Share the item-id owner grammar and harden the repartition migration

Author: RhysSullivan

bun.lock

@@ -1,17 +1,14 @@
 // Selfhost-only: the browser-approval HTTP endpoints are session-scoped. A
 // signed-in user who does not own the MCP session must not be able to read the
 // paused execution or record the human decision for it.
-import { randomBytes } from "node:crypto";
-
 import { expect } from "@effect/vitest";
 import { Effect } from "effect";
 import { composePluginApi } from "@executor-js/api/server";
 
 import { scenario } from "../src/scenario";
 import { Api, Mcp, Target } from "../src/services";
 import { parseBrowserApproval } from "../src/surfaces/mcp";
-import type { Identity } from "../src/target";
-import { signInSession } from "../targets/selfhost";
+import { createInvitedIdentity } from "../targets/selfhost";
 
 const coreApi = composePluginApi([] as const);
 
@@ -21,46 +18,6 @@ const result = await tools.executor.coreTools.policies.list({});
 return JSON.stringify(result);
 `;
 
-const createInvitedIdentity = async (baseUrl: string, admin: Identity): Promise<Identity> => {
-  const cookie = admin.headers?.cookie;
-  expect(typeof cookie, "bootstrap admin has a Better Auth session cookie").toBe("string");
-
-  const invite = await fetch(new URL("/api/admin/invites", baseUrl), {
-    method: "POST",
-    headers: {
-      "content-type": "application/json",
-      cookie: cookie!,
-      origin: new URL(baseUrl).origin,
-    },
-    body: JSON.stringify({ role: "member" }),
-  });
-  expect(invite.status, `admin invite create response: ${await invite.clone().text()}`).toBe(200);
-  const inviteBody = (await invite.json()) as { readonly code?: string };
-  expect(typeof inviteBody.code, "invite response includes a redeemable code").toBe("string");
-
-  const email = `approval-cross-user-${randomBytes(5).toString("hex")}@e2e.test`;
-  const password = "approval-cross-user-password-123";
-  const signup = await fetch(new URL("/api/auth/sign-up/email", baseUrl), {
-    method: "POST",
-    headers: { "content-type": "application/json", origin: new URL(baseUrl).origin },
-    body: JSON.stringify({
-      email,
-      password,
-      name: email,
-      inviteCode: inviteBody.code,
-    }),
-  });
-  expect(signup.status, `invited signup response: ${await signup.clone().text()}`).toBe(200);
-
-  const session = await signInSession(baseUrl, { email, password });
-  return {
-    label: email,
-    credentials: { email, password },
-    headers: { cookie: session.cookieHeader },
-    cookies: session.cookies,
-  };
-};
-
 const approvalEndpoint = (baseUrl: string, sessionId: string, executionId: string): URL =>
   new URL(
     `/api/mcp-sessions/${encodeURIComponent(sessionId)}/executions/${encodeURIComponent(
@@ -77,7 +34,9 @@ scenario(
     const api = yield* Api;
     const mcp = yield* Mcp;
     const owner = yield* target.newIdentity();
-    const other = yield* Effect.promise(() => createInvitedIdentity(target.baseUrl, owner));
+    const other = yield* Effect.promise(() =>
+      createInvitedIdentity(target.baseUrl, owner, { emailPrefix: "approval-cross-user" }),
+    );
     const client = yield* api.client(coreApi, owner);
 
