okengine 0.15.2 → 0.16.0

package/src/console/server/dev-identities.ts

@@ -0,0 +1,229 @@
+/**
+ * Default invoke-as identities — ten rungs from owner to guest.
+ *
+ * `user_demo` (owner) and `user_member` keep their historic ids so Call API
+ * tests and Access fixtures stay stable. Owner scopes follow the Manifest;
+ * lower rungs intersect a named profile with that catalog. Keel (`app ===
+ * "keel"`) always unions {@link KEEL_SCOPES} so seeding is not missing a
+ * declared Gate. No leftover app catalog is invented for other apps.
+ */
+
+import { setRoleGrants, upsertRole, type RoleStore } from "../../auth/index.ts";
+import type { Manifest } from "../../manifest/types.ts";
+
+/**
+ * Every Keel user-plane scope — `gate.policy("member")` plus `gate.scope`.
+ * Seeded onto the owner → guest ladder when the Manifest app is `keel`.
+ */
+export const KEEL_SCOPES = [
+  "member",
+  "task:write",
+  "comment:write",
+  "files:write",
+  "project:admin",
+  "member:admin",
+  "webhook:admin",
+] as const;
+
+/** One seeded development identity. */
+export interface SeededDevIdentity {
+  readonly id: string;
+  readonly email: string;
+  readonly name: string;
+  readonly status: "active";
+  readonly scopes: readonly string[];
+}
+
+/** Stable person for one authorization rung. */
+export interface DevIdentityPerson {
+  readonly id: string;
+  readonly email: string;
+  readonly name: string;
+  /** Workspace / Access role label, owner → guest. */
+  readonly role: string;
+}
+
+/**
+ * Ten people, owner → guest. Demo and Member keep historic ids.
+ */
+export const DEV_IDENTITY_LADDER = [
+  { id: "user_demo", email: "demo@example.com", name: "Demo User", role: "owner" },
+  { id: "user_admin", email: "admin@example.com", name: "Admin", role: "admin" },
+  {
+    id: "user_workspace",
+    email: "workspace@example.com",
+    name: "Workspace Admin",
+    role: "workspace_admin",
+  },
+  { id: "user_pm", email: "pm@example.com", name: "Project Manager", role: "project_manager" },
+  { id: "user_lead", email: "lead@example.com", name: "Lead", role: "lead" },
+  { id: "user_dev", email: "developer@example.com", name: "Developer", role: "developer" },
+  { id: "user_writer", email: "writer@example.com", name: "Contributor", role: "contributor" },
+  { id: "user_member", email: "member@example.com", name: "Member", role: "member" },
+  { id: "user_commenter", email: "commenter@example.com", name: "Commenter", role: "commenter" },
+  { id: "user_guest", email: "guest@example.com", name: "Guest", role: "guest" },
+] as const satisfies readonly DevIdentityPerson[];
+
+/** One Keel ladder role and the scopes it holds. */
+export type KeelLadderRole = (typeof DEV_IDENTITY_LADDER)[number]["role"];
+
+/**
+ * Owner → guest grants. Owner and admin hold {@link KEEL_SCOPES}.
+ */
+export const KEEL_LADDER_GRANTS: Readonly<Record<KeelLadderRole, readonly string[]>> = {
+  owner: KEEL_SCOPES,
+  admin: KEEL_SCOPES,
+  workspace_admin: [
+    "member",
+    "task:write",
+    "comment:write",
+    "files:write",
+    "project:admin",
+    "member:admin",
+  ],
+  project_manager: ["member", "task:write", "comment:write", "files:write", "project:admin"],
+  lead: ["member", "task:write", "comment:write", "project:admin"],
+  developer: ["member", "task:write", "comment:write", "files:write"],
+  contributor: ["member", "task:write", "comment:write"],
+  member: ["member"],
+  commenter: ["member", "comment:write"],
+  guest: [],
+};
+
+/** `*` = every catalog scope (owner). Other rungs follow {@link KEEL_LADDER_GRANTS}. */
+const LADDER_SCOPE_PROFILES: readonly (readonly string[] | "*")[] = [
+  "*",
+  ...DEV_IDENTITY_LADDER.slice(1).map((person) => KEEL_LADDER_GRANTS[person.role]),
+];
+
+/**
+ * Whether this Manifest is the Keel example (full scope seed applies).
+ *
+ * @param manifest - Optional Manifest
+ */
+export function isKeelManifest(manifest?: Manifest | null): boolean {
+  return manifest?.app === "keel";
+}
+
+/**
+ * Application scopes implied by a Manifest — gate `scopes`, scoped gate
+ * ids, and flow gate refs. Always includes `member`.
+ *
