create-astram-app 0.4.0 → 0.5.0

package/template/frontend/src/pages/service-accounts/ServiceAccountsPage.jsx

@@ -0,0 +1,309 @@
+/**
+ * ServiceAccountsPage — the Service Accounts admin screen (ADR-0033): machine identities (AI agents,
+ * MCP servers, scripts) that authenticate with an `ask_…` API key. List the tenant's accounts (with
+ * their roles + scope BY NAME), create one with roles + scope, edit its access, and per-account
+ * Issue / Rotate / Revoke its keys (+ Enable/Disable). Create/edit live in
+ * {@link ServiceAccountAccessDialog} (pickers limited to what you may grant — Phase 4).
+ *
+ * The KEY lifecycle is the sensitive part: issue/rotate reveal the raw key EXACTLY ONCE via
+ * {@link KeyRevealDialog}; rotate/revoke/disable go through {@link ConfirmDialog} (they're
+ * destructive). Accounts are shown by LABEL (+ created-by name); the id is a handle only (ADR-0012).
+ *
+ * The list is served whole by the server (no server-side paging on this surface), so this page filters
+ * by search client-side and does not use the EntityList pager.
+ */
+import { useCallback, useEffect, useMemo, useState } from 'react';
+import { Bot, KeyRound } from 'lucide-react';
+import { toast } from 'sonner';
+import { useAuth } from '@/auth/AuthContext';
+import AppShell from '@/shell/AppShell';
+import PageHeader from '@/components/PageHeader';
+import EntityList, { EntityListControls } from '@/components/EntityList';
+import ConfirmDialog from '@/components/ConfirmDialog';
+import { Badge } from '@/components/ui/badge';
+import ServiceAccountActionsMenu from './ServiceAccountActionsMenu';
+import ServiceAccountAccessDialog from './ServiceAccountAccessDialog';
+import KeyRevealDialog from './KeyRevealDialog';
+import { summarizeNames } from './accessModel';
+
+function formatDate(ms) {
+  if (!ms) return '—';
+  try {
+    return new Date(ms).toLocaleDateString(undefined, { day: 'numeric', month: 'short', year: 'numeric' });
+  } catch {
+    return '—';
+  }
+}
+
+export default function ServiceAccountsPage() {
+  const { tokens, serviceAccounts } = useAuth();
+  const token = tokens?.accessToken;
+
+  const [accounts, setAccounts] = useState([]);
+  const [loading, setLoading] = useState(true);
+  const [error, setError] = useState('');
+  const [search, setSearch] = useState('');
+
+  // Create / edit-access dialog: `null` closed, `{ account: null }` create, `{ account }` edit.
+  const [accessDialog, setAccessDialog] = useState(null);
+
+  // One-time key reveal + destructive-confirm state.
+  const [issuedKey, setIssuedKey] = useState(null);
+  const [pending, setPending] = useState(null); // { kind: 'rotate'|'revoke'|'toggle', account }
+  const [pendingBusy, setPendingBusy] = useState(false);
+
+  const load = useCallback(async () => {
+    if (!token) return;
+    setLoading(true);
+    const r = await serviceAccounts.list(token);
+    if (r.ok) {
+      setAccounts(r.accounts);
+      setError('');
+    } else {
+      setAccounts([]);
+      setError(r.error || 'Could not load service accounts.');
+    }
+    setLoading(false);
+  }, [serviceAccounts, token]);
+
+  useEffect(() => {
+    load();
+  }, [load]);
+
+  const rows = useMemo(() => {
+    const q = search.trim().toLowerCase();
+    // Match the name OR any role/company name shown on the row.
+    const filtered = q
+      ? accounts.filter((a) =>
+          [a.label, ...(a.roleLabels ?? []), ...(a.scopeLabels ?? [])].some((s) =>
+            (s || '').toLowerCase().includes(q),
+          ),
+        )
+      : accounts;
+    // Adapt to the EntityList `{ id, fields }` row shape; the account rides along for the menu.
