@stigmer/server 3.40.1 → 3.41.0

package/dist/authorization/lane-admission.d.ts

@@ -1,50 +0,0 @@
-/**
- * Lane admission over the Authorizer seam — open source's rendering of
- * the cloud's decorator (stigmer-cloud `authorizer/lane-admission.ts`,
- * stigmer-cloud#709), composed around the built-in Authorizer under the
- * built-in authorization posture (boot/compose.ts).
- *
- * The OSS AuthorizeRunTarget step asks the Authorizer, for every caller
- * but the internal class, whether the caller may run what a session or
- * execution targets — the run-gate checks (`isRunGateCheck`, the
- * OSS-owned definition of that set: `can_execute` on the blueprints and
- * instances, `can_create_execution_in` on a session). A runner acting
- * for a WORKFLOW execution creates the workflow's child agent executions
- * (the `agent_call` activity), and it does so AS THE HUMAN whose workflow
- * it is (runnerauth/runner-subject-verifier.ts). Checked as that human,
- * a member running an organization-visible workflow that calls another
- * member's private agent would be refused at the child create — but
- * the parent workflow execution already passed its own run gate, and
- * the human's visibility of the agents a shared workflow calls is not
- * the question. The cloud admits its `workflow_sandbox` lane on exactly
- * these checks for exactly this reason; this decorator gives an
- * enforcing self-host the same answer, so a workflow behaves the same in
- * both editions (the parent program's rule: nothing diverges silently).
- *
- * Why a predicate and not a class set: the cloud keys its decorator on
- * `callerClass` because there the class IS the token type. In open
- * source the class is `runner` for every bound execution, and the
- * binding's KIND lives in the token, readable by the one function that
- * interprets runner tokens (`isWorkflowBoundRunner` in
- * runnerauth/built-in-runner-credential-provider.ts). Handing that
- * reading in as `isAdmittedLane` keeps this module free of token
- * knowledge and lets the cloud adopt the same shape later without a
- * second class name. An AGENT-bound runner is NOT admitted: a subagent
- * create is checked as the human, the cloud's `sandbox` posture.
- *
- * Narrow by construction: an admitted lane on any NON-run-gate check,
- * and any other caller on any check, delegate untouched. The cloud's
- * header records one caveat — a human who can view a workflow execution
- * can exchange for its token and replay it against the run gate. Open
- * source has no such caveat: under this posture the exchange is a mint
- * gate that answers only the run's own person (the built-in provider's
- * exchangeScopedToken, runnerauth/built-in-runner-credential-provider.ts),
- * so the only human who can hold a workflow's credential is the one whose
- * workflow it is — and their own run gate already passed.
- */
-import type { CallerIdentity } from "../extensions/identity.js";
-import type { Authorizer } from "../extensions/authorizer.js";
-/** Whether `caller` is a lane whose admission to CREATE a run was decided upstream. */
-export type LaneAdmissionPredicate = (caller: CallerIdentity) => boolean;
-export declare function newLaneAdmittedAuthorizer(inner: Authorizer, isAdmittedLane: LaneAdmissionPredicate): Authorizer;
-//# sourceMappingURL=lane-admission.d.ts.map

package/dist/authorization/lane-admission.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"lane-admission.d.ts","sourceRoot":"","sources":["../../src/authorization/lane-admission.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2CG;AACH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAChE,OAAO,KAAK,EACV,UAAU,EAGX,MAAM,6BAA6B,CAAC;AAKrC,uFAAuF;AACvF,MAAM,MAAM,sBAAsB,GAAG,CAAC,MAAM,EAAE,cAAc,KAAK,OAAO,CAAC;AAEzE,wBAAgB,yBAAyB,CACvC,KAAK,EAAE,UAAU,EACjB,cAAc,EAAE,sBAAsB,GACrC,UAAU,CAYZ"}

package/dist/authorization/lane-admission.js

@@ -1,13 +0,0 @@
-import { isRunGateCheck } from "../pipeline/steps/authorize-run-target.js";
-const ADMITTED = { kind: "allow" };
-export function newLaneAdmittedAuthorizer(inner, isAdmittedLane) {
-    return {
-        authorize(caller, check) {
-            if (isRunGateCheck(check) && isAdmittedLane(caller)) {
-                return Promise.resolve(ADMITTED);
-            }
-            return inner.authorize(caller, check);
-        },
-    };
-}
-//# sourceMappingURL=lane-admission.js.map

