Uh oh!
There was an error while loading. Please reload this page.
feat(spec): stamp-only tenancy.organizationField — read-neutral organization declaration for audit stamping (#8778) - #8905
Merged
Conversation
…i_key audit stamps through it (#8778) Option A per the maintainer ruling on #8778: a read-neutral, stamp-only organization declaration. The audit writer's resolveRecordOrganizationField consults it first (with the #5315 field-presence guard); sys_api_key declares { enabled: false, organizationField: 'active_organization_id' } and stays unwalled. Read-neutrality pinned beside each named read path. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Fgvh1iEJfxetei7aNVdtJt
…-surface, changeset (#8778) Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Fgvh1iEJfxetei7aNVdtJt
The latest updates on your projects. Learn more about Vercel for GitHub. 1 Skipped Deployment
|
Contributor
📓 Docs Drift CheckThis PR changes 3 package(s): 107 hand-written doc(s) reference the affected code and may need an implementation-accuracy re-verification:
⛔ 7 release-owned page(s) also reference the affected code. These are read-only:
|
os-project-manager
marked this pull request as ready for review
August 15, 2026 20:02
This was referenced Aug 15, 2026
Uh oh!
There was an error while loading. Please reload this page.
This was referenced Aug 15, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes#8778
Implements the maintainer-ruled option A (delegated adjudication, issue comment
5299847449): a read-neutral, stamp-only organization declaration —tenancy.organizationField— so audit rows can follow the organization a record is ABOUT on objects that must stay unwalled. This is the remaining half of #8707 (the precedence half landed in PR #8777); #8707 stays open for its own seat to verify and unblock — no closing keyword targets it here.What changed
packages/spec/src/data/object.zod.ts—TenancyConfigSchemagains optionalorganizationFieldwith a describe() that states loudly it is stamp-only and does NOT tenant-scope reads. Liveness ledger entry added (live, evidence = the audit writer); authorable-surface, reference docs and liveness counts regenerated (check:generated --fix, only the proved-stale set).packages/plugins/plugin-audit/src/audit-writers.ts—resolveRecordOrganizationFieldconsults the declaration as limb 0, ahead of the ADR-0066enabled: falseopt-out (an author declaring it on an unwalled object is stating exactly that the trail follows the record even though no wall does), guarded by the same TenancyConfigSchema.tenantField 的默认值是 'tenant_id',但平台的租户列叫 organization_id —— 两个 spec 文件对「默认值」的说法互相矛盾 #5315 field-presence checktenantFieldcarries.packages/platform-objects/src/identity/sys-api-key.object.ts— declarestenancy: { enabled: false, organizationField: 'active_organization_id' }. The revocation row now lands behind the wall of the KEY's organization, not the revoker's.The pinned-gap test flipped as designed
The ⛔ KNOWN GAP case in
audit-writers.test.ts:1414went red exactly as it was written to, and is rewritten to expectorg-key, plus: the #5315 fall-through case, anorganizationField-outranks-tenantFieldprecedence pin, and a control pinning that WITHOUT the declaration the actor's org is still stamped (no hidden column-name heuristic).Read-neutrality — pinned beside each named read path
applyTenantScope/injectTenantOnInsert(driver-sql): new suite insql-driver-tenant-scope.test.ts— a walled object declaring the key keeps scoping/injecting onorganization_id(a row whose wall and stamp columns disagree is the discriminating fixture), and the sys_api_key-shaped object stays unwalled with no injection.computeTenantLayer0Filter(plugin-security): the [finding] API keys carry no organization — under the isolated posture a minted key reads no org data at all (no leak, but the key surface is inert) #8287 suite intenant-layer.test.tsnow derives BOTH Layer-0 inputs (objectHasOrgIdField,tenancyDisabled) from the REAL shippedSysApiKeypost-declaration — filter stays null in all three postures.resolveInjectedSystemColumns(spec): new case — the plan is blind to the key on a plain tenant object and on the better-auth shape.Declaration-shape measurement (
enabled: falsevs the previous absent block, for sys_api_key)Measured on every reader of the
tenancyblock repo-wide:resolveInjectedSystemColumnsbails onmanagedBy: 'better-auth'before tenancy is read — identical plan.SqlDriver.computeTenantField/computeAndRecordTenantField→ null either way (noorganization_id, notenantField); the sticky opt-out entry only preserves a null that is already null.computeTenantLayer0Filter→ null either way (tenancyDisabledshort-circuit vsobjectHasOrgIdField === falseshort-circuit).ObjectQLEngine.buildDriverOptionsnow withholdstenantIdfor this object — every downstream reader (applyTenantScope,injectTenantOnInsert,auditMissingTenant) gates on the null tenant field and was already a no-op for it.enabled: true— unaffected.posturePermitsCrossTenant(plugin-security) is already true viaisBetterAuthManaged— unaffected.organization_idon an object lacking it as deny (fail-closed) unless the object opted out of tenancy, in which case it skips. Withenabled: false, a hypothetical org-targeting wildcard RLS policy on sys_api_key would now be skipped as "not applicable on this object" instead of contributing to the deny sentinel. No shipped policy has this shape (the wildcard tenant policy was retired from the seeds; sys_api_key's Layer 1 is theuser_id-based self policy), so shipped behavior is identical; the delta direction on custom metadata is the branch's own documented semantics for opted-out objects, and matches [finding] API keys carry no organization — under the isolated posture a minted key reads no org data at all (no leak, but the key surface is inert) #8287's design (the credential table is owner-scoped, never org-walled).Verification
@objectstack/specbuild + full test suite,check:generated(all gates green after regenerating exactly the two proved-stale artifacts).scripts/pm/dispatch-gates.mjs; run receipts (with the head SHA) in the dev report.Generated by Claude Code
Generated by Claude Code