fix(plugin-security): an organization administrator's refused assignment write answers the same for a row it cannot read as for a missing one - #29932

📓 Docs Drift Check

This PR changes 1 package(s): @objectstack/plugin-security, touching 4 documentable anchor(s).

1 hand-written doc(s) NAME something this change touched and may need an implementation-accuracy re-verification:

• content/docs/permissions/delegated-administration.mdx (via DelegatedAdminGate (symbol, a top-level class))

⛔ 1 release-owned page(s) also name something this change touched. These are read-only:

• content/docs/releases/v13.mdx (via DelegatedAdminGate (symbol, a top-level class))

content/docs/releases/ is RELEASE-OWNED (AGENTS.md "Documentation Guardrails"): release
notes are written centrally at release time, and a code PR that edits them is the exact PR
that guardrail exists to stop. They are still audited — read-only. If one of them is actually
wrong, file an issue or open a dedicated docs-only PR; do not edit it here.

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin a75819f70b5f3159cc9aeec788129b3d2655dbf1 && git checkout a75819f70b5f3159cc9aeec788129b3d2655dbf1
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin 7b2bb668dacc8d915c161791facf20be78138a99 51d9481a50435663746886fd79a8bca4aaed02f7 && git checkout -B drift-repro 7b2bb668dacc8d915c161791facf20be78138a99 && git merge --no-ff 51d9481a50435663746886fd79a8bca4aaed02f7

node scripts/docs-audit/affected-docs.mjs --json 7b2bb668dacc8d915c161791facf20be78138a99

Advisory only, and a precision-first one (#9192): a page is listed because it names a
symbol, wire route or SDK method this diff touched — not because it mentions a changed
package. Each row says which anchor put it there, so a wrong row is reportable rather than
merely annoying. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs 7b2bb668dacc8d915c161791facf20be78138a99 → pass the list as
args.docs, on the commit named under Which tree this was computed on.

security#1 · os-justin · session_01QSeKYn5CmmdShCJifm6WYj

Contract-review-claim: session_01QSeKYn5CmmdShCJifm6WYj · head 51d9481 · 2026-11-03T13:43Z

security#1 · os-justin · session_01QSeKYn5CmmdShCJifm6WYj

Contract review

Served-tier: CONTRACT_REVIEW_TIER
Head-sha: 51d9481a50435663746886fd79a8bca4aaed02f7
Local-runs: none
Scope: packages/plugins/plugin-security/src/delegated-admin-gate.ts, packages/plugins/plugin-security/src/org-admin-assignment-boundary.posture.test.ts, packages/qa/dogfood/test/org-admin-assignment-removal-unreadable-row.dogfood.test.ts, .changeset/org-admin-removal-caller-read.md + packages/plugins/plugin-security/src/security-plugin-authz-middleware.ts (readDoorAnswerForGateRefusal, the gate call, step 2.7), packages/plugins/plugin-security/src/security-plugin.ts (getCallerPreImage, absentUnderCallerRead, the gate's construction), packages/plugins/plugin-security/src/security-plugin-addressed-writes.ts (readRowById), packages/plugins/plugin-security/src/security-plugin-object-admission.ts (the admission probe's call into the gate), packages/plugins/plugin-security/src/objects/default-permission-sets.ts (the two organization-administrator sets), packages/plugins/plugin-security/src/objects/sys-user-position.object.ts, packages/plugins/plugin-security/src/objects/sys-user-permission-set.object.ts, packages/objectql/src/engine.ts (findOne), packages/spec/src/identity/eval-user.zod.ts, content/docs/permissions/delegated-administration.mdx

Reviewed on the net diff against main at the merge base (4 files, +319/−2), the PR body and the head's check-runs; no dispatch order and no developer report were read as inputs. The record stays at rule level.

① Derived judgments

What changes, and for whom. One thing: in the ORGANIZATION branch of the ADR-0090 D12 gate, the pre-image of a by-id removal is now the caller's own by-id read through the engine (organizationTargets) instead of a system-context read. The read has the same shape as the by-id write doors' own pre-image read (readRowById: findOne(object, { where: { id }, context })), so it is the read door's own question, every wall and read visibility included.

