Add identity access controls

AgentCompany-New/tests/unit/domain-services.test.ts

@@ -23,7 +23,7 @@ describe("domain services", () => {
     const connection = createConnection();
 
     const rows = connection.db.prepare("select version from schema_migrations order by version asc").all() as Array<{ version: number }>;
-    expect(rows.map((row) => row.version)).toEqual([1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14]);
+    expect(rows.map((row) => row.version)).toEqual([1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15]);
     connection.close();
   });
 
@@ -43,6 +43,8 @@ describe("domain services", () => {
     expect(state.organizations).toHaveLength(1);
     expect(state.employees[0]?.displayName).toBe("Dana Lee");
     expect(state.providers.length).toBeGreaterThanOrEqual(6);
+    expect(state.employeeIdentities).toHaveLength(1);
+    expect(state.roleGrants.map((grant) => grant.roleKey).sort()).toEqual(["approval_decider", "hiring_manager", "org_admin"]);
     expect(state.chatSpaces.map((space) => space.name)).toContain("board");
     expect(state.policyRules[0]?.action).toBe("task_create");
     expect(state.auditEvents[0]?.action).toBe("created");

AgentCompany-New/tests/unit/identity-access-service.test.ts

@@ -0,0 +1,100 @@
+import { randomUUID } from "node:crypto";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { describe, expect, test } from "vitest";
+import { DatabaseConnection } from "../../src/main/database/connection";
+import { ApprovalService } from "../../src/main/services/approval-service";
+import { IdentityAccessService } from "../../src/main/services/identity-access-service";
+import { OrganizationService } from "../../src/main/services/organization-service";
+import { SnapshotService } from "../../src/main/services/snapshot-service";
+import { RISK_LEVEL, ROLE_KEY } from "../../src/shared/domain";
+
+function createConnection(): DatabaseConnection {
+  return new DatabaseConnection(join(tmpdir(), `agentcompany-new-identity-${randomUUID()}.db`));
+}
+
+function createOrganization(organization: OrganizationService): string {
+  return organization.createOrganization({
+    organizationName: "Acme Operations",
+    employeeName: "Dana Lee",
+    mission: "Coordinate agents with auditable approvals.",
+    goal: "Ship a verified control plane.",
+  });
+}
+
+function firstEmployeeId(connection: DatabaseConnection, orgId: string): string {
+  return (connection.db.prepare("select id from employees where org_id = ? order by created_at asc limit 1")
+    .get(orgId) as { id: string }).id;
+}
+
+describe("identity access service", () => {
+  test("syncs SSO employee identities and grants scoped roles", () => {
+    const connection = createConnection();
+    const organization = new OrganizationService(connection.db);
+    const identityAccess = new IdentityAccessService(connection.db);
+    const snapshot = new SnapshotService(connection.db);
+    let orgId = "";
+    let employeeId = "";
+
+    connection.transaction(() => {
+      orgId = createOrganization(organization);
+      employeeId = firstEmployeeId(connection, orgId);
+      identityAccess.syncEmployeeIdentity({
+        orgId,
+        employeeId,
+        source: "sso",
+        externalSubject: "okta-00u1",
+        email: "dana@example.com",
+      });
+      identityAccess.grantRole({
+        orgId,
+        principalType: "employee",
+        principalId: employeeId,
+        roleKey: ROLE_KEY.APPROVAL_DECIDER,
+        scopeType: "organization",
+        scopeId: orgId,
+        grantedByEmployeeId: employeeId,
+      });
+    });
+
+    const state = snapshot.load();
+    expect(state.employeeIdentities.some((identity) => identity.source === "sso" && identity.email === "dana@example.com")).toBe(true);
+    expect(state.roleGrants.some((grant) => grant.principalId === employeeId && grant.roleKey === ROLE_KEY.APPROVAL_DECIDER)).toBe(true);
+    expect(state.auditEvents.some((event) => event.entityType === "employee_identity" && event.action === "synced")).toBe(true);
+    connection.close();
+  });
+
+  test("records denied access decisions when approval decider role is missing", () => {
+    const connection = createConnection();
+    const organization = new OrganizationService(connection.db);
+    const approvals = new ApprovalService(connection.db);
+    let orgId = "";
+    let employeeId = "";
+    let approvalId = "";
+
+    connection.transaction(() => {
+      orgId = createOrganization(organization);
+      employeeId = firstEmployeeId(connection, orgId);
+      connection.db.prepare("delete from role_grants where org_id = ? and principal_id = ?").run(orgId, employeeId);
+      approvalId = approvals.create({
+        orgId,
+        kind: "release",
+        title: "Release approval",
+        details: "Approve release train.",
+        risk: RISK_LEVEL.MEDIUM,
+        requestedByType: "system",
+        requestedById: null,
+      });
+    });
+
+    expect(() => approvals.decide({
+      orgId,
+      approvalId,
+      state: "approved",
+      decidedByEmployeeId: employeeId,
+    })).toThrow("Employee requires approval_decider role.");
+    expect(connection.db.prepare("select decision, reason from access_decisions where org_id = ?").all(orgId))
+      .toEqual([{ decision: "deny", reason: "missing_role" }]);
+    connection.close();
+  });
+});

