Check a send grant on every outbound mail

Makefile

@@ -81,7 +81,7 @@ test-unit: FORCE
 # (port 0, mkdtemp dirs, unique schemas) and none rely on fresh module state,
 # so sharing the registry across files is safe.
 test-workflow: FORCE
-	$(BUN) test --timeout 120000 --parallel=$(WF_PARALLEL) --no-isolate tests/workflow-deploy/multistep-signal.test.ts tests/workflow-deploy/hub-link-reconnect.test.ts tests/workflow-deploy/reconnect-reemits-parked-correlation.test.ts tests/workflow-deploy/interrupted-pack-reconnect-recovery.test.ts tests/workflow-deploy/deploy-window-reconnect-recovery.test.ts tests/workflow-deploy/midrun-signal-survives-reconnect.test.ts tests/workflow-deploy/multistep-perstep-reroute-reconnect.test.ts tests/workflow-deploy/crash-restart-reconnect-resumes.test.ts tests/workflow-deploy/crash-respawn-fifo.test.ts tests/workflow-deploy/crash-loop-latch.test.ts tests/workflow-deploy/on-trigger-signal-delivery.test.ts tests/workflow-deploy/on-trigger-between-events-restart.test.ts tests/workflow-deploy/on-trigger-body-sleep-restart-resumes.test.ts tests/workflow-deploy/sleep-restart-keeps-authority.test.ts tests/workflow-deploy/sleep-restart-hub-access.test.ts tests/workflow-deploy/on-trigger-agent-body.test.ts tests/workflow-deploy/on-trigger-action-body.test.ts tests/workflow-deploy/on-trigger-loop-body.test.ts tests/workflow-deploy/single-step-real-agent.test.ts tests/workflow-deploy/map-fan-out-real-agent.test.ts tests/workflow-deploy/multistep-signed-send.test.ts tests/workflow-deploy/single-step-message-input.test.ts tests/workflow-deploy/single-step-posix-tool.test.ts tests/workflow-deploy/single-step-credential-tool.test.ts tests/workflow-deploy/credential-bound-route-deploy.test.ts tests/workflow-deploy/action-step-credential.test.ts tests/workflow-deploy/action-hub-access.test.ts tests/workflow-deploy/tool-hub-access.test.ts tests/workflow-deploy/invoker-hub-access.test.ts tests/workflow-deploy/body-hub-access.test.ts tests/workflow-deploy/revoked-creator-grant-running-run.test.ts tests/workflow-deploy/expired-run-grant-running-run.test.ts tests/workflow-deploy/tarball-route-deploy.test.ts tests/workflow-deploy/folded-tools-failover-real-agent.test.ts tests/workflow-deploy/single-step-grants-bridge.test.ts tests/workflow-deploy/single-step-pinned-ask-tool.test.ts tests/workflow-deploy/single-step-per-run-grants.test.ts tests/workflow-deploy/approval-tracer-roundtrip.test.ts tests/workflow-deploy/scope-always-roundtrip.test.ts tests/workflow-deploy/childworkflow-scope-always-roundtrip.test.ts tests/workflow-deploy/mail-trigger-derived-grants-roundtrip.test.ts tests/workflow-deploy/mail-trigger-run-completes-real-route.test.ts tests/workflow-deploy/inbound-mail-enforcement-real-route.test.ts tests/workflow-deploy/run-mail-send-real-route.test.ts tests/workflow-deploy/mail-federation-derived-grants-roundtrip.test.ts tests/workflow-deploy/mail-federation-run-completes.test.ts tests/workflow-deploy/single-step-event-threading.test.ts tests/workflow-deploy/single-step-conversation-durability.test.ts tests/workflow-deploy/multistep-conversation-failover.test.ts tests/workflow-deploy/per-level-pipeline-real-agents.test.ts tests/workflow-deploy/dispatch-orchestrator-real-agents.test.ts tests/workflow-deploy/single-step-full-lifecycle.test.ts tests/workflow-deploy/single-step-mail-loop.test.ts tests/workflow-deploy/single-step-mail-in-reply-to.test.ts tests/workflow-deploy/single-step-mail-wait-wake.test.ts tests/workflow-deploy/single-step-mail-two-turn-thread.test.ts tests/workflow-deploy/single-step-mail-interactive-turns.test.ts tests/workflow-deploy/single-step-mail-flag-expunge.test.ts tests/workflow-deploy/cross-process-custom-adapter.test.ts tests/workflow-deploy/conversation-state-wal.test.ts tests/workflow-deploy/conversation-state-connector-seed.test.ts tests/workflow-deploy/drain-roundtrip.test.ts tests/workflow-deploy/fixtures/child-workflow.test.ts tests/workflow-deploy/child-workflow-roundtrip.test.ts tests/workflow-deploy/child-workflow-tool-invoke-roundtrip.test.ts tests/workflow-deploy/child-workflow-inherited-grants-roundtrip.test.ts tests/workflow-deploy/on-trigger-childworkflow-roundtrip.test.ts tests/workflow-deploy/loop-roundtrip.test.ts