+    return filtered.map((a) => ({ id: a.id, fields: a, account: a }));
+  }, [accounts, search]);
+
+  const onSaved = async () => {
+    setAccessDialog(null);
+    await load();
+  };
+
+  const onIssueKey = async (account) => {
+    const r = await serviceAccounts.issueKey(token, account.id);
+    if (!r.ok) {
+      toast.error(r.error || 'Could not issue a key.');
+      return;
+    }
+    setIssuedKey(r.key); // reveal ONCE
+  };
+
+  const confirmPending = async () => {
+    if (!pending) return;
+    setPendingBusy(true);
+    const { kind, account } = pending;
+    let r;
+    if (kind === 'rotate') r = await serviceAccounts.rotateKey(token, account.id);
+    else if (kind === 'revoke') r = await serviceAccounts.revokeKeys(token, account.id);
+    else r = await serviceAccounts.update(token, account.id, { status: account.status === 'disabled' ? 'active' : 'disabled' });
+    setPendingBusy(false);
+    setPending(null);
+    if (!r.ok) {
+      toast.error(r.error || 'The action could not be completed.');
+      return;
+    }
+    if (kind === 'rotate') {
+      setIssuedKey(r.key); // reveal the NEW key ONCE
+      toast.success('Key rotated — the previous key no longer works.');
+    } else if (kind === 'revoke') {
+      toast.success('All keys revoked.');
+    } else {
+      toast.success(account.status === 'disabled' ? 'Account enabled.' : 'Account disabled.');
+    }
+    await load();
+  };
+
+  const COLUMNS = [
+    {
+      key: 'label',
+      label: 'Name',
+      render: (row) => (
+        <div className="flex items-center gap-2">
+          <span className="inline-flex size-8 items-center justify-center rounded-full bg-secondary text-muted-foreground">
+            <Bot className="size-4" />
+          </span>
+          <div className="min-w-0 font-medium">
+            <div className="truncate">{row.fields.label}</div>
+          </div>
+        </div>
+      ),
+    },
+    {
+      key: 'roles',
+      label: 'Roles',
+      render: (row) => {
+        const { shown, more } = summarizeNames(row.fields.roleLabels);
+        if (shown.length === 0) {
+          return (
+            <Badge variant="outline" className="text-muted-foreground" title="Denied everything until it has a role">
+              No roles
+            </Badge>
+          );
+        }
+        return (
+          <div className="flex flex-wrap items-center gap-1">
+            {shown.map((name, i) => (
+              <Badge key={`${name}-${i}`} variant="secondary">
+                {name}
+              </Badge>
+            ))}
+            {more > 0 && (
+              <Badge variant="outline" title={row.fields.roleLabels.slice(3).join(', ')}>
+                +{more}
+              </Badge>
+            )}
+          </div>
+        );
+      },
+    },
+    {
+      key: 'scope',
+      label: 'Scope',
+      render: (row) => {
+        const names = row.fields.scopeLabels ?? [];
+        const { shown, more } = summarizeNames(names);
+        if (shown.length === 0) return <span className="text-muted-foreground">—</span>;
+        return (
+          <span className="text-sm text-muted-foreground" title={names.join(', ')}>
+            {shown.join(', ')}
+            {more > 0 ? ` +${more}` : ''}
+          </span>
+        );
+      },
+    },
+    {
+      key: 'status',
+      label: 'Status',
+      render: (row) =>
+        row.fields.status === 'disabled' ? (
+          <Badge variant="outline" className="text-muted-foreground">Disabled</Badge>
+        ) : (
+          <Badge>Active</Badge>
+        ),
+    },
+    {
+      key: 'createdBy',
+      label: 'Created by',
+      render: (row) => row.fields.createdByName || '—',
+    },
+    {
+      key: 'created',
+      label: 'Created',
+      render: (row) => formatDate(row.fields.createdAtMs),
+    },
+    {
+      key: 'actions',
+      label: '',
+      render: (row) => (
+        <div className="flex justify-end">
+          <ServiceAccountActionsMenu
