@xemahq/contracts 0.77.0 → 0.78.0

package/dist/authorization-module/platform/xema_core.fga.yaml

@@ -8,10 +8,18 @@ tuples:
   - user: org:org1
     relation: parent
     object: project:org1|p1
+  # bob and pat hold MEMBERSHIPS; the project grants bind to the membership
+  # instance (`membership#holder`), never to the user.
   - user: user:bob
+    relation: holder
+    object: membership:org1|mbob
+  - user: user:pat
+    relation: holder
+    object: membership:org1|mpat
+  - user: membership:org1|mbob#holder
     relation: viewer
     object: project:org1|p1
-  - user: user:pat
+  - user: membership:org1|mpat#holder
     relation: editor
     object: project:org1|p1
   - user: user:dave
@@ -35,22 +43,33 @@ tuples:
     relation: parent
     object: xema_artifact:org1|a2
   - user: user:carol
+    relation: holder
+    object: membership:org1|mcarol
+  # An org-scoped OWNER is a membership instance, never a user.
+  - user: membership:org1|mcarol#holder
     relation: owner
     object: xema_artifact:org1|a2
   - user: project:org1|p1
     relation: parent
     object: xema_session:org1|s1
   - user: user:erin
+    relation: holder
+    object: membership:org1|merin
+  - user: membership:org1|merin#holder
     relation: participant
     object: xema_session:org1|s1
   - user: xema_session:org1|s1
     relation: parent
     object: xema_artifact:org1|a3
-  # An ORG-OWNED session: owner is the organization, ANCHORED to the project
-  # (containment only), with no parent and no participant.
+  # An ORG-OWNED session: owner is the organization, its owning space is the
+  # org (`owner_org`), ANCHORED to the project (containment only), with no
+  # parent and no participant.
   - user: organization:org1
     relation: owner
     object: xema_session:org1|s2
+  - user: org:org1
+    relation: owner_org
+    object: xema_session:org1|s2
   - user: project:org1|p1
     relation: anchor
     object: xema_session:org1|s2
@@ -137,13 +156,22 @@ tests:
         assertions:
           can_read: true
           can_write: false
-  - name: an org-owned session derives no human rights — not even the org admin's
+  - name: an org-owned session is managed by its owning org's admins and no one else; nobody acts in it
     check:
       - user: user:root
         object: xema_session:org1|s2
         assertions:
-          can_read: false
-          can_write: false
+          can_read: true
+          can_write: true
+          xema_write: true
+          xema_admin: true
+          can_act: false
+      # the org OWNER is an org admin by the model
+      - user: user:own
+        object: xema_session:org1|s2
+        assertions:
+          xema_admin: true
+          can_act: false
       - user: user:bob
         object: xema_session:org1|s2
         assertions:
@@ -152,11 +180,12 @@ tests:
         object: xema_session:org1|s2
         assertions:
           can_read: false
+      # management reaches the session's artifacts through their parent
       - user: user:root
         object: xema_artifact:org1|a4
         assertions:
-          can_read: false
-          can_delete: false
+          can_read: true
+          can_delete: true
       - user: user:bob
         object: xema_artifact:org1|a4
         assertions:
@@ -169,12 +198,18 @@ tests:
         relation: parent
         object: xema_session:org1|s5
       - user: user:olga
+        relation: holder
+        object: membership:org1|molga
+      - user: membership:org1|molga#holder
         relation: owner
         object: xema_session:org1|s5
       - user: user:ed
+        relation: holder
+        object: membership:org1|med
+      - user: membership:org1|med#holder
         relation: editor
         object: xema_session:org1|s5
-      - user: user:erin
+      - user: membership:org1|merin#holder
         relation: participant
         object: xema_session:org1|s5
     check:
@@ -240,6 +275,9 @@ tests:
   - name: a session without a parent tuple grants parent readers, parent writers and org admins nothing
     tuples:
       - user: user:olga
+        relation: holder
+        object: membership:org1|molga
+      - user: membership:org1|molga#holder
         relation: owner
         object: xema_session:org1|s6
     check:
@@ -273,6 +311,126 @@ tests:
           can_read: true
           can_act: true
           can_write: true
+  # Owner rule 10-09: authority follows the OWNING SPACE. An org-owned
+  # session keeps its org admins' management after the human who launched or
+  # edited it leaves; a user-owned session gives org admins nothing implicit.
