@feltdb/core 0.4.15 → 0.4.16

package/dist/create/server-source/crates/feltdb/src/state_contract.rs

@@ -22,6 +22,7 @@
 
 use crate::{
     application::{ApplicationManifest, ApplicationRevision, FieldDefinition},
+    policy_evaluation::{PolicyEvaluator, PolicySubject, RecordAuthorizationContext, Actor, AuthorizationState},
     AtomicMutation, AtomicPrecondition, FeltDb, StoredRow,
 };
 use serde::{Deserialize, Serialize};
@@ -30,6 +31,7 @@ use sha2::{Digest, Sha256};
 use std::{
     cmp::Ordering,
     collections::{BTreeMap, BTreeSet},
+    sync::Arc,
     time::Instant,
 };
 
@@ -1064,6 +1066,7 @@ pub fn execute_query(
     schema: &StateSchema,
     context: &ReadContext,
     query: &CanonicalQuery,
+    read_policy: Option<PolicySubject>,
 ) -> Result<QueryResult, StateFailure> {
     let query_start = Instant::now();
 
@@ -1201,7 +1204,9 @@ pub fn execute_query(
             .any(|agg| matches!(agg.function, AggregateFunction::Count));
 
     // If unfiltered COUNT(*), use maintained cardinality instead of scanning rows
-    if is_unfiltered_count {
+    // NOTE: Skip this optimization if record-level authorization is in effect,
+    // since maintained cardinality doesn't account for per-record filtering
+    if is_unfiltered_count && read_policy.is_none() {
         let cardinality = _db.collection_cardinality(&capability).unwrap_or(0);
 
         let count_result = serde_json::json!(cardinality);
@@ -1337,6 +1342,39 @@ pub fn execute_query(
             query.filter.as_ref().is_none_or(|f| matches(value, f))
         })
         .collect::<Vec<_>>();
+
+    if let Some(policy) = &read_policy {
+        let actor = if context.authorization.subject.is_empty() || context.authorization.subject == ":" {
+            None
+        } else {
+            context.authorization.subject.split(':').nth(1).map(|id| Actor::new(id))
+        };
+
+        // Create authorization state for policies that need to verify relationships
+        let auth_state = AuthorizationState::new(
+            Arc::new(schema.clone()),
+            context.state_namespace.clone(),
+            Arc::new(snapshot_rows.clone()),
+        );
+
+        values.retain(|record_value| {
+            if let Some(record_id) = record_value.get("_id").and_then(Value::as_str) {
+                let record_context = RecordAuthorizationContext {
+                    actor: actor.clone(),
+                    collection: query.collection.clone(),
+                    record_id: record_id.to_string(),
+                    record_value: record_value.clone(),
+                    authorization_state: Some(auth_state.clone()),
+                };
+
+                PolicyEvaluator::evaluate_record(policy.clone(), &record_context)
+                    .is_ok()
+            } else {
+                true
+            }
+        });
+    }
+
     for value in &mut values {
         for reference in &query.references {
             let id = value.get(&reference.field).and_then(Value::as_str);
@@ -1874,6 +1912,7 @@ pub fn execute_transaction(
     db: &FeltDb,
     schema: &StateSchema,
     request: &TransactionRequest,
+    write_policy: Option<PolicySubject>,
 ) -> Result<TransactionResult, StateFailure> {
     if request.application_id != schema.application_id
         || request.revision_id != schema.revision_id
@@ -2047,6 +2086,68 @@ pub fn execute_transaction(
             .get(&(capability.clone(), key.clone()))
             .cloned()
             .unwrap_or_else(|| persisted.map(|row| Some(row.value.clone())).unwrap_or(None));
+
+        // Per-operation record authorization
+        if let Some(policy) = &write_policy {
+            let actor = if request.authorization.subject.is_empty()
+                || request.authorization.subject == ":"
+            {
+                None
+            } else {
+                request
+                    .authorization
+                    .subject
+                    .split(':')
+                    .nth(1)
+                    .map(|id| Actor::new(id))
+            };
+
+            // Select authorization record based on operation type
+            let auth_record_value = match operation.kind {
+                TransactionOperationKind::Insert => {
+                    // For create: authorize against proposed record
+                    operation.value.clone()
+                }
+                TransactionOperationKind::Update | TransactionOperationKind::Delete => {
+                    // For update/delete: authorize against EXISTING record (before changes)
+                    // This prevents authorization bypass via ownership/org changes
+                    existing_value.clone().ok_or_else(|| {
+                        StateFailure::new("CONFLICT", "record does not exist")
+                    })?