+            account={row.account}
+            onEditAccess={(a) => setAccessDialog({ account: a })}
+            onIssueKey={onIssueKey}
+            onRotateKey={(a) => setPending({ kind: 'rotate', account: a })}
+            onToggleStatus={(a) => setPending({ kind: 'toggle', account: a })}
+            onRevokeKeys={(a) => setPending({ kind: 'revoke', account: a })}
+          />
+        </div>
+      ),
+    },
+  ];
+
+  const confirmCopy = (() => {
+    if (!pending) return { title: '', message: '', confirmLabel: 'Confirm', destructive: false };
+    const name = pending.account.label;
+    if (pending.kind === 'rotate') {
+      return {
+        title: `Rotate the key for “${name}”?`,
+        message:
+          'A new key is generated and shown once. The current key stops working immediately — update any client using it.',
+        confirmLabel: 'Rotate key',
+        destructive: true,
+      };
+    }
+    if (pending.kind === 'revoke') {
+      return {
+        title: `Revoke all keys for “${name}”?`,
+        message:
+          'Every key for this account stops working immediately. Any agent using it will lose access until you issue a new key.',
+        confirmLabel: 'Revoke keys',
+        destructive: true,
+      };
+    }
+    const disabling = pending.account.status !== 'disabled';
+    return {
+      title: disabling ? `Disable “${name}”?` : `Enable “${name}”?`,
+      message: disabling
+        ? 'A disabled account cannot authenticate. Its keys are kept and start working again when you enable it.'
+        : 'The account can authenticate again with its existing keys.',
+      confirmLabel: disabling ? 'Disable' : 'Enable',
+      destructive: disabling,
+    };
+  })();
+
+  return (
+    <AppShell section="Identity" title="Service accounts">
+      <div className="p-4">
+        <PageHeader
+          section="Identity"
+          title="Service accounts"
+          icon={KeyRound}
+          actions={
+            <EntityListControls
+              search={search}
+              onSearchChange={setSearch}
+              searchPlaceholder="Search service accounts…"
+              addLabel="New service account"
+              onAdd={() => setAccessDialog({ account: null })}
+            />
+          }
+        />
+
+        <EntityList
+          columns={COLUMNS}
+          rows={rows}
+          search={search}
+          loading={loading}
+          error={error}
+          emptyLabel="No service accounts yet. Create one to give an agent or script scoped API access."
+        />
+      </div>
+
+      {/* Create + edit access (roles + scope, limited to what you may grant) */}
+      {accessDialog && (
+        <ServiceAccountAccessDialog
+          key={accessDialog.account?.id ?? 'new'}
+          open
+          account={accessDialog.account}
+          onClose={() => setAccessDialog(null)}
+          onSaved={onSaved}
+        />
+      )}
+
+      {/* One-time key reveal (issue + rotate) */}
+      <KeyRevealDialog issued={issuedKey} onClose={() => setIssuedKey(null)} />
+
+      {/* Destructive confirms: rotate / revoke / disable */}
+      <ConfirmDialog
+        open={!!pending}
+        title={confirmCopy.title}
+        message={confirmCopy.message}
+        confirmLabel={confirmCopy.confirmLabel}
+        destructive={confirmCopy.destructive}
+        busy={pendingBusy}
+        onConfirm={confirmPending}
+        onCancel={() => setPending(null)}
+      />
+    </AppShell>
+  );
+}

package/template/frontend/src/pages/service-accounts/accessModel.js

@@ -0,0 +1,136 @@
+/**
+ * accessModel — the pure (no React, no I/O) logic behind the service-account access dialog
+ * (Phase 4): turn the server's `assignable` set + an existing account into picker options, work out
+ * which of the agent's items are LOCKED (assigned by someone with more access), validate, and build
+ * a minimal PATCH. Kept separate so it is unit-tested with `node --test` (accessModel.test.mjs).