+  - name: org-owned session management survives the departure of its human editor; the departed editor gets nothing
+    tuples:
+      - user: organization:org1
+        relation: owner
+        object: xema_session:org1|so1
+      - user: org:org1
+        relation: owner_org
+        object: xema_session:org1|so1
+      # kim was the invited editor; she LEFT, so her holder tuple is gone
+      - user: membership:org1|mkim#holder
+        relation: editor
+        object: xema_session:org1|so1
+    check:
+      - user: user:root
+        object: xema_session:org1|so1
+        assertions:
+          can_read: true
+          can_write: true
+          xema_write: true
+          xema_admin: true
+          can_act: false
+      - user: user:kim
+        object: xema_session:org1|so1
+        assertions:
+          can_read: false
+          can_act: false
+          xema_admin: false
+      - user: user:dave
+        object: xema_session:org1|so1
+        assertions:
+          can_read: false
+          xema_admin: false
+  - name: a user-owned session gives the org admin no management, before or after its owner leaves, and no act
+    tuples:
+      # olga owned it and LEFT: the owner tuple is inert, and nothing moves to the org
+      - user: membership:org1|molga2#holder
+        relation: owner
+        object: xema_session:org1|su1
+    check:
+      - user: user:root
+        object: xema_session:org1|su1
+        assertions:
+          can_read: false
+          can_write: false
+          xema_write: false
+          xema_admin: false
+          can_act: false
+      - user: user:own
+        object: xema_session:org1|su1
+        assertions:
+          xema_admin: false
+          can_act: false
+      - user: user:olga
+        object: xema_session:org1|su1
+        assertions:
+          can_read: false
+          xema_admin: false
+  # A PERSONAL session (owning space = the user): owner is the bare `user`,
+  # never a membership instance, so it survives the user leaving an org. No
+  # writer emits one yet: it is ready for a future user-tier session scope.
+  - name: personal session owner 1 a personal session's user owner reads, writes, administers and acts
+    tuples:
+      - user: user:pia
+        relation: holder
+        object: membership:org1|mpia1
+      - user: user:pia
+        relation: owner
+        object: xema_session:org1|sp1
+    check:
+      - user: user:pia
+        object: xema_session:org1|sp1
+        assertions:
+          can_read: true
+          can_write: true
+          xema_write: true
+          xema_admin: true
+          can_act: true
+      # a personal session gives the org admin nothing implicit
+      - user: user:root
+        object: xema_session:org1|sp1
+        assertions:
+          can_read: false
+          xema_admin: false
+          can_act: false
+  - name: personal session owner 2 the user owner survives leaving the org (no holder tuple)
+    tuples:
+      - user: user:pia
+        relation: owner
+        object: xema_session:org1|sp1
+    check:
+      - user: user:pia
+        object: xema_session:org1|sp1
+        assertions:
+          can_read: true
+          can_write: true
+          xema_admin: true
+          can_act: true
+  - name: personal session owner 3 an org-scoped (membership) owner beside it goes inert on leave
+    tuples:
+      - user: user:pia
+        relation: owner
+        object: xema_session:org1|sp1
+      - user: membership:org1|mpia1#holder
+        relation: owner
+        object: xema_session:org1|so9
+    check:
+      - user: user:pia
+        object: xema_session:org1|sp1
+        assertions:
+          can_act: true
+          xema_admin: true
+      - user: user:pia
+        object: xema_session:org1|so9
+        assertions:
+          can_read: false
+          xema_admin: false
+          can_act: false
   # ── Durable delegation: may_delegate_for defaults ──────────────────────
   # `user#is_self` is NEVER stored: the PDP supplies it per decision as a
   # CONTEXTUAL tuple for the asking principal (`buildSelfContextualTuples`).
@@ -341,81 +499,6 @@ tests:
         object: org:org2
         assertions:
           may_delegate_for: false
-  # ── Durable delegation: integration facts ─────────────────────────────
-  - name: an integration is configured by its configurers and its org's admin, and states its active, holder and bound-scope facts
-    tuples:
-      - user: org:org1
-        relation: parent
-        object: xema_integration:org1|i1
-      - user: org:org1
-        relation: active
-        object: xema_integration:org1|i1
-      - user: service:connector-sync
-        relation: holder
-        object: xema_integration:org1|i1
-      - user: xema_scope:repo-42
-        relation: bound_scope
-        object: xema_integration:org1|i1
-      - user: user:cora
-        relation: configurer
-        object: xema_integration:org1|i1
-      - user: org:org1
-        relation: parent
-        object: team:ops
-      - user: user:tess
-        relation: direct_member
-        object: team:ops
-      - user: team:ops#member
-        relation: configurer
-        object: xema_integration:org1|i1
-      - user: org:org1
-        relation: parent
-        object: xema_integration:org1|i2
-    check:
-      - user: user:cora
-        object: xema_integration:org1|i1
-        assertions:
-          configure: true
-      - user: user:tess
-        object: xema_integration:org1|i1
-        assertions:
-          configure: true
-      - user: user:root
-        object: xema_integration:org1|i1
-        assertions:
-          configure: true
-      - user: user:dave
-        object: xema_integration:org1|i1
-        assertions:
-          configure: false
-      - user: user:cora
-        object: xema_integration:org1|i2
-        assertions:
-          configure: false
-      - user: org:org1
-        object: xema_integration:org1|i1
-        assertions:
-          active: true
-      - user: org:org1
-        object: xema_integration:org1|i2
-        assertions:
-          active: false
-      - user: service:connector-sync
-        object: xema_integration:org1|i1
-        assertions:
-          holder: true
-      - user: service:mailops
-        object: xema_integration:org1|i1
-        assertions:
-          holder: false
-      - user: xema_scope:repo-42
-        object: xema_integration:org1|i1
-        assertions:
-          bound_scope: true
-      - user: xema_scope:repo-43
-        object: xema_integration:org1|i1
-        assertions:
-          bound_scope: false
   - name: an org admin administers the org, and is not its owner
     check:
       - user: user:root
@@ -463,21 +546,363 @@ tests:
         assertions:
           admin: false
           xema_read: false
-  - name: integration configure is the configurer or the org administrators, never installation authority
+  - name: project 1 an active membership with a share is allowed
     tuples:
-      - user: org:org1
-        relation: parent
-        object: xema_integration:org1|i9
+      - user: user:ann
+        relation: holder
+        object: membership:org1|mann1
+      - user: membership:org1|mann1#holder
+        relation: viewer
+        object: project:org1|m1
     check:
-      - user: user:ops
-        object: xema_integration:org1|i9
+      - user: user:ann
+        object: project:org1|m1
         assertions:
-          configure: false
-      - user: user:own
-        object: xema_integration:org1|i9
+          xema_read: true
+  - name: project 2 leave deletes the holder tuple — the share yields no access
+    tuples:
+      - user: membership:org1|mann1#holder
+        relation: viewer
+        object: project:org1|m2
+    check:
+      - user: user:ann
+        object: project:org1|m2
         assertions:
-          configure: true
-      - user: user:root
-        object: xema_integration:org1|i9
+          xema_read: false
+  - name: project 3 rejoin is a new membership — the share on the old one stays refused
+    tuples:
+      - user: user:ann
+        relation: holder
+        object: membership:org1|mann2
+      - user: membership:org1|mann1#holder
+        relation: viewer
+        object: project:org1|m3
+    check:
+      - user: user:ann
+        object: project:org1|m3
         assertions:
-          configure: true
+          xema_read: false
+  - name: project 4 a new share to the new membership is allowed
+    tuples:
+      - user: user:ann
+        relation: holder
+        object: membership:org1|mann2
+      - user: membership:org1|mann1#holder
+        relation: viewer
+        object: project:org1|m4
+      - user: membership:org1|mann2#holder
+        relation: viewer