+ * @param manifest - Optional Manifest
+ */
+export function demoScopesFromManifest(manifest?: Manifest | null): string[] {
+  const scopes = new Set<string>(["member"]);
+  if (isKeelManifest(manifest)) {
+    for (const scope of KEEL_SCOPES) scopes.add(scope);
+  }
+  if (!manifest) return [...scopes].sort();
+  for (const [gateId, gate] of Object.entries(manifest.gates ?? {})) {
+    for (const scope of gate.scopes ?? []) scopes.add(scope);
+    if (gateId.includes(":") && !gateId.startsWith("rate:")) scopes.add(gateId);
+  }
+  for (const flow of Object.values(manifest.flows ?? {})) {
+    for (const gate of flow.gates ?? []) {
+      if (gate.includes(":") && !gate.startsWith("rate:")) scopes.add(gate);
+    }
+  }
+  return [...scopes].sort();
+}
+
+/**
+ * Scopes for one ladder rung — owner is the full catalog; others intersect
+ * their profile. `member` stays on every signed-in rung.
+ *
+ * @param rung - 0 (owner) … 9 (guest)
+ * @param catalog - Manifest-derived scopes
+ */
+export function scopesForDevIdentityRung(rung: number, catalog: readonly string[]): string[] {
+  const profile = LADDER_SCOPE_PROFILES[rung];
+  if (profile === undefined) return [];
+  if (profile === "*") return [...catalog].sort((a, b) => a.localeCompare(b));
+  const allowed = new Set(catalog);
+  return [...new Set(profile.filter((scope) => scope === "member" || allowed.has(scope)))].sort(
+    (a, b) => a.localeCompare(b),
+  );
+}
+
+/**
+ * Default development identities for the invoke-as picker.
+ *
+ * @param manifest - Optional Manifest used to derive application scopes
+ */
+export function defaultDevIdentities(manifest?: Manifest | null): SeededDevIdentity[] {
+  const catalog = demoScopesFromManifest(manifest);
+  return DEV_IDENTITY_LADDER.map((person, rung) => ({
+    id: person.id,
+    email: person.email,
+    name: person.name,
+    status: "active",
+    scopes: scopesForDevIdentityRung(rung, catalog),
+  }));
+}
+
+/**
+ * Whether the live list is still the built-in ladder (safe to refresh).
+ *
+ * @param identities - Live identity list
+ */
+export function isDefaultIdentitySeed(identities: readonly { readonly id: string }[]): boolean {
+  if (identities.length !== DEV_IDENTITY_LADDER.length) return false;
+  const ids = new Set(identities.map((row) => row.id));
+  return DEV_IDENTITY_LADDER.every((person) => ids.has(person.id));
+}
+
+/**
+ * Signed-in ladder ids (guest excluded) — default `role_member` holders.
+ */
+export function defaultMemberIdentityIds(): string[] {
+  return DEV_IDENTITY_LADDER.filter((person) => person.role !== "guest").map((person) => person.id);
+}
+
+/**
+ * Replace the default ladder when a Manifest arrives.
+ *
+ * @param identities - Live identity list
+ * @param manifest - New Manifest
+ */
+export function refreshSeededIdentities(
+  identities: Array<{
+    id: string;
+    email: string;
+    name: string;
+    status: "active" | "disabled";
+    scopes: readonly string[];
+  }>,
+  manifest: Manifest | null,
+): void {
+  if (!isDefaultIdentitySeed(identities)) return;
+  const next = defaultDevIdentities(manifest);
+  identities.splice(0, identities.length, ...next);
+}
+
+/**
+ * Seed Access roles for Keel — every {@link KEEL_SCOPES} pair lands on the
+ * owner / admin rung; lower rungs use {@link KEEL_LADDER_GRANTS}.
+ *
+ * @param roles - Role store
+ * @param roleMembers - roleId → principal ids
+ */
+export function seedKeelAccessRoles(roles: RoleStore, roleMembers: Map<string, string[]>): void {
+  for (const person of DEV_IDENTITY_LADDER) {
+    const roleId = `role_${person.role}`;
+    upsertRole(roles, {
+      id: roleId,
+      name: person.role,
+      plane: "user",
+      description:
+        person.role === "owner"
+          ? "Full workspace authorization"
+          : person.role === "guest"
+            ? "Least authorization — no write scopes"
+            : `Keel ${person.role.replaceAll("_", " ")}`,
+    });
+    setRoleGrants(roles, roleId, KEEL_LADDER_GRANTS[person.role]);
+    roleMembers.set(roleId, person.role === "guest" ? [] : [person.id]);
+  }
+  roleMembers.set("role_member", defaultMemberIdentityIds());
+}