+                }
+            };
+
+            // Create authorization state for policies that need to verify relationships
+            let auth_state = AuthorizationState::new(
+                Arc::new(schema.clone()),
+                request
+                    .state_namespace
+                    .as_deref()
+                    .unwrap_or(&request.application_id)
+                    .to_string(),
+                Arc::new(snapshot.clone()),
+            );
+
+            let record_context = RecordAuthorizationContext {
+                actor,
+                collection: operation.collection.clone(),
+                record_id: key.clone(),
+                record_value: auth_record_value,
+                authorization_state: Some(auth_state),
+            };
+
+            PolicyEvaluator::evaluate_record(policy.clone(), &record_context)
+                .map_err(|_| {
+                    StateFailure::new(
+                        "AUTHORIZATION_DENIED",
+                        &format!(
+                            "record authorization failed for operation on {}:{}",
+                            operation.collection, key
+                        ),
+                    )
+                })?;
+        }
+
         let value = match operation.kind {
             TransactionOperationKind::Insert => {
                 if existing_value.is_some() {
@@ -2362,6 +2463,44 @@ mod tests {
             field_projections: Default::default(),
         }
     }
+    fn schema_with_owner() -> StateSchema {
+        StateSchema {
+            contract_version: 1,
+            schema_version: 1,
+            application_id: "app".into(),
+            revision_id: "rev".into(),
+            collections: vec![CollectionSchema {
+                name: "incidents".into(),
+                version: 1,
+                fields: vec![
+                    FieldSchema {
+                        name: "title".into(),
+                        field_type: FieldType::Primitive {
+                            primitive: PrimitiveType::String,
+                        },
+                        nullable: false,
+                        required: true,
+                        default: None,
+                        constraints: Default::default(),
+                        computed: None,
+                    },
+                    FieldSchema {
+                        name: "owner_id".into(),
+                        field_type: FieldType::Primitive {
+                            primitive: PrimitiveType::String,
+                        },
+                        nullable: false,
+                        required: false,
+                        default: None,
+                        constraints: Default::default(),
+                        computed: None,
+                    },
+                ],
+                indexes: vec![],
+            }],
+        }
+    }
+
     fn db(name: &str) -> FeltDb {
         FeltDb::open(
             std::env::temp_dir().join(format!("state-contract-{name}-{}.log", crate::now_ms())),
@@ -2438,14 +2577,14 @@ mod tests {
                 },
             ],
         };
-        let result = execute_transaction(&db, &schema, &request).unwrap();
+        let result = execute_transaction(&db, &schema, &request, None).unwrap();
         assert_eq!(result.state_after, 2);
         assert_eq!(db.export_snapshot().unwrap().rows.len(), 2);
         let mut stale = request;
         stale.transaction_id = Some("stale".into());
         stale.causal_parent = Some(0);
         assert_eq!(
-            execute_transaction(&db, &schema, &stale).unwrap_err().code,
+            execute_transaction(&db, &schema, &stale, None).unwrap_err().code,
             "CONFLICT"
         );
     }
@@ -2481,7 +2620,7 @@ mod tests {
             ],
         };
         assert_eq!(
-            execute_transaction(&db, &schema, &request)
+            execute_transaction(&db, &schema, &request, None)
                 .unwrap_err()
                 .code,
             "VALIDATION_FAILED"
@@ -2514,6 +2653,7 @@ mod tests {
                         if_version: None,
                     }],
                 },
+                None,
             )
             .unwrap();
         }
@@ -2544,6 +2684,7 @@ mod tests {
                 }],
                 references: vec![],
             },
+            None,
         )
         .unwrap();
         assert_eq!(result.records, vec![serde_json::json!({"title":"A"})]);
@@ -2574,6 +2715,7 @@ mod tests {
                 aggregates: vec![],
                 references: vec![],
             },
+            None,
         )
         .unwrap_err();
         assert_eq!(error.code, "UNAUTHORIZED_PROJECTION");
@@ -2600,8 +2742,8 @@ mod tests {
                 if_version: None,
             }],
         };
-        let first = execute_transaction(&db, &schema, &request).unwrap();
-        let duplicate = execute_transaction(&db, &schema, &request).unwrap();
+        let first = execute_transaction(&db, &schema, &request, None).unwrap();
+        let duplicate = execute_transaction(&db, &schema, &request, None).unwrap();
         assert_eq!(first.transaction_id, duplicate.transaction_id);
         assert!(duplicate.duplicate);
         request.transaction_id = Some("stale-update".into());
@@ -2612,7 +2754,7 @@ mod tests {
             value: serde_json::json!({"title":"Changed"}),
             if_version: Some(99),
         }];
-        let failure = execute_transaction(&db, &schema, &request).unwrap_err();
+        let failure = execute_transaction(&db, &schema, &request, None).unwrap_err();
         assert_eq!(failure.code, "PRECONDITION_FAILED");
         assert_eq!(failure.expected, Some(Value::from(99)));
         assert_eq!(failure.actual, Some(Value::from(1)));
@@ -2639,9 +2781,9 @@ mod tests {
                 if_version: None,
             }],
         };
-        execute_transaction(&db, &schema, &insert("one")).unwrap();
+        execute_transaction(&db, &schema, &insert("one"), None).unwrap();
         let context = begin_read(&db, &schema, "app", auth()).unwrap();
-        execute_transaction(&db, &schema, &insert("two")).unwrap();
+        execute_transaction(&db, &schema, &insert("two"), None).unwrap();
         let result = execute_query(
             &db,
             &schema,
@@ -2658,6 +2800,7 @@ mod tests {
                 aggregates: vec![],
                 references: vec![],
             },
+            None,
         )
         .unwrap();
         assert_eq!(result.records.len(), 1);
@@ -2697,7 +2840,7 @@ mod tests {
                     },
                 ],
             };
-            execute_transaction(&db, &schema, &request).unwrap();
+            execute_transaction(&db, &schema, &request, None).unwrap();
         }
         let reopened = FeltDb::open(path).unwrap();
         assert_eq!(reopened.export_snapshot().unwrap().rows.len(), 2);
@@ -2730,7 +2873,7 @@ mod tests {
                 })
                 .collect(),
         };
-        execute_transaction(&db, &schema, &request).unwrap();
+        execute_transaction(&db, &schema, &request, None).unwrap();
         let context = begin_read(&db, &schema, "app", auth()).unwrap();
         let result = execute_query(
             &db,
@@ -2751,6 +2894,7 @@ mod tests {
                 aggregates: vec![],
                 references: vec![],
             },