+        object: project:org1|m4
+    check:
+      - user: user:ann
+        object: project:org1|m4
+        assertions:
+          xema_read: true
+  - name: project 5 a demotion keeps the holder tuple — the share survives (no org admin tuple needed)
+    tuples:
+      - user: user:ann
+        relation: holder
+        object: membership:org1|mann1
+      - user: membership:org1|mann1#holder
+        relation: viewer
+        object: project:org1|m5
+    check:
+      - user: user:ann
+        object: project:org1|m5
+        assertions:
+          xema_read: true
+  - name: project 6 a revoked share is refused
+    tuples:
+      - user: user:ann
+        relation: holder
+        object: membership:org1|mann1
+    check:
+      - user: user:ann
+        object: project:org1|m6
+        assertions:
+          xema_read: false
+  - name: project owner 1 an active membership owner is allowed
+    tuples:
+      - user: user:ann
+        relation: holder
+        object: membership:org1|mown1
+      - user: membership:org1|mown1#holder
+        relation: owner
+        object: project:org1|o1
+    check:
+      - user: user:ann
+        object: project:org1|o1
+        assertions:
+          xema_admin: true
+          xema_write: true
+  - name: project owner 2 leave deletes the holder tuple — the owner tuple is inert
+    tuples:
+      - user: membership:org1|mown1#holder
+        relation: owner
+        object: project:org1|o1
+    check:
+      - user: user:ann
+        object: project:org1|o1
+        assertions:
+          xema_admin: false
+          xema_write: false
+  - name: project owner 3 rejoin is a new membership — the owner on the old one stays refused
+    tuples:
+      - user: user:ann
+        relation: holder
+        object: membership:org1|mown2
+      - user: membership:org1|mown1#holder
+        relation: owner
+        object: project:org1|o1
+    check:
+      - user: user:ann
+        object: project:org1|o1
+        assertions:
+          xema_admin: false
+          xema_write: false
+  - name: project owner 4 a demotion keeps the holder tuple — the owner survives (no org admin tuple needed)
+    tuples:
+      - user: user:ann
+        relation: holder
+        object: membership:org1|mown1
+      - user: membership:org1|mown1#holder
+        relation: owner
+        object: project:org1|o1
+    check:
+      - user: user:ann
+        object: project:org1|o1
+        assertions:
+          xema_admin: true
+          xema_write: true
+  - name: session owner 1 an active membership owner is allowed
+    tuples:
+      - user: user:ann
+        relation: holder
+        object: membership:org1|mown1
+      - user: membership:org1|mown1#holder
+        relation: owner
+        object: xema_session:org1|o2
+    check:
+      - user: user:ann
+        object: xema_session:org1|o2
+        assertions:
+          xema_admin: true
+          xema_write: true
+          can_act: true
+  - name: session owner 2 leave deletes the holder tuple — the owner tuple is inert
+    tuples:
+      - user: membership:org1|mown1#holder
+        relation: owner
+        object: xema_session:org1|o2
+    check:
+      - user: user:ann
+        object: xema_session:org1|o2
+        assertions:
+          xema_admin: false
+          xema_write: false
+          can_act: false
+  - name: session owner 3 rejoin is a new membership — the owner on the old one stays refused
+    tuples:
+      - user: user:ann
+        relation: holder
+        object: membership:org1|mown2
+      - user: membership:org1|mown1#holder
+        relation: owner
+        object: xema_session:org1|o2
+    check:
+      - user: user:ann
+        object: xema_session:org1|o2
+        assertions:
+          xema_admin: false
+          xema_write: false
+          can_act: false
+  - name: session owner 4 a demotion keeps the holder tuple — the owner survives (no org admin tuple needed)
+    tuples:
+      - user: user:ann
+        relation: holder
+        object: membership:org1|mown1
+      - user: membership:org1|mown1#holder
+        relation: owner
+        object: xema_session:org1|o2
+    check:
+      - user: user:ann
+        object: xema_session:org1|o2
+        assertions:
+          xema_admin: true
+          xema_write: true
+          can_act: true
+  - name: artifact owner 1 an active membership owner is allowed
+    tuples:
+      - user: user:ann
+        relation: holder
+        object: membership:org1|mown1
+      - user: membership:org1|mown1#holder
+        relation: owner
+        object: xema_artifact:org1|o3
+    check:
+      - user: user:ann
+        object: xema_artifact:org1|o3
+        assertions:
+          can_read: true
+          can_write: true
+          can_delete: true
+  - name: artifact owner 2 leave deletes the holder tuple — the owner tuple is inert
+    tuples:
+      - user: membership:org1|mown1#holder
+        relation: owner
