|
| 1 | +--- |
| 2 | +'@objectstack/spec': major |
| 3 | +'@objectstack/plugin-security': minor |
| 4 | +'@objectstack/plugin-auth': minor |
| 5 | +'@objectstack/core': minor |
| 6 | +'@objectstack/types': minor |
| 7 | +'@objectstack/lint': minor |
| 8 | +'@objectstack/platform-objects': minor |
| 9 | +'@objectstack/rest': patch |
| 10 | +'@objectstack/runtime': patch |
| 11 | +'@objectstack/mcp': patch |
| 12 | +'@objectstack/plugin-hono-server': patch |
| 13 | +'@objectstack/plugin-approvals': patch |
| 14 | +'@objectstack/cli': patch |
| 15 | +--- |
| 16 | + |
| 17 | +ADR-0105 Phase 0 + Phase 1: group tenancy posture; organization scope as a |
| 18 | +first-class authorization dimension. |
| 19 | + |
| 20 | +## Tenancy is now a spectrum (D1) |
| 21 | + |
| 22 | +`single | group | isolated`, resolved by the `tenancy` service and selected with |
| 23 | +the new `OS_TENANCY_POSTURE` env var. Existing deployments are unchanged: |
| 24 | +`OS_TENANCY_POSTURE` unset derives the posture from `OS_MULTI_ORG_ENABLED` |
| 25 | +(`true` ⇒ `isolated`, else `single`). An unrecognized value throws at boot |
| 26 | +rather than silently landing in a posture with no organization wall. |
| 27 | + |
| 28 | +- `single` — no wall (unchanged). |
| 29 | +- `group` — **new.** Organizations are membership boundaries over one shared |
| 30 | + dataset; Layer 0 becomes `organization_id IN accessible_org_ids` (union / MOAC |
| 31 | + semantics). Enforced by the OPEN engine. |
| 32 | +- `isolated` — today's `multi`, renamed. Behavior, enterprise `org-scoping` |
| 33 | + probe and degraded-boot handling all unchanged. |
| 34 | + |
| 35 | +## Organization scope is a first-class context field (D2) |
| 36 | + |
| 37 | +`ExecutionContext.accessible_org_ids` — every organization the caller holds a |
| 38 | +currently-valid membership in (ADR-0091 validity windows) — is resolved once by |
| 39 | +`resolveAuthzContext` and carried by every transport. The `group` wall reads it |
| 40 | +directly; RLS policies may reference it as |
| 41 | +`organization_id IN (current_user.accessible_org_ids)`. An empty or absent set |
| 42 | +fails the wall closed. |
| 43 | + |
| 44 | +Only the Layer 0 PREDICATE widens. Composition is untouched: the wall is still |
| 45 | +computed independently of the RLS compiler, AND-composed outermost, and |
| 46 | +crossable only by a true `PLATFORM_ADMIN` on a posture-permitting object — so |
| 47 | +ADR-0095's W1/W2 invariants hold in every posture. |
| 48 | + |
| 49 | +## Two P0 correctness fixes (D3, D4) — behavior changes |
| 50 | + |
| 51 | +**D3 — app-authored org-scoped RLS policies are no longer silently dropped** |
| 52 | +(finding F1, framework#3539). `collectRLSPolicies` used to strip any policy whose |
| 53 | +`using` contained the substring `current_user.organization_id` when isolation was |
| 54 | +inactive, which swallowed app-authored policies as well as the platform's own. |
| 55 | +Stripping is now decided by PROVENANCE (identity against the shipped |
| 56 | +declaration). **Upgrade impact:** in a deployment with no organization wall, an |
| 57 | +app-authored policy referencing the active organization is now RETAINED and |
| 58 | +fails closed (zero rows) with a one-time warning, where it previously vanished |
| 59 | +and the object read unscoped. `getReadFilter` shared the defect, so analytics and |
| 60 | +raw-SQL consumers were affected too. If a policy was only ever meant for |
| 61 | +multi-org, delete it or install `@objectstack/organizations`. |
| 62 | + |
| 63 | +**D4 — `viewAllRecords`/`modifyAllRecords` never cross an organization |
| 64 | +boundary** (finding F2, framework#3540). Under a wall-less posture nothing |
| 65 | +bounded the wildcard superuser bits `organization_admin` carries, so a |
| 66 | +deployment that accumulated organizations (personal orgs on signup) made every |
| 67 | +owner/admin an environment-wide superuser. `auto-org-admin-grant` now grants a |
| 68 | +de-VAMA'd `organization_admin_no_bypass` variant when no wall is enforced, and |