package/src/console/server/flows-invoke.test.ts

@@ -15,12 +15,29 @@ import { http } from "../../kernel/triggers.ts";
 import { field, store } from "../../elements/store.ts";
 import { PII_MASK } from "../../elements/store/classify.ts";
 import { createTestApp } from "../../test/create-test-app.ts";
+import type { Manifest } from "../../manifest/types.ts";
 import { FLOWS_TEST_MANIFEST } from "../ui-next/src/features/flows/fixture.ts";
 import { bindHostInvokeUserFlow } from "./invoke-user-flow.ts";
 import { startConsoleApp } from "./serve.ts";
 import { setManifest } from "./state.ts";
 import type { InvokeUserFlowInput } from "./invoke-user-flow.ts";
 
+/** Fixture plus the booking gate the host actually enforces. */
+const BOOKING_INVOKE_MANIFEST: Manifest = {
+  ...FLOWS_TEST_MANIFEST,
+  gates: {
+    member: { kind: "policy", scopes: ["member"] },
+    "booking:create": { kind: "policy", scopes: ["booking:create"] },
+  },
+  flows: {
+    ...FLOWS_TEST_MANIFEST.flows,
+    "bookings.create": {
+      ...FLOWS_TEST_MANIFEST.flows!["bookings.create"]!,
+      gates: ["member", "booking:create"],
+    },
+  },
+};
+
 const memoryDrivers = {
   store: { kv: { dev: "memory", test: "memory", prod: "memory" } },
   signal: { dev: "memory", test: "memory", prod: "memory" },
@@ -147,11 +164,11 @@ describe("console flows invoke", () => {
       secret: "test-secret-flows",
       silentClaim: true,
       production: false,
-      manifest: FLOWS_TEST_MANIFEST,
+      manifest: BOOKING_INVOKE_MANIFEST,
     });
     const host = await bootInvokeHost();
     try {
-      setManifest(handle.state, FLOWS_TEST_MANIFEST);
+      setManifest(handle.state, BOOKING_INVOKE_MANIFEST);
       handle.state.invokeUserFlow = bindHostInvokeUserFlow(host);
       const auth = await claimOperator(handle);
 
@@ -214,12 +231,12 @@ describe("console flows invoke", () => {
       secret: "test-secret-flows-adv",
       silentClaim: true,
       production: false,
-      manifest: FLOWS_TEST_MANIFEST,
+      manifest: BOOKING_INVOKE_MANIFEST,
     });
     const host = await bootInvokeHost();
     const seen: InvokeUserFlowInput[] = [];
     try {
-      setManifest(handle.state, FLOWS_TEST_MANIFEST);
+      setManifest(handle.state, BOOKING_INVOKE_MANIFEST);
       const bound = bindHostInvokeUserFlow(host);
       handle.state.invokeUserFlow = async (input) => {
         seen.push(input);

