@objectstack/core 14.8.0 → 15.0.0

package/dist/index.cjs

@@ -40,6 +40,9 @@ __export(index_exports, {
   ObjectKernel: () => ObjectKernel,
   ObjectKernelBase: () => ObjectKernelBase,
   ObjectLogger: () => ObjectLogger,
+  POSTURE_INJECTION_RULE: () => POSTURE_INJECTION_RULE,
+  POSTURE_LADDER: () => POSTURE_LADDER,
+  POSTURE_RANK: () => POSTURE_RANK,
   PluginConfigValidator: () => PluginConfigValidator,
   PluginHealthMonitor: () => PluginHealthMonitor,
   PluginLoader: () => PluginLoader,
@@ -69,6 +72,7 @@ __export(index_exports, {
   createPluginPermissionEnforcer: () => createPluginPermissionEnforcer,
   deepMerge: () => deepMerge,
   defaultIsTransientError: () => defaultIsTransientError,
+  derivePosture: () => derivePosture,
   evaluateAuthGate: () => evaluateAuthGate,
   extractApiKey: () => extractApiKey,
   generateApiKey: () => generateApiKey,
@@ -83,6 +87,7 @@ __export(index_exports, {
   isNode: () => isNode,
   parseScopes: () => parseScopes,
   parseSignature: () => parseSignature,
+  postureVisibleRows: () => postureVisibleRows,
   readAuthoredTranslationLayer: () => readAuthoredTranslationLayer,
   resolveApiKeyPrincipal: () => resolveApiKeyPrincipal,
   resolveAuthzContext: () => resolveAuthzContext,
@@ -4243,6 +4248,62 @@ function isGrantExpired(row, nowMs) {
   return !(nowMs < until);
 }
 
+// src/security/posture-ladder.ts
+var POSTURE_LADDER = [
+  "PLATFORM_ADMIN",
+  "TENANT_ADMIN",
+  "MEMBER",
+  "EXTERNAL"
+];
+var POSTURE_RANK = {
+  PLATFORM_ADMIN: 3,
+  TENANT_ADMIN: 2,
+  MEMBER: 1,
+  EXTERNAL: 0
+};
+var POSTURE_INJECTION_RULE = {
+  PLATFORM_ADMIN: "Layer 0 exemption where the object posture permits (private / platform-global / better-auth-managed) \u2014 crosses the tenant wall; org-scoped like TENANT_ADMIN on ordinary tenant business objects.",
+  TENANT_ADMIN: "All rows within the active organization (organization_id == ctx.tenantId); no ownership / depth / sharing narrowing.",
+  MEMBER: "Business RLS within the organization \u2014 ownership (owner / unit depth), the OWD baseline, and explicit sharing.",
+  EXTERNAL: "Explicitly shared rows ONLY \u2014 OWD baselines and sharing rules never apply; a misconfiguration can only shrink visibility, never widen it."
+};
+function derivePosture(evidence) {
+  if (evidence.isPlatformAdmin) return "PLATFORM_ADMIN";
+  if (evidence.isTenantAdmin) return "TENANT_ADMIN";
+  return "MEMBER";
+}
+function isSharedTo(row, userId) {
+  return (row.sharedTo ?? []).includes(userId);
+}
+function externalVisible(rows, p) {
+  return rows.filter((r) => isSharedTo(r, p.userId));
+}
+function memberVisible(rows, p) {
+  const shared = new Set(externalVisible(rows, p));
+  return rows.filter(
+    (r) => shared.has(r) || r.organization_id === p.organizationId && (r.owner_id === p.userId || r.owdVisible === true)
+  );
+}
+function tenantAdminVisible(rows, p) {
+  const member = new Set(memberVisible(rows, p));
+  return rows.filter((r) => member.has(r) || r.organization_id === p.organizationId);
+}
+function platformAdminVisible(rows) {
+  return [...rows];
+}
+function postureVisibleRows(posture, rows, principal) {
+  switch (posture) {
+    case "PLATFORM_ADMIN":
+      return platformAdminVisible(rows);
+    case "TENANT_ADMIN":
+      return tenantAdminVisible(rows, principal);
+    case "MEMBER":
+      return memberVisible(rows, principal);
+    case "EXTERNAL":
+      return externalVisible(rows, principal);
+  }
+}
+
 // src/security/resolve-authz-context.ts
 function safeJsonParse2(s, fallback) {
   try {
@@ -4389,6 +4450,10 @@ async function resolveAuthzContext(input) {
   if (hasPlatformAdminGrant && !ctx.positions.includes(import_spec.BUILTIN_IDENTITY_PLATFORM_ADMIN)) {
     ctx.positions.unshift(import_spec.BUILTIN_IDENTITY_PLATFORM_ADMIN);
   }
+  ctx.posture = derivePosture({
+    isPlatformAdmin: hasPlatformAdminGrant,
+    isTenantAdmin: ctx.permissions.includes(import_spec.ORGANIZATION_ADMIN)
+  });
   if (!ctx.permissions.includes("ai_seat")) {
     const aiAccess = (await getUserRow())?.ai_access;
     if (aiAccess === true || aiAccess === 1 || aiAccess === "1") ctx.permissions.push("ai_seat");
@@ -5505,6 +5570,9 @@ var NamespaceResolver = class {
   ObjectKernel,
   ObjectKernelBase,
   ObjectLogger,
+  POSTURE_INJECTION_RULE,
+  POSTURE_LADDER,
+  POSTURE_RANK,
   PluginConfigValidator,
   PluginHealthMonitor,
   PluginLoader,
@@ -5534,6 +5602,7 @@ var NamespaceResolver = class {
   createPluginPermissionEnforcer,
   deepMerge,
   defaultIsTransientError,
+  derivePosture,
   evaluateAuthGate,
   extractApiKey,
   generateApiKey,
@@ -5548,6 +5617,7 @@ var NamespaceResolver = class {
   isNode,
   parseScopes,
   parseSignature,
+  postureVisibleRows,
   readAuthoredTranslationLayer,
   resolveApiKeyPrincipal,
   resolveAuthzContext,