount/v1/command_pb";
+import { IdentityAccountProvisioningMode } from "@stigmer/protos/ai/stigmer/iam/identityaccount/v1/enum_pb";
 import { IdentityAccountQueryController } from "@stigmer/protos/ai/stigmer/iam/identityaccount/v1/query_pb";
 import { IamPermission } from "@stigmer/protos/ai/stigmer/iam/v1/enum_pb";
 
 import { loadConfig } from "../../boot/config.js";
 import { composeServer } from "../../boot/compose.js";
 import type { ComposedServer } from "../../boot/compose.js";
-import { accountIdFor } from "../../domain/identityaccount/constants.js";
+import {
+  accountIdFor,
+  NOT_A_DIRECT_SIGN_IN_MESSAGE,
+} from "../../domain/identityaccount/constants.js";
 import { newResourceIdentityAccountStore } from "../../domain/identityaccount/resource-store.js";
 import type { IdentityAccountStore } from "../../domain/identityaccount/store.js";
 import {
@@ -80,7 +89,7 @@ import type { Store } from "../../store/interface.js";
 import { SqliteStore } from "../../store/sqlite/store.js";
 import type { Authorizer } from "../authorizer.js";
 import type { GateSlotName } from "../gate-slots.js";
-import type { CallerIdentity } from "../identity.js";
+import type { CallerIdentity, IdentityVerifier } from "../identity.js";
 import type { IdentityFederation } from "../identity-federation.js";
 import type { ServerExtension } from "../registry.js";
 import {
@@ -486,6 +495,37 @@ describe("identity-account points (composed server, trusted-local: driver + fede
 // (B) the cloud's shape: a declared posture, the unit's verifier, the driver
 // ---------------------------------------------------------------------------
 
+/**
+ * A lane that vouches for accounts of its own, the shape of an
+ * organization's identity provider: a JWT-shaped token whose third segment
+ * is `lane`, carrying `sub` (the subject the lane chose) and `acct` (the
+ * account it stamps). Nothing about it is a platform sign-in.
+ */
+function laneJwt(sub: string, acct: string): string {
+  const segment = (value: unknown): string =>
+    Buffer.from(JSON.stringify(value)).toString("base64url");
+  return `${segment({ alg: "none" })}.${segment({ sub, acct })}.lane`;
+}
+
+const laneVerifier: IdentityVerifier = {
+  name: "fake-lane-verifier",
+  verify: (token) => {
+    const segments = token.split(".");
+    if (segments.length !== 3 || segments[2] !== "lane") {
+      return Promise.resolve(null);
+    }
+    const claims = JSON.parse(
+      Buffer.from(segments[1] ?? "", "base64url").toString("utf8"),
+    ) as { acct?: unknown };
+    return Promise.resolve({
+      identityId: typeof claims.acct === "string" ? claims.acct : "",
+      callerClass: "user",
+      issuer: "https://lane.invalid",
+      rawToken: token,
+    });
+  },
+};
+
 describe("identity-account points (composed server, declared posture: the verifiers follow the driver)", () => {
   const SUB = "fake|provisioned-subject";
   const EMAIL = "provisioned@example.com";
@@ -500,7 +540,7 @@ describe("identity-account points (composed server, declared posture: the verifi
     const unit: ServerExtension = {
       name: "fake-iam",
       requireAuthentication: true,
-      identityVerifiers: [fakeVerifier],
+      identityVerifiers: [fakeVerifier, laneVerifier],
       drivers: { identityAccountStore: driver.accounts },
     };
     server = await composeServer({
@@ -535,6 +575,46 @@ describe("identity-account points (composed server, declared posture: the verifi
     expect(await accountIdsIn(server.store)).toEqual([]);
   });
 
