okengine 0.15.2 → 0.16.0

package/src/console/server/access.test.ts

@@ -132,6 +132,10 @@ describe("projectAccessPanel", () => {
     expect(projection.userPlane.grantableScopes.every((s) => !s.startsWith("console:"))).toBe(true);
 
     expect(projection.hygiene.unusedKeys.some((k) => k.id === "key_stale")).toBe(true);
+    expect(projection.userPlane.keys.find((k) => k.id === "key_stale")?.creatorId).toBe("op1");
+    expect(projection.userPlane.keys.find((k) => k.id === "key_stale")?.creatorScopes).toEqual([
+      "member",
+    ]);
     expect(projection.hygiene.neverSignedInOperators.some((o) => o.id === "op_never")).toBe(true);
     expect(projection.hygiene.expiredInvitations.some((i) => i.id === "inv1")).toBe(true);
   });
@@ -154,6 +158,40 @@ describe("projectAccessPanel", () => {
     expect(projection.operatorPlane.grantableScopes).toContain("console:store.sql:read");
     expect(projection.operatorPlane.grantableScopes).not.toContain("console:store.sql:write");
   });
+
+  test("issuer scopes drop role grants that are not in the catalog", () => {
+    const auth = createDefaultGateAuthStores();
+    setRoleGrants(auth.roles, "role_member", ["member", "booking:create"]);
+    const projection = projectAccessPanel({
+      manifest: {
+        oke: "1.0",
+        app: "keel-like",
+        flows: {},
+        gates: {
+          member: { kind: "policy", scopes: ["member"] },
+          "task:write": { kind: "policy", scopes: ["task:write"] },
+        },
+      },
+      roles: auth.roles,
+      apiKeys: auth.apiKeys,
+      operators: createOperatorStore(),
+      invites: createOperatorInviteStore(),
+      identities: [
+        {
+          id: "user_demo",
+          email: "demo@example.com",
+          name: "Demo",
+          status: "active",
+          scopes: ["member", "task:write"],
+        },
+      ],
+      roleMembers: auth.roleMembers,
+      actorScopes: ["console:*"],
+      now: () => 0,
+    });
+    expect(projection.userPlane.users?.[0]?.scopes).toEqual(["member", "task:write"]);
+    expect(projection.userPlane.users?.[0]?.scopes).not.toContain("booking:create");
+  });
 });
 
 describe("effectivePermissions", () => {
@@ -213,7 +251,7 @@ describe("keyBlastRadius", () => {
         flow: "bookings.create",
         trigger: "http",
         plane: "user",
-        principal: "key_demo",
+        principal: "u",
         gates: [],
         cache: "none",
         effects: [],
@@ -221,14 +259,14 @@ describe("keyBlastRadius", () => {
         durationMs: 10,
         startedAt: 100,
         endedAt: 110,
-        dimensions: { ip: "203.0.113.10" },
+        dimensions: { api_key: "key_demo", ip: "203.0.113.10" },
       },
       {
         id: "r2",
         flow: "bookings.create",
         trigger: "http",
         plane: "user",
-        principal: "key_demo",
+        principal: "u",
         gates: [],
         cache: "none",
         effects: [],
@@ -236,7 +274,7 @@ describe("keyBlastRadius", () => {
         durationMs: 10,
         startedAt: 200,
         endedAt: 210,
-        dimensions: { source_ip: "198.51.100.7" },
+        dimensions: { api_key: "key_demo", source_ip: "198.51.100.7" },
       },
     ];
     const ttl = 7 * 60 * 1000;
@@ -262,14 +300,25 @@ describe("accessCreateKey / revoke", () => {
       plane: "user",
       name: "k",
       scopes: ["member"],
-      creatorId: "op1",
-      creatorScopes: ["console:*"],
+      creatorId: "user_demo",
+      creatorScopes: ["member"],
       catalog: ["member", "booking:create", "console:store.sql:read"],
       now: () => 1,
     });
     expect(created.secret.startsWith("oke_")).toBe(true);
     expect(created.row.scopes).toEqual(["member"]);
 