+ *
+ * The server is the authority (ADR-0029 ceiling): `assignable` is computed from the same ceiling the
+ * write enforces. An agent's existing role/node that is NOT assignable to the editor is shown checked
+ * + disabled and is NEVER sent — a non-root PATCH keeps it server-side (sending it would be a 403).
+ * Options carry `name` for display; `id` is only the value sent back (never rendered, ADR-0012).
+ */
+
+export const LOCKED_HINT = 'assigned by someone with more access';
+export const NO_ROLES_WARNING = 'This agent will be denied everything until it has a role.';
+export const SCOPE_REQUIRED = 'Choose at least one scope node.';
+
+/** Depth of each node by walking `parentId` inside the set (cycle-safe; unknown parent ⇒ top). */
+export function withDepth(nodes) {
+  const byId = new Map(nodes.map((n) => [n.id, n]));
+  const depthOf = (n) => {
+    let depth = 0;
+    const seen = new Set([n.id]);
+    let p = n.parentId;
+    while (p && byId.has(p) && !seen.has(p)) {
+      seen.add(p);
+      depth += 1;
+      p = byId.get(p).parentId;
+    }
+    return depth;
+  };
+  return nodes.map((n) => ({ id: n.id, name: n.name, depth: depthOf(n) }));
+}
+
+/** Items the agent holds that the editor cannot grant, labelled from the view (same order as ids). */
+function lockedItems(ids, labels, assignableIds) {
+  const out = [];
+  (ids || []).forEach((id, i) => {
+    if (!assignableIds.has(id))
+      out.push({ id, name: (labels && labels[i]) || 'Unnamed', depth: 0, locked: true });
+  });
+  return out;
+}
+
+/**
+ * Build the picker model. `account` is null for create.
+ *  - create: no roles ticked; every assignable scope node ticked ("defaults to everything you can reach").
+ *  - edit:   the agent's assignable items ticked; its non-assignable items appended as locked.
+ */
+export function buildAccessModel(assignable, account) {
+  const roles = (assignable && assignable.roles) || [];
+  const nodes = (assignable && assignable.scopeNodes) || [];
+  const roleIds = new Set(roles.map((r) => r.id));
+  const nodeIds = new Set(nodes.map((n) => n.id));
+
+  const roleOptions = roles.map((r) => ({ id: r.id, name: r.name, depth: 0 }));
+  const scopeOptions = withDepth(nodes);
+
+  if (!account) {
+    return {
+      roleOptions,
+      scopeOptions,
+      initialRoles: [],
+      initialScope: nodes.map((n) => n.id),
+    };
+  }
+  const lockedRoles = lockedItems(account.roleIds, account.roleLabels, roleIds);
+  const lockedScope = lockedItems(account.scopeSubtreeNodeIds, account.scopeLabels, nodeIds);
+  return {
+    roleOptions: [...roleOptions, ...lockedRoles],
+    scopeOptions: [...scopeOptions, ...lockedScope],
+    initialRoles: (account.roleIds || []).filter((id) => roleIds.has(id)),
+    initialScope: (account.scopeSubtreeNodeIds || []).filter((id) => nodeIds.has(id)),
+  };
+}
+
+/** Number of locked options (always held by the agent, never sent). */
+export function lockedCount(options) {
+  return options.filter((o) => o.locked).length;
+}
+
+/** Order-insensitive equality of two id lists. */
+export function sameIds(a, b) {
+  const sa = new Set(a);
+  const sb = new Set(b);
+  if (sa.size !== sb.size) return false;
+  for (const x of sa) if (!sb.has(x)) return false;
+  return true;
+}
+
+/**
+ * Field errors for the form (empty object ⇒ valid). When the scope will be sent (`requireScope`,
+ * default true) it needs ≥1 node — the server rejects an empty scope on edit with a 400.