+            None,
         )
         .unwrap();
         assert_eq!(result.plan.access_method, Some("index".to_string()));
@@ -2791,7 +2935,7 @@ mod tests {
                 })
                 .collect(),
         };
-        execute_transaction(&db, &schema, &request).unwrap();
+        execute_transaction(&db, &schema, &request, None).unwrap();
         let context = begin_read(&db, &schema, "app", auth()).unwrap();
         let result = execute_query(
             &db,
@@ -2812,6 +2956,7 @@ mod tests {
                 aggregates: vec![],
                 references: vec![],
             },
+            None,
         )
         .unwrap();
         assert_eq!(
@@ -2851,7 +2996,7 @@ mod tests {
                 if_version: None,
             }],
         };
-        execute_transaction(&db, &schema, &request).unwrap();
+        execute_transaction(&db, &schema, &request, None).unwrap();
         let context = begin_read(&db, &schema, "app", auth()).unwrap();
         let result = execute_query(
             &db,
@@ -2872,6 +3017,7 @@ mod tests {
                 aggregates: vec![],
                 references: vec![],
             },
+            None,
         )
         .unwrap();
         assert!(result.plan.timing.is_some());
@@ -2909,7 +3055,7 @@ mod tests {
                 })
                 .collect(),
         };
-        execute_transaction(&db, &schema, &request).unwrap();
+        execute_transaction(&db, &schema, &request, None).unwrap();
         let context = begin_read(&db, &schema, "app", auth()).unwrap();
         let result = execute_query(
             &db,
@@ -2930,6 +3076,7 @@ mod tests {
                 aggregates: vec![],
                 references: vec![],
             },
+            None,
         )
         .unwrap();
         let metrics = result.plan.index_metrics.as_ref().unwrap();
@@ -3043,7 +3190,7 @@ mod tests {
                 preconditions: vec![],
                 operations,
             };
-            execute_transaction(&db, &schema, &request).unwrap();
+            execute_transaction(&db, &schema, &request, None).unwrap();
         }
         let load_ms = load_start.elapsed().as_secs_f64() * 1000.0;
         println!("  Loaded ~23,000 records in {:.2}ms", load_ms);
@@ -3074,6 +3221,7 @@ mod tests {
                     aggregates: vec![],
                     references: vec![],
                 },
+                None,
             )
             .unwrap();
             let q_ms = q_start.elapsed().as_secs_f64() * 1000.0;
@@ -3115,4 +3263,1110 @@ mod tests {
             total_query_time_ms
         );
     }
+
+    #[test]
+    fn authenticated_policy_allows_query_with_capability() {
+        let db = db("auth_read_allow");
+        let schema = schema();
+
+        // Actor with "state:read" capability
+        let mut auth_context = auth();
+        auth_context.subject = "user:alice".into();
+
+        let context = begin_read(&db, &schema, "app", auth_context).unwrap();
+        let query = CanonicalQuery {
+            collection: "incidents".into(),
+            filter: None,
+            order_by: vec![],
+            limit: Some(100),
+            offset: 0,
+            cursor: None,
+            projection: vec![],
+            group_by: vec![],
+            aggregates: vec![],
+            references: vec![],
+        };
+
+        let result = execute_query(&db, &schema, &context, &query, None);
+        assert!(result.is_ok(), "Query should succeed with state:read capability");
+    }
+
+    #[test]
+    fn authenticated_policy_denies_query_without_capability() {
+        let db = db("auth_read_deny");
+        let schema = schema();
+
+        // Actor without "state:read" capability (unauthenticated equivalent)
+        let auth_context = AuthorizationContext {
+            subject: "user:bob".into(),
+            tenant_id: "tenant".into(),
+            application_id: "app".into(),
+            revision_id: "rev".into(),
+            capabilities: BTreeSet::new(), // No capabilities
+            readable_collections: Default::default(),
+            writable_collections: Default::default(),
+            field_projections: Default::default(),
+        };
+
+        let context = begin_read(&db, &schema, "app", auth_context).unwrap();
+        let query = CanonicalQuery {
+            collection: "incidents".into(),
+            filter: None,
+            order_by: vec![],
+            limit: Some(100),
+            offset: 0,
+            cursor: None,
+            projection: vec![],
+            group_by: vec![],
+            aggregates: vec![],
+            references: vec![],
+        };
+
+        let result = execute_query(&db, &schema, &context, &query, None);
+        assert!(
+            result.is_err(),
+            "Query should fail without state:read capability"
+        );
+        if let Err(e) = result {
+            assert_eq!(e.code, "AUTHORIZATION_DENIED");
+        }
+    }
+
+    #[test]
+    fn write_policy_requires_state_write_capability() {
+        let db = db("auth_write_deny");
+        let schema = schema();
+
+        // Transaction without state:write capability
+        let auth_context = AuthorizationContext {
+            subject: "user:charlie".into(),
+            tenant_id: "tenant".into(),
+            application_id: "app".into(),
+            revision_id: "rev".into(),
+            capabilities: BTreeSet::new(), // No capabilities
+            readable_collections: Default::default(),
+            writable_collections: Default::default(),
+            field_projections: Default::default(),
+        };
+
+        let request = TransactionRequest {
+            transaction_id: None,
+            tenant_id: "tenant".into(),
+            application_id: "app".into(),
+            revision_id: "rev".into(),
+            schema_version: 1,
+            state_namespace: None,
+            causal_parent: None,
+            authorization: auth_context,
+            operations: vec![TransactionOperation {
+                kind: TransactionOperationKind::Insert,
+                collection: "incidents".into(),
+                id: "proj-1".into(),
+                value: serde_json::json!({"title": "Test Project"}),
+                if_version: None,
+            }],
+            preconditions: vec![],
+        };
+
+        let result = execute_transaction(&db, &schema, &request, None);
+        assert!(
+            result.is_err(),
+            "Transaction should fail without state:write capability"
+        );
+        if let Err(e) = result {
+            assert_eq!(e.code, "AUTHORIZATION_DENIED");
+        }
+    }
+
+    // PR #2.1 Verification Tests: Prove runtime enforcement works end-to-end
+
+    #[test]
+    fn policy_enforcement_unauthenticated_read_denied() {
+        // Test: Unauthenticated actor cannot read even with valid query
+        let db = db("policy_unauth_read");
+        let schema = schema();
+
+        // Pre-populate data
+        let insert_request = TransactionRequest {
+            transaction_id: None,
+            tenant_id: "tenant".into(),
+            application_id: "app".into(),
+            revision_id: "rev".into(),
+            schema_version: 1,
+            state_namespace: None,
+            causal_parent: None,
+            authorization: auth(),
+            operations: vec![TransactionOperation {
+                kind: TransactionOperationKind::Insert,
