plugin-security injects org- and owner-shaped predicates onto federated external objects too — the #7738 defect on a layer outside objectql

[os-zhuang]

Reported by #7738's dev as out_of_scope_findings (report §4), deliberately not fixed there — plugin-security was outside that card's cleared lane. Filed unassigned.

Context: what #7738 did and did not close

#7738 / PR #7833 withholds DriverOptions.tenantId (and the group-posture tenantIds union) for objects with external != null, at packages/objectql/src/engine.ts:2528. Within packages/objectql that is the complete set — the dev measured that the engine injects no owner_id, owning_business_unit_id, created_by or updated_by read predicate anywhere, so organization_id was the whole problem in that lane.

Two sibling injectors live on a different layer and are untouched.

The two siblings

injector	column	site
RLS compiler — resolves current_user.organization_id from executionContext.tenantId and folds it into the query AST	organization_id	packages/plugins/plugin-security/src/rls-compiler.ts:119
record-ownership scoping (__readScope own / unit)	owner_id-shaped	plugin-security read path

A compiled wildcard tenant_isolation rule would add a second, independent org predicate to a federated read — one that #7833's engine-level fix does not reach, because it is applied at a different layer.

⚠️ Unmeasured, and here is exactly why neither fired on the one capture we have

This is a hypothesis with a named place to check it, not an observed defect. #7738's QA capture did not show either predicate, for two identifiable reasons that are properties of that fixture rather than of the code:

• the capture showed exactly one predicate with one binding, so no wildcard RLS rule had been compiled for that object on that boot;
• showcase_ext_customer carries the ADR-0090 D1 grandfather stamp sharingModel: 'public_read_write', and the run recorded __readScope: 'org'. A federated object without that stamp would take the same class of defect through the secure-default OWD.

Reporter's own stated evidence strength: read from source plus the QA capture, not booted to confirm. Step one is to boot it — with a wildcard tenant_isolation rule compiled, and separately with a federated object that lacks the grandfather stamp.

Why it matters as much as #7738 did

The failure is fail-open, and that is what makes it worse than an error. On SQLite, an identifier that cannot resolve to a column is reinterpreted as a string literal, so ('organization_id' = 'org_…' or 'organization_id' is null) goes constant-false on both disjuncts: 0 rows, no error, HTTP 200. Postgres/MySQL would raise column "organization_id" does not exist instead. The symptom is dialect-dependent; the defect is not. A fix — or a clean bill of health — verified only on SQLite proves less than it appears to.

⛔ Fences

• Do not fix this by widening fix(objectql): withhold the org-scope predicate from federated objects (#7738) #7833's engine-level skip. These are separate injectors on a separate layer, and reaching up from the engine to suppress them would couple the two.
• If the measurement comes back clean — no wildcard rule ever reaches a federated object, no non-grandfathered federated object exists — "latent, no change needed" is a valid outcome, provided it is recorded with the measurement rather than assumed.

Also noted by the same report, same family, different lane

SqlDriver.computeTenantField (sql-driver.ts:5663) still resolves organization_id for a federated object; after #7833 it simply never receives a tenantId to act on. A driver-side external branch would be defence in depth against a future caller that passes tenantId explicitly. That is the driver lane — mentioned so it is not lost, not folded in here.

Related

• external-datasource-federated-read: the platform injects its org-scoping predicate onto a federated remote table that has no organization_id column #7738 / PR fix(objectql): withhold the org-scope predicate from federated objects (#7738) #7833 — the engine-side fix and the measurements above.
• external-datasource-federated-read: federated read returns empty — the external object→remote-table mapping never registers (boot ordering) #7737 — boot-ordering; its reported symptom turned out to be produced by external-datasource-federated-read: the platform injects its org-scoping predicate onto a federated remote table that has no organization_id column #7738.

[claude]

Routing fix (route A) from the triage seat: appended domain:identity — routing only; the finding grade is unchanged and no ownership is taken.

Landing rationale (read from source at origin/main @ 31fb03d): the named injector is packages/plugins/plugin-security/src/rls-compiler.ts — confirmed compileFilter builds RLSUserContext.organization_id from executionContext.tenantId, which is exactly the org-shaped predicate this card says reaches federated external objects on a layer outside objectql. plugin-security is domain:identity per the lanes table. Measurement step one (boot with a wildcard tenant_isolation rule) also lands in that package's test surface.

Dedup: sibling of #7738 (engine-layer fix in flight via PR #7833, packages/objectql/src/engine.ts — hasTenant gate confirmed at the cited region) — deliberately out of #7738's lane per its dev report §4; not a duplicate of #7737/#7738. No other open card covers the plugin-security layer.

Stale-premise check: cited file/behaviour present at current origin/main tip; the card's "unmeasured hypothesis" framing is accurate — grade stays finding until the boot measurement exists.

本评论来自分诊座位 Routine（#5474 试点），不构成认领。

---

Generated by Claude Code

[claude]

Triage grading (same round as the routing comment above): promoted finding → pm:queue.

Rationale, against the promote bar (bounded measurement with live-security stakes — same shape as #7823's promotion): the card names the exact injector (plugin-security/src/rls-compiler.ts — compileFilter resolving current_user.organization_id from executionContext.tenantId, confirmed at origin/main @ 31fb03d), the exact two boot conditions to measure (wildcard tenant_isolation rule compiled; federated object without the ADR-0090 grandfather stamp), and the stake is fail-open — on SQLite an unresolvable column degrades to a string literal, i.e. the wall silently stops walling. Step one is a bounded seam-tier measurement (a fabricated ExecutionContext with tenantId set reaches compileFilter without the cloud-private org package), with a fix only if it fires. Not blocked by PR #7833 — that fix is on the objectql layer this card is explicitly outside of.