+  it.each([
+    ["a platform person already holds the subject's direct account", SUB, true],
+    ["nobody holds the subject", "fake|nobody-yet", false],
+  ])(
+    "a lane's own account is refused provisionMyAccount before its subject is read (%s), and nothing is created",
+    async (_case, subject, personHoldsIt) => {
+      if (personHoldsIt) {
+        // The platform person signs in first (idempotent if an earlier case did).
+        await createClient(
+          IdentityAccountCommandController,
+          transportFor(port, fakeJwt(subject, EMAIL)),
+        ).provisionMyAccount({});
+      }
+      const laneAccount = "ida_lane_account";
+      await driver.accounts.save(
+        create(IdentityAccountSchema, {
+          apiVersion: "iam.stigmer.ai/v1",
+          kind: "IdentityAccount",
+          metadata: { id: laneAccount, name: "lane person" },
+          spec: {
+            idpId: subject,
+            provisioningMode: IdentityAccountProvisioningMode.federated,
+            identityProviderRef: { org: "acme", slug: "acme-okta" },
+          },
+        }),
+      );
+      const before = await accountIdsIn(driver.store);
+      const refused = await connectErrorOf(
+        createClient(
+          IdentityAccountCommandController,
+          transportFor(port, laneJwt(subject, laneAccount)),
+        ).provisionMyAccount({}),
+      );
+      expect(refused.code).toBe(Code.PermissionDenied);
+      expect(refused.rawMessage).toBe(NOT_A_DIRECT_SIGN_IN_MESSAGE);
+      expect(await accountIdsIn(driver.store)).toEqual(before);
+      await driver.accounts.deleteById(laneAccount);
+    },
+  );
+
   it("an API key the subject minted resolves through the OSS API-key lane to the DRIVER's account", async () => {
     const minted = await createClient(
       ApiKeyCommandController,

package/src/extensions/__tests__/list-read-scope-composed.test.ts

@@ -65,6 +65,7 @@ import {
 } from "../../pipeline/interceptors/auth.js";
 import type { ListReadScope } from "../list-read-scope.js";
 import type { ServerExtension } from "../registry.js";
+import { seedOrganizations } from "../../domain/organization/__tests__/support.js";
 
 const silentLogger = createLogger({
   level: "error",
@@ -130,6 +131,7 @@ describe("list read scope (composed server, fake scope)", () => {
     });
     const port = await server.start();
     transport = createGrpcTransport({ baseUrl: `http://127.0.0.1:${port}` });
+    await seedOrganizations(transport, ["acme"]);
 
     // Two rows per kind — one the scope will keep, one it must hide.
     // Seeded through the store: the write path is not under test.

package/src/extensions/__tests__/registry.test.ts

@@ -5,13 +5,16 @@
  * enforcement for authorizer and edition, unique unit names, the
  * unknown-gate-slot boot throw, and the O5 driver points (single-instance
  * providers, name-keyed storage-driver registration with duplicate and
- * built-in-shadow throws). The composed-server behavior (services on
+ * built-in-shadow throws), the row readers' kind-keyed merge with its
+ * reserved kinds, and the units' hand-over and start points kept in unit
+ * order. The composed-server behavior (services on
  * both routers, edition on the wire) is pinned by
  * extension-composition.test.ts; empty-set wire byte-identity is pinned by
  * the conformance rosters.
  */
 import { describe, expect, it } from "vitest";
 
+import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
 import { ServerEdition } from "@stigmer/protos/ai/stigmer/platform/v1/server_info_pb";
 import type { DescMessage } from "@bufbuild/protobuf";
 
@@ -28,6 +31,7 @@ import type { CallerGuard } from "../caller-guards.js";
 import { DECLARED_GATE_SLOTS, GATE_SLOT_NAMES } from "../gate-slots.js";
 import type { GateSlotName } from "../gate-slots.js";
 import type { IdentityVerifier } from "../identity.js";
+import type { ResourceRowReader } from "../resource-row-reader.js";
 import { resolveExtensions } from "../registry.js";
 import type { ServerExtension } from "../registry.js";
 
@@ -146,6 +150,9 @@ describe("resolveExtensions — defaults", () => {
     expect(resolved.drivers.secretCodecs.size).toBe(0);
     expect(resolved.services).toEqual([]);
     expect(resolved.workers).toEqual([]);
+    expect(resolved.drivers.resourceRowReaders.size).toBe(0);
+    expect(resolved.onComposed).toEqual([]);
+    expect(resolved.start).toEqual([]);
   });
 