package/src/console/server/flows.ts

@@ -36,6 +36,7 @@ import { PUBLIC_CONSOLE_FLOWS } from "./public-flows.ts";
 import { resolveInvokeAs } from "./invoke-user-flow.ts";
 import { resolveRlsIdentity } from "../../elements/store.ts";
 import type { RlsIdentity } from "../../drivers/pg-rls.ts";
+import { accessUserCeiling } from "./access.ts";
 import { isKnownConsoleSqlGate, StoreFileNotFoundError, tenancyDeclared } from "./store.ts";
 import {
   PG_STAT_STATEMENTS_NOT_CREATED,
@@ -1164,6 +1165,22 @@ const GatesPowersOut = z.object({
   deniedFlowIds: z.array(z.string()),
 });
 
+const AccessKeyRowOut = z.object({
+  id: z.string(),
+  name: z.string(),
+  plane: z.enum(["user", "operator"]),
+  creatorId: z.string(),
+  creatorScopes: z.array(z.string()),
+  scopes: z.array(z.string()),
+  createdAt: z.number(),
+  lastUsedAt: z.number().nullable(),
+  expiresAt: z.number().nullable(),
+  revokedAt: z.number().nullable(),
+  rateLimit: z.object({ max: z.number(), per: z.string() }).nullable(),
+  ipAllowlist: z.array(z.string()),
+  unused90d: z.boolean(),
+});
+
 const AccessPlaneSection = z.object({
   plane: z.enum(["user", "operator"]),
   operators: z
@@ -1202,21 +1219,7 @@ const AccessPlaneSection = z.object({
       memberCount: z.number(),
     }),
   ),
-  keys: z.array(
-    z.object({
-      id: z.string(),
-      name: z.string(),
-      plane: z.enum(["user", "operator"]),
-      scopes: z.array(z.string()),
-      createdAt: z.number(),
-      lastUsedAt: z.number().nullable(),
-      expiresAt: z.number().nullable(),
-      revokedAt: z.number().nullable(),
-      rateLimit: z.object({ max: z.number(), per: z.string() }).nullable(),
-      ipAllowlist: z.array(z.string()),
-      unused90d: z.boolean(),
-    }),
-  ),
+  keys: z.array(AccessKeyRowOut),
   invites: z
     .array(
       z.object({
@@ -1236,21 +1239,7 @@ const AccessListOut = z.object({
   operatorPlane: AccessPlaneSection,
   userPlane: AccessPlaneSection,
   hygiene: z.object({
-    unusedKeys: z.array(
-      z.object({
-        id: z.string(),
-        name: z.string(),
-        plane: z.enum(["user", "operator"]),
-        scopes: z.array(z.string()),
-        createdAt: z.number(),
-        lastUsedAt: z.number().nullable(),
-        expiresAt: z.number().nullable(),
-        revokedAt: z.number().nullable(),
-        rateLimit: z.object({ max: z.number(), per: z.string() }).nullable(),
-        ipAllowlist: z.array(z.string()),
-        unused90d: z.boolean(),
-      }),
-    ),
+    unusedKeys: z.array(AccessKeyRowOut),
     neverSignedInOperators: z.array(
       z.object({
         id: z.string(),
@@ -1317,25 +1306,28 @@ const AccessCreateKeyIn = z.object({
   plane: z.enum(["user", "operator"]),
   name: z.string().min(1),
   scopes: z.array(z.string()),
+  /** Required for user-plane keys — issuer whose grants are the ceiling. */
+  creatorUserId: z.string().min(1).optional(),
+  expiresAt: z.number().nullable().optional(),
+  rateLimit: z.object({ max: z.number(), per: z.string() }).nullable().optional(),
+  ipAllowlist: z.array(z.string()).optional(),
+});
+
+const AccessUpdateKeyIn = z.object({
+  keyId: z.string().min(1),
+  name: z.string().min(1).optional(),
+  scopes: z.array(z.string()).optional(),
   expiresAt: z.number().nullable().optional(),
   rateLimit: z.object({ max: z.number(), per: z.string() }).nullable().optional(),
   ipAllowlist: z.array(z.string()).optional(),
 });
 