     const policy = yield* client.policies.create({

e2e/selfhost/mcp-browser-approval-ownership.test.ts

@@ -2,20 +2,21 @@
 // the org, not just whoever's browser session completed the consent.
 //
 // Issue #1453: the encrypted-secrets provider (the writable provider on
-// self-host and the Cloudflare host) files token rows under the ACTING
+// self-host and the Cloudflare host) filed token rows under the ACTING
 // caller's partition — so completing an org connection's consent in a user
-// session lands the tokens at owner='user', subject=<that user>, while the
-// connection row itself says org. The consenting user's own probe still reads
-// the tokens (user rows shadow org rows), so the connection looks healthy —
-// but every other principal resolves no value and fails with
+// session landed the tokens at owner='user', subject=<that user>, while the
+// connection row itself said org. The consenting user's own calls still read
+// the tokens (user rows shadow org rows), so the connection looked healthy —
+// but every other principal resolved no value and failed with
 // `oauth_connection_missing`. The same mis-filing was fixed for the WorkOS
-// Vault provider in #950; encrypted-secrets never got that fix.
+// Vault provider in #950.
 //
 // The journey: the bootstrap admin registers an OAuth-protected integration,
 // completes the org-owned authorization-code flow (a real test AS on
-// 127.0.0.1), and proves the tool works for them. A second, invited member of
-// the same org then invokes the same tool — the guarantee under test is that
-// the org connection resolves for them too.
+// 127.0.0.1), and proves the tool call carries the minted token upstream. A
+// second, invited member of the same org then invokes the same tool — the
+// guarantee under test is that the same org connection resolves the same
+// token for them too.
 import { randomBytes } from "node:crypto";
 import { createServer } from "node:http";
 
@@ -33,23 +34,22 @@ import { serveOAuthTestServer } from "@executor-js/sdk/testing";
 
 import { scenario } from "../src/scenario";
 import { Api, Target } from "../src/services";
-import type { Identity } from "../src/target";
-import { signInSession } from "../targets/selfhost";
+import { createInvitedIdentity } from "../targets/selfhost";
 
 const api = composePluginApi([openApiHttpPlugin()] as const);
 
 const unique = (prefix: string) => `${prefix}${randomBytes(4).toString("hex")}`;
 
-/** Upstream on 127.0.0.1: `GET /me` is 200 for any bearer. Credential
- *  resolution is the subject under test, so the upstream only needs to prove
- *  a token reached it. */
+/** Upstream on 127.0.0.1: `GET /me` echoes the authorization header it
+ *  received, so the scenario can assert a real token reached it — not merely
+ *  that a request was made. */
 const serveUpstream = () =>
   Effect.acquireRelease(
     Effect.callback<{ readonly url: string; readonly close: () => void }>((resume) => {
       const server = createServer((request, response) => {
         if (request.method === "GET" && (request.url ?? "").startsWith("/me")) {
           response.writeHead(200, { "content-type": "application/json" });
-          response.end(JSON.stringify({ me: "ok" }));
+          response.end(JSON.stringify({ authorization: request.headers.authorization ?? null }));
           return;
         }
         response.writeHead(404, { "content-type": "application/json" });
@@ -106,43 +106,6 @@ const specFor = (
     },
   });
 
-/** A second, distinct member of the (single) selfhost org: admin invite →
- *  invited email signup → Better Auth session. */
-const createInvitedIdentity = async (baseUrl: string, admin: Identity): Promise<Identity> => {
-  const cookie = admin.headers?.cookie;
-  expect(typeof cookie, "bootstrap admin has a Better Auth session cookie").toBe("string");
-
-  const invite = await fetch(new URL("/api/admin/invites", baseUrl), {
-    method: "POST",
-    headers: {
-      "content-type": "application/json",
-      cookie: cookie!,
-      origin: new URL(baseUrl).origin,
-    },
-    body: JSON.stringify({ role: "member" }),
-  });
-  expect(invite.status, `admin invite create response: ${await invite.clone().text()}`).toBe(200);
-  const inviteBody = (await invite.json()) as { readonly code?: string };
-  expect(typeof inviteBody.code, "invite response includes a redeemable code").toBe("string");
-
-  const email = `org-oauth-member-${randomBytes(5).toString("hex")}@e2e.test`;
-  const password = "org-oauth-member-password-123";
-  const signup = await fetch(new URL("/api/auth/sign-up/email", baseUrl), {
-    method: "POST",
-    headers: { "content-type": "application/json", origin: new URL(baseUrl).origin },
-    body: JSON.stringify({ email, password, name: email, inviteCode: inviteBody.code }),
-  });
-  expect(signup.status, `invited signup response: ${await signup.clone().text()}`).toBe(200);
-
-  const session = await signInSession(baseUrl, { email, password });
-  return {
-    label: email,
-    credentials: { email, password },
-    headers: { cookie: session.cookieHeader },
-    cookies: session.cookies,
-  };
-};
-
 /** Complete the test AS's consent headlessly and return the authorization
  *  code from the callback redirect. */
 const consentCode = (authorizationUrl: string) =>
@@ -164,6 +127,7 @@ const consentCode = (authorizationUrl: string) =>
 
 type ToolEnvelope = {
   readonly ok: boolean;
+  readonly data?: { readonly authorization?: string | null };
   readonly error?: { readonly code?: string; readonly message?: string };
 };
 
