@objectstack/plugin-reports 14.8.0 → 15.1.0

package/.turbo/turbo-build.log

@@ -1,5 +1,5 @@
 
-> @objectstack/plugin-reports@14.8.0 build /home/runner/work/framework/framework/packages/plugins/plugin-reports
+> @objectstack/plugin-reports@15.1.0 build /home/runner/work/framework/framework/packages/plugins/plugin-reports
 > tsup --config ../../../tsup.config.ts
 
 CLI Building entry: src/index.ts
@@ -10,13 +10,13 @@
 CLI Cleaning output folder
 ESM Build start
 CJS Build start
-CJS dist/index.js     20.55 KB
-CJS dist/index.js.map 39.47 KB
-CJS ⚡️ Build success in 151ms
-ESM dist/index.mjs     19.42 KB
-ESM dist/index.mjs.map 39.48 KB
-ESM ⚡️ Build success in 157ms
+ESM dist/index.mjs     22.17 KB
+ESM dist/index.mjs.map 46.00 KB
+ESM ⚡️ Build success in 165ms
+CJS dist/index.js     23.30 KB
+CJS dist/index.js.map 46.00 KB
+CJS ⚡️ Build success in 171ms
 DTS Build start
-DTS ⚡️ Build success in 17821ms
-DTS dist/index.d.mts 5.60 KB
-DTS dist/index.d.ts  5.60 KB
+DTS ⚡️ Build success in 19372ms
+DTS dist/index.d.mts 7.17 KB
+DTS dist/index.d.ts  7.17 KB

package/CHANGELOG.md

@@ -1,5 +1,98 @@
 # @objectstack/plugin-reports
 
+## 15.1.0
+
+### Patch Changes
+
+- f531a26: fix(security): close three execution-surface authz holes surfaced by the #2849 class sweep (#2980, #2981, #2982)
+
+  Three independent, confirmed-exploitable defects where an execution surface
+  ignored the caller's identity or fell open on a missing one. Each is fixed at
+  its own enforcement point; none change behaviour for correctly-scoped callers.
+
+  - **#2980 — reports IDOR + scheduled-report RLS bypass.** `ReportService`
+    discarded the caller's context and read/wrote `sys_saved_report` with a system
+    context, so any authenticated user could read, delete, or overwrite any saved
+    report by id (cross-owner / cross-tenant), and `listReports` enumerated all
+    owners. `getReport`/`deleteReport`/`saveReport`/`listReports` are now
+    owner-scoped (system read of the protection-locked metadata object, but
+    authorization enforced by owner match); create/overwrite can no longer spoof
+    ownership. Scheduled dispatch no longer runs `isSystem` (which emailed the
+    target object's entire table past the owner's RLS): it resolves the owner to a
+    real RLS-bearing context via a new `resolveOwnerContext` seam and **fails
+    closed** (skips + marks the schedule failed) when the owner can't be resolved,
+    rather than running elevated. Wiring that resolver is the reports-surface
+    consumer of ADR-0073's user-less identity resolution.
+
+  - **#2981 — knowledge/RAG retrieval fall-open.** `applyPermissionFilter` returned
+    every hit when the context was missing _or_ system. A missing identity is no
+    longer treated as a grant: object-backed hits fail closed (dropped, keeping
+    ACL-less file/http hits), and only an **explicit** system context passes
+    through. Closes the agent path where an omitted `ToolExecutionContext.actor`
+    yielded unfiltered semantic search over the whole corpus.
+
+  - **#2982 — bulk-write OWD gap.** `update({multi:true})` / `deleteMany` had no
+    single id to `canEdit`-gate, so owner scoping was skipped on private (and
+    public_read) objects. A new `SharingService.buildWriteFilter` (the edit-set
+    analogue of `buildReadFilter`) is AND-ed into the write AST for multi writes,
+    constraining them to rows the caller may edit — including the on-behalf-of
+    delegator intersection.
+
+  Tracked as the motivating evidence of ADR-0096 (execution-surface identity
+  admission); the mechanism that would prevent the class structurally is separate.
+
+- Updated dependencies [f531a26]
+- Updated dependencies [f531a26]
+- Updated dependencies [f531a26]
+- Updated dependencies [f531a26]
+- Updated dependencies [f531a26]
+- Updated dependencies [f531a26]
+- Updated dependencies [3fe9df1]
+- Updated dependencies [f531a26]
+- Updated dependencies [f531a26]
+- Updated dependencies [f531a26]
+- Updated dependencies [f531a26]
+- Updated dependencies [f531a26]
+- Updated dependencies [f531a26]
+- Updated dependencies [f531a26]
+- Updated dependencies [f531a26]
+- Updated dependencies [f531a26]
+- Updated dependencies [f531a26]
+- Updated dependencies [f531a26]
+- Updated dependencies [f531a26]
+- Updated dependencies [f531a26]
+- Updated dependencies [f531a26]
+- Updated dependencies [f531a26]
+- Updated dependencies [4109153]
+- Updated dependencies [f531a26]
+- Updated dependencies [f531a26]
+- Updated dependencies [f531a26]
+- Updated dependencies [f531a26]
+- Updated dependencies [f531a26]
+- Updated dependencies [f531a26]
+- Updated dependencies [f531a26]
+- Updated dependencies [627f225]
+- Updated dependencies [f531a26]
+- Updated dependencies [f531a26]
+- Updated dependencies [f531a26]
+  - @objectstack/spec@15.1.0
+  - @objectstack/platform-objects@15.1.0
+  - @objectstack/core@15.1.0
+
+## 15.0.0
+
+### Patch Changes
+
+- Updated dependencies [02a014b]
+- Updated dependencies [28b7c28]
+- Updated dependencies [13749ec]
+- Updated dependencies [e62c233]
+- Updated dependencies [ed61c9b]
+- Updated dependencies [31d04d4]
+  - @objectstack/platform-objects@15.0.0
+  - @objectstack/spec@15.0.0
+  - @objectstack/core@15.0.0
+
 ## 14.8.0
 