tests/workflow-deploy/loop-nested-roundtrip.test.ts tests/workflow-deploy/loop-action-roundtrip.test.ts tests/workflow-deploy/all-action-deploy.test.ts tests/workflow-deploy/sidecar-runs-no-workflow-code.test.ts tests/workflow-deploy/onfailure-action-roundtrip.test.ts tests/workflow-deploy/loop-await-signal-restart-resumes.test.ts tests/workflow-deploy/loop-childworkflow-roundtrip.test.ts tests/workflow-deploy/loop-work-then-signal-restart-resumes.test.ts tests/workflow-deploy/loop-await-signal-drain-roundtrip.test.ts tests/workflow-deploy/loop-childworkflow-inflight-grandchild-drain.test.ts tests/workflow-deploy/childworkflow-restart-resumes.test.ts tests/workflow-deploy/body-action-restart-effect-once.test.ts tests/workflow-deploy/body-action-crash-mid-effect.test.ts tests/workflow-deploy/childworkflow-drain-wait-resumes.test.ts tests/workflow-deploy/childworkflow-unanswerable-gate.test.ts tests/workflow-deploy/on-trigger-drain-roundtrip.test.ts tests/workflow-deploy/unresolvable-director.test.ts tests/workflow-deploy/fifo-mail.test.ts tests/workflow-deploy/mail-edge-cases.test.ts tests/workflow-deploy/run-event-batching.test.ts tests/workflow-deploy/walking-skeleton.e2e.test.ts tests/workflow-deploy/asset-source.e2e.test.ts tests/workflow-deploy/asset-tool-restarts.e2e.test.ts tests/workflow-deploy/source-workflow.e2e.test.ts tests/workflow-deploy/source-monorepo.e2e.test.ts tests/workflow-deploy/source-monorepo-many.e2e.test.ts tests/workflow-deploy/source-tamper-reject.e2e.test.ts tests/workflow-deploy/source-catalog.e2e.test.ts tests/workflow-deploy/source-mixed-closure.e2e.test.ts tests/workflow-deploy/source-closure-director.e2e.test.ts tests/workflow-deploy/source-credential.e2e.test.ts tests/workflow-deploy/source-inline-tool.e2e.test.ts tests/workflow-deploy/source-posix-lsp.e2e.test.ts tests/workflow-deploy/loop-tool-invoke-roundtrip.test.ts tests/workflow-deploy/child-workflow-loop-tool-invoke-roundtrip.test.ts tests/workflow-deploy/on-trigger-tool-invoke-roundtrip.test.ts tests/workflow-deploy/on-trigger-credential-tool.test.ts tests/workflow-deploy/loop-map-tool-invoke-roundtrip.test.ts tests/workflow-deploy/loop-nested-tool-invoke-roundtrip.test.ts
+	$(BUN) test --timeout 120000 --parallel=$(WF_PARALLEL) --no-isolate tests/workflow-deploy/multistep-signal.test.ts tests/workflow-deploy/hub-link-reconnect.test.ts tests/workflow-deploy/reconnect-reemits-parked-correlation.test.ts tests/workflow-deploy/interrupted-pack-reconnect-recovery.test.ts tests/workflow-deploy/deploy-window-reconnect-recovery.test.ts tests/workflow-deploy/midrun-signal-survives-reconnect.test.ts tests/workflow-deploy/multistep-perstep-reroute-reconnect.test.ts tests/workflow-deploy/crash-restart-reconnect-resumes.test.ts tests/workflow-deploy/crash-respawn-fifo.test.ts tests/workflow-deploy/crash-loop-latch.test.ts tests/workflow-deploy/on-trigger-signal-delivery.test.ts tests/workflow-deploy/on-trigger-between-events-restart.test.ts tests/workflow-deploy/on-trigger-body-sleep-restart-resumes.test.ts tests/workflow-deploy/sleep-restart-keeps-authority.test.ts tests/workflow-deploy/sleep-restart-hub-access.test.ts tests/workflow-deploy/on-trigger-agent-body.test.ts tests/workflow-deploy/on-trigger-action-body.test.ts tests/workflow-deploy/on-trigger-loop-body.test.ts tests/workflow-deploy/single-step-real-agent.test.ts tests/workflow-deploy/map-fan-out-real-agent.test.ts tests/workflow-deploy/multistep-signed-send.test.ts tests/workflow-deploy/single-step-message-input.test.ts tests/workflow-deploy/single-step-posix-tool.test.ts tests/workflow-deploy/single-step-credential-tool.test.ts tests/workflow-deploy/credential-bound-route-deploy.test.ts tests/workflow-deploy/action-step-credential.test.ts tests/workflow-deploy/action-hub-access.test.ts tests/workflow-deploy/tool-hub-access.test.ts tests/workflow-deploy/invoker-hub-access.test.ts tests/workflow-deploy/body-hub-access.test.ts tests/workflow-deploy/revoked-creator-grant-running-run.test.ts tests/workflow-deploy/expired-run-grant-running-run.test.ts tests/workflow-deploy/tarball-route-deploy.test.ts tests/workflow-deploy/folded-tools-failover-real-agent.test.ts tests/workflow-deploy/single-step-grants-bridge.test.ts