proof-harness 0.1.0-next.12 → 0.1.0-next.13

package/COMPATIBILITY.md

@@ -27,10 +27,29 @@ versions rather than guessing how to interpret them.
 
 ## Prerelease migration notes
 
-### 0.1.0-next.12 — independent isolation fixtures and column ACL recovery (candidate)
+### 0.1.0-next.13 — column-restricted tenant isolation (release candidate)
 
-Not yet published. Keep the existing consumer pin until this release is reviewed
-and published; then pin exactly `proof-harness@0.1.0-next.12`.
+Prepared for release. After publication, pin exactly `proof-harness@0.1.0-next.13`
+and update the lockfile. Add `columns` only where column grants require it, then
+rerun the baseline, coverage, mutation and control checks against the real database.
+Existing consumers that omit this option need no API changes.
+
+`assert.tenantIsolation` accepts optional `columns: ["id", "account_id"]` for
+private tables that grant customers only selected columns. The SDK uses the
+same projection for service ground truth, owner controls, and outsider probes.
+Only distinct plain column names are allowed; empty lists, wildcards, aliases,
+aggregates, casts and joins are rejected before fixture setup. Omitting the
+option retains the existing all-column query.
+
+This proves row isolation for the selected columns. Consumers must separately
+prove that private columns remain unreadable; do not grant extra columns to
+make a fixture pass. Existing positive-control, bidirectional, non-vacuity and
+provenance requirements are unchanged. No trace, mission, or health protocol migration is
+required. Adopt only an exact reviewed published package version.
+
+### 0.1.0-next.12 — independent isolation fixtures and column ACL recovery
+
+Published release. Pin exactly `proof-harness@0.1.0-next.12` when adopting these changes.
 
 `assert.tenantIsolation` now accepts a caller-owned `isolationFixture` instead of
 workspace seeding. Supply a stable fixture `id`, the matching `table`, an explicit

package/README.md

@@ -157,6 +157,10 @@ privileged writes and requires action-boundary evidence even without workspace
 inputs or for internal actions. See [required migration steps](COMPATIBILITY.md)
 before adopting the exact version.
 
-Release candidate `0.1.0-next.12` adds caller-owned account/user isolation fixtures
+Release `0.1.0-next.12` adds caller-owned account/user isolation fixtures
 and restores column grants and grant options after table-privilege mutations.
-Keep existing pins until publication; see [migration requirements](COMPATIBILITY.md).
+See [migration requirements](COMPATIBILITY.md).
+
+Release candidate `0.1.0-next.13` adds optional readable-column selection to
+`assert.tenantIsolation` for tables with column grants. Private-column denial
+remains a separate consumer proof; see [migration requirements](COMPATIBILITY.md).

package/dist/playwright.d.ts

@@ -97,6 +97,10 @@ declare const actAsUser: {
 };
 
 interface TenantIsolationBaseOptions {
+    /** Plain readable column names for column-restricted tables. Defaults to all
+     * columns. The same projection is used for ground truth and both actors.
+     * This proves row isolation only; test secret-column denial separately. */
+    columns?: readonly string[];
     /**
      * Table to query as userB. RLS on the table is what is being tested.
      * Must be a table governed by a tenant-scoped RLS policy — either