@@ -261,30 +225,38 @@ scenario(
               });
               expect(execution.status, `${who}: the execution completes`).toBe("completed");
               if (execution.status !== "completed") return yield* Effect.die("not completed");
-              const envelope = (execution.structured as { result?: ToolEnvelope }).result;
-              return envelope;
+              return (execution.structured as { result?: ToolEnvelope }).result;
             });
 
-          // Sanity: the consenting member sees a healthy connection — this is
-          // exactly why the bug is invisible to whoever set the connection up.
+          // Sanity: the consenting member's call carries a real bearer to the
+          // upstream — this passing is exactly why the bug is invisible to
+          // whoever set the connection up.
           const adminResult = yield* invoke(adminClient, "consenting member");
           expect(
-            adminResult,
-            "the consenting member's tool call resolves the org connection",
-          ).toMatchObject({ ok: true });
+            adminResult?.ok,
+            `the consenting member's tool call resolves the org connection (got: ${JSON.stringify(adminResult)})`,
+          ).toBe(true);
+          const adminToken = adminResult?.data?.authorization;
+          expect(adminToken, "the upstream received the minted bearer").toMatch(/^Bearer .+/);
 
           // THE guarantee: a different member of the same org resolves the
-          // same org-owned connection. Before the fix the token rows sit in
-          // the consenting user's partition, so this member resolves nothing
-          // and the call fails with `oauth_connection_missing`.
-          const member = yield* Effect.promise(() => createInvitedIdentity(target.baseUrl, admin));
+          // same org-owned connection to the same token. Before the fix the
+          // token rows sat in the consenting user's partition, so this member
+          // resolved nothing and failed with `oauth_connection_missing`.
+          const member = yield* Effect.promise(() =>
+            createInvitedIdentity(target.baseUrl, admin, { emailPrefix: "org-oauth-member" }),
+          );
           const memberClient = yield* makeClient(api, member);
           const memberResult = yield* invoke(memberClient, "other member");
           expect(
-            memberResult,
+            memberResult?.ok,
             "another org member's tool call resolves the same org connection " +
               `(got: ${JSON.stringify(memberResult)})`,
-          ).toMatchObject({ ok: true });
+          ).toBe(true);
+          expect(
+            memberResult?.data?.authorization,
+            "both members resolve the same org-shared token",
+          ).toBe(adminToken);
         }),
         Effect.gen(function* () {
           yield* adminClient.connections

e2e/selfhost/oauth-org-connection-cross-principal.test.ts

@@ -2,6 +2,8 @@
 // on a throwaway data dir, with Better Auth + the bootstrap admin. MCP OAuth is
 // headless via `forcedMcpConsent` below. Boot lives in
 // setup/selfhost.globalsetup.ts.
+import { randomBytes } from "node:crypto";
+
 import { Effect } from "effect";
 
 import { e2ePort } from "../src/ports";
@@ -99,6 +101,53 @@ export const forcedMcpConsent =
     return { code };
   };
 
+// A second, distinct member of the (single) selfhost org: admin invite →
+// invited email signup → Better Auth session. What multi-user scenarios use
+// until per-test invite-signup isolation lands in newIdentity itself.
+export const createInvitedIdentity = async (
+  baseUrl: string,
+  admin: Identity,
+  options?: { readonly role?: "admin" | "member"; readonly emailPrefix?: string },
+): Promise<Identity> => {
+  const cookie = admin.headers?.cookie;
+  if (typeof cookie !== "string") {
+    throw new Error("createInvitedIdentity: the admin identity has no Better Auth session cookie");
+  }
+  const origin = new URL(baseUrl).origin;
+
+  const invite = await fetch(new URL("/api/admin/invites", baseUrl), {
+    method: "POST",
+    headers: { "content-type": "application/json", cookie, origin },
+    body: JSON.stringify({ role: options?.role ?? "member" }),
+  });
+  if (invite.status !== 200) {
+    throw new Error(`createInvitedIdentity: invite create failed (${await invite.text()})`);
+  }
+  const inviteBody = (await invite.json()) as { readonly code?: string };
+  if (typeof inviteBody.code !== "string") {
+    throw new Error("createInvitedIdentity: invite response carried no redeemable code");
+  }
+
+  const email = `${options?.emailPrefix ?? "invited-member"}-${randomBytes(5).toString("hex")}@e2e.test`;
+  const password = "invited-member-password-123";
+  const signup = await fetch(new URL("/api/auth/sign-up/email", baseUrl), {
+    method: "POST",
+    headers: { "content-type": "application/json", origin },
+    body: JSON.stringify({ email, password, name: email, inviteCode: inviteBody.code }),
+  });
+  if (signup.status !== 200) {
+    throw new Error(`createInvitedIdentity: invited signup failed (${await signup.text()})`);
+  }
+
+  const session = await signInSession(baseUrl, { email, password });
+  return {
+    label: email,
+    credentials: { email, password },
+    headers: { cookie: session.cookieHeader },
+    cookies: session.cookies,
+  };
+};
+
 export const selfhostTarget = (): Target => ({
   name: "selfhost",
   baseUrl: SELFHOST_BASE_URL,