AgentCompany-New/tests/unit/migration-service.test.ts

@@ -93,6 +93,10 @@ describe("migration service", () => {
     const legacyPath = createLegacyDatabase(`
       create table organizations(id text primary key);
       create table employees(id text primary key, org_id text);
+      create table employee_identities(id text primary key, org_id text, employee_id text);
+      create table service_identities(id text primary key, org_id text, agent_id text);
+      create table role_grants(id text primary key, org_id text, granted_by_employee_id text);
+      create table access_decisions(id text primary key, org_id text);
       create table agents(id text primary key, org_id text, model_provider_id text, manager_agent_id text, workspace_id text);
       create table tasks(id text primary key, org_id text, assignee_agent_id text, project_id text, goal_id text, workspace_id text);
       create table workspaces(id text primary key, org_id text, project_id text);
@@ -136,12 +140,16 @@ describe("migration service", () => {
       create table audit_events(id text primary key, org_id text);
       insert into organizations(id) values ('org-1');
       insert into employees(id, org_id) values ('emp-1', 'org-1');
+      insert into employee_identities(id, org_id, employee_id) values ('eid-1', 'org-1', 'emp-1');
       insert into credentials(id, org_id) values ('cred-1', 'org-1');
       insert into providers(id, org_id, credential_id) values ('prov-1', 'org-1', 'cred-1');
       insert into chat_spaces(id, org_id) values ('space-1', 'org-1');
       insert into file_objects(id, org_id, space_id) values ('file-1', 'org-1', 'space-1');
       insert into workspaces(id, org_id, project_id) values ('wsp-1', 'org-1', 'prj-1');
       insert into agents(id, org_id, model_provider_id, manager_agent_id, workspace_id) values ('agent-1', 'org-1', 'prov-1', null, 'wsp-1');
+      insert into service_identities(id, org_id, agent_id) values ('sid-1', 'org-1', 'agent-1');
+      insert into role_grants(id, org_id, granted_by_employee_id) values ('role-1', 'org-1', 'emp-1');
+      insert into access_decisions(id, org_id) values ('access-1', 'org-1');
       insert into goals(id, org_id, owner_agent_id) values ('goal-1', 'org-1', 'agent-1');
       insert into projects(id, org_id, goal_id, lead_agent_id) values ('prj-1', 'org-1', 'goal-1', 'agent-1');
       insert into tasks(id, org_id, assignee_agent_id, project_id, goal_id, workspace_id) values ('task-1', 'org-1', 'agent-1', 'prj-1', 'goal-1', 'wsp-1');
@@ -188,6 +196,8 @@ describe("migration service", () => {
     const body = JSON.parse(snapshot.load().migrationReports[0]!.reportJson) as MigrationReportBody;
     expect(body.failures).toEqual([]);
     expect(body.tableCounts.credentials).toBe(1);
+    expect(body.tableCounts.employee_identities).toBe(1);
+    expect(body.tableCounts.role_grants).toBe(1);
     expect(body.tableCounts.skill_artifacts).toBe(1);
     expect(body.tableCounts.chat_read_state).toBe(1);
     expect(body.tableCounts.board_interventions).toBe(1);
@@ -198,6 +208,8 @@ describe("migration service", () => {
     expect(body.tableCounts.search_documents).toBe(1);
     expect(body.tableChecksums.audit_events).toHaveLength(64);
     expect(body.idMaps.skill_runtime_snapshots).toEqual(["snapshot-1"]);
+    expect(body.idMaps.service_identities).toEqual(["sid-1"]);
+    expect(body.idMaps.access_decisions).toEqual(["access-1"]);
     expect(body.idMaps.board_interventions).toEqual(["bdi-1"]);
     expect(body.idMaps.retention_freezes).toEqual(["freeze-1"]);
     expect(body.idMaps.provider_usage_windows).toEqual(["usage-1"]);