   it("resolves the empty list identically to the omitted set", () => {
@@ -683,3 +690,142 @@ describe("resolveExtensions — loud-fail throws (DD-006 §2b)", () => {
     );
   });
 });
+
+/**
+ * The row readers (drivers.resourceRowReaders): a kind-keyed map merged
+ * across units under the keyed maps' rule — one reader per kind, and none
+ * for a kind open source keeps in its own store or reads through the
+ * account port, since a reader there would answer checks from rows the
+ * lanes never wrote.
+ */
+describe("resolveExtensions — resource row readers", () => {
+  const reader = (): ResourceRowReader => ({
+    findById: () => Promise.resolve(undefined),
+  });
+
+  it("merges readers as a kind-keyed map across units", () => {
+    const providers = reader();
+    const teams = reader();
+    const resolved = resolveExtensions([
+      {
+        name: "identity",
+        drivers: {
+          resourceRowReaders: new Map([
+            [ApiResourceKind.identity_provider, providers],
+          ]),
+        },
+      },
+      {
+        name: "teams",
+        drivers: {
+          resourceRowReaders: new Map([[ApiResourceKind.team, teams]]),
+        },
+      },
+    ]);
+    expect(
+      resolved.drivers.resourceRowReaders.get(
+        ApiResourceKind.identity_provider,
+      ),
+    ).toBe(providers);
+    expect(resolved.drivers.resourceRowReaders.get(ApiResourceKind.team)).toBe(
+      teams,
+    );
+    expect(resolved.drivers.resourceRowReaders.size).toBe(2);
+  });
+
+  it("throws on a second reader for one kind, naming both units", () => {
+    expect(() =>
+      resolveExtensions([
+        {
+          name: "first",
+          drivers: {
+            resourceRowReaders: new Map([
+              [ApiResourceKind.invitation, reader()],
+            ]),
+          },
+        },
+        {
+          name: "second",
+          drivers: {
+            resourceRowReaders: new Map([
+              [ApiResourceKind.invitation, reader()],
+            ]),
+          },
+        },
+      ]),
+    ).toThrowError(
+      /extension 'second' registers a row reader for 'invitation', but 'first' already did/,
+    );
+  });
+
+  it("throws on a reader for a kind open source serves from its own store", () => {
+    expect(() =>
+      resolveExtensions([
+        {
+          name: "shadowing",
+          drivers: {
+            resourceRowReaders: new Map([[ApiResourceKind.agent, reader()]]),
+          },
+        },
+      ]),
+    ).toThrowError(
+      "extension 'shadowing' registers a row reader for 'agent', which open source serves from its own store — readers are for kinds a unit keeps itself",
+    );
+  });
+
+  it("throws on a reader for the identity account, which the account port reads", () => {
+    expect(() =>
+      resolveExtensions([
+        {
+          name: "accounts",
+          drivers: {
+            resourceRowReaders: new Map([
+              [ApiResourceKind.identity_account, reader()],
+            ]),
+          },
+        },
+      ]),
+    ).toThrowError(
+      /registers a row reader for 'identity_account', which is reserved — identity accounts are read through the account port/,
+    );
+  });
+
+  it("throws on a reader for the unknown kind", () => {
+    expect(() =>
+      resolveExtensions([
+        {
+          name: "unknown",
+          drivers: {
+            resourceRowReaders: new Map([
+              [ApiResourceKind.api_resource_kind_unknown, reader()],
+            ]),
+          },
+        },
+      ]),
+    ).toThrowError(/registers a row reader for the unknown kind/);
+  });
+});
+
+/**
+ * The two unit points (extensions/composed-services.ts): each unit's
+ * hand-over and start hook is kept with its unit's name, in unit order,
+ * so compose.ts calls them in that order and a failing start names its
+ * unit. A unit that declares neither contributes nothing.
+ */
+describe("resolveExtensions — the hand-over and start points", () => {
+  it("keeps each unit's hooks with its name, in unit order", () => {
+    const composedFirst = (): void => {};
+    const composedThird = (): void => {};
+    const startFirst = (): Promise<void> => Promise.resolve();
+    const resolved = resolveExtensions([
+      { name: "first", onComposed: composedFirst, start: startFirst },
+      { name: "second" },
+      { name: "third", onComposed: composedThird },
+    ]);
+    expect(resolved.onComposed).toEqual([
+      { unit: "first", hook: composedFirst },
+      { unit: "third", hook: composedThird },
+    ]);
+    expect(resolved.start).toEqual([{ unit: "first", hook: startFirst }]);
+  });
+});

package/src/extensions/__tests__/secret-cleanup-composed.test.ts

@@ -54,6 +54,7 @@ import type { SecretCodec } from "../../encryption/codec.js";
 import type { EncryptionScope } from "../../encryption/encryption.js";
 import { REDACTED_MARKER } from "../../encryption/encryption.js";
 import { ResourceNotFoundError } from "../../store/interface.js";
+import { seedOrganizations } from "../../domain/organization/__tests__/support.js";
 
 const silentLogger = createLogger({
   level: "error",
@@ -127,6 +128,7 @@ beforeAll(async () => {
   const transport: Transport = createGrpcTransport({
     baseUrl: `http://127.0.0.1:${port}`,
   });
+  await seedOrganizations(transport, [ORG]);
   envCommand = createClient(EnvironmentCommandController, transport);
   oauthCommand = createClient(OAuthAppCommandController, transport);
   channelCommand = createClient(ChannelAppCommandController, transport);