 ### Patch Changes

package/dist/index.d.mts

@@ -1,5 +1,5 @@
 export { SysReportSchedule, SysSavedReport } from '@objectstack/platform-objects/audit';
-import { IReportService, SaveReportInput, SharingExecutionContext, SavedReport, ReportRunResult, ScheduleReportInput, ReportSchedule, ReportFormat } from '@objectstack/spec/contracts';
+import { IReportService, SharingExecutionContext, SaveReportInput, SavedReport, ReportRunResult, ScheduleReportInput, ReportSchedule, ReportFormat } from '@objectstack/spec/contracts';
 export { IReportService, ReportFormat, ReportQuery, ReportRunResult, ReportSchedule, SaveReportInput, SavedReport, ScheduleReportInput } from '@objectstack/spec/contracts';
 import { Plugin, PluginContext } from '@objectstack/core';
 
@@ -40,6 +40,17 @@ interface ReportClock {
     now(): Date;
 }
 declare function renderReport(rows: any[], format: ReportFormat, fields?: string[]): string;
+/**
+ * Resolves a saved report's owner (`owner_id`) into a real, RLS-bearing
+ * `ExecutionContext` so a **scheduled** report executes under the owner's
+ * authority — the same rows the owner would see interactively — instead of
+ * bypassing RLS with a system context. Returns `null` when the owner cannot
+ * be resolved (unknown/disabled user), in which case the scheduler fails the
+ * run closed rather than running elevated (#2849 / #2980). Supplying this
+ * resolver is the reports-surface consumer of ADR-0073's user-less identity
+ * resolution.
+ */
+type OwnerContextResolver = (ownerId: string) => Promise<SharingExecutionContext | null>;
 interface ReportServiceOptions {
     engine: ReportEngine;
     email?: ReportEmail;
@@ -51,6 +62,12 @@ interface ReportServiceOptions {
     };
     /** Cap rows per report to protect both DB and email size. */
     maxRows?: number;
+    /**
+     * Resolves a report owner into an RLS-bearing context for scheduled runs
+     * (see {@link OwnerContextResolver}). When omitted, scheduled reports fail
+     * closed instead of running with RLS bypassed (#2980).
+     */
+    resolveOwnerContext?: OwnerContextResolver;
 }
 declare class ReportService implements IReportService {
     private readonly engine;
@@ -58,14 +75,27 @@ declare class ReportService implements IReportService {
     private readonly clock;
     private readonly logger;
     private readonly maxRows;
+    private readonly resolveOwnerContext?;
     constructor(opts: ReportServiceOptions);
+    /**
+     * Authorization for a saved-report row. `sys_saved_report` is a
+     * protection-locked system object, so its rows are *read* with
+     * `SYSTEM_CTX`; the caller's right to see/mutate a specific report is
+     * enforced HERE, by owner match, not by the metadata read's own RLS —
+     * otherwise any authenticated caller could read/delete/overwrite any
+     * report by id (#2980). An explicit elevated context (`isSystem`) — the
+     * scheduler / server tooling — sees everything.
+     */
+    private canAccessReport;
+    /** Raw metadata read of a saved report by id (no authz — callers gate). */
+    private loadReportRow;
     saveReport(input: SaveReportInput, context: SharingExecutionContext): Promise<SavedReport>;
     listReports(filter: {
         object?: string;
         ownerId?: string;
-    } | undefined, _context: SharingExecutionContext): Promise<SavedReport[]>;
-    getReport(reportId: string, _context: SharingExecutionContext): Promise<SavedReport | null>;
-    deleteReport(reportId: string, _context: SharingExecutionContext): Promise<void>;
+    } | undefined, context: SharingExecutionContext): Promise<SavedReport[]>;
+    getReport(reportId: string, context: SharingExecutionContext): Promise<SavedReport | null>;
+    deleteReport(reportId: string, context: SharingExecutionContext): Promise<void>;
     run(reportId: string, context: SharingExecutionContext): Promise<ReportRunResult>;
     runAdHoc(input: SaveReportInput, context: SharingExecutionContext): Promise<ReportRunResult>;
     private executeReport;