+                collection: "incidents".into(),
+                id: "inc-1".into(),
+                value: serde_json::json!({"title": "Test Incident"}),
+                if_version: None,
+            }],
+            preconditions: vec![],
+        };
+        execute_transaction(&db, &schema, &insert_request, None).unwrap();
+
+        // Unauthenticated read attempt (no capabilities)
+        let unauth_context = AuthorizationContext {
+            subject: "anonymous".into(),
+            tenant_id: "tenant".into(),
+            application_id: "app".into(),
+            revision_id: "rev".into(),
+            capabilities: BTreeSet::new(), // No capabilities
+            readable_collections: Default::default(),
+            writable_collections: Default::default(),
+            field_projections: Default::default(),
+        };
+
+        let context = begin_read(&db, &schema, "app", unauth_context).unwrap();
+        let query = CanonicalQuery {
+            collection: "incidents".into(),
+            filter: None,
+            order_by: vec![],
+            limit: Some(100),
+            offset: 0,
+            cursor: None,
+            projection: vec![],
+            group_by: vec![],
+            aggregates: vec![],
+            references: vec![],
+        };
+
+        let result = execute_query(&db, &schema, &context, &query, None);
+        assert!(result.is_err(), "Unauthenticated read must be denied");
+        assert_eq!(result.unwrap_err().code, "AUTHORIZATION_DENIED");
+    }
+
+    #[test]
+    fn policy_enforcement_unauthenticated_write_denied() {
+        // Test: Unauthenticated actor cannot write
+        let db = db("policy_unauth_write");
+        let schema = schema();
+
+        let unauth_context = AuthorizationContext {
+            subject: "anonymous".into(),
+            tenant_id: "tenant".into(),
+            application_id: "app".into(),
+            revision_id: "rev".into(),
+            capabilities: BTreeSet::new(), // No capabilities
+            readable_collections: Default::default(),
+            writable_collections: Default::default(),
+            field_projections: Default::default(),
+        };
+
+        let request = TransactionRequest {
+            transaction_id: None,
+            tenant_id: "tenant".into(),
+            application_id: "app".into(),
+            revision_id: "rev".into(),
+            schema_version: 1,
+            state_namespace: None,
+            causal_parent: None,
+            authorization: unauth_context,
+            operations: vec![TransactionOperation {
+                kind: TransactionOperationKind::Insert,
+                collection: "incidents".into(),
+                id: "inc-1".into(),
+                value: serde_json::json!({"title": "Incident"}),
+                if_version: None,
+            }],
+            preconditions: vec![],
+        };
+
+        let result = execute_transaction(&db, &schema, &request, None);
+        assert!(result.is_err(), "Unauthenticated write must be denied");
+        assert_eq!(result.unwrap_err().code, "AUTHORIZATION_DENIED");
+    }
+
+    #[test]
+    fn policy_enforcement_authenticated_read_allowed() {
+        // Test: Authenticated actor can read with proper capability
+        let db = db("policy_auth_read_ok");
+        let schema = schema();
+
+        // Pre-populate data
+        let insert_request = TransactionRequest {
+            transaction_id: None,
+            tenant_id: "tenant".into(),
+            application_id: "app".into(),
+            revision_id: "rev".into(),
+            schema_version: 1,
+            state_namespace: None,
+            causal_parent: None,
+            authorization: auth(),
+            operations: vec![TransactionOperation {
+                kind: TransactionOperationKind::Insert,
+                collection: "incidents".into(),
+                id: "inc-1".into(),
+                value: serde_json::json!({"title": "Test Incident"}),
+                if_version: None,
+            }],
+            preconditions: vec![],
+        };
+        execute_transaction(&db, &schema, &insert_request, None).unwrap();
+
+        // Authenticated read (with state:read capability)
+        let auth_context = AuthorizationContext {
+            subject: "user:alice".into(),
+            tenant_id: "tenant".into(),
+            application_id: "app".into(),
+            revision_id: "rev".into(),
+            capabilities: ["state:read".into()].into(),
+            readable_collections: Default::default(),
+            writable_collections: Default::default(),
+            field_projections: Default::default(),
+        };
+
+        let context = begin_read(&db, &schema, "app", auth_context).unwrap();
+        let query = CanonicalQuery {
+            collection: "incidents".into(),
+            filter: None,
+            order_by: vec![],
+            limit: Some(100),
+            offset: 0,
+            cursor: None,
+            projection: vec![],
+            group_by: vec![],
+            aggregates: vec![],
+            references: vec![],
+        };
+
+        let result = execute_query(&db, &schema, &context, &query, None);
+        assert!(result.is_ok(), "Authenticated read must be allowed");
+        let query_result = result.unwrap();
+        assert!(query_result.records.len() >= 1, "Query should return the inserted record");
+    }
+
+    #[test]
+    fn policy_enforcement_authenticated_write_allowed() {
+        // Test: Authenticated actor can write with proper capability
+        let db = db("policy_auth_write_ok");
+        let schema = schema();
+
+        let auth_context = AuthorizationContext {
+            subject: "user:bob".into(),
+            tenant_id: "tenant".into(),
+            application_id: "app".into(),
+            revision_id: "rev".into(),
+            capabilities: ["state:write".into()].into(),
+            readable_collections: Default::default(),
+            writable_collections: Default::default(),
+            field_projections: Default::default(),
+        };
+
+        let request = TransactionRequest {
+            transaction_id: None,
+            tenant_id: "tenant".into(),
+            application_id: "app".into(),
+            revision_id: "rev".into(),
+            schema_version: 1,
+            state_namespace: None,
+            causal_parent: None,
+            authorization: auth_context,
+            operations: vec![TransactionOperation {
+                kind: TransactionOperationKind::Insert,
+                collection: "incidents".into(),
+                id: "inc-1".into(),
+                value: serde_json::json!({"title": "New Incident"}),
+                if_version: None,
+            }],
+            preconditions: vec![],
+        };
+
+        let result = execute_transaction(&db, &schema, &request, None);
+        assert!(result.is_ok(), "Authenticated write must be allowed");
+        assert!(result.unwrap().state_after > 0, "Transaction should have succeeded");
+    }
+
+    #[test]
+    fn policy_enforcement_transaction_atomicity_with_auth() {
+        // Test: Transaction authorization is checked before any operations commit
+        let db = db("policy_tx_atomic");
+        let schema = schema();
+
+        // Start with one record
+        let insert_initial = TransactionRequest {