+        object: xema_artifact:org1|o3
+    check:
+      - user: user:ann
+        object: xema_artifact:org1|o3
+        assertions:
+          can_read: false
+          can_write: false
+          can_delete: false
+  - name: artifact owner 3 rejoin is a new membership — the owner on the old one stays refused
+    tuples:
+      - user: user:ann
+        relation: holder
+        object: membership:org1|mown2
+      - user: membership:org1|mown1#holder
+        relation: owner
+        object: xema_artifact:org1|o3
+    check:
+      - user: user:ann
+        object: xema_artifact:org1|o3
+        assertions:
+          can_read: false
+          can_write: false
+          can_delete: false
+  - name: artifact owner 4 a demotion keeps the holder tuple — the owner survives (no org admin tuple needed)
+    tuples:
+      - user: user:ann
+        relation: holder
+        object: membership:org1|mown1
+      - user: membership:org1|mown1#holder
+        relation: owner
+        object: xema_artifact:org1|o3
+    check:
+      - user: user:ann
+        object: xema_artifact:org1|o3
+        assertions:
+          can_read: true
+          can_write: true
+          can_delete: true
+  - name: session participant 1 an active membership participant is allowed
+    tuples:
+      - user: user:ann
+        relation: holder
+        object: membership:org1|mgr1
+      - user: membership:org1|mgr1#holder
+        relation: participant
+        object: xema_session:org1|p1
+    check:
+      - user: user:ann
+        object: xema_session:org1|p1
+        assertions:
+          xema_read: true
+          can_read: true
+          can_act: false
+          xema_write: false
+  - name: session participant 2 leave deletes the holder tuple — the grant is inert
+    tuples:
+      - user: membership:org1|mgr1#holder
+        relation: participant
+        object: xema_session:org1|p1
+    check:
+      - user: user:ann
+        object: xema_session:org1|p1
+        assertions:
+          xema_read: false
+          can_read: false
+          can_act: false
+          xema_write: false
+  - name: session participant 3 rejoin is a new membership — the grant on the old one stays refused
+    tuples:
+      - user: user:ann
+        relation: holder
+        object: membership:org1|mgr2
+      - user: membership:org1|mgr1#holder
+        relation: participant
+        object: xema_session:org1|p1
+    check:
+      - user: user:ann
+        object: xema_session:org1|p1
+        assertions:
+          xema_read: false
+          can_read: false
+          can_act: false
+          xema_write: false
+  - name: session participant 4 a demotion keeps the holder tuple — the grant survives (no org admin tuple needed)
+    tuples:
+      - user: user:ann
+        relation: holder
+        object: membership:org1|mgr1
+      - user: membership:org1|mgr1#holder
+        relation: participant
+        object: xema_session:org1|p1
+    check:
+      - user: user:ann
+        object: xema_session:org1|p1
+        assertions:
+          xema_read: true
+          can_read: true
+          can_act: false
+          xema_write: false
+  - name: session editor 1 an active membership editor is allowed
+    tuples:
+      - user: user:ann
+        relation: holder
+        object: membership:org1|mgr1
+      - user: membership:org1|mgr1#holder
+        relation: editor
+        object: xema_session:org1|e1
+    check:
+      - user: user:ann
+        object: xema_session:org1|e1
+        assertions:
+          xema_read: true
+          can_act: true
+          xema_write: false
+  - name: session editor 2 leave deletes the holder tuple — the grant is inert
+    tuples:
+      - user: membership:org1|mgr1#holder
+        relation: editor
+        object: xema_session:org1|e1
+    check:
+      - user: user:ann
+        object: xema_session:org1|e1
+        assertions:
+          xema_read: false
+          can_act: false
+          xema_write: false
+  - name: session editor 3 rejoin is a new membership — the grant on the old one stays refused
+    tuples:
+      - user: user:ann
+        relation: holder
+        object: membership:org1|mgr2
+      - user: membership:org1|mgr1#holder
+        relation: editor
+        object: xema_session:org1|e1
+    check:
+      - user: user:ann
+        object: xema_session:org1|e1
+        assertions:
+          xema_read: false
+          can_act: false
+          xema_write: false
+  - name: session editor 4 a demotion keeps the holder tuple — the grant survives (no org admin tuple needed)
+    tuples:
+      - user: user:ann
+        relation: holder
+        object: membership:org1|mgr1
+      - user: membership:org1|mgr1#holder
+        relation: editor
+        object: xema_session:org1|e1
+    check:
+      - user: user:ann
+        object: xema_session:org1|e1
+        assertions:
+          xema_read: true
+          can_act: true
+          xema_write: false