+    await expect(
+      accessCreateKey(store, {
+        plane: "user",
+        name: "wide",
+        scopes: ["booking:create"],
+        creatorId: "user_demo",
+        creatorScopes: ["member"],
+        catalog: ["member", "booking:create"],
+      }),
+    ).rejects.toThrow();
+
     await expect(
       accessCreateKey(store, {
         plane: "operator",
@@ -311,11 +360,70 @@ describe("accessCreateKey / revoke", () => {
   });
 });
 
+describe("resolveAccessKeyIssuer", () => {
+  test("user-plane create without creatorUserId fails; scopes cannot exceed the user", async () => {
+    const { resolveAccessKeyIssuer } = await import("./flows.ts");
+    const state = {
+      identities: [
+        {
+          id: "user_u",
+          email: "u@example.com",
+          name: "U",
+          status: "active" as const,
+          scopes: ["member"],
+        },
+      ],
+      roleMembers: new Map<string, string[]>(),
+      roles: createRoleStore(),
+      operators: { roles: new Map() },
+    };
+    expect(resolveAccessKeyIssuer(state as never, "op1", { plane: "user" })).toEqual({
+      error: "creatorUserId is required for user-plane keys",
+    });
+    const issued = resolveAccessKeyIssuer(state as never, "op1", {
+      plane: "user",
+      creatorUserId: "user_u",
+    });
+    expect(issued).toEqual({ creatorId: "user_u", creatorScopes: ["member"] });
+  });
+
+  test("user-plane ceiling includes role grants, not only identity.scopes", async () => {
+    const { resolveAccessKeyIssuer } = await import("./flows.ts");
+    const roles = createRoleStore();
+    upsertRole(roles, {
+      id: "role_member",
+      name: "member",
+      plane: "user",
+      description: "",
+    });
+    setRoleGrants(roles, "role_member", ["member", "task:write"]);
+    const issued = resolveAccessKeyIssuer(
+      {
+        identities: [
+          {
+            id: "user_u",
+            email: "u@example.com",
+            name: "U",
+            status: "active" as const,
+            scopes: ["member"],
+          },
+        ],
+        roleMembers: new Map([["role_member", ["user_u"]]]),
+        roles,
+        operators: { roles: new Map() },
+      } as never,
+      "op1",
+      { plane: "user", creatorUserId: "user_u" },
+    );
+    expect(issued).toEqual({ creatorId: "user_u", creatorScopes: ["member", "task:write"] });
+  });
+});
+
 describe("helpers", () => {
-  test("expandAccessCeiling adds application scopes for console:*", () => {
+  test("expandAccessCeiling expands console:* to console catalog only", () => {
     const held = expandAccessCeiling(["console:*"], ["console:store.sql:read", "booking:create"]);
     expect(held.has("console:store.sql:read")).toBe(true);
-    expect(held.has("booking:create")).toBe(true);
+    expect(held.has("booking:create")).toBe(false);
   });
 
   test("isKeyUnused90d", () => {

package/src/console/server/access.ts

@@ -19,6 +19,7 @@ import {
   revokeApiKey,
   revokeFamily,
   rotateApiKey,
+  updateApiKey,
   setRoleGrants,
   scopesForRoles,
   type ApiKeyStore,
@@ -81,6 +82,10 @@ export interface AccessKeyRow {
   readonly id: string;
   readonly name: string;
   readonly plane: "user" | "operator";
+  /** Stored issuer — user id or operator id. Frozen after mint. */
+  readonly creatorId: string;
+  /** Issuer ceiling stored on the key — edit scopes stay at or under this. */
+  readonly creatorScopes: readonly string[];
   readonly scopes: readonly string[];
   readonly createdAt: number;
   readonly lastUsedAt: number | null;
@@ -205,7 +210,7 @@ export function projectAccessPanel(options: ProjectAccessOptions): AccessPanelPr
   });
 
   const operators = projectOperators(options);
-  const users = projectUsers(options);
+  const users = projectUsers(options, catalog);
   const roles = projectRoles(options);
   const keys = projectKeys(options, now);
   const invites = projectInvites(options, now);
@@ -497,6 +502,36 @@ export async function accessRotateKey(
   };
 }
 