| 69 | +revokes the superseded variant whenever the posture changes. **Upgrade impact:** |
| 70 | +in `single` posture an org owner/admin keeps full CRUD but loses the blanket |
| 71 | +ownership/sharing/RLS bypass. Deliberate deployment-wide visibility remains |
| 72 | +available through `admin_full_access` or an explicitly authored permission set — |
| 73 | +it just stops being a side effect of a better-auth membership role. |
| 74 | + |
| 75 | +## Engine-owned organization stamping (D5) |
| 76 | + |
| 77 | +Under any wall-enforcing posture the engine stamps `organization_id` from the |
| 78 | +caller's active organization on an insert that omits it, and validates every |
| 79 | +supplied value against the wall. Idempotent with the enterprise auto-stamp |
| 80 | +(neither overwrites a supplied value). This also closes a real hole: the |
| 81 | +pre-existing post-image check required a non-array payload, so a BULK insert |
| 82 | +could carry a forged `organization_id` per row. One forged row now denies the |
| 83 | +whole write. |
| 84 | + |
| 85 | +## Group structure, extension fields and red-line lints (D6, D7) |
| 86 | + |
| 87 | +- `sys_organization` gains `parent_organization_id` and `sort_order` — a |
| 88 | + **reporting dimension only**. |
| 89 | +- New lint `validateOrgAxisRedLines` (`org-axis-permission-inheritance`, |
| 90 | + `org-axis-cross-org-bu-grant`), wired into `os lint` / `os compile` / |
| 91 | + `os validate`: an RLS policy or sharing rule that walks the org tree is an |
| 92 | + error, as is a business-unit grant on a platform-global object. |
| 93 | +- Extension fields on better-auth-managed objects ride the existing ADR-0092 |
| 94 | + whitelist. A new guard derives better-auth's real field surface from |
| 95 | + `getAuthTables()` at the pinned version and fails the build on any name |
| 96 | + collision, so a library upgrade cannot silently take ownership of a column. |
| 97 | + |
| 98 | +## Enforce-or-remove (D11) — BREAKING |
| 99 | + |
| 100 | +Both removals are of surface that had **zero runtime consumers**, so no |
| 101 | +behavior changes; authoring them is now a no-op instead of a lint warning. |
| 102 | + |
| 103 | +- **`PermissionSet.contextVariables` — REMOVED.** The RLS compiler never read |
| 104 | + it. FROM → TO: a set a policy needs as `field IN (current_user.<key>)` is now |
| 105 | + supplied by a registered membership resolver (below); a constant belongs in |
| 106 | + the policy itself as a literal (`status = 'published'`). |
| 107 | +- **`Territory` / `TerritoryModel` / `TerritoryType` (`security/territory.zod.ts`) |
| 108 | + — REMOVED.** No runtime object, stack field or resolver existed. FROM → TO: |
| 109 | + matrix requirements are served by multi-position × business-unit anchoring; a |
| 110 | + generalized dimension-security module will arrive with its own ADR. |
| 111 | +- **`ExecutionContext.rlsMembership` — PRODUCTIZED.** The bag the compiler has |
| 112 | + merged since ADR-0056 finally has a producer: register an |
| 113 | + `IRlsMembershipResolver` (`@objectstack/spec/contracts`) under the |
| 114 | + `rls-membership-resolver` service, declaring the keys it owns. Fail-closed by |
| 115 | + construction — an unresolved key makes its policies drop out. Kernel-owned |
| 116 | + keys (`accessible_org_ids`, `org_user_ids`, …) are reserved and cannot be |
| 117 | + overwritten from this seam. |
| 118 | + |
| 119 | +## Edition boundary (D12) |
| 120 | + |
| 121 | +The `group` posture's enforcement primitives ship OPEN — the union wall, |
| 122 | +`accessible_org_ids` resolution, D5 stamping/validation, the D3/D4 correctness |
| 123 | +fixes and the D6 lints — because the correctness of a wall is never a paid |
| 124 | +feature (cloud ADR-0016 铁律「强制免费、治理收费」). `isolated` keeps its existing |
| 125 | +enterprise `org-scoping` probe, so the current commercial boundary for |
| 126 | +legal-entity isolation is unchanged by this release. |
0 commit comments