package/dist/authorization/lane-admission.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"lane-admission.js","sourceRoot":"","sources":["../../src/authorization/lane-admission.ts"],"names":[],"mappings":"AAkDA,OAAO,EAAE,cAAc,EAAE,MAAM,2CAA2C,CAAC;AAE3E,MAAM,QAAQ,GAAkB,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;AAKlD,MAAM,UAAU,yBAAyB,CACvC,KAAiB,EACjB,cAAsC;IAEtC,OAAO;QACL,SAAS,CACP,MAAsB,EACtB,KAAiB;YAEjB,IAAI,cAAc,CAAC,KAAK,CAAC,IAAI,cAAc,CAAC,MAAM,CAAC,EAAE,CAAC;gBACpD,OAAO,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;YACnC,CAAC;YACD,OAAO,KAAK,CAAC,SAAS,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QACxC,CAAC;KACF,CAAC;AACJ,CAAC"}

package/src/authorization/__tests__/lane-admission.test.ts

@@ -1,115 +0,0 @@
-/**
- * Pins the lane-admission decorator (lane-admission.ts): a caller the
- * predicate names is ADMITTED on the run-gate checks without the inner
- * Authorizer being consulted, and every other combination — an admitted
- * lane on a non-run-gate check, any other caller on any check — reaches
- * the inner Authorizer untouched, its answer returned as-is (deny and
- * unavailable included, so the decorator can never turn a refusal into
- * an allow off the run gate). The predicate is the whole policy; this
- * file proves the decorator's arithmetic with a plain one, and the
- * built-in provider's tests prove the predicate open source composes.
- */
-import { describe, expect, it } from "vitest";
-
-import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
-import { IamPermission } from "@stigmer/protos/ai/stigmer/iam/v1/enum_pb";
-
-import type {
-  Authorizer,
-  AuthzCheck,
-  AuthzDecision,
-} from "../../extensions/authorizer.js";
-import type { CallerIdentity } from "../../extensions/identity.js";
-import { RUN_GATE_CHECKS } from "../../pipeline/steps/authorize-run-target.js";
-import { newLaneAdmittedAuthorizer } from "../lane-admission.js";
-
-const WORKFLOW_RUNNER: CallerIdentity = {
-  identityId: "ida_carol",
-  callerClass: "runner",
-  issuer: "",
-  rawToken: "wex-bound",
-};
-const AGENT_RUNNER: CallerIdentity = {
-  ...WORKFLOW_RUNNER,
-  rawToken: "aex-bound",
-};
-const PERSON: CallerIdentity = {
-  identityId: "ida_carol",
-  callerClass: "user",
-  issuer: "https://issuer.example/",
-  rawToken: "eyJ.person.token",
-};
-
-const isWorkflowRunner = (caller: CallerIdentity): boolean =>
-  caller.callerClass === "runner" && caller.rawToken === "wex-bound";
-
-const runGate: AuthzCheck = { ...RUN_GATE_CHECKS.agent, resourceId: "agt_1" };
-const sessionGate: AuthzCheck = {
-  ...RUN_GATE_CHECKS.session,
-  resourceId: "ses_1",
-};
-const notRunGate: AuthzCheck = {
-  permission: IamPermission.can_edit,
-  resourceKind: ApiResourceKind.agent_execution,
-  resourceId: "aex_1",
-};
-
-function recording(answer: AuthzDecision) {
-  const seen: Array<{ caller: CallerIdentity; check: AuthzCheck }> = [];
-  const inner: Authorizer = {
-    authorize(caller, check) {
-      seen.push({ caller, check });
-      return Promise.resolve(answer);
-    },
-  };
-  return { inner, seen };
-}
-
-describe("newLaneAdmittedAuthorizer", () => {
-  it("an admitted lane on a run-gate check is allowed without consulting the inner Authorizer", async () => {
-    const { inner, seen } = recording({ kind: "deny", reason: "would deny" });
-    const authorizer = newLaneAdmittedAuthorizer(inner, isWorkflowRunner);
-    expect(await authorizer.authorize(WORKFLOW_RUNNER, runGate)).toEqual({
-      kind: "allow",
-    });
-    expect(await authorizer.authorize(WORKFLOW_RUNNER, sessionGate)).toEqual({
-      kind: "allow",
-    });
-    expect(seen).toEqual([]);
-  });
-
-  it("an admitted lane on a NON-run-gate check reaches the inner Authorizer untouched — the reach is the run gate alone", async () => {
-    const { inner, seen } = recording({ kind: "deny", reason: "not yours" });
-    const authorizer = newLaneAdmittedAuthorizer(inner, isWorkflowRunner);
-    expect(await authorizer.authorize(WORKFLOW_RUNNER, notRunGate)).toEqual({
-      kind: "deny",
-      reason: "not yours",
-    });
-    expect(seen).toEqual([{ caller: WORKFLOW_RUNNER, check: notRunGate }]);
-  });
-
-  it.each([
-    ["an agent-bound runner", AGENT_RUNNER],
-    ["a person", PERSON],
-  ])(
-    "%s on a run-gate check is checked by the inner Authorizer as themselves",
-    async (_label, caller) => {
-      const { inner, seen } = recording({ kind: "not-found" });
-      const authorizer = newLaneAdmittedAuthorizer(inner, isWorkflowRunner);
-      expect(await authorizer.authorize(caller, runGate)).toEqual({
-        kind: "not-found",
-      });
-      expect(seen).toEqual([{ caller, check: runGate }]);
-    },
-  );
-
-  it("an unavailable answer off the run gate is returned as-is — the decorator never masks a fault", async () => {
-    const cause = new Error("evaluator down");
-    const { inner } = recording({ kind: "unavailable", cause });
-    const authorizer = newLaneAdmittedAuthorizer(inner, isWorkflowRunner);
-    expect(await authorizer.authorize(PERSON, runGate)).toEqual({
-      kind: "unavailable",
-      cause,
-    });
-  });
-});