tests/workflow-deploy/single-step-pinned-ask-tool.test.ts tests/workflow-deploy/single-step-per-run-grants.test.ts tests/workflow-deploy/approval-tracer-roundtrip.test.ts tests/workflow-deploy/scope-always-roundtrip.test.ts tests/workflow-deploy/childworkflow-scope-always-roundtrip.test.ts tests/workflow-deploy/mail-trigger-derived-grants-roundtrip.test.ts tests/workflow-deploy/mail-trigger-run-completes-real-route.test.ts tests/workflow-deploy/mail-send-denied-real-route.test.ts tests/workflow-deploy/inbound-mail-enforcement-real-route.test.ts tests/workflow-deploy/run-mail-send-real-route.test.ts tests/workflow-deploy/mail-federation-derived-grants-roundtrip.test.ts tests/workflow-deploy/mail-federation-run-completes.test.ts tests/workflow-deploy/single-step-event-threading.test.ts tests/workflow-deploy/single-step-conversation-durability.test.ts tests/workflow-deploy/multistep-conversation-failover.test.ts tests/workflow-deploy/per-level-pipeline-real-agents.test.ts tests/workflow-deploy/dispatch-orchestrator-real-agents.test.ts tests/workflow-deploy/single-step-full-lifecycle.test.ts tests/workflow-deploy/single-step-mail-loop.test.ts tests/workflow-deploy/single-step-mail-in-reply-to.test.ts tests/workflow-deploy/single-step-mail-wait-wake.test.ts tests/workflow-deploy/single-step-mail-two-turn-thread.test.ts tests/workflow-deploy/single-step-mail-interactive-turns.test.ts tests/workflow-deploy/single-step-mail-flag-expunge.test.ts tests/workflow-deploy/cross-process-custom-adapter.test.ts tests/workflow-deploy/conversation-state-wal.test.ts tests/workflow-deploy/conversation-state-connector-seed.test.ts tests/workflow-deploy/drain-roundtrip.test.ts tests/workflow-deploy/fixtures/child-workflow.test.ts tests/workflow-deploy/child-workflow-roundtrip.test.ts tests/workflow-deploy/child-workflow-tool-invoke-roundtrip.test.ts tests/workflow-deploy/child-workflow-inherited-grants-roundtrip.test.ts tests/workflow-deploy/on-trigger-childworkflow-roundtrip.test.ts tests/workflow-deploy/loop-roundtrip.test.ts tests/workflow-deploy/loop-nested-roundtrip.test.ts tests/workflow-deploy/loop-action-roundtrip.test.ts tests/workflow-deploy/all-action-deploy.test.ts tests/workflow-deploy/sidecar-runs-no-workflow-code.test.ts tests/workflow-deploy/onfailure-action-roundtrip.test.ts tests/workflow-deploy/loop-await-signal-restart-resumes.test.ts tests/workflow-deploy/loop-childworkflow-roundtrip.test.ts tests/workflow-deploy/loop-work-then-signal-restart-resumes.test.ts tests/workflow-deploy/loop-await-signal-drain-roundtrip.test.ts tests/workflow-deploy/loop-childworkflow-inflight-grandchild-drain.test.ts tests/workflow-deploy/childworkflow-restart-resumes.test.ts tests/workflow-deploy/body-action-restart-effect-once.test.ts tests/workflow-deploy/body-action-crash-mid-effect.test.ts tests/workflow-deploy/childworkflow-drain-wait-resumes.test.ts tests/workflow-deploy/childworkflow-unanswerable-gate.test.ts tests/workflow-deploy/on-trigger-drain-roundtrip.test.ts tests/workflow-deploy/unresolvable-director.test.ts tests/workflow-deploy/fifo-mail.test.ts tests/workflow-deploy/mail-edge-cases.test.ts tests/workflow-deploy/run-event-batching.test.ts tests/workflow-deploy/walking-skeleton.e2e.test.ts tests/workflow-deploy/asset-source.e2e.test.ts tests/workflow-deploy/asset-tool-restarts.e2e.test.ts tests/workflow-deploy/source-workflow.e2e.test.ts tests/workflow-deploy/source-monorepo.e2e.test.ts tests/workflow-deploy/source-monorepo-many.e2e.test.ts tests/workflow-deploy/source-tamper-reject.e2e.test.ts tests/workflow-deploy/source-catalog.e2e.test.ts tests/workflow-deploy/source-mixed-closure.e2e.test.ts tests/workflow-deploy/source-closure-director.e2e.test.ts tests/workflow-deploy/source-credential.e2e.test.ts tests/workflow-deploy/source-inline-tool.e2e.test.ts tests/workflow-deploy/source-posix-lsp.e2e.test.ts tests/workflow-deploy/loop-tool-invoke-roundtrip.test.ts tests/workflow-deploy/child-workflow-loop-tool-invoke-roundtrip.test.ts tests/workflow-deploy/on-trigger-tool-invoke-roundtrip.test.ts tests/workflow-deploy/on-trigger-credential-tool.test.ts tests/workflow-deploy/loop-map-tool-invoke-roundtrip.test.ts tests/workflow-deploy/loop-nested-tool-invoke-roundtrip.test.ts
 