• Organization administrator, both variants (organization_admin, organization_admin_no_bypass), under group and isolated. A by-id DELETE of a row the caller's read does not return is refused at the gate with the answer an id naming no row already got (403 PERMISSION_DENIED, "the assignment row to remove could not be read", details {operation, object}), and never reaches the engine. Before this head the same write was refused with guidance naming the row's organization. A row the caller reads is judged on what it read, so an own-organization row keeps its boundary guidance (pinned as a control for both variants and both tables). UPDATE, and the lifecycle verbs, are refused by the branch as "not part of the right" BEFORE any row is read, so their answers are identical for a hidden row and a missing id with or without this change — the tree bears out the body's claim that update answers are unchanged.
• single. No wall: the caller reads a row of another organization, so the guidance that names that organization stands. Consistent with the ruling (the row is one the caller can read); pinned as a control.
• Tenant-level / platform administrator. Returns from the gate before the branch; the engine answers both a hidden row and a missing id with its not-found (pinned as a control). Unchanged.
• Delegate (no organization-administrator set). Never enters the branch; judged by the delegated branch, whose pre-image read is unchanged (see ③).
• A caller holding BOTH an organization-administrator set and a delegated scope. The organization branch refuses as above, and authorize then hands the write to the delegated branch (held.length > 0), which answers it. That caller class is therefore still answered by the delegated branch — out of this PR by design (③).
• System. Short-circuits the middleware before the gate; a flow run's system context is refused ahead of it. Unchanged.
• A caller read that is refused (declared 4xx) or that faults. The gate has no catch, so it propagates; the middleware's readDoorAnswerForGateRefusal then asks the read door again and answers a declared read refusal as the answer for any id, and passes a fault (≥500) through as raised. Both are the same answers the merged by-id write door already gives that caller; a store fault is neither an answer nor a refusal, as readRowById already holds.

Clause-②: no is right. Every removal the branch admitted before is still admitted: admission requires the row to be the caller's own organization's and inside the boundary; both administrator sets hold allowRead on both assignment tables (the walled variant also viewAllRecords), the two objects declare no row-level sharing or owner floor that could hide an own-organization row, and the posture test's control reads another user's own-organization row for both variants under both walled postures. The only answers that change were refusals before and are refusals now, so nothing a consumer could do on main is taken away. The canWrite admission probe, which calls the gate with a synthetic context, answers false for that row before and after.

② Semver level

patch for @objectstack/plugin-security; Metadata-protocol: none. No published schema, spec export, route or wire shape changes; the only observable change is the wording of one refusal for a class of write that was already refused. The changeset carries the rule, the two trailer lines and no mechanism.

③ Boundary flags

1. HTTP dogfood pin has no red leg. The ablation was run only at the engine level (the posture test went 2 red, controls green, restored run green). The HTTP pin's ability to fail rests on its own controls: the wall is asserted active and not degraded, the caller is asserted no platform administrator and active in its organization, its GET of each foreign row is asserted 404 and of its own row 200, and the own-row control asserts the answer is NOT the missing-id answer. Accepted as a flag; the seat's follow-up should give the HTTP pin a measured red leg.
2. The dogfood battery ran at the merge commit b6fe08a, not this head. Verified on the commit list: the two later commits (23da8f6, 51d9481) touch only the posture test. Accepted.
3. Check-runs on this head. Green: Auto Label, Check Changeset, Check PR Size, Dogfood Regression Gate, Flag docs affected, Governed Surface Queue Guard, Lint · PM dispatch-gates, Lint · docs & code guards, Lint · scoped · query-options erasure, Lint · scoped · tooling self-tests, PR-body guards, Plan Test Core shards, Spec property liveness, Test UI, Type Check · source gates, filter, Build Core, Lint · ESLint, Lint · CI/release/engine gates, Lint · repo & tooling gates, Lint · scoped · slot lookup & corpus, Live E2E UI, Type Check · consumer gates, Type Check · debt ledger, Type Check · workspace, Test Core 2/8, 3/8, 5/8, 6/8 and 7/8 (32 green at the last refresh). Skipped (opt-in or no UI change): 18.x upgrade harness, Build & E2E UI, Build Docs, Build UI Deps, the Dogfood Regression Gate shards, Dogfood Verify CLI, Lint UI, Packed-tarball smoke, Schedule gate, Temporal Conformance, Test UI shards, Type Check UI, UI Published Artifacts. STILL RUNNING at the time of this record: Test Core 1/8, 4/8 and 8/8. Their conclusions are the gate verdicts; this PASS does not stand in for them. The Dogfood Regression Gate's three shards were skipped, so the new HTTP pin's CI execution on this head is not evidenced by a check-run.
4. The delegated branch is left as it was — correctly, and escalated. materializeTargets still reads a removal's pre-image under the system context and does not refuse an empty pre-image at the gate, so for a delegate — and for the organization administrator who also holds a delegated scope (①) — a hidden row and a missing id are not yet answered alike. Leaving it out of this PR is right: it is a different branch with its own pre-image semantics (a merged update image, subtree and allowlist judgments) and needs its own measurement. Escalated to the seat as its follow-up, no card.
5. Unit harness. delegated-admin-gate.test.ts (not in the diff) drives the organization branch through a fake engine that ignores context, so its foreign-row case now stands for a caller who reads the row and its expectation is unchanged — the same shape the single control pins on the real engine. Fine as is; a follow-up may add a context-honouring double.
6. Docs. The drift check names content/docs/permissions/delegated-administration.mdx; read at this head it states nothing about the pre-image's read context, so no sentence is contradicted. The lane may add the rule ("the removal is judged as the caller reads the row") when the delegated follow-up lands, so both branches are documented once.