package/dist/index.d.ts

@@ -1,5 +1,5 @@
 export { SysReportSchedule, SysSavedReport } from '@objectstack/platform-objects/audit';
-import { IReportService, SaveReportInput, SharingExecutionContext, SavedReport, ReportRunResult, ScheduleReportInput, ReportSchedule, ReportFormat } from '@objectstack/spec/contracts';
+import { IReportService, SharingExecutionContext, SaveReportInput, SavedReport, ReportRunResult, ScheduleReportInput, ReportSchedule, ReportFormat } from '@objectstack/spec/contracts';
 export { IReportService, ReportFormat, ReportQuery, ReportRunResult, ReportSchedule, SaveReportInput, SavedReport, ScheduleReportInput } from '@objectstack/spec/contracts';
 import { Plugin, PluginContext } from '@objectstack/core';
 
@@ -40,6 +40,17 @@ interface ReportClock {
     now(): Date;
 }
 declare function renderReport(rows: any[], format: ReportFormat, fields?: string[]): string;
+/**
+ * Resolves a saved report's owner (`owner_id`) into a real, RLS-bearing
+ * `ExecutionContext` so a **scheduled** report executes under the owner's
+ * authority — the same rows the owner would see interactively — instead of
+ * bypassing RLS with a system context. Returns `null` when the owner cannot
+ * be resolved (unknown/disabled user), in which case the scheduler fails the
+ * run closed rather than running elevated (#2849 / #2980). Supplying this
+ * resolver is the reports-surface consumer of ADR-0073's user-less identity
+ * resolution.
+ */
+type OwnerContextResolver = (ownerId: string) => Promise<SharingExecutionContext | null>;
 interface ReportServiceOptions {
     engine: ReportEngine;
     email?: ReportEmail;
@@ -51,6 +62,12 @@ interface ReportServiceOptions {
     };
     /** Cap rows per report to protect both DB and email size. */
     maxRows?: number;
+    /**
+     * Resolves a report owner into an RLS-bearing context for scheduled runs
+     * (see {@link OwnerContextResolver}). When omitted, scheduled reports fail
+     * closed instead of running with RLS bypassed (#2980).
+     */
+    resolveOwnerContext?: OwnerContextResolver;
 }
 declare class ReportService implements IReportService {
     private readonly engine;
@@ -58,14 +75,27 @@ declare class ReportService implements IReportService {
     private readonly clock;
     private readonly logger;
     private readonly maxRows;
+    private readonly resolveOwnerContext?;
     constructor(opts: ReportServiceOptions);
+    /**
+     * Authorization for a saved-report row. `sys_saved_report` is a
+     * protection-locked system object, so its rows are *read* with
+     * `SYSTEM_CTX`; the caller's right to see/mutate a specific report is
+     * enforced HERE, by owner match, not by the metadata read's own RLS —
+     * otherwise any authenticated caller could read/delete/overwrite any
+     * report by id (#2980). An explicit elevated context (`isSystem`) — the
+     * scheduler / server tooling — sees everything.
+     */
+    private canAccessReport;
+    /** Raw metadata read of a saved report by id (no authz — callers gate). */
+    private loadReportRow;
     saveReport(input: SaveReportInput, context: SharingExecutionContext): Promise<SavedReport>;
     listReports(filter: {
         object?: string;
         ownerId?: string;
-    } | undefined, _context: SharingExecutionContext): Promise<SavedReport[]>;
-    getReport(reportId: string, _context: SharingExecutionContext): Promise<SavedReport | null>;
-    deleteReport(reportId: string, _context: SharingExecutionContext): Promise<void>;
+    } | undefined, context: SharingExecutionContext): Promise<SavedReport[]>;
+    getReport(reportId: string, context: SharingExecutionContext): Promise<SavedReport | null>;
+    deleteReport(reportId: string, context: SharingExecutionContext): Promise<void>;
     run(reportId: string, context: SharingExecutionContext): Promise<ReportRunResult>;
     runAdHoc(input: SaveReportInput, context: SharingExecutionContext): Promise<ReportRunResult>;
     private executeReport;