+const AccessUpdateKeyOut = z.object({
+  key: AccessKeyRowOut,
+});
+
 const AccessCreateKeyOut = z.object({
-  key: z.object({
-    id: z.string(),
-    name: z.string(),
-    plane: z.enum(["user", "operator"]),
-    scopes: z.array(z.string()),
-    createdAt: z.number(),
-    lastUsedAt: z.number().nullable(),
-    expiresAt: z.number().nullable(),
-    revokedAt: z.number().nullable(),
-    rateLimit: z.object({ max: z.number(), per: z.string() }).nullable(),
-    ipAllowlist: z.array(z.string()),
-    unused90d: z.boolean(),
-  }),
+  key: AccessKeyRowOut,
   /** Raw secret — returned exactly once. */
   secret: z.string(),
 });
@@ -1347,19 +1339,7 @@ const AccessRevokeKeyIn = z.object({
 });
 
 const AccessRevokeKeyOut = z.object({
-  key: z.object({
-    id: z.string(),
-    name: z.string(),
-    plane: z.enum(["user", "operator"]),
-    scopes: z.array(z.string()),
-    createdAt: z.number(),
-    lastUsedAt: z.number().nullable(),
-    expiresAt: z.number().nullable(),
-    revokedAt: z.number().nullable(),
-    rateLimit: z.object({ max: z.number(), per: z.string() }).nullable(),
-    ipAllowlist: z.array(z.string()),
-    unused90d: z.boolean(),
-  }),
+  key: AccessKeyRowOut,
   blastRadius: AccessKeyBlastOut,
 });
 
@@ -1855,6 +1835,7 @@ export function createConsoleBindings(state: ConsoleState): {
       readonly createKey: AnyFlowDef;
       readonly revokeKey: AnyFlowDef;
       readonly rotateKey: AnyFlowDef;
+      readonly updateKey: AnyFlowDef;
       readonly setRoleGrants: AnyFlowDef;
     };
     readonly diff: {
@@ -1928,6 +1909,7 @@ export function createConsoleBindings(state: ConsoleState): {
   const accessCreateKeyFlow = createAccessCreateKey(state);
   const accessRevokeKeyFlow = createAccessRevokeKey(state);
   const accessRotateKeyFlow = createAccessRotateKey(state);
+  const accessUpdateKeyFlow = createAccessUpdateKey(state);
   const accessSetRoleGrantsFlow = createAccessSetRoleGrants(state);
   const diffList = createDiffList(state);
   const pluginsList = createPluginsList(state);
@@ -1990,6 +1972,7 @@ export function createConsoleBindings(state: ConsoleState): {
     bindHttp(http.post("/console/access/keys"), accessCreateKeyFlow),
     bindHttp(http.post("/console/access/keys/revoke"), accessRevokeKeyFlow),
     bindHttp(http.post("/console/access/keys/rotate"), accessRotateKeyFlow),
+    bindHttp(http.post("/console/access/keys/update"), accessUpdateKeyFlow),
     bindHttp(http.post("/console/access/roles/grants"), accessSetRoleGrantsFlow),
     bindHttp(http.get("/console/diff"), diffList),
     bindHttp(http.get("/console/plugins"), pluginsList),
@@ -2059,6 +2042,7 @@ export function createConsoleBindings(state: ConsoleState): {
         createKey: accessCreateKeyFlow,
         revokeKey: accessRevokeKeyFlow,
         rotateKey: accessRotateKeyFlow,
+        updateKey: accessUpdateKeyFlow,
         setRoleGrants: accessSetRoleGrantsFlow,
       },
       diff: { list: diffList },
@@ -3854,6 +3838,46 @@ function actorScopesOf(state: ConsoleState, operatorId: string): string[] {
   return [...new Set([...fromRoles, "console:*"])];
 }
 