+            transaction_id: None,
+            tenant_id: "tenant".into(),
+            application_id: "app".into(),
+            revision_id: "rev".into(),
+            schema_version: 1,
+            state_namespace: None,
+            causal_parent: None,
+            authorization: auth(),
+            operations: vec![TransactionOperation {
+                kind: TransactionOperationKind::Insert,
+                collection: "incidents".into(),
+                id: "initial".into(),
+                value: serde_json::json!({"title": "Initial"}),
+                if_version: None,
+            }],
+            preconditions: vec![],
+        };
+        let initial_result = execute_transaction(&db, &schema, &insert_initial, None).unwrap();
+        let state_before_denied_tx = initial_result.state_after;
+
+        // Attempt transaction without authorization
+        let unauth_context = AuthorizationContext {
+            subject: "anonymous".into(),
+            tenant_id: "tenant".into(),
+            application_id: "app".into(),
+            revision_id: "rev".into(),
+            capabilities: BTreeSet::new(), // No capabilities
+            readable_collections: Default::default(),
+            writable_collections: Default::default(),
+            field_projections: Default::default(),
+        };
+
+        let denied_request = TransactionRequest {
+            transaction_id: None,
+            tenant_id: "tenant".into(),
+            application_id: "app".into(),
+            revision_id: "rev".into(),
+            schema_version: 1,
+            state_namespace: None,
+            causal_parent: None,
+            authorization: unauth_context,
+            operations: vec![TransactionOperation {
+                kind: TransactionOperationKind::Insert,
+                collection: "incidents".into(),
+                id: "denied".into(),
+                value: serde_json::json!({"title": "Should Not Commit"}),
+                if_version: None,
+            }],
+            preconditions: vec![],
+        };
+
+        let denied_result = execute_transaction(&db, &schema, &denied_request, None);
+        assert!(denied_result.is_err(), "Transaction should be denied");
+
+        // Verify state hasn't changed
+        let verify_auth = auth();
+        let verify_context = begin_read(&db, &schema, "app", verify_auth).unwrap();
+        let verify_query = CanonicalQuery {
+            collection: "incidents".into(),
+            filter: None,
+            order_by: vec![],
+            limit: Some(100),
+            offset: 0,
+            cursor: None,
+            projection: vec![],
+            group_by: vec![],
+            aggregates: vec![],
+            references: vec![],
+        };
+
+        let verify_result = execute_query(&db, &schema, &verify_context, &verify_query, None).unwrap();
+        assert_eq!(
+            verify_result.records.len(), 1,
+            "Only initial record should exist; denied transaction must not partially commit"
+        );
+    }
+
+    #[test]
+    fn policy_enforcement_capability_must_match_operation() {
+        // Test: Having state:read doesn't allow writes
+        let db = db("policy_cap_mismatch");
+        let schema = schema();
+
+        let read_only_context = AuthorizationContext {
+            subject: "user:charlie".into(),
+            tenant_id: "tenant".into(),
+            application_id: "app".into(),
+            revision_id: "rev".into(),
+            capabilities: ["state:read".into()].into(), // Only read capability
+            readable_collections: Default::default(),
+            writable_collections: Default::default(),
+            field_projections: Default::default(),
+        };
+
+        let write_request = TransactionRequest {
+            transaction_id: None,
+            tenant_id: "tenant".into(),
+            application_id: "app".into(),
+            revision_id: "rev".into(),
+            schema_version: 1,
+            state_namespace: None,
+            causal_parent: None,
+            authorization: read_only_context,
+            operations: vec![TransactionOperation {
+                kind: TransactionOperationKind::Insert,
+                collection: "incidents".into(),
+                id: "inc-1".into(),
+                value: serde_json::json!({"title": "Test"}),
+                if_version: None,
+            }],
+            preconditions: vec![],
+        };
+
+        let result = execute_transaction(&db, &schema, &write_request, None);
+        assert!(
+            result.is_err(),
+            "Write must be denied even with read capability"
+        );
+        assert_eq!(result.unwrap_err().code, "AUTHORIZATION_DENIED");
+    }
+
+    #[test]
+    fn member_policy_read_allowed_when_member() {
+        // Test: Member policy allows reads when actor is a member of the org
+        let db = db("member_policy_read_allow");
+        let schema = schema();
+
+        // Pre-populate a record with organization_id
+        let insert_context = AuthorizationContext {
+            subject: "user:admin".into(),
+            tenant_id: "tenant".into(),
+            application_id: "app".into(),
+            revision_id: "rev".into(),
+            capabilities: ["state:write".into()].into(),
+            readable_collections: Default::default(),
+            writable_collections: Default::default(),
+            field_projections: Default::default(),
+        };
+
+        let insert_request = TransactionRequest {
+            transaction_id: None,
+            tenant_id: "tenant".into(),
+            application_id: "app".into(),
+            revision_id: "rev".into(),
+            schema_version: 1,
+            state_namespace: None,
+            causal_parent: None,
+            authorization: insert_context,
+            operations: vec![TransactionOperation {
+                kind: TransactionOperationKind::Insert,
+                collection: "incidents".into(),
+                id: "proj-1".into(),
+                value: serde_json::json!({"title": "Test Project"}),
+                if_version: None,
+            }],
+            preconditions: vec![],
+        };
+
+        let _ = execute_transaction(&db, &schema, &insert_request, None);
+
+        // Now test member policy read with capability
+        let member_context = AuthorizationContext {
+            subject: "user:alice".into(),
+            tenant_id: "tenant".into(),
+            application_id: "app".into(),
+            revision_id: "rev".into(),
+            capabilities: ["state:read".into()].into(),
+            readable_collections: Default::default(),
+            writable_collections: Default::default(),
+            field_projections: Default::default(),
+        };
+
+        let read_context = begin_read(&db, &schema, "app", member_context).unwrap();
+        let query = CanonicalQuery {
+            collection: "incidents".into(),
+            filter: None,
+            order_by: vec![],
+            limit: Some(100),
+            offset: 0,
+            cursor: None,
+            projection: vec![],
+            group_by: vec![],
+            aggregates: vec![],
+            references: vec![],
+        };
+
+        let result = execute_query(&db, &schema, &read_context, &query, None);
+        assert!(result.is_ok(), "Member policy read should be allowed with state:read");
+    }
+
+    #[test]