package/dist/index.js

@@ -154,6 +154,32 @@ var ReportService = class {
     this.clock = opts.clock ?? { now: () => /* @__PURE__ */ new Date() };
     this.logger = opts.logger ?? {};
     this.maxRows = Math.max(1, opts.maxRows ?? 5e3);
+    this.resolveOwnerContext = opts.resolveOwnerContext;
+  }
+  // ── Access control ─────────────────────────────────────────────
+  /**
+   * Authorization for a saved-report row. `sys_saved_report` is a
+   * protection-locked system object, so its rows are *read* with
+   * `SYSTEM_CTX`; the caller's right to see/mutate a specific report is
+   * enforced HERE, by owner match, not by the metadata read's own RLS —
+   * otherwise any authenticated caller could read/delete/overwrite any
+   * report by id (#2980). An explicit elevated context (`isSystem`) — the
+   * scheduler / server tooling — sees everything.
+   */
+  canAccessReport(row, context) {
+    if (!row) return false;
+    if (context?.isSystem) return true;
+    const userId = context?.userId;
+    return !!userId && row.owner_id === userId;
+  }
+  /** Raw metadata read of a saved report by id (no authz — callers gate). */
+  async loadReportRow(reportId) {
+    const rows = await this.engine.find("sys_saved_report", {
+      filter: { id: reportId },
+      limit: 1,
+      context: SYSTEM_CTX
+    });
+    return Array.isArray(rows) && rows[0] ? rows[0] : null;
   }
   // ── Report CRUD ────────────────────────────────────────────────
   async saveReport(input, context) {
@@ -161,24 +187,25 @@ var ReportService = class {
     if (!input.object) throw new Error("VALIDATION_FAILED: object is required");
     if (!input.query) throw new Error("VALIDATION_FAILED: query is required");
     const now = this.clock.now().toISOString();
+    const ownerId = context.isSystem ? input.ownerId ?? context.userId ?? null : context.userId ?? null;
     const payload = {
       name: input.name,
       description: input.description ?? null,
       object_name: input.object,
       query_json: JSON.stringify(input.query ?? {}),
       format: input.format ?? DEFAULT_FORMAT,
-      owner_id: input.ownerId ?? context.userId ?? null,
+      owner_id: ownerId,
       updated_at: now
     };
     if (input.id) {
-      const existing = await this.engine.find("sys_saved_report", {
-        filter: { id: input.id },
-        limit: 1,
-        context: SYSTEM_CTX
-      });
-      if (Array.isArray(existing) && existing[0]) {
+      const existing = await this.loadReportRow(input.id);
+      if (existing) {
+        if (!this.canAccessReport(existing, context)) {
+          throw new Error(`REPORT_NOT_FOUND: ${input.id}`);
+        }
+        if (!context.isSystem) payload.owner_id = existing.owner_id ?? payload.owner_id;
         await this.engine.update("sys_saved_report", { id: input.id, ...payload }, { context: SYSTEM_CTX });
-        return rowFromSaved({ ...existing[0], ...payload, id: input.id });
+        return rowFromSaved({ ...existing, ...payload, id: input.id });
       }
     }
     const id = input.id ?? uid("rpt");
@@ -186,10 +213,16 @@ var ReportService = class {
     await this.engine.insert("sys_saved_report", row, { context: SYSTEM_CTX });
     return rowFromSaved(row);
   }
-  async listReports(filter, _context) {
+  async listReports(filter, context) {
     const f = {};
     if (filter?.object) f.object_name = filter.object;
-    if (filter?.ownerId) f.owner_id = filter.ownerId;
+    if (context?.isSystem) {
+      if (filter?.ownerId) f.owner_id = filter.ownerId;
+    } else {
+      if (!context?.userId) return [];
+      if (filter?.ownerId && filter.ownerId !== context.userId) return [];
+      f.owner_id = context.userId;
+    }