+ */
+export function validateAccess({ label, scope, requireScope = true }) {
+  const errors = {};
+  if (!label || !label.trim()) errors.label = 'Give the service account a name.';
+  if (requireScope && (!scope || scope.length === 0)) errors.scope = SCOPE_REQUIRED;
+  return errors;
+}
+
+/** Does the agent end up with no role at all (ticked + locked)? → show the non-blocking warning. */
+export function hasNoRoles(roles, roleOptions) {
+  return roles.length === 0 && lockedCount(roleOptions) === 0;
+}
+
+/** Create body: always sends roles + ≥1 scope node (only assignable ids — never locked ones). */
+export function createBody({ label, roles, scope }) {
+  return { label: label.trim(), roleIds: [...roles], scopeSubtreeNodeIds: [...scope] };
+}
+
+/**
+ * Minimal PATCH for an edit: only the fields that changed. `roles` / `scope` hold assignable ids
+ * only (locked items are preserved by the server). Returns `{}` when nothing changed.
+ */
+export function editPatch({ account, label, roles, scope, initialRoles, initialScope }) {
+  const patch = {};
+  const nextLabel = label.trim();
+  if (nextLabel !== account.label) patch.label = nextLabel;
+  if (!sameIds(roles, initialRoles)) patch.roleIds = [...roles];
+  if (!sameIds(scope, initialScope)) patch.scopeSubtreeNodeIds = [...scope];
+  return patch;
+}
+
+/** Route a 400 server message to the field it is about (else the form-level error). */
+export function fieldOfServerError(message) {
+  const m = (message || '').toLowerCase();
+  if (m.includes('scope')) return 'scope';
+  if (m.includes('label') || m.includes('name')) return 'label';
+  return null;
+}
+
+/** First `max` names + a "+N" overflow count, for the row badges. */
+export function summarizeNames(names, max = 3) {
+  const list = names || [];
+  return { shown: list.slice(0, max), more: Math.max(0, list.length - max) };
+}

package/template/frontend/src/pages/service-accounts/accessModel.test.mjs

@@ -0,0 +1,161 @@
+// accessModel.test.mjs — Phase 4: the service-account access dialog's pure logic (picker
+// options, locked items, validation, minimal PATCH). No React/DOM; runs under Node's built-in
+// runner with zero dependencies:
+//
+//   node --test src/pages/service-accounts/accessModel.test.mjs
+import { test, describe } from 'node:test';
+import assert from 'node:assert/strict';
+import {
+  withDepth,
+  buildAccessModel,
+  lockedCount,
+  sameIds,
+  validateAccess,
+  hasNoRoles,
+  createBody,
+  editPatch,
+  fieldOfServerError,
+  summarizeNames,
+  SCOPE_REQUIRED,
+} from './accessModel.js';
+
+const ASSIGNABLE = {
+  roles: [
+    { id: 'r-ingest', name: 'Ingest' },
+    { id: 'r-audit', name: 'Auditor' },
+  ],
+  scopeNodes: [
+    { id: 'n-acme', name: 'Acme', parentId: null },
+    { id: 'n-east', name: 'Acme East', parentId: 'n-acme' },
+    { id: 'n-east-1', name: 'East 1', parentId: 'n-east' },
+  ],
+};
+
+const ACCOUNT = {
+  id: 'sa-1',
+  label: 'Ingest Bot',
+  roleIds: ['r-ingest', 'r-finance'],
+  roleLabels: ['Ingest', 'Finance Admin'],
+  scopeSubtreeNodeIds: ['n-east', 'n-beta'],
+  scopeLabels: ['Acme East', 'Beta'],
+};
+
+describe('withDepth', () => {
+  test('indents by parent chain inside the set', () => {
+    assert.deepEqual(
+      withDepth(ASSIGNABLE.scopeNodes).map((n) => n.depth),