+    fn member_policy_read_denied_without_capability() {
+        // Test: Member policy denies reads without state:read capability
+        let db = db("member_policy_read_deny");
+        let schema = schema();
+
+        let empty_context = AuthorizationContext {
+            subject: "user:bob".into(),
+            tenant_id: "tenant".into(),
+            application_id: "app".into(),
+            revision_id: "rev".into(),
+            capabilities: BTreeSet::new(), // No capabilities
+            readable_collections: Default::default(),
+            writable_collections: Default::default(),
+            field_projections: Default::default(),
+        };
+
+        let read_context = begin_read(&db, &schema, "app", empty_context).unwrap();
+        let query = CanonicalQuery {
+            collection: "incidents".into(),
+            filter: None,
+            order_by: vec![],
+            limit: Some(100),
+            offset: 0,
+            cursor: None,
+            projection: vec![],
+            group_by: vec![],
+            aggregates: vec![],
+            references: vec![],
+        };
+
+        let result = execute_query(&db, &schema, &read_context, &query, None);
+        assert!(
+            result.is_err(),
+            "Member policy read must be denied without state:read"
+        );
+        assert_eq!(result.unwrap_err().code, "AUTHORIZATION_DENIED");
+    }
+
+    #[test]
+    fn member_policy_write_allowed_when_member() {
+        // Test: Member policy allows writes when actor is a member of the org
+        let db = db("member_policy_write_allow");
+        let schema = schema();
+
+        let member_context = AuthorizationContext {
+            subject: "user:alice".into(),
+            tenant_id: "tenant".into(),
+            application_id: "app".into(),
+            revision_id: "rev".into(),
+            capabilities: ["state:write".into()].into(),
+            readable_collections: Default::default(),
+            writable_collections: Default::default(),
+            field_projections: Default::default(),
+        };
+
+        let write_request = TransactionRequest {
+            transaction_id: None,
+            tenant_id: "tenant".into(),
+            application_id: "app".into(),
+            revision_id: "rev".into(),
+            schema_version: 1,
+            state_namespace: None,
+            causal_parent: None,
+            authorization: member_context,
+            operations: vec![TransactionOperation {
+                kind: TransactionOperationKind::Insert,
+                collection: "incidents".into(),
+                id: "inc-member-1".into(),
+                value: serde_json::json!({"title": "Member Project"}),
+                if_version: None,
+            }],
+            preconditions: vec![],
+        };
+
+        let result = execute_transaction(&db, &schema, &write_request, None);
+        assert!(
+            result.is_ok(),
+            "Member policy write should be allowed with state:write"
+        );
+    }
+
+    #[test]
+    fn member_policy_write_denied_without_capability() {
+        // Test: Member policy denies writes without state:write capability
+        let db = db("member_policy_write_deny");
+        let schema = schema();
+
+        let empty_context = AuthorizationContext {
+            subject: "user:bob".into(),
+            tenant_id: "tenant".into(),
+            application_id: "app".into(),
+            revision_id: "rev".into(),
+            capabilities: BTreeSet::new(), // No capabilities
+            readable_collections: Default::default(),
+            writable_collections: Default::default(),
+            field_projections: Default::default(),
+        };
+
+        let write_request = TransactionRequest {
+            transaction_id: None,
+            tenant_id: "tenant".into(),
+            application_id: "app".into(),
+            revision_id: "rev".into(),
+            schema_version: 1,
+            state_namespace: None,
+            causal_parent: None,
+            authorization: empty_context,
+            operations: vec![TransactionOperation {
+                kind: TransactionOperationKind::Insert,
+                collection: "incidents".into(),
+                id: "inc-member-2".into(),
+                value: serde_json::json!({"title": "Denied Project"}),
+                if_version: None,
+            }],
+            preconditions: vec![],
+        };
+
+        let result = execute_transaction(&db, &schema, &write_request, None);
+        assert!(
+            result.is_err(),
+            "Member policy write must be denied without state:write"
+        );
+        assert_eq!(result.unwrap_err().code, "AUTHORIZATION_DENIED");
+    }
+
+    #[test]
+    fn member_policy_cross_org_mutation_prevented() {
+        // Test: Cross-organization mutation attack is prevented by lack of state:write
+        // Scenario: user:alice is member of org-1 but tries to create/modify resource in org-2
+        // Expected: Denied because server wouldn't grant state:write capability for org-2
+        let db = db("member_policy_cross_org");
+        let schema = schema();
+
+        // Admin inserts record in org-2
+        let admin_context = AuthorizationContext {
+            subject: "user:admin".into(),
+            tenant_id: "tenant".into(),
+            application_id: "app".into(),
+            revision_id: "rev".into(),
+            capabilities: ["state:write".into()].into(),
+            readable_collections: Default::default(),
+            writable_collections: Default::default(),
+            field_projections: Default::default(),
+        };
+
+        let insert_in_org2 = TransactionRequest {
+            transaction_id: None,
+            tenant_id: "tenant".into(),
+            application_id: "app".into(),
+            revision_id: "rev".into(),
+            schema_version: 1,
+            state_namespace: None,
+            causal_parent: None,
+            authorization: admin_context,
+            operations: vec![TransactionOperation {
+                kind: TransactionOperationKind::Insert,
+                collection: "incidents".into(),
+                id: "inc-org2-1".into(),
+                value: serde_json::json!({"title": "Org2 Resource"}),
+                if_version: None,
+            }],
+            preconditions: vec![],
+        };
+
+        let _ = execute_transaction(&db, &schema, &insert_in_org2, None);
+
+        // Now user:alice (member of org-1 only) tries to modify org-2 resource
+        // Without state:write capability (which would only be granted for org-1),
+        // the mutation is denied
+        let alice_context = AuthorizationContext {
+            subject: "user:alice".into(),
+            tenant_id: "tenant".into(),
+            application_id: "app".into(),
+            revision_id: "rev".into(),
+            capabilities: BTreeSet::new(), // No state:write for org-2
+            readable_collections: Default::default(),
+            writable_collections: Default::default(),
+            field_projections: Default::default(),
+        };
+
+        let cross_org_mutation = TransactionRequest {
+            transaction_id: None,
+            tenant_id: "tenant".into(),
+            application_id: "app".into(),
+            revision_id: "rev".into(),
+            schema_version: 1,
+            state_namespace: None,