④ Design judgment

Tried to break it against the cited code; no must-fix found.

• An organization-administrator refusal still worded from a system read? None. Update and the lifecycle verbs are refused before any read; a filter delete is refused before any read; insert judges payload rows. The branch's other reads (positionBoundaryFailure, organizationBoundaryFailure, businessUnitInOrganization) read the catalog and the organization's units by values taken from the row the caller read, and businessUnitInOrganization runs on t.next only (insert). No guidance about a removal's row can come from a read the caller did not make.
• A caller read that throws something other than a declared 4xx. The call passes only where: { id } (scalar by extractSingleId) and context, both accepted by findOne (requireFindOnePredicate is satisfied; no projection, no order). What can be thrown is a declared read refusal (answered, ①) or a store fault (propagated as raised, exactly as readRowById propagates one). The object-admission probe catches PermissionDeniedError only and lets a fault reach its outer deny-and-log, as before.
• Cost on the admitted path. Read count is unchanged (one gate read before, one now, plus the middleware's own step 2.7 pre-image read either way), but the gate's read now carries a full read-middleware pass as the caller, and it is not shared with the middleware's opCtx.__preImage memo, so an admitted by-id delete reads the row as the caller twice and a refused one three times (readDoorAnswerForGateRefusal asks again). Bounded (by id, limit 1), on a low-volume administrative write; not a must-fix. A follow-up may let the gate seed or consume that memo (the gate receives the middleware's own opCtx; the admission probe's synthetic context would be unaffected).
• Race between the caller read and the write. Unchanged window: the gate's read is advisory to the gate alone; the middleware's step 2.7 re-reads the row under the write-class filter and the tenant wall is composed into the write itself, so a row that changes organization after the gate read is refused there or written correctly, never written across the wall. The row-level answer is not an existence answer.
• An own-organization row whose guidance changed. None found: a readable row is judged on organization_id, position / the grant's set name, and (insert only) business_unit_id; neither set declares field masking on the two tables, and both controls show those fields present after the caller's read.
• single. The branch behaves as before: no wall, the row is read, the organization guidance stands; callerOrganizationId is the Default Organization. The control pins it for both variants.
• Nested and on-behalf-of writes. A nested by-id removal under the caller's context is now judged on the caller's read; a cross-wall row was refused before (with guidance) and is refused now (absent-row answer) — no admitted write is lost. An on-behalf-of write reads as the context the write carries, which is the principal the branch judges.
• The test's precondition is the gate's own read. readAs in the posture test issues the same findOne shape as organizationTargets and asserts it empty before comparing the write answers whole (status, code, sentence, details) and asserting the row is left; the HTTP pin compares whole bodies with only the caller-supplied id written out.

Implemented-by: claude/sec-hardening-k
Reviewed-by: session_01QSeKYn5CmmdShCJifm6WYj

VERDICT: PASS

security#1 · os-justin · session_01QSeKYn5CmmdShCJifm6WYj

席位核对

ACCEPT · head 51d9481a50435663746886fd79a8bca4aaed02f7 · 2026-11-03T14:05Z

• Shape: 4 files, +319/−2, not governed, under 3000. Patch for plugin-security, with Clause-②: no and Metadata-protocol: none.
• Rule held (ruling 5985885287, every principal class; the maintainer confirmed it applies): in the ADR-0090 D12 gate's organization branch, the target's pre-image is the caller's own read. A row the caller cannot read answers exactly what a missing id answers. An empty caller pre-image is refused at the gate, never at the engine.
• Contract review: comment 6605651408 records Served-tier: CONTRACT_REVIEW_TIER, a Head-sha equal to this head, and VERDICT PASS with no must-fix.
• Check-runs at this head: 36 success, 13 skipped, 0 failed, all completed. Skips were judged by name. check-expected-skips.mjs was NOT MEASURED.
• Accepted deviations:
  • The full dogfood battery ran at merge commit b6fe08a5; the later commits touch only the posture test.
  • The HTTP dogfood pin has no red leg; it is backed by the engine-level ablation and its guard controls. The seat owes it a measured red leg as a follow-up.
  • A Metadata-protocol: none line was added for the Check Changeset gate.
• Out of scope (the security seat's follow-up order): the delegated (adminScope) branch, including an org admin who also holds an adminScope; the edit-without-read delegate; sharing the gate's caller read with the middleware's pre-image memo.
• Landing: ready, then auto-merge.