package/src/extensions/__tests__/visitor-classifier-points.test.ts

@@ -0,0 +1,42 @@
+/**
+ * Pins the visitorClassifier driver point in the single-instance shape the
+ * registry already enforces for outboundEgress and licenseStatus:
+ *
+ *   - `drivers.visitorClassifier` — which callers are visitors, read by
+ *     ComposeDeclaredPreferences to withhold the organization's standing
+ *     context (stigmer/stigmer#1401); single instance; absent = nobody is
+ *     a visitor, open source's own posture.
+ *
+ * What the step does with it is pinned beside the step
+ * (domain/agentexecution/__tests__/create-steps.test.ts).
+ */
+import { describe, expect, it } from "vitest";
+
+import { resolveExtensions } from "../registry.js";
+import type { VisitorClassifier } from "../visitor-classifier.js";
+
+const nobody: VisitorClassifier = { isVisitor: () => false };
+
+describe("the visitorClassifier driver point", () => {
+  it("is undefined with no extensions — nobody is a visitor", () => {
+    expect(resolveExtensions([]).drivers.visitorClassifier).toBeUndefined();
+  });
+
+  it("carries the one registered instance through", () => {
+    const resolved = resolveExtensions([
+      { name: "cloud-sharing", drivers: { visitorClassifier: nobody } },
+    ]);
+    expect(resolved.drivers.visitorClassifier).toBe(nobody);
+  });
+
+  it("throws on a second registration, naming both units", () => {
+    expect(() =>
+      resolveExtensions([
+        { name: "visitors-a", drivers: { visitorClassifier: nobody } },
+        { name: "visitors-b", drivers: { visitorClassifier: nobody } },
+      ]),
+    ).toThrowError(
+      /extension 'visitors-b' registers a VisitorClassifier, but 'visitors-a' already did/,
+    );
+  });
+});

package/src/extensions/composed-services.ts

@@ -0,0 +1,61 @@
+/**
+ * The composed services — what the composition built that a unit's own
+ * lanes must use, handed to the unit rather than rebuilt by it. A unit
+ * receives them through `ServerExtension.onComposed` (extensions/
+ * registry.ts), called once, in unit order, at the end of `composeServer`,
+ * before it returns; and it runs boot work that needs them through
+ * `ServerExtension.start`, called in unit order first in the server's
+ * `start()`, before any worker, reconciler or listener.
+ *
+ * Why the composition hands these over instead of the host passing them
+ * in: under open source's own authorization the Authorizer, the list read
+ * scope and the policy check are built inside `composeServer`, after every
+ * unit exists, so no host could pass them; and where a host could (its own
+ * Authorizer), handing the unit anything but the instance the Authorize
+ * step calls would let the unit's gates ask a different question than the
+ * chain around them. Receiving the one instance makes that impossible by
+ * construction, in every host.
+ *
+ * The contract:
+ *   - `onComposed` is synchronous and only keeps what it is handed. The
+ *     unit's lanes may be called by anyone once `composeServer` returns (a
+ *     host's own sweep before `start`, a test that never starts), so the
+ *     services must be in place by then; nothing in `composeServer` calls
+ *     a unit's lanes before the hand-over.
+ *   - `start` runs boot work that must finish before anything serves (a
+ *     repair of the unit's own rows). A throw fails `start()`, so a server
+ *     whose repair failed never listens.
+ *   - Every field is the composition's one instance, whichever posture
+ *     built it: a unit's registration, or open source's built-in.
+ */
+import type { Transport } from "@connectrpc/connect";
+
+import type { AuthorizationQueryEngine } from "./authorization-queries.js";
+import type { Authorizer } from "./authorizer.js";
+import type { ListReadScope } from "./list-read-scope.js";
+import type { ResourceAuthorizationLifecycle } from "./resource-authorization.js";
+
+export interface ComposedServices {
+  /** The one Authorizer the Authorize step of every chain calls. */
+  readonly authorizer: Authorizer;
+  /** The one list read scope; undefined where lists are the full scan (open source signed-out). */
+  readonly listReadScope: ListReadScope | undefined;
+  /**
+   * "Is this policy effectively held": the registered engine's `check`, or
+   * under open source's own authorization the evaluator's
+   * (authorization/policy-check.ts); undefined where neither exists (a
+   * unit Authorizer with no engine, or open source signed-out).
+   */
+  readonly authorizationQueries:
+    | Pick<AuthorizationQueryEngine, "check">
+    | undefined;
+  /**
+   * The registered tuple lifecycle; undefined where the tuples are derived
+   * from the rows, so a unit's creation event has nothing to write.
+   */
+  readonly resourceAuthorizationLifecycle:
+    | ResourceAuthorizationLifecycle
+    | undefined;
+  /** The in-process transport: server code calling another domain's RPCs rides it (boot/inprocess.ts). */
+  readonly inProcessTransport: Transport;
+}