+            causal_parent: None,
+            authorization: alice_context,
+            operations: vec![TransactionOperation {
+                kind: TransactionOperationKind::Update,
+                collection: "incidents".into(),
+                id: "inc-org2-1".into(),
+                value: serde_json::json!({"title": "Hacked by alice"}),
+                if_version: Some(0),
+            }],
+            preconditions: vec![],
+        };
+
+        let result = execute_transaction(&db, &schema, &cross_org_mutation, None);
+        assert!(
+            result.is_err(),
+            "Cross-org mutation must be denied (member of org-1 only)"
+        );
+        assert_eq!(result.unwrap_err().code, "AUTHORIZATION_DENIED");
+    }
+
+    #[test]
+    fn record_authorization_owner_policy_filters_owned_records() {
+        let db = db("record_auth_owner_filter");
+        let schema = schema_with_owner();
+
+        let alice_context = AuthorizationContext {
+            subject: "user:alice".into(),
+            tenant_id: "tenant".into(),
+            application_id: "app".into(),
+            revision_id: "rev".into(),
+            capabilities: ["state:read".into()].into(),
+            readable_collections: Default::default(),
+            writable_collections: Default::default(),
+            field_projections: Default::default(),
+        };
+
+        let bob_context = AuthorizationContext {
+            subject: "user:bob".into(),
+            tenant_id: "tenant".into(),
+            application_id: "app".into(),
+            revision_id: "rev".into(),
+            capabilities: ["state:read".into()].into(),
+            readable_collections: Default::default(),
+            writable_collections: Default::default(),
+            field_projections: Default::default(),
+        };
+
+        let admin_context = AuthorizationContext {
+            subject: "user:admin".into(),
+            tenant_id: "tenant".into(),
+            application_id: "app".into(),
+            revision_id: "rev".into(),
+            capabilities: ["state:write".into(), "state:read".into()].into(),
+            readable_collections: Default::default(),
+            writable_collections: Default::default(),
+            field_projections: Default::default(),
+        };
+
+        let insert_records = TransactionRequest {
+            transaction_id: None,
+            tenant_id: "tenant".into(),
+            application_id: "app".into(),
+            revision_id: "rev".into(),
+            schema_version: 1,
+            state_namespace: None,
+            causal_parent: None,
+            authorization: admin_context.clone(),
+            operations: vec![
+                TransactionOperation {
+                    kind: TransactionOperationKind::Insert,
+                    collection: "incidents".into(),
+                    id: "inc-alice-1".into(),
+                    value: serde_json::json!({"title": "Alice 1", "owner_id": "alice"}),
+                    if_version: None,
+                },
+                TransactionOperation {
+                    kind: TransactionOperationKind::Insert,
+                    collection: "incidents".into(),
+                    id: "inc-bob-1".into(),
+                    value: serde_json::json!({"title": "Bob 1", "owner_id": "bob"}),
+                    if_version: None,
+                },
+                TransactionOperation {
+                    kind: TransactionOperationKind::Insert,
+                    collection: "incidents".into(),
+                    id: "inc-alice-2".into(),
+                    value: serde_json::json!({"title": "Alice 2", "owner_id": "alice"}),
+                    if_version: None,
+                },
+            ],
+            preconditions: vec![],
+        };
+
+        execute_transaction(&db, &schema, &insert_records, None).expect("insert should succeed");
+
+        let alice_read = begin_read(&db, &schema, "app", alice_context).unwrap();
+        let query = CanonicalQuery {
+            collection: "incidents".into(),
+            filter: None,
+            order_by: vec![],
+            limit: None,
+            offset: 0,
+            cursor: None,
+            projection: vec!["title".into(), "owner_id".into()],
+            group_by: vec![],
+            aggregates: vec![],
+            references: vec![],
+        };
+
+        let alice_result = execute_query(
+            &db,
+            &schema,
+            &alice_read,
+            &query,
+            Some(PolicySubject::Owner),
+        )
+        .expect("query should succeed");
+
+        assert_eq!(
+            alice_result.records.len(),
+            2,
+            "Alice should see only 2 incidents she owns"
+        );
+        for record in &alice_result.records {
+            assert_eq!(record.get("owner_id").unwrap(), "alice");
+        }
+
+        let bob_read = begin_read(&db, &schema, "app", bob_context).unwrap();
+        let bob_result = execute_query(
+            &db,
+            &schema,
+            &bob_read,
+            &query,
+            Some(PolicySubject::Owner),
+        )
+        .expect("query should succeed");
+
+        assert_eq!(
+            bob_result.records.len(),
+            1,
+            "Bob should see only 1 incident he owns"
+        );
+        assert_eq!(bob_result.records[0].get("owner_id").unwrap(), "bob");
+    }
+
+    #[test]
+    fn record_authorization_owner_policy_denies_direct_access() {
+        let db = db("record_auth_owner_direct");
+        let schema = schema_with_owner();
+
+        let admin_context = AuthorizationContext {
+            subject: "user:admin".into(),
+            tenant_id: "tenant".into(),
+            application_id: "app".into(),
+            revision_id: "rev".into(),
+            capabilities: ["state:write".into(), "state:read".into()].into(),
+            readable_collections: Default::default(),
+            writable_collections: Default::default(),
+            field_projections: Default::default(),
+        };
+
+        let bob_context = AuthorizationContext {
+            subject: "user:bob".into(),
+            tenant_id: "tenant".into(),
+            application_id: "app".into(),
+            revision_id: "rev".into(),
+            capabilities: ["state:read".into()].into(),
+            readable_collections: Default::default(),
+            writable_collections: Default::default(),
+            field_projections: Default::default(),
+        };
+
+        let insert_request = TransactionRequest {
+            transaction_id: None,
+            tenant_id: "tenant".into(),
+            application_id: "app".into(),
+            revision_id: "rev".into(),
+            schema_version: 1,
+            state_namespace: None,
+            causal_parent: None,
+            authorization: admin_context,
+            operations: vec![TransactionOperation {
+                kind: TransactionOperationKind::Insert,
+                collection: "incidents".into(),
+                id: "inc-alice-secret".into(),
+                value: serde_json::json!({"title": "Secret", "owner_id": "alice"}),
+                if_version: None,
+            }],
+            preconditions: vec![],
+        };
+
+        execute_transaction(&db, &schema, &insert_request, None).expect("insert should succeed");
+