+      [0, 1, 2],
+    );
+  });
+  test('a parent outside the set, or a cycle, does not loop or over-indent', () => {
+    const d = withDepth([
+      { id: 'a', name: 'A', parentId: 'b' },
+      { id: 'b', name: 'B', parentId: 'a' },
+      { id: 'c', name: 'C', parentId: 'zzz' },
+    ]);
+    assert.equal(d.find((n) => n.id === 'c').depth, 0);
+    assert.ok(d.every((n) => n.depth <= 1));
+  });
+});
+
+describe('buildAccessModel', () => {
+  test('create: no roles ticked, every reachable node ticked, nothing locked', () => {
+    const m = buildAccessModel(ASSIGNABLE, null);
+    assert.deepEqual(m.initialRoles, []);
+    assert.deepEqual(m.initialScope, ['n-acme', 'n-east', 'n-east-1']);
+    assert.equal(lockedCount(m.roleOptions) + lockedCount(m.scopeOptions), 0);
+  });
+
+  test('edit: assignable items ticked; out-of-ceiling items appended LOCKED with their names', () => {
+    const m = buildAccessModel(ASSIGNABLE, ACCOUNT);
+    assert.deepEqual(m.initialRoles, ['r-ingest']);
+    assert.deepEqual(m.initialScope, ['n-east']);
+    const lockedRole = m.roleOptions.find((o) => o.locked);
+    assert.deepEqual(lockedRole, {
+      id: 'r-finance',
+      name: 'Finance Admin',
+      depth: 0,
+      locked: true,
+    });
+    const lockedNode = m.scopeOptions.find((o) => o.locked);
+    assert.equal(lockedNode.name, 'Beta');
+  });
+
+  test('edit by root (everything assignable): nothing locked', () => {
+    const all = {
+      roles: [...ASSIGNABLE.roles, { id: 'r-finance', name: 'Finance Admin' }],
+      scopeNodes: [...ASSIGNABLE.scopeNodes, { id: 'n-beta', name: 'Beta', parentId: null }],
+    };
+    const m = buildAccessModel(all, ACCOUNT);
+    assert.equal(lockedCount(m.roleOptions) + lockedCount(m.scopeOptions), 0);
+    assert.deepEqual(m.initialRoles.sort(), ['r-finance', 'r-ingest']);
+  });
+});
+
+describe('validation + warnings', () => {
+  test('a name and at least one scope node are required', () => {
+    assert.deepEqual(validateAccess({ label: ' ', scope: [] }), {
+      label: 'Give the service account a name.',
+      scope: SCOPE_REQUIRED,
+    });
+    assert.deepEqual(validateAccess({ label: 'Bot', scope: ['n-acme'] }), {});
+  });
+  test('an unsent (unchanged) scope is not validated — rename of an all-locked agent still works', () => {
+    assert.deepEqual(validateAccess({ label: 'Bot', scope: [], requireScope: false }), {});
+  });
+  test('no-roles warning only when nothing is ticked AND nothing is locked', () => {
+    const create = buildAccessModel(ASSIGNABLE, null);
+    assert.equal(hasNoRoles([], create.roleOptions), true);
+    const edit = buildAccessModel(ASSIGNABLE, ACCOUNT);
+    assert.equal(hasNoRoles([], edit.roleOptions), false); // the locked role still applies
+  });
+});
+
+describe('request bodies never carry locked items', () => {
+  test('createBody sends trimmed name + roles + scope', () => {
+    assert.deepEqual(createBody({ label: ' Bot ', roles: ['r-ingest'], scope: ['n-acme'] }), {
+      label: 'Bot',
+      roleIds: ['r-ingest'],
+      scopeSubtreeNodeIds: ['n-acme'],
+    });
+  });
+
+  test('editPatch: unchanged → {}; only changed fields are sent; locked ids never appear', () => {
+    const m = buildAccessModel(ASSIGNABLE, ACCOUNT);
+    const base = { account: ACCOUNT, initialRoles: m.initialRoles, initialScope: m.initialScope };