package/src/extensions/drivers.ts

@@ -43,6 +43,12 @@
  *     `cloud.iam_platform_client` driver fills, the RS256 key ring every
  *     self-signed token rides, and the one token method only an edition
  *     that hosts shared-agent pages serves) — landed 2026-09-23
+ *   - visitor classifier (which callers are visitors: admitted to the
+ *     organization's agents without belonging to it, whose runs never
+ *     carry its standing context) — landed with stigmer/stigmer#1401
+ *   - resource row readers (where the built-in authorizer reads the rows
+ *     of a kind a unit keeps in a store of its own, so an edition above
+ *     open source can keep open source's authorizer) — landed 2026-09-29
  *
  * Merge rules (enforced by resolveExtensions, DD-006 §2b): the two
  * provider kinds are single-instance points — a second declaring unit is
@@ -50,10 +56,14 @@
  * and sandbox-provisioner drivers merge as name-keyed maps — a
  * duplicated name, or a name shadowing a built-in, is a boot throw (the
  * gateSteps rule: a registration the factory could never reach must fail
- * loudly, not sit dark). OSS defaults install at the boot/compose.ts
+ * loudly, not sit dark); resource row readers merge as a kind-keyed map
+ * under the same rule, with open-source kinds and the identity account
+ * reserved (extensions/resource-row-reader.ts). OSS defaults install at the boot/compose.ts
  * consumption sites, never here (the default-lives-with-the-consumer
  * doctrine).
  */
+import type { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
+
 import type { ArtifactStorageDriverFactory } from "../artifactstorage/artifact-storage.js";
 import type { ChannelRuntime } from "../domain/agentchannel/channel-runtime.js";
 import type { IdentityAccountStore } from "../domain/identityaccount/store.js";
@@ -75,7 +85,9 @@ import type { OrganizationDirectory } from "./organization-directory.js";
 import type { PolicyGrantScope } from "./policy-grant-scope.js";
 import type { PrincipalDisplay } from "./principal-display.js";
 import type { ResourceAuthorizationLifecycle } from "./resource-authorization.js";
+import type { ResourceRowReader } from "./resource-row-reader.js";
 import type { ScheduleFireCallerMint } from "./schedule-fire-caller.js";
+import type { VisitorClassifier } from "./visitor-classifier.js";
 
 /** The driver contributions of one extension unit. */
 export interface ExtensionDrivers {
@@ -296,4 +308,24 @@ export interface ExtensionDrivers {
    * (extensions/guest-token-minting.ts carries the contract).
    */
   readonly guestTokenMinting?: GuestTokenMinting;
+  /**
+   * The visitor classifier (single-instance point): which callers are
+   * visitors, admitted to the organization's agents without belonging to
+   * it (extensions/visitor-classifier.ts carries the contract). When
+   * composed, ComposeDeclaredPreferences composes no organization
+   * standing context onto a visitor's run; when absent, nobody is a
+   * visitor — OSS behavior byte-identical.
+   */
+  readonly visitorClassifier?: VisitorClassifier;
+  /**
+   * Row readers keyed by the kind whose rows they read
+   * (extensions/resource-row-reader.ts): the built-in authorizer's loader
+   * asks a kind's reader before the generic Store, so a unit that keeps a
+   * kind in a store of its own can still be answered by open source's
+   * authorizer. Instances, one per kind across the composed set; an
+   * open-source kind or `identity_account` is a boot throw. When absent,
+   * every row is read from the generic Store and identity accounts through
+   * the account port — OSS behavior byte-identical.
+   */
+  readonly resourceRowReaders?: ReadonlyMap<ApiResourceKind, ResourceRowReader>;
 }

package/src/extensions/identity.ts

@@ -165,7 +165,10 @@ export function isServerComposedRequest(caller: CallerIdentity): boolean {
  * (not machine, not impersonated, no token_type, not a PlatformClient user
  * token). Stated once for every consumer that must tell the person from a
  * lane acting near them: memory recall and the person's declared
- * preferences on execution create (domain/agentexecution/create-steps.ts).
+ * preferences on execution create (domain/agentexecution/create-steps.ts),
+ * and memory capture's fall-through for a credential the composed runner
+ * provider does not classify (pipeline/steps/guard-memory-capture.ts), so
+ * both halves of the memory loop admit the same people (stigmer#1406).
  *
  * An ALLOW-list, so a lane this module has never heard of is excluded by
  * construction: the class must be `user` (every human verifier stamps it —