e2e/targets/selfhost.ts

@@ -162,6 +162,14 @@ export {
   type ExecutorOwnerPolicyContext,
 } from "./owner-policy";
 
+// Provider item-id owner grammar — the partition credential providers file
+// rows under (issues #950, #1453).
+export {
+  OWNER_SCOPED_ITEM_ID_PREFIXES,
+  embeddedItemOwner,
+  ownerForItemId,
+} from "./provider-item-owner";
+
 // Tool policies.
 export {
   matchPattern,

packages/core/sdk/src/index.ts

@@ -0,0 +1,47 @@
+// ---------------------------------------------------------------------------
+// The owner a provider item id embeds — the single parser for the id grammar
+// the SDK constructs (accessItemId in oauth-service.ts, the connection value
+// ids in executor.ts, the oauth-client secret ids):
+//
+//   connection:<owner>:<integration>:<name>:<variable>
+//   oauth:<owner>:<integration>:<name>[:refresh]
+//   oauth-client:<owner>:<slug>:secret
+//
+// Credential providers file plugin-storage rows by THIS owner, not the acting
+// caller's binding — an org connection whose OAuth consent completes in one
+// member's browser session must produce rows every member can resolve
+// (issues #950, #1453).
+// ---------------------------------------------------------------------------
+
+import { Owner } from "./ids";
+import type { OwnerBinding } from "./plugin";
+
+/** Item-id prefixes whose SECOND colon-segment is the owning partition. */
+export const OWNER_SCOPED_ITEM_ID_PREFIXES: ReadonlySet<string> = new Set([
+  "connection",
+  "oauth",
+  "oauth-client",
+]);
+
+/** The owner a logical item id embeds, or null for ids that carry none
+ *  (legacy random `secret_*` ids). Reads the second colon-segment of the
+ *  owner-scoped prefixes. */
+export const embeddedItemOwner = (id: string): Owner | null => {
+  const [prefix, owner] = id.split(":");
+  if (OWNER_SCOPED_ITEM_ID_PREFIXES.has(prefix ?? "") && (owner === "org" || owner === "user")) {
+    return Owner.make(owner);
+  }
+  return null;
+};
+
+/** Map the executor's (tenant, subject?) binding onto the storage `Owner`
+ *  literal: a bound subject writes the user's own partition, otherwise the
+ *  org-shared one. Fallback only — prefer `ownerForItemId`. */
+const ownerOf = (binding: OwnerBinding): Owner =>
+  binding.subject == null ? Owner.make("org") : Owner.make("user");
+
+/** The partition a credential belongs to: the CREDENTIAL's owner (embedded in
+ *  the item id), not the acting caller's binding. Ids without an embedded
+ *  owner fall back to the caller binding. */
+export const ownerForItemId = (id: string, binding: OwnerBinding): Owner =>
+  embeddedItemOwner(id) ?? ownerOf(binding);

packages/core/sdk/src/provider-item-owner.ts

@@ -18,7 +18,6 @@
   },
   "devDependencies": {
     "@effect/vitest": "catalog:",
-    "@libsql/client": "catalog:",
     "@types/node": "catalog:",
     "bun-types": "catalog:",
     "tsup": "catalog:",