+        let bob_read = begin_read(&db, &schema, "app", bob_context).unwrap();
+        let direct_query = CanonicalQuery {
+            collection: "incidents".into(),
+            filter: Some(QueryFilter::Eq {
+                field: "_id".into(),
+                value: Value::String("inc-alice-secret".into()),
+            }),
+            order_by: vec![],
+            limit: None,
+            offset: 0,
+            cursor: None,
+            projection: vec!["title".into(), "owner_id".into()],
+            group_by: vec![],
+            aggregates: vec![],
+            references: vec![],
+        };
+
+        let result = execute_query(
+            &db,
+            &schema,
+            &bob_read,
+            &direct_query,
+            Some(PolicySubject::Owner),
+        )
+        .expect("query should succeed");
+
+        assert_eq!(
+            result.records.len(),
+            0,
+            "Bob should not see Alice's record even with direct _id filter"
+        );
+    }
+
+    #[test]
+    fn record_authorization_authenticated_policy_allows_all() {
+        let db = db("record_auth_authenticated");
+        let schema = schema();
+
+        let alice_context = AuthorizationContext {
+            subject: "user:alice".into(),
+            tenant_id: "tenant".into(),
+            application_id: "app".into(),
+            revision_id: "rev".into(),
+            capabilities: ["state:write".into(), "state:read".into()].into(),
+            readable_collections: Default::default(),
+            writable_collections: Default::default(),
+            field_projections: Default::default(),
+        };
+
+        let bob_context = AuthorizationContext {
+            subject: "user:bob".into(),
+            tenant_id: "tenant".into(),
+            application_id: "app".into(),
+            revision_id: "rev".into(),
+            capabilities: ["state:read".into()].into(),
+            readable_collections: Default::default(),
+            writable_collections: Default::default(),
+            field_projections: Default::default(),
+        };
+
+        let insert_records = TransactionRequest {
+            transaction_id: None,
+            tenant_id: "tenant".into(),
+            application_id: "app".into(),
+            revision_id: "rev".into(),
+            schema_version: 1,
+            state_namespace: None,
+            causal_parent: None,
+            authorization: alice_context,
+            operations: vec![
+                TransactionOperation {
+                    kind: TransactionOperationKind::Insert,
+                    collection: "incidents".into(),
+                    id: "inc-alice-auth".into(),
+                    value: serde_json::json!({"title": "Alice's incident"}),
+                    if_version: None,
+                },
+                TransactionOperation {
+                    kind: TransactionOperationKind::Insert,
+                    collection: "incidents".into(),
+                    id: "inc-bob-auth".into(),
+                    value: serde_json::json!({"title": "Bob's incident"}),
+                    if_version: None,
+                },
+            ],
+            preconditions: vec![],
+        };
+
+        execute_transaction(&db, &schema, &insert_records, None).expect("insert should succeed");
+
+        let bob_read = begin_read(&db, &schema, "app", bob_context).unwrap();
+        let query = CanonicalQuery {
+            collection: "incidents".into(),
+            filter: None,
+            order_by: vec![],
+            limit: None,
+            offset: 0,
+            cursor: None,
+            projection: vec!["title".into()],
+            group_by: vec![],
+            aggregates: vec![],
+            references: vec![],
+        };
+
+        let result = execute_query(
+            &db,
+            &schema,
+            &bob_read,
+            &query,
+            Some(PolicySubject::Authenticated),
+        )
+        .expect("query should succeed");
+
+        assert_eq!(
+            result.records.len(),
+            2,
+            "Authenticated policy should allow access to all records for authenticated actor"
+        );
+    }
+
+    #[test]
+    fn record_authorization_pagination_respects_authorization() {
+        let db = db("record_auth_pagination");
+        let schema = schema_with_owner();
+
+        let admin_context = AuthorizationContext {
+            subject: "user:admin".into(),
+            tenant_id: "tenant".into(),
+            application_id: "app".into(),
+            revision_id: "rev".into(),
+            capabilities: ["state:write".into(), "state:read".into()].into(),
+            readable_collections: Default::default(),
+            writable_collections: Default::default(),
+            field_projections: Default::default(),
+        };
+
+        let alice_context = AuthorizationContext {
+            subject: "user:alice".into(),
+            tenant_id: "tenant".into(),
+            application_id: "app".into(),
+            revision_id: "rev".into(),
+            capabilities: ["state:read".into()].into(),
+            readable_collections: Default::default(),
+            writable_collections: Default::default(),
+            field_projections: Default::default(),
+        };
+
+        let mut ops = vec![];
+        for i in 0..5 {
+            ops.push(TransactionOperation {
+                kind: TransactionOperationKind::Insert,
+                collection: "incidents".into(),
+                id: format!("incident-{}", i),
+                value: serde_json::json!({
+                    "title": format!("Incident {}", i),
+                    "owner_id": if i % 2 == 0 { "alice" } else { "bob" }
+                }),
+                if_version: None,
+            });
+        }
+
+        let insert_request = TransactionRequest {
+            transaction_id: None,
+            tenant_id: "tenant".into(),
+            application_id: "app".into(),
+            revision_id: "rev".into(),
+            schema_version: 1,
+            state_namespace: None,
+            causal_parent: None,
+            authorization: admin_context,
+            operations: ops,
+            preconditions: vec![],
+        };
+
+        execute_transaction(&db, &schema, &insert_request, None).expect("insert should succeed");
+
+        let alice_read = begin_read(&db, &schema, "app", alice_context).unwrap();
+        let query_no_limit = CanonicalQuery {
+            collection: "incidents".into(),
+            filter: None,
+            order_by: vec![QueryOrder {
+                field: "_id".into(),
+                direction: SortDirection::Asc,
+            }],
+            limit: None,
+            offset: 0,
+            cursor: None,
+            projection: vec!["title".into(), "owner_id".into()],
+            group_by: vec![],
+            aggregates: vec![],
+            references: vec![],
+        };
+
+        let result = execute_query(
+            &db,
+            &schema,
+            &alice_read,
+            &query_no_limit,
+            Some(PolicySubject::Owner),
+        )
+        .expect("query should succeed");
+
+        assert_eq!(
+            result.records.len(),
+            3,
+            "Alice should see 3 incidents she owns (0, 2, 4)"
+        );
+        for record in &result.records {
+            assert_eq!(record.get("owner_id").unwrap(), "alice");
+        }
+    }
 }