fix(example-crm): bind sales positions to crm_sales_user permission set

[os-zhuang]

Fixes#8060

What

examples/app-crm declared three positions (sales_rep, sales_manager,
finance_approver) and a crm_sales_user permission set granting CRUD on 5
CRM objects, but nothing ever bound them together — no
sys_position_permission_set seeding, and crm_sales_user was not
isDefault. Any user assigned one of the three positions therefore resolved
only the platform everyone baseline and was 403'd on every CRM object.

This mirrors examples/app-showcase/src/security/bind-position-sets.ts
exactly, per the triage ruling: a new
examples/app-crm/src/security/bind-position-sets.ts binds the three
positions to crm_sales_user imperatively on kernel:bootstrapped (a
declarative seed can't do this — the seed loader runs before the security
bootstrap creates the sys_position/sys_permission_set rows), wired via a
new onEnable export in objectstack.config.ts. crm_sales_user is
deliberately not marked isDefault — that would auto-bind it to the
everyone anchor and grant every user the CRM permissions, changing the
example's security story rather than completing it (explicitly ruled out).

Measured (predict-then-mutate + reverse verification)

Reproduced the issue's own acceptance test with
objectstack verify --app examples/app-crm/objectstack.config.ts --rls:

Before (confirmed matches the issue exactly):

declared=3 [sales_rep,sales_manager,finance_approver] ran=3 notRun=[]
sales_rep proven=0 unproven=6 (probeBlocked=6)
sales_manager proven=0 unproven=6 (probeBlocked=6)
finance_approver proven=0 unproven=6 (probeBlocked=6)
totals: probeBlocked=18, proven=6 (base persona only)

After, per persona: objects:6, probeBlocked:1, memberVisible:5.
probeBlocked (no object grant at all — the by-id-write class never
exercised) drops from 18/18 → 3/18. The one remaining probe-blocked object
per persona is crm_opportunity_line_item, which crm_sales_user does not
grant at all — a separate, pre-existing gap (filed as #8164, out of this
card's scope). Zero RLS holes introduced or found, in either state.

Reverse verification: disabled the onEnable wiring, re-ran — readout
returned to exactly the pre-fix 18/18 probeBlocked baseline, confirming the
hook (not something else) is the lever. Re-enabled and re-confirmed the fixed
readout before pushing.

A caveat on "proven": the report's strict proven field (⇒
rls-consistent) stayed at 0 for the position personas even after the fix —
not a defect of this change. All 5 now-granted CRM objects declare
sharingModel: 'public_read_write' ("everyone reads+writes"), so once the
object gate opens, the record is visible to any authenticated holder by
design — the report classifies that as member-visible (inconclusive), which
is correct and expected for this app, not rls-consistent. Zero holes is the
signal that matters: no security regression.

Sharing rules (PM mechanism assumption #2)

The three sharedWith: { type: 'position', value: … } sharing rules do
not start mattering after this fix — measured, not assumed. They widen
record visibility on top of the object's OWD baseline, but every CRM object
they target is already public_read_write (org-wide read+write for anyone
holding the object grant), so there is nothing left to widen. The sharing
rules remain inert on top of an already-maximal baseline; this is a property
of the objects' declared sharingModel, unrelated to the binding fix.

Out of scope

• packages/plugins/plugin-security/** untouched, per the ruling.
• crm_opportunity_line_item has no object-level CRUD grant in any app-crm permission set — the platform's own build lint already flags it #8164 filed (unassigned, unlabeled) for crm_opportunity_line_item having
  no object-level CRUD grant in any app-crm permission set — the platform's
  own build-time lint (security-master-detail-ungranted) already flags this
  independently of the binding gap this card fixes.

Tests

• objectstack verify --app examples/app-crm/objectstack.config.ts --rls
  (see above) — the issue's own acceptance test, run before/after/reverted.
• cd examples/app-crm && npx vitest run — 27/27 passing (unchanged; no test
  file added, following the showcase's own precedent of proving the binding
  via the live verify --rls probe rather than a unit test).
• cd examples/app-crm && npx tsc --noEmit — clean.
• pnpm --filter '@objectstack/example-crm...' build — clean, only the
  pre-existing (now separately filed) security-master-detail-ungranted
  warning on crm_opportunity_line_item.
• pnpm check:changeset-gate-self-tests, check:i18n-coverage (after
  rebuilding the showcase closure to clear a stale-dist false positive
  unrelated to this diff), check:objectui-changeset,
  check-changeset-no-major.mjs, check:nul-bytes — all green. Note
  check:objectui-pin-fresh / check-objectui-pin-fresh.mjs are red, but
  pre-existing and unrelated (ambient objectui pin staleness, independent of
  this diff's content).

---

Generated by Claude Code

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
objectstack	Ignored		Aug 12, 2026 7:13pm