+/**
+ * Derive the issuer for a Console-minted key.
+ * Operator-plane: the acting operator. User-plane: required `creatorUserId`.
+ *
+ * @param state - Console state
+ * @param operatorId - Acting operator
+ * @param input - Create payload
+ */
+export function resolveAccessKeyIssuer(
+  state: ConsoleState,
+  operatorId: string,
+  input: { readonly plane: "user" | "operator"; readonly creatorUserId?: string },
+):
+  | { readonly creatorId: string; readonly creatorScopes: readonly string[] }
+  | { readonly error: string } {
+  if (input.plane === "operator") {
+    return { creatorId: operatorId, creatorScopes: actorScopesOf(state, operatorId) };
+  }
+  const userId = input.creatorUserId;
+  if (!userId) {
+    return { error: "creatorUserId is required for user-plane keys" };
+  }
+  const identity = state.identities.find((row) => row.id === userId);
+  const roleIds = [...state.roleMembers.entries()]
+    .filter(([, members]) => members.includes(userId))
+    .map(([id]) => id);
+  if (!identity && roleIds.length === 0) {
+    return { error: `unknown user: ${userId}` };
+  }
+  return {
+    creatorId: userId,
+    creatorScopes: accessUserCeiling({
+      userId,
+      identityScopes: identity?.scopes,
+      roles: state.roles,
+      roleMembers: state.roleMembers,
+    }),
+  };
+}
+
 function createAccessList(state: ConsoleState) {
   return flow("console.access.list", {
     plane: "operator",
@@ -3916,12 +3940,16 @@ function createAccessCreateKey(state: ConsoleState) {
     do: async (input: z.infer<typeof AccessCreateKeyIn>, fx) => {
       if (!fx.operator.id) return fail("AuthFailed", {});
       try {
+        const issued = resolveAccessKeyIssuer(state, fx.operator.id, input);
+        if ("error" in issued) {
+          return fail("AccessGrantDenied", { reason: issued.error });
+        }
         const created = await state.accessCreateKey({
           plane: input.plane,
           name: input.name,
           scopes: input.scopes,
-          creatorId: fx.operator.id,
-          creatorScopes: actorScopesOf(state, fx.operator.id),
+          creatorId: issued.creatorId,
+          creatorScopes: issued.creatorScopes,
           expiresAt: input.expiresAt,
           rateLimit: input.rateLimit,
           ipAllowlist: input.ipAllowlist,
@@ -4004,6 +4032,33 @@ function createAccessRotateKey(state: ConsoleState) {
   });
 }
 
+function createAccessUpdateKey(state: ConsoleState) {
+  return flow("console.access.updateKey", {
+    plane: "operator",
+    in: AccessUpdateKeyIn,
+    out: AccessUpdateKeyOut,
+    errors: { AuthFailed, AccessKeyNotFound, AccessGrantDenied },
+    do: async (input: z.infer<typeof AccessUpdateKeyIn>, fx) => {
+      if (!fx.operator.id) return fail("AuthFailed", {});
+      try {
+        const key = await state.accessUpdateKey(input);
+        if (!key) {
+          return fail("AccessKeyNotFound", { keyId: input.keyId });
+        }
+        fx.log.info("console.access.updateKey", {
+          keyId: key.id,
+          operatorId: fx.operator.id,
+        });
+        return { key: { ...key } };
+      } catch (err) {
+        return fail("AccessGrantDenied", {
+          reason: err instanceof Error ? err.message : "grant denied",
+        });
+      }
+    },
+  });
+}
+
 function createAccessSetRoleGrants(state: ConsoleState) {
   return flow("console.access.setRoleGrants", {
     plane: "operator",

package/src/console/server/gates.test.ts

@@ -78,6 +78,14 @@ async function liveRuntime(): Promise<{
   };
 }
 
+describe("createDefaultGateAuthStores", () => {
+  test("user roles grant member only — no leftover app catalog", () => {
+    const auth = createDefaultGateAuthStores();
+    expect([...(auth.roles.grants.get("role_member") ?? [])]).toEqual(["member"]);
+    expect([...(auth.roles.grants.get("role_staff") ?? [])]).toEqual(["member"]);
+  });
+});
+
 describe("isApplicationScope", () => {
   test("console:* is not application; everything else is", () => {
     expect(isApplicationScope("console:store.sql:write")).toBe(false);
@@ -91,6 +99,21 @@ describe("projectGatesPanel", () => {
     const auth = createDefaultGateAuthStores();
     // Poison an operator role with an application scope.
     setRoleGrants(auth.roles, "role_ops", ["console:store.sql:read", "booking:create"]);
+    auth.apiKeys.keys.set("key_fixture", {
+      id: "key_fixture",
+      plane: "user",
+      hash: "fixture",
+      name: "Fixture",
+      scopes: ["member"],
+      expiresAt: null,
+      rateLimit: null,
+      ipAllowlist: [],
+      creatorId: "user_demo",
+      creatorScopes: ["member"],
+      createdAt: 0,
+      lastUsedAt: null,
+      revokedAt: null,
+    });
 