+/**
+ * Update key metadata. Scope changes re-attenuate against stored creatorScopes.
+ *
+ * @param store - API key store
+ * @param input - Patch
+ */
+export function accessUpdateKey(
+  store: ApiKeyStore,
+  input: {
+    readonly keyId: string;
+    readonly name?: string;
+    readonly scopes?: readonly string[];
+    readonly expiresAt?: number | null;
+    readonly rateLimit?: { max: number; per: string } | null;
+    readonly ipAllowlist?: readonly string[];
+  },
+): AccessKeyRow | null {
+  const existing = store.keys.get(input.keyId);
+  if (!existing) return null;
+  const row = updateApiKey(store, input.keyId, {
+    ceiling: existing.creatorScopes,
+    name: input.name,
+    scopes: input.scopes,
+    expiresAt: input.expiresAt,
+    rateLimit: input.rateLimit,
+    ipAllowlist: input.ipAllowlist,
+  });
+  return row ? toKeyRow(row, () => Date.now()) : null;
+}
+
 /**
  * Create an operator invitation.
  *
@@ -528,10 +563,9 @@ export class AccessGrantError extends Error {
 /**
  * Expand held scopes for Access administration.
  *
- * `console:*` covers every `console:…` pair and, for the Access admin
- * surface, every application scope in the catalog so operators can manage
- * the user plane without holding application scopes on their own principal
- * (which Gates would flag as a plane violation).
+ * `console:*` covers every `console:…` pair in the catalog. Application
+ * scopes are never added — user-plane keys are attenuated to the issuer's
+ * own grants (`scopesForRoles`), not the operator catalog.
  *
  * @param held - Actor scopes
  * @param catalog - Manifest Module:Action pairs
@@ -540,17 +574,7 @@ export function expandAccessCeiling(
   held: Iterable<string>,
   catalog: readonly string[],
 ): Set<string> {
-  const out = expandHeldScopes(held, catalog);
-  let star = false;
-  for (const s of held) {
-    if (s === "console:*") star = true;
-  }
-  if (star) {
-    for (const scope of catalog) {
-      if (isApplicationScope(scope)) out.add(scope);
-    }
-  }
-  return out;
+  return expandHeldScopes(held, catalog);
 }
 
 function projectOperators(options: ProjectAccessOptions): AccessOperatorRow[] {
@@ -574,14 +598,35 @@ function projectOperators(options: ProjectAccessOptions): AccessOperatorRow[] {
   return rows.sort((a, b) => a.email.localeCompare(b.email));
 }
 
-function projectUsers(options: ProjectAccessOptions): AccessUserRow[] {
+/**
+ * User-plane issuer ceiling — identity scopes plus role grants.
+ * Create must use this union; the list already did.
+ *
+ * @param options - User + roles
+ */
+export function accessUserCeiling(options: {
+  readonly userId: string;
+  readonly identityScopes?: Iterable<string>;
+  readonly roles: RoleStore;
+  readonly roleMembers: ReadonlyMap<string, readonly string[]>;
+}): string[] {
+  const roleIds = roleIdsForMember(options.roleMembers, options.userId);
+  const fromRoles = [...scopesForRoles(options.roles, roleIds, "user")];
+  const fromIdentity = [...(options.identityScopes ?? [])];
+  return [...new Set([...fromRoles, ...fromIdentity])].sort((a, b) => a.localeCompare(b));
+}
+
+function projectUsers(options: ProjectAccessOptions, catalog: readonly string[]): AccessUserRow[] {
+  const allowed = new Set(catalog);
   return options.identities
     .map((identity) => {
       const roleIds = roleIdsForMember(options.roleMembers, identity.id);
-      const fromRoles = [...scopesForRoles(options.roles, roleIds, "user")];
-      const scopes = [...new Set([...fromRoles, ...identity.scopes])].sort((a, b) =>
-        a.localeCompare(b),
-      );
+      const scopes = accessUserCeiling({
+        userId: identity.id,
+        identityScopes: identity.scopes,
+        roles: options.roles,
+        roleMembers: options.roleMembers,
+      }).filter((scope) => allowed.has(scope));
       return {
         id: identity.id,
         email: identity.email,
@@ -637,6 +682,8 @@ function toKeyRow(
     readonly id: string;
     readonly name: string;
     readonly plane: "user" | "operator";
+    readonly creatorId: string;
+    readonly creatorScopes: readonly string[];
     readonly scopes: readonly string[];
     readonly createdAt: number;
     readonly lastUsedAt: number | null;
@@ -652,6 +699,8 @@ function toKeyRow(
     id: key.id,
     name: key.name,
     plane: key.plane,
+    creatorId: key.creatorId,
+    creatorScopes: [...key.creatorScopes].sort((a, b) => a.localeCompare(b)),
     scopes: [...key.scopes].sort((a, b) => a.localeCompare(b)),
     createdAt: key.createdAt,
     lastUsedAt: key.lastUsedAt,
@@ -717,9 +766,7 @@ function roleIdsForMember(
 }
 