     const rows = await this.engine.find("sys_saved_report", {
       filter: f,
       limit: 500,
@@ -198,16 +231,18 @@ var ReportService = class {
     });
     return Array.isArray(rows) ? rows.map(rowFromSaved) : [];
   }
-  async getReport(reportId, _context) {
-    const rows = await this.engine.find("sys_saved_report", {
-      filter: { id: reportId },
-      limit: 1,
-      context: SYSTEM_CTX
-    });
-    return Array.isArray(rows) && rows[0] ? rowFromSaved(rows[0]) : null;
+  async getReport(reportId, context) {
+    const row = await this.loadReportRow(reportId);
+    if (!this.canAccessReport(row, context)) return null;
+    return rowFromSaved(row);
   }
-  async deleteReport(reportId, _context) {
+  async deleteReport(reportId, context) {
     if (!reportId) throw new Error("VALIDATION_FAILED: reportId is required");
+    const row = await this.loadReportRow(reportId);
+    if (!row) return;
+    if (!this.canAccessReport(row, context)) {
+      throw new Error(`REPORT_NOT_FOUND: ${reportId}`);
+    }
     const schedules = await this.engine.find("sys_report_schedule", {
       filter: { report_id: reportId },
       limit: 500,
@@ -353,8 +388,8 @@ var ReportService = class {
     let fired = 0, failed = 0, skipped = 0;
     for (const schedule of list) {
       try {
-        const report = await this.getReport(schedule.report_id, { isSystem: true });
-        if (!report) {
+        const row = await this.loadReportRow(schedule.report_id);
+        if (!row) {
           skipped++;
           await this.markSchedule(schedule.id, {
             last_status: "skipped",
@@ -362,8 +397,22 @@ var ReportService = class {
           });
           continue;
         }
+        const report = rowFromSaved(row);
+        const ownerId = report.owner_id;
+        const runContext = ownerId && this.resolveOwnerContext ? await this.resolveOwnerContext(ownerId).catch((err) => {
+          this.logger.warn?.("ReportService.dispatchDue: owner context resolution failed", err);
+          return null;
+        }) : null;
+        if (!runContext) {
+          failed++;
+          await this.markSchedule(schedule.id, {
+            last_status: "failed",
+            last_error: ownerId ? `owner '${ownerId}' context unavailable \u2014 refusing to run scheduled report with RLS bypassed (#2849/#2980)` : "report has no owner \u2014 refusing to run scheduled report with RLS bypassed (#2849/#2980)"
+          });
+          continue;
+        }
         const fmt = schedule.format ?? "html_table";
-        const result = await this.executeReport({ ...report, format: fmt }, { isSystem: true }, false);
+        const result = await this.executeReport({ ...report, format: fmt }, runContext, false);
         const recipients = schedule.recipients.split(",").map((s) => s.trim()).filter(Boolean);
         const subject = renderSubject(schedule.subject_template, {
           name: schedule.name ?? report.name,
@@ -510,7 +559,14 @@ var ReportsServicePlugin = class {
         engine,
         email,
         logger: ctx.logger,
-        maxRows: this.options.maxRows
+        maxRows: this.options.maxRows,
+        // Scheduled reports run under the owner's resolved RLS context, not a
+        // system bypass (#2980). No owner-context resolver is wired yet — that
+        // is the reports-surface consumer of ADR-0073's user-less identity
+        // resolution (M2) — so until it lands, scheduled runs FAIL CLOSED
+        // (skipped + marked failed) rather than exfiltrate. Interactive runs
+        // (run/runAdHoc) are unaffected: they carry the caller's context.
+        resolveOwnerContext: void 0
       });
       ctx.registerService("reports", this.service);
       if (this.options.disableDispatcher) {