     const projection = projectGatesPanel({
       manifest: MANIFEST,
@@ -318,6 +341,7 @@ describe("simulateGates — evaluate only", () => {
   test("role principal resolves scopes from RoleStore", async () => {
     const { runtime, close } = await liveRuntime();
     const auth = createDefaultGateAuthStores();
+    setRoleGrants(auth.roles, "role_member", ["member", "booking:create"]);
     try {
       const ok = await simulateGates({
         flowId: "bookings.create",

package/src/console/server/gates.ts

@@ -33,6 +33,7 @@ import { statusForFailure } from "../../compiler/response.ts";
 import { gateDenialFailure } from "../../kernel/index.ts";
 import { diffManifest } from "../../manifest/diff.ts";
 import type { Gate as ManifestGate, Manifest, ManifestChange } from "../../manifest/types.ts";
+import { defaultMemberIdentityIds } from "./dev-identities.ts";
 
 /** Identity slice needed for Gates (avoids circular import with state). */
 export interface GatesIdentity {
@@ -413,8 +414,8 @@ export function createDefaultGateAuthStores(): {
     plane: "operator",
     description: "Console operators",
   });
-  setRoleGrants(roles, "role_member", ["member", "booking:create"]);
-  setRoleGrants(roles, "role_staff", ["member", "booking:create", "staff", "reports:export"]);
+  setRoleGrants(roles, "role_member", ["member"]);
+  setRoleGrants(roles, "role_staff", ["member"]);
   setRoleGrants(roles, "role_ops", [
     "console:store.sql:read",
     "console:store.sql:write",
@@ -422,24 +423,9 @@ export function createDefaultGateAuthStores(): {
   ]);
 
   const apiKeys = createApiKeyStore();
-  apiKeys.keys.set("key_demo", {
-    id: "key_demo",
-    plane: "user",
-    hash: "demo",
-    name: "Demo key",
-    scopes: ["member", "booking:create"],
-    expiresAt: null,
-    rateLimit: null,
-    ipAllowlist: [],
-    creatorId: "user_demo",
-    creatorScopes: ["member", "booking:create"],
-    createdAt: 0,
-    lastUsedAt: null,
-    revokedAt: null,
-  });
 
   const roleMembers = new Map<string, string[]>([
-    ["role_member", ["user_demo", "user_member"]],
+    ["role_member", defaultMemberIdentityIds()],
     ["role_staff", []],
     ["role_ops", []],
   ]);
@@ -706,7 +692,7 @@ function resolvePrincipalContext(options: SimulateGatesOptions): {
     return {
       ctx: {
         auth: { userId: null, scopes: new Set(), verified: false },
-        operator: { id: `key:${id}` },
+        operator: { id: key.creatorId },
         meta: { ip: options.meta?.ip },
       },
     };
@@ -714,12 +700,13 @@ function resolvePrincipalContext(options: SimulateGatesOptions): {
   return {
     ctx: {
       auth: {
-        userId: `key:${id}`,
+        userId: key.creatorId,
         scopes: new Set(key.scopes),
         verified: true,
+        apiKeyId: key.id,
       },
       operator: { id: null },
-      meta: { ip: options.meta?.ip, userId: `key:${id}` },
+      meta: { ip: options.meta?.ip, userId: key.creatorId },
     },
   };
 }

package/src/console/server/index.ts

@@ -6,6 +6,7 @@ export {
   accessCreateKey,
   accessRevokeKey,
   accessRotateKey,
+  accessUpdateKey,
   accessSetRoleGrants,
   effectivePermissions,
   expandAccessCeiling,