From e1a1a8b28ed0296dcf658b72a721bf0ab7e7df86 Mon Sep 17 00:00:00 2001 From: Claude Date: Wed, 12 Aug 2026 04:20:24 +0000 Subject: [PATCH] docs(qa): state the org-wall boundary at the dogfood autoconnect assertion (#7834) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit `showcase-external-autoconnect.dogfood.test.ts` is a required-CI test that names the federated-read path and asserts `rows.length >= 3` on an authenticated admin read — the exact shape that should have caught #7738's fail-open federated read, and did not. It boots single-tenant, so the org predicate is never emitted and the assertion passes without ever crossing the wall. A green gate over a path it does not exercise reads as coverage. Per the maintainer's 2026-08-12 ruling on #7834 (option 2), record the boundary at the assertion site instead of building a posture-aware fixture: what the test does cover (the ADR-0062 D8 autoconnect path — real, hence not skipped), what it does not (the organization wall), why (no `opts.multiTenant` => no `isolated` posture request, `autoDefaultOrganization: false`, no org plugin => `execCtx.tenantId` undefined => `hasTenant` false), and where the regression defence actually lives (#7833's seam pin on `DriverOptions` in `packages/objectql/src/engine-external-tenant-scope.test.ts` — a unit/seam pin, explicitly not end-to-end proof). Comment-only; no behaviour change and no new assertion. Verified by re-measurement: with #7833's `!isFederated` guard locally removed and `@objectstack/objectql` rebuilt, this file still passes 3/3, and a probe in `buildDriverOptions` records `tenantId=undefined`/`hasTenant=false` for `showcase_ext_customer` and `showcase_ext_order` (0 of 1069 calls in the whole boot ever get a tenant). Probe reverted; nothing outside the comment changed. Co-Authored-By: Claude Opus 5 Claude-Session: https://claude.ai/code/session_01NmZQLn86u9wLfoXQUBX7bs --- ...wcase-external-autoconnect.dogfood.test.ts | 44 +++++++++++++++++++ 1 file changed, 44 insertions(+) diff --git a/packages/qa/dogfood/test/showcase-external-autoconnect.dogfood.test.ts b/packages/qa/dogfood/test/showcase-external-autoconnect.dogfood.test.ts index 8d64f66038..509e292179 100644 --- a/packages/qa/dogfood/test/showcase-external-autoconnect.dogfood.test.ts +++ b/packages/qa/dogfood/test/showcase-external-autoconnect.dogfood.test.ts @@ -38,6 +38,50 @@ describe('showcase: external datasource auto-connects with no onEnable bridge (A const res = await stack.apiAs(admin, 'GET', '/data/showcase_ext_customer'); expect(res.status, 'federated object must be queryable — driver auto-connected').toBe(200); const rows = listOf(await res.json()); + // [#7834] ⛔ THIS ASSERTION IS NOT ORG-WALL COVERAGE — read this before + // treating a green run of this file as proof of anything about tenancy. + // + // What it DOES cover (real, which is why this test is not skipped): the + // ADR-0062 D8 auto-connect path — a declared external datasource connects + // at boot with no `onEnable` driver bridge, and its federated objects + // answer a genuine authenticated read through the real REST stack. + // + // What it does NOT cover: the organization wall. `bootStack(showcaseStack)` + // above passes NO options, and `bootStack` requests + // `OS_TENANCY_POSTURE = 'isolated'` only when `opts.multiTenant` is truthy + // (`packages/verify/src/harness.ts`, `requestIsolatedPosture`). It also + // boots AuthPlugin with `autoDefaultOrganization: false` and registers no + // organization plugin. So this fixture boots posture `single` — the boot + // log says so: `[security] tenancy posture 'single' — Layer 0 is inert` — + // with no active org. `execCtx.tenantId` is therefore undefined, which is + // the FIRST conjunct of `hasTenant` in `ObjectQLEngine.buildDriverOptions` + // (`packages/objectql/src/engine.ts`); it short-circuits false before the + // `isFederated` exemption is even reached, and the driver is handed no + // `tenantId` to scope by. **The org predicate is never emitted here, in + // either direction.** Measured on #7738: `engine.ts` was checked back out + // at pre-fix `main`, `@objectstack/objectql` rebuilt, and this file re-run + // — 3 passed / 3 both WITH the fix and WITHOUT it. This assertion sat green + // while a correctly-bound federated object answered 0 rows under a real + // org wall, and it cannot catch a regression of that. + // + // Where the regression defence actually lives: the seam pin in + // `packages/objectql/src/engine-external-tenant-scope.test.ts` (#7833). It + // asserts on `DriverOptions` in both directions — an external object gets + // no `tenantId`/`tenantIds`, an ordinary one still does — and is reachable + // without the enterprise package. ⛔ That is a UNIT/SEAM pin, not + // end-to-end proof: it pins what the engine hands the driver, never what a + // walled deployment returns over HTTP. + // + // Why this is deliberately left as-is (maintainer ruling, 2026-08-12 on + // #7834): the federated-read × org-walled intersection is accepted as + // covered at the unit/seam tier ONLY. The single honest walled harness is + // `multiTenant: true` with the cloud-private `@objectstack/organizations` + // (`'posture-only'` stamps nothing and scopes no query — see + // `BootOptions.multiTenant` — so it would assert nothing here); its + // feasibility in this repo is untested, and one intersection does not + // justify building that fixture. ⛔ Do not "fix" this by asserting tenancy + // on this single-tenant boot — that pins the inert path and makes the + // false reading of coverage worse. expect(rows.length).toBeGreaterThanOrEqual(3); expect(rows.map((r) => r.name)).toContain('Aurora Labs'); });