 function runTouchesKey(run: WideEvent, keyId: string): boolean {
-  if (run.principal === keyId) return true;
   const dims = run.dimensions;
-  if (dims.principal === keyId) return true;
   if (dims.api_key === keyId || dims.apiKey === keyId || dims.key === keyId) {
     return true;
   }

package/src/console/server/app.ts

@@ -137,6 +137,7 @@ export function createConsoleApp(options: CreateConsoleAppOptions = {}): Console
         accessCreateKey: routes.access.createKey,
         accessRevokeKey: routes.access.revokeKey,
         accessRotateKey: routes.access.rotateKey,
+        accessUpdateKey: routes.access.updateKey,
         accessSetRoleGrants: routes.access.setRoleGrants,
         diffList: routes.diff.list,
         clockList: routes.clock.list,

package/src/console/server/dev-identities.test.ts

@@ -0,0 +1,127 @@
+/**
+ * Default invoke-as ladder — ten rungs, historic demo + member ids.
+ */
+
+import { describe, expect, test } from "bun:test";
+import type { Manifest } from "../../manifest/types.ts";
+import { createRoleStore } from "../../auth/index.ts";
+import {
+  DEV_IDENTITY_LADDER,
+  KEEL_SCOPES,
+  defaultDevIdentities,
+  defaultMemberIdentityIds,
+  demoScopesFromManifest,
+  isDefaultIdentitySeed,
+  refreshSeededIdentities,
+  scopesForDevIdentityRung,
+  seedKeelAccessRoles,
+} from "./dev-identities.ts";
+
+const KEEL_LIKE: Manifest = {
+  oke: "1.0",
+  app: "keel-like",
+  gates: {
+    member: { kind: "policy", scopes: ["member"] },
+    "task:write": { kind: "policy", scopes: ["task:write"] },
+    "comment:write": { kind: "policy", scopes: ["comment:write"] },
+    "files:write": { kind: "policy", scopes: ["files:write"] },
+    "project:admin": { kind: "policy", scopes: ["project:admin"] },
+    "member:admin": { kind: "policy", scopes: ["member:admin"] },
+    "webhook:admin": { kind: "policy", scopes: ["webhook:admin"] },
+  },
+};
+
+describe("DEV_IDENTITY_LADDER", () => {
+  test("is ten people from owner to guest and keeps demo + member", () => {
+    expect(DEV_IDENTITY_LADDER).toHaveLength(10);
+    expect(DEV_IDENTITY_LADDER[0]).toMatchObject({
+      id: "user_demo",
+      email: "demo@example.com",
+      role: "owner",
+    });
+    expect(DEV_IDENTITY_LADDER[7]).toMatchObject({
+      id: "user_member",
+      email: "member@example.com",
+      role: "member",
+    });
+    expect(DEV_IDENTITY_LADDER[9]?.role).toBe("guest");
+    expect(new Set(DEV_IDENTITY_LADDER.map((p) => p.role)).size).toBe(10);
+  });
+});
+
+describe("defaultDevIdentities", () => {
+  test("demo follows the Manifest; member stays member-only", () => {
+    const rows = defaultDevIdentities({
+      oke: "1.0",
+      app: "keel-like",
+      gates: {
+        member: { kind: "policy", scopes: ["member"] },
+        "task:write": { kind: "policy", scopes: ["task:write"] },
+        "booking:create": { kind: "policy", scopes: ["booking:create"] },
+      },
+    });