 # The core integration pass: inference, hub-api, and db suites that need
 # real Postgres and the extended timeout. Files run in parallel

apps/hub/src/server.ts

@@ -26,6 +26,7 @@ import {
   createApp,
   createAuth,
   createCorrespondentGrantMinter,
+  createMailSendAuthorizer,
   createMailTriggeredRunGrantsMaterializer,
   createRunGrantsLoader,
   sweepLapsedDeployerGrants,
@@ -296,7 +297,10 @@ export async function createHubServer({
   // the same authorization an externally-triggered run gets. Threaded into
   // the sidecar router as a lookup its `mail.outbound` handler invokes for
   // each workflow-deployment recipient.
-  const lookups: SidecarLookups = {
+  // The relay refuses every recipient without a send authorizer, so the
+  // type requires one here.
+  const lookups: SidecarLookups &
+    Required<Pick<SidecarLookups, "authorizeMailSend">> = {
     ...createHubSessionLookups({
       db,
       agentRepoStore,
@@ -334,9 +338,13 @@ export async function createHubServer({
     // the sending run gains a `mail.accept:principal:<recipient>` grant so that
     // party's reply is admitted. Gated on the sending definition having
     // authored the `correspondent` relation; best-effort, never breaks a send.
-    mintCorrespondentGrant: createCorrespondentGrantMinter({
+    mintCorrespondentGrant: createCorrespondentGrantMinter({ db }),
+    // Decides which recipients a relayed mail's sender may send to, from its
+    // `mail.send` grants. It evaluates conditions with its own narrower
+    // registry, not the one createHubApp uses.
+    authorizeMailSend: createMailSendAuthorizer({
       db,
-      principalKeyStore,
+      grantStoreFor: createGrantStore,
     }),
   };
 

bin/workflow-fixture.ts

@@ -84,8 +84,8 @@ export const WORKFLOW_RUN_GRANT_RESOURCE = "workflow-run:*";
 export const WORKFLOW_RUN_GRANT_ACTION = "manage";
 
