Uh oh!
There was an error while loading. Please reload this page.
fix(objectql): the tenant-scope index follows the wall's derivation, not the injection plan (#8608) - #8752
Merged
Conversation
…8608) The platform's tenant-scope index was gated on the spec's INJECTION plan (`resolveInjectedSystemColumns(...).tenant`), while plugin-security's Layer 0 wall derives `tenancyDisabled` from exactly two clauses: tenancy.enabled === false || systemFields.tenant === false `systemFields: false` — the hard object-level opt-out — is in the plan and in neither clause, so an object using it while declaring its own `organization_id` had the wall predicate AND-composed onto essentially every read with no index behind it. Measured end to end before the fix: the registry answered `indexes: null` while `SecurityPlugin#getReadFilter` answered `{ organization_id: 'org-1' }` for the same object. Per the triage ruling of 2026-08-14 (option A, standing meta-rule: the governed side wins and the ungoverned side rebinds to it), `carriesTenantScopeColumn` is rebound to the wall's two clauses plus "the object carries organization_id", and the `applySystemFields` exit that injects nothing now routes through `provisionTenantScopeIndex` like every other exit — it was the last one that decided the index by not asking. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01XeQRiAa7vYRVX5Fog7Zby8
…ant-index-follows-wall
The latest updates on your projects. Learn more about Vercel for GitHub. 1 Skipped Deployment
|
Contributor
📓 Docs Drift CheckThis PR changes 1 package(s): 15 hand-written doc(s) reference the affected code and may need an implementation-accuracy re-verification:
⛔ 1 release-owned page(s) also reference the affected code. These are read-only:
|
hotlong
marked this pull request as ready for review
August 14, 2026 18:46
Uh oh!
There was an error while loading. Please reload this page.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes#8608
Implements the triage ruling of 2026-08-14 — option A: the wall's derivation is authoritative and the index follows it. Option B (narrowing the wall) is not implemented and not attempted.
The premise, measured end to end first
The card asserted its security half from source and said so. Triage made measuring it step one, because a flipped premise ends the card. So it was measured before anything was edited:
SecurityPluginbooted over a fake ObjectQL serving the registry's own output for the object in question, ordinary member oforg-1,isolatedposture.On the pre-fix tree:
organization_id)applySystemFields(obj, { multiTenant: true }).indexesSecurityPlugin#getReadFiltersystemFields: false(row 1)null{"organization_id":"org-1"}systemFields.tenant: false(row 2)nullnull[{"fields":["organization_id"]}]{"organization_id":"org-1"}Row 1 is the disagreement, confirmed: the wall filters on a column the platform declines to index. Rows 2 and 3 agree and are controls.
The cause
provisionTenantScopeIndexasked the spec's injection plan (resolveInjectedSystemColumns(...).tenant); plugin-security derivestenancyDisabledfrom exactly two clauses —tenancy.enabled === false || systemFields.tenant === false.systemFields: falseis in the plan and in neither clause.There was also a second site: the
applySystemFieldsexit for objects that inject nothing returnedschemadirectly, so the hard-opt-out row never reached the index decision at all. It was the last exit that decided the index by not asking — which is how the withholding survived #8375's convergence.The change
packages/objectql/src/registry.tsonly, two edits:carriesTenantScopeColumnis rebound to the wall's terms — the wall's two clauses decide "is tenancy off here", then the object must carryorganization_id(the platform provisions it or the author declared it).provisionTenantScopeIndexlike every other exit.managedBy: 'better-auth'is deliberately not re-added as a third clause: the wall does not read it either, and adding an exclusion the wall lacks would re-open the drift this card closes.stripProvisionedTenantIndexFromsees a body with noorganization_id. The injection-plan branch answers on a stripped body; the field-map branch only ever adds objects that branch cannot see — and is safe on the write path for the mirrored reason (on exactly those rows the strip removes nothing, so the author's column is still there when the re-stamp asks). Pinned by a new round-trip case, not left as an argument.Blast radius: exactly one shipped object — please review this line
All 44 objects
@objectstack/platform-objectsships were scanned before and after. One row changes:sys_membergains{"fields":["organization_id"]}.That is the ruling's predicate applied, not drift:
sys_memberismanagedBy: 'better-auth', declaresorganization_id, is not tenancy-disabled, and is therefore walled on that column — while its only tenant-leading index is the composite['organization_id','user_id'], whichdeclaresTenantIndexdeliberately does not accept as a substitute (a leading-column match is dialect-dependent; #8459 pins that boundary). Every other table that would qualify already declares its own single-column tenant index (sys_invitation,sys_team,sys_scim_provider) or is tenancy-disabled (sys_sso_provider).Related: the card's clause table records
managedBy: 'better-auth'as "n/a (no org column exists)". That is not accurate for the shipped set — four better-auth tables declareorganization_id. It does not change the ruling, and it is why the fix touches one object rather than none.Reverse verification — direction predicted before running
Predicted non-uniform: only the row-1 family flips. Ablated the fix from the committed state (
git restore --source=origin/main, no stash), re-ran all three tenant-index files:The five: row 1, the better-auth row, the read exit, the idempotence case, and the new round-trip case. Both controls stayed green with the fix absent, as did the whole #8459 file — which is what makes "one row wide" a measurement rather than a claim. Fix restored from
HEAD, tree verified byte-clean against it before pushing.Tests and gates — at
c56e36d, the pushed headMerged
main(bringing #8737 and #8682) before this run, so the numbers describe the merged tree.packages/objectqlfull suite: 206 files / 3629 tests passed;typecheckclean.registry-tenant-index-follows-wall.test.ts(all three table rows, the wall's other clause, the better-auth row, the no-column case, the injects-nothing pin, the read exit, and the single-tenant / author-declared-index / idempotence controls) + 1 write-path case in the existing round-trip file, which reuses that file's already-pinned engine double rather than declaring a second one.check:nul-bytes,check:durability-log-level,check-engine-split-ratio,check:engine-double-contract,check:query-options-erasure,check:type-check-coverage,check:type-check-debt(re-measure: 33 ledger entries, none above ceiling),check:changeset-gate-self-tests,check:objectui-changeset,check-adr-0087-registration,check-changeset-no-major,check-empty-changeset— all 0.scripts/pm/dispatch-gates.mjsagainst the actual diff.Scope
packages/plugins/plugin-securitywas read to measure the premise and never edited (#8536 in flight).packages/objectql/src/engine.tsuntouched. Nopackages/specchange and no new spec export — option C's convergence needs neither, sinceisTenancyDisabledis already public in@objectstack/spec/data; the remaining half of C (one shared predicate across both packages) would require a plugin-security edit, so it stays a follow-up.Generated by Claude Code