package/src/authorization/lane-admission.ts

@@ -1,73 +0,0 @@
-/**
- * Lane admission over the Authorizer seam — open source's rendering of
- * the cloud's decorator (stigmer-cloud `authorizer/lane-admission.ts`,
- * stigmer-cloud#709), composed around the built-in Authorizer under the
- * built-in authorization posture (boot/compose.ts).
- *
- * The OSS AuthorizeRunTarget step asks the Authorizer, for every caller
- * but the internal class, whether the caller may run what a session or
- * execution targets — the run-gate checks (`isRunGateCheck`, the
- * OSS-owned definition of that set: `can_execute` on the blueprints and
- * instances, `can_create_execution_in` on a session). A runner acting
- * for a WORKFLOW execution creates the workflow's child agent executions
- * (the `agent_call` activity), and it does so AS THE HUMAN whose workflow
- * it is (runnerauth/runner-subject-verifier.ts). Checked as that human,
- * a member running an organization-visible workflow that calls another
- * member's private agent would be refused at the child create — but
- * the parent workflow execution already passed its own run gate, and
- * the human's visibility of the agents a shared workflow calls is not
- * the question. The cloud admits its `workflow_sandbox` lane on exactly
- * these checks for exactly this reason; this decorator gives an
- * enforcing self-host the same answer, so a workflow behaves the same in
- * both editions (the parent program's rule: nothing diverges silently).
- *
- * Why a predicate and not a class set: the cloud keys its decorator on
- * `callerClass` because there the class IS the token type. In open
- * source the class is `runner` for every bound execution, and the
- * binding's KIND lives in the token, readable by the one function that
- * interprets runner tokens (`isWorkflowBoundRunner` in
- * runnerauth/built-in-runner-credential-provider.ts). Handing that
- * reading in as `isAdmittedLane` keeps this module free of token
- * knowledge and lets the cloud adopt the same shape later without a
- * second class name. An AGENT-bound runner is NOT admitted: a subagent
- * create is checked as the human, the cloud's `sandbox` posture.
- *
- * Narrow by construction: an admitted lane on any NON-run-gate check,
- * and any other caller on any check, delegate untouched. The cloud's
- * header records one caveat — a human who can view a workflow execution
- * can exchange for its token and replay it against the run gate. Open
- * source has no such caveat: under this posture the exchange is a mint
- * gate that answers only the run's own person (the built-in provider's
- * exchangeScopedToken, runnerauth/built-in-runner-credential-provider.ts),
- * so the only human who can hold a workflow's credential is the one whose
- * workflow it is — and their own run gate already passed.
- */
-import type { CallerIdentity } from "../extensions/identity.js";
-import type {
-  Authorizer,
-  AuthzCheck,
-  AuthzDecision,
-} from "../extensions/authorizer.js";
-import { isRunGateCheck } from "../pipeline/steps/authorize-run-target.js";
-
-const ADMITTED: AuthzDecision = { kind: "allow" };
-
-/** Whether `caller` is a lane whose admission to CREATE a run was decided upstream. */
-export type LaneAdmissionPredicate = (caller: CallerIdentity) => boolean;
-
-export function newLaneAdmittedAuthorizer(
-  inner: Authorizer,
-  isAdmittedLane: LaneAdmissionPredicate,
-): Authorizer {
-  return {
-    authorize(
-      caller: CallerIdentity,
-      check: AuthzCheck,
-    ): Promise<AuthzDecision> {
-      if (isRunGateCheck(check) && isAdmittedLane(caller)) {
-        return Promise.resolve(ADMITTED);
-      }
-      return inner.authorize(caller, check);
-    },
-  };
-}