 /**
- * Authored trigger address. The capability walk derives `mail.address`
- * / `mail.send` approvals from this value; the runtime inbound address
+ * Authored trigger address. The capability walk derives the
+ * `mail.address` approval from this value; the runtime inbound address
  * is derived independently from the deployment id at deploy time, so
  * this only has to be a well-formed address whose domain matches the
  * Acme tenant domain (`<slug>.localhost`) for a coherent approval set.

docs/API.md

@@ -426,7 +426,7 @@ Creates a grant targeting either a role or a principal directly. Exactly one of
 Body: CreateGrant
 
 201: GrantResponse -- Grant created
-400: ErrorResponse -- Validation error. A body that fails its schema gets the body validator's error envelope. A body whose `conditions` names an unregistered condition, holds a malformed condition body, or, on a workflow run's principal, holds a condition the run cannot evaluate gets an `ErrorResponse` whose message lists each problem as a JSON array.
+400: ErrorResponse -- Validation error. A body that fails its schema gets the body validator's error envelope. A body whose `conditions` names an unregistered condition, holds a malformed condition body, or, on a workflow run's principal, holds a condition the run cannot evaluate gets an `ErrorResponse` whose message lists each problem as a JSON array. A `mail.send` resource that can match no recipient coordinate, a domain pattern that is not in lower case, a `mail.send` grant whose action cannot match `send`, or a pattern outside the `mail.send` namespace that names part of a send resource, such as `mail.send*:domain:<id>`, gets an `ErrorResponse` that names the problem.
 
 ### GET /api/tenants/:tenantId/grants/:grantId
 Get grant details
@@ -584,6 +584,7 @@ Body: SendMessage
 
 202: unknown -- Trigger accepted for delivery
 400: ErrorResponse -- Attachment validation error. Each variant carries a structured code (too_many_attachments, oversize_attachment, disallowed_mime_type, invalid_attachment_name, malformed_base64, oversize_total) with the offending index and limits. A malformed request body that fails SendMessage validation returns the generic error shape instead.
+403: ErrorResponse -- The caller lacks `manage` on the run, (`insufficient_grants`) a delegator lacks a grant the definition requires, or (`mail_send_denied`) no `mail.send` grant of the caller allows mail to the run
 404: ErrorResponse -- Run not found
 409: ErrorResponse -- Run address is not routable, its allocation is no longer active, the run is stopping or terminal, (`deployer_unavailable`) the definition has invoker-sourced grant requirements and the deployer is not recorded or no longer active, or (`workflow_run_principal_inactive`) the first trigger finds the run principal suspended or deactivated
 413: ErrorResponse -- Request body exceeds the maximum allowed size
@@ -711,6 +712,7 @@ Body: SendMessage
 
 202: unknown -- Trigger accepted for delivery
 400: ErrorResponse -- Attachment validation error. Each variant carries a structured code (too_many_attachments, oversize_attachment, disallowed_mime_type, invalid_attachment_name, malformed_base64, oversize_total) with the offending index and limits. A malformed request body that fails SendMessage validation returns the generic error shape instead.
+403: ErrorResponse -- The caller lacks `manage` on the deployment, (`insufficient_grants`) a delegator lacks a grant the definition requires, or (`mail_send_denied`) no `mail.send` grant of the caller allows mail to the deployment
 404: ErrorResponse -- Workflow deployment not found
 409: ErrorResponse -- Deployment address is not routable, its allocation is no longer active, its top-level run is stopping or terminal, (`deployer_unavailable`) the definition has invoker-sourced grant requirements and the deployer is not recorded or no longer active, or (`workflow_run_principal_inactive`) the first trigger finds the run principal suspended or deactivated
 413: ErrorResponse -- Request body exceeds the maximum allowed size