+    assert.deepEqual(
+      editPatch({ ...base, label: 'Ingest Bot', roles: ['r-ingest'], scope: ['n-east'] }),
+      {},
+    );
+    assert.deepEqual(
+      editPatch({ ...base, label: 'Renamed', roles: ['r-ingest'], scope: ['n-east'] }),
+      {
+        label: 'Renamed',
+      },
+    );
+    const p = editPatch({ ...base, label: 'Ingest Bot', roles: [], scope: ['n-east', 'n-acme'] });
+    assert.deepEqual(p, { roleIds: [], scopeSubtreeNodeIds: ['n-east', 'n-acme'] });
+    assert.ok(!JSON.stringify(p).includes('r-finance'));
+    assert.ok(!JSON.stringify(p).includes('n-beta'));
+  });
+
+  test('sameIds is order-insensitive', () => {
+    assert.equal(sameIds(['a', 'b'], ['b', 'a']), true);
+    assert.equal(sameIds(['a'], ['a', 'b']), false);
+  });
+});
+
+describe('misc', () => {
+  test('fieldOfServerError routes 400s to the right field', () => {
+    assert.equal(fieldOfServerError('choose at least one scope node'), 'scope');
+    assert.equal(fieldOfServerError('label cannot be empty'), 'label');
+    assert.equal(fieldOfServerError('no fields to update'), null);
+  });
+  test('summarizeNames: first 3 + overflow count', () => {
+    assert.deepEqual(summarizeNames(['a', 'b', 'c', 'd', 'e']), {
+      shown: ['a', 'b', 'c'],
+      more: 2,
+    });
+    assert.deepEqual(summarizeNames(undefined), { shown: [], more: 0 });
+  });
+});

package/template/frontend/src/shell/nav.js

@@ -16,6 +16,9 @@
  *                 via `GET access/role-grants` + `GET permission-catalog`, BOTH gated
  *                 `role:read` — "managing/reading grants IS role administration")
  *   - Audit     → `identity:role:read`     (audit.controller.ts `GET audit`)
+ *   - Service accounts → `identity:service_account:read`
+ *                 (service-account.controller.ts `GET service-accounts`; create/edit are
+ *                 service_account:create|update, keys are service_account:manage_keys)
  *   - Cross-tenant → `identity:role:read`  (cross-tenant-grant.controller.ts `GET
  *                 cross-tenant-grants` / `GET .../inbox` / `GET .../offerable-types`,
  *                 all gated `role:read` — reading/managing cross-tenant grants IS role
@@ -24,6 +27,7 @@
  * caller may reach (no admin-only list route backs them).
  */
 import {
+  Bot,
   Building2,
   Handshake,
   History,
@@ -82,6 +86,14 @@ export const NAV_SECTIONS = [
         matchPrefix: true,
         gate: 'identity:role:read',
       },
+      {
+        icon: Bot,
+        label: 'Service accounts',
+        path: '/service-accounts',
+        badge: null,
+        matchPrefix: true,
+        gate: 'identity:service_account:read',
+      },
       {
         icon: Handshake,
         label: 'Cross-tenant',

package/template/server/package.json

@@ -19,11 +19,11 @@
     "postinstall": "node scripts/sync-astram-guide.mjs"
   },
   "dependencies": {
-    "@astram/core": "^1.2.0",
-    "@astram/engine": "^0.2.0",
-    "@astram/guard": "^0.6.0",
+    "@astram/core": "^1.3.0",
+    "@astram/engine": "^0.3.0",
+    "@astram/guard": "^0.7.0",
     "@astram/guide": "^0.1.0",
-    "@astram/identity": "^0.3.1",
+    "@astram/identity": "^0.4.0",
     "@astram/migrate": "^0.2.0",
     "@astram/sdk": "^0.2.0",
     "@nestjs/common": "^11.0.0",