Uh oh!
There was an error while loading. Please reload this page.
feat(dogfood): owner-isolated RLS fixture — hard, revert-provable #1994 gate - #2037
Merged
Conversation
The latest updates on your projects. Learn more about Vercel for GitHub.
|
… gate The cross-owner RLS proof runner (src/rls.ts, #2032) was unit-proven but had nothing live to exercise it: the harness boots single-tenant, so the org tenant_isolation policy is stripped and a fresh member falls back to member_default (broad read) — every object reports `member-visible`, so the #1994 by-id-write invariant ("can't read ⇒ can't write") never fired live. Two faithful ways to create real isolation, both now live: 1. Owner-scoped fixture (test/rls-fixture.dogfood.test.ts + fixtures/): one object `rls_note` whose member fallback permission set carries RLS.ownerPolicy('rls_note','created_by'). Keyed on created_by/current_user.id (not organization_id), so it survives single-tenant stripping — a fresh member genuinely can't read the admin's note. - GREEN: owner policy on `all` ops → rls-consistent (pre-image check denies the by-id write). - AUTOMATED RED: owner policy on `select` only → rls-hole (read scoped, no write policy applies, by-id write lands) — #1994 hole class every CI run. - MANUAL REVERT PROOF (README): disabling the pre-image check flips the green fixture to "GET 404 yet MUTATED it by id (PATCH 200)". Verified, restored. 2. Multi-tenant org-scoped (test/rls-multitenant.dogfood.test.ts): bootDogfoodStack gains `{ multiTenant: true }` → registers plugin-org-scoping before SecurityPlugin so organization_id policies APPLY. CRM flips from every-object-member-visible (single-tenant) to 4 consistent / 0 holes / 0 member-visible — confirming member-visible was single-tenant RLS-stripping, not a broad-read default (the model real apps like hotcrm rely on). harness: BootOptions gains `security?` (SecurityPlugin override for the fixture fallback) and `multiTenant?`. README documents both paths + the revert proof. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
os-zhuangforce-pushed
the
feat/dogfood-rls-fixture
branch
from
June 18, 2026 12:49
1e1413a to
a2316e6CompareContributor
📓 Docs Drift CheckNo hand-written docs reference the 1 changed package(s). ✅ |
Uh oh!
There was an error while loading. Please reload this page.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
The cross-owner RLS proof runner (
src/rls.ts, from #2032) was unit-proven but had nothing live to exercise it. The harness boots single-tenant, so the orgtenant_isolationpolicy is stripped and a fresh member falls back tomember_default(broad read) — every object reportsmember-visible, so the #1994 invariant ("a user who cannot READ a record must not be able to WRITE it") never actually fired against an app.What
Two faithful ways to create real cross-owner isolation, both now live:
1. Owner-scoped fixture — the hard gate
test/rls-fixture.dogfood.test.ts+test/fixtures/rls-owner-fixture.ts: a one-object app (rls_note) whose member fallback permission set carriesRLS.ownerPolicy('rls_note','created_by'). The predicate keys oncreated_by/current_user.id(notorganization_id), so it survives single-tenant stripping — a fresh member genuinely can't read the admin's note.allops →rls-consistent(the fix(security)[P0]: enforce RLS on by-id writes — close member-edits-others'-records hole (#1985) #1994 pre-image check denies the by-id write).select-only variant →rls-holeon every CI run (read scoped, no write policy applies, by-id write lands) — the fix(security)[P0]: enforce RLS on by-id writes — close member-edits-others'-records hole (#1985) #1994 hole class reproduced at the policy layer. A gate that can't go red isn't a gate.plugin-securityflips the green fixture toGET 404 yet MUTATED it by id (PATCH 200). Verified, then restored.2. Org-scoped / multi-tenant
test/rls-multitenant.dogfood.test.ts:bootDogfoodStacknow takes{ multiTenant: true }, registeringplugin-org-scopingbeforeSecurityPluginsoorganization_idpolicies apply. CRM flips from every objectmember-visible(single-tenant) to 4 consistent / 0 holes / 0 member-visible — confirming themember-visibleresult was single-tenant RLS-stripping, not a broad-read default (the model real apps like hotcrm rely on). hotcrm isn't in this repo, so this validates against the in-repo CRM example and documents the path.Harness
BootOptionsgainssecurity?(SecurityPlugin override for the fixture fallback) andmultiTenant?. README documents both gates + the revert proof; the stale "next step" note in the single-tenant smoke now points at the two new tests.Verification
tsc --noEmitclean;@objectstack/specimport guard compliant.🤖 Generated with Claude Code