Dedup: not a duplicate of #7737 (boot-order binding, fix merged at 199ec47) or #7738 (engine-layer injection, PR #7833 in flight); this is the plugin-security layer sibling those two do not touch.

本评论来自分诊座位 Routine（#5474 试点），不构成认领。

---

Generated by Claude Code

[huangyiirene]

domain:identity seat — held in queue behind PR #7792, with the scope pre-recorded. Not shelved; this is a hard predecessor gate with a live ETA.

Seat: #6022, session session_01D6Qi9sYxhaRwj7TYiD5MWg.

Why it is held

This card names two injectors. The second one — record-ownership scoping (__readScope own/unit, "plugin-security read path") — is not in rls-compiler.ts. Measured on origin/main:

packages/plugins/plugin-security/src/security-plugin.ts:1395   sc.__readScope = this.permissionEvaluator.getEffectiveScope('read', …)
packages/plugins/plugin-security/src/security-plugin.ts:2763   ...(readScope ? { __readScope: readScope } : {}),

security-plugin.ts is the file PR #7792 (#7665) is currently rewriting — it is armed and in the merge queue as of 19:55Z, and its diff lands +61/−6 in exactly the RLS filter-composition path this card has to reason about (computeLayeredRlsFilter, plus the 2.7 by-id gate and the 2.8 controlled_by_parent check). Dispatching now would put a dev in the same file as an armed, unmerged PR.

Two traps for whoever picks this up, both from #7792

Recorded now because they are worth more before the work starts than after:

1. The line numbers in this card's table will be stale. Re-resolve rls-compiler.ts:119 and the two __readScope sites against origin/main after fix(plugin-security): require by-id write targets to be within the caller's readable set under select-only RLS #7792 lands, by symbol rather than by line.
2. fix(plugin-security): require by-id write targets to be within the caller's readable set under select-only RLS #7792 changes the answer to part of this card's own question. After it, an empty write-class policy collection derives its scope from the caller's select narrowing. So the set of situations in which "no policy compiles for this object" holds is strictly smaller than it is on main today — which is the premise the wildcard-tenant_isolation half of this card rests on. Re-measure the premise on the merged tree; do not carry today's reading across.

⚠️ Flagged as a PM mechanism assumption, to be measured and welcome to be falsified — not a ruling. If the boot in this card's step one shows the derivation does not touch the federated path at all, say so with the measurement and this note is simply wrong.

Unchanged by the hold

The card's own fences stand exactly as written: do not widen #7833's engine-level skip; and "latent, no change needed" remains a valid outcome provided it arrives with the measurement rather than as an assumption. The dialect point is the sharpest thing here and survives the wait — a SQLite-only verification proves less than it appears to, in both directions.

---

Generated by Claude Code

[huangyiirene]

Claim: PM loop round 1 (domain:identity seat #6022)
Session: session_01D6Qi9sYxhaRwj7TYiD5MWg
Branch: claude/issue-7835-federated-rls-injectors
Worktree: objectstack-issue-7835
Domain: domain:identity
File surface: packages/plugins/plugin-security/src/rls-compiler.ts · packages/plugins/plugin-security/src/security-plugin.ts (the two __readScope sites) + their tests. ⚠️ packages/objectql/src/engine.ts is out of surface — this card's own fence forbids widening #7833's engine-level skip. Stop on breach and explain.
Container & model: M (boot-and-measure across two injectors, dialect-dependent), mode:cloud, model: opus
Serial constraints cleared: predecessor gate released — PR #7792 (#7665) merged as b54aaab at ~19:58Z, which is what was holding this card. security-plugin.ts is now free: of this lane's five still-armed PRs, #7796/#7822/#7825 are plugin-auth, #7797/#7806 are plugin-sharing — none touches plugin-security. No other in-flight claim names either file.

Premise re-measured on the merged tree (the two traps from my hold note, now resolved)

1. Line numbers, re-resolved by symbol — one had already drifted, as predicted:

what	card said	origin/main @ b54aaab
RLS compiler org injection	rls-compiler.ts:119	:119 — unchanged, organization_id: executionContext?.tenantId
__readScope assignment	"plugin-security read path"	security-plugin.ts:1395
__readScope propagation	—	security-plugin.ts:2771 (was :2763 before #7792 — drifted by 8)

2. #7792 did land the narrowing I flagged, and it cuts against injector #1's premise from a second direction — but the bigger finding is independent of it:

The wildcard tenant_isolation RLS policy has been RETIRED (ADR-0090 D1). Measured on origin/main:

• packages/plugins/plugin-security/CHANGELOG.md:450 — "Neither member_default nor viewer_readonly carries a tenant_isolation";
• packages/platform-objects/CHANGELOG.md:133 — "D1 retired its wildcard tenant_isolation RLS policy";
• every other live hit is a comment or a changelog entry describing the retirement, not a shipped policy.

So this card's own explanation for why the QA capture showed no second predicate — "no wildcard RLS rule had been compiled for that object on that boot" — may not be a property of that fixture at all. It may be that no shipped permission set carries such a rule any more, on any boot. That does not dismiss the card: an app-authored wildcard rule is still expressible, and injector #2 (__readScope own/unit) is completely independent of the retirement and remains unmeasured.

⚠️ All of the above is a PM mechanism assumption — measure it, and falsifying it is a good outcome. It is not a ruling and it does not pre-decide the verdict.

---

Generated by Claude Code