+    const demo = rows.find((row) => row.id === "user_demo");
+    const member = rows.find((row) => row.id === "user_member");
+    const guest = rows.find((row) => row.id === "user_guest");
+    expect(demo?.scopes).toEqual(["booking:create", "member", "task:write"]);
+    expect(member?.scopes).toEqual(["member"]);
+    expect(guest?.scopes).toEqual([]);
+    expect(demo?.scopes).not.toEqual(member?.scopes);
+  });
+
+  test("keel profiles step down from owner to guest", () => {
+    const catalog = demoScopesFromManifest(KEEL_LIKE);
+    const owner = scopesForDevIdentityRung(0, catalog);
+    const admin = scopesForDevIdentityRung(1, catalog);
+    const member = scopesForDevIdentityRung(7, catalog);
+    const guest = scopesForDevIdentityRung(9, catalog);
+    expect(owner).toEqual(catalog);
+    expect(admin).toEqual(catalog);
+    expect(scopesForDevIdentityRung(2, catalog).length).toBeLessThan(admin.length);
+    expect(member).toEqual(["member"]);
+    expect(guest).toEqual([]);
+  });
+});
+
+describe("refreshSeededIdentities", () => {
+  test("replaces the default ladder and ignores a custom list", () => {
+    const seeded = defaultDevIdentities();
+    refreshSeededIdentities(seeded, KEEL_LIKE);
+    expect(seeded.find((row) => row.id === "user_demo")?.scopes).toContain("task:write");
+    expect(isDefaultIdentitySeed(seeded)).toBe(true);
+
+    const custom = [{ ...seeded[0]!, id: "user_custom" }];
+    refreshSeededIdentities(custom, KEEL_LIKE);
+    expect(custom).toHaveLength(1);
+  });
+});
+
+describe("keel scope seed", () => {
+  test("keel Manifest unions every declared Gate scope onto owner", () => {
+    const rows = defaultDevIdentities({ oke: "1.0", app: "keel" });
+    const demo = rows.find((row) => row.id === "user_demo");
+    expect(demo?.scopes).toEqual([...KEEL_SCOPES].sort((a, b) => a.localeCompare(b)));
+    expect(rows.find((row) => row.id === "user_admin")?.scopes).toEqual([...KEEL_SCOPES].sort());
+    expect(rows.find((row) => row.id === "user_member")?.scopes).toEqual(["member"]);
+    expect(rows.find((row) => row.id === "user_guest")?.scopes).toEqual([]);
+  });
+
+  test("seedKeelAccessRoles writes every Keel scope onto owner", () => {
+    const roles = createRoleStore();
+    const roleMembers = new Map<string, string[]>();
+    seedKeelAccessRoles(roles, roleMembers);
+    expect([...(roles.grants.get("role_owner") ?? [])].sort()).toEqual(
+      [...KEEL_SCOPES].sort((a, b) => a.localeCompare(b)),
+    );
+    expect(KEEL_SCOPES.every((scope) => roles.grants.get("role_owner")?.has(scope))).toBe(true);
+    expect(roleMembers.get("role_owner")).toEqual(["user_demo"]);
+  });
+});
+
+describe("defaultMemberIdentityIds", () => {
+  test("omits guest", () => {
+    expect(defaultMemberIdentityIds()).not.toContain("user_guest");
+    expect(defaultMemberIdentityIds()).toContain("user_demo");
+    expect(defaultMemberIdentityIds()).toContain("user_member");
+  });
+});