package/dist/playwright.js

@@ -1765,9 +1765,22 @@ async function runRlsProbe(probe, actorCreds) {
     detail: `${actorCreds.label} UPDATE on ${probe.table} left ${columns.join(", ")} unchanged across ${before.length} targeted row(s)${error ? ` (${error.message})` : ""}; verified by service-role re-read (RLS honored)`
   });
 }
-async function countRowsAsService(sb, table, filter) {
+function tenantColumnSelection(columns) {
+  if (columns === void 0) return "*";
+  if (!Array.isArray(columns) || columns.length === 0 || columns.some(
+    (column) => typeof column !== "string" || !/^[A-Za-z_][A-Za-z0-9_]*$/.test(column)
+  ) || new Set(columns).size !== columns.length) {
+    throw proofFail(
+      "tenant_isolation_setup",
+      "a non-empty list of distinct plain column names",
+      "invalid tenant column projection"
+    );
+  }
+  return columns.join(",");
+}
+async function countRowsAsService(sb, table, filter, selection) {
   const { count, error } = await applyEq(
-    sb.from(table).select("*", { count: "exact", head: true }),
+    sb.from(table).select(selection, { count: "exact", head: true }),
     filter
   );
   if (error) {
@@ -1800,8 +1813,13 @@ async function probeTenantIsolation(args) {
     [scopeColumn]: scopeValue,
     ...criterion?.where ?? {}
   };
-  const criterionDetail = criterion ? ` matching planner criterion "${criterion.description}" (${JSON.stringify(criterion.where)})` : "";
-  const actualRowCount = await countRowsAsService(sb, table, filter);
+  const criterionDetail = (criterion ? ` matching planner criterion "${criterion.description}" (${JSON.stringify(criterion.where)})` : "") + (args.selection === "*" ? "" : ` selecting columns ${args.selection}`);
+  const actualRowCount = await countRowsAsService(
+    sb,
+    table,
+    filter,
+    args.selection
+  );
   if (actualRowCount === 0) {
     return "skipped_no_data";
   }
@@ -1813,7 +1831,7 @@ async function probeTenantIsolation(args) {
     data: ownRows,
     error: ownError,
     status: ownStatus
-  } = await applyEq(ownerClient.from(table).select("*"), filter);
+  } = await applyEq(ownerClient.from(table).select(args.selection), filter);
   failIfInfrastructure(
     ownError,
     ownStatus,
@@ -1860,7 +1878,7 @@ async function probeTenantIsolation(args) {
     data: leakedRows,
     error: queryError,
     status: queryStatus
-  } = await applyEq(client.from(table).select("*"), filter);
+  } = await applyEq(client.from(table).select(args.selection), filter);
   failIfInfrastructure(
     queryError,
     queryStatus,
@@ -1902,7 +1920,9 @@ async function probeTenantIsolation(args) {
     );
   }
   if (leakedRows && leakedRows.length > 0) {
-    const sampleIds = leakedRows.slice(0, 3).map((r) => r.id ?? "?").join(", ");
+    const sampleIds = leakedRows.slice(0, 3).map(
+      (r) => r !== null && typeof r === "object" && "id" in r ? String(r.id) : "?"
+    ).join(", ");
     recordAssertion({
       kind: "tenant_isolation",
       target: table,
@@ -2037,6 +2057,7 @@ var assertMethods = {
    */
   async tenantIsolation(opts) {
     const { table, page } = opts;
+    const selection = tenantColumnSelection(opts.columns);
     if (opts.isolationFixture) {
       const fixture = await withoutAssertionProvenance(async () => {
         const supplied = opts.isolationFixture;
@@ -2078,10 +2099,15 @@ var assertMethods = {
         });
         const sb = createProofServiceClient();
         for (const side of participants) {
-          const count = await countRowsAsService(sb, table, {
-            [opts.scopeColumn]: side.scopeValue,
-            ...opts.criterion?.where ?? {}
-          });
+          const count = await countRowsAsService(
+            sb,
+            table,
+            {
+              [opts.scopeColumn]: side.scopeValue,
+              ...opts.criterion?.where ?? {}
+            },
+            selection
+          );
           if (!count)
             throw proofFail(
               "tenant_isolation_vacuous",
@@ -2094,6 +2120,7 @@ var assertMethods = {
           [participants[1], participants[0]]
         ]) {
           const outcome = await probeTenantIsolation({
+            selection,
             table,
             owner: owner.actor,
             viewer: viewer.actor,
@@ -2256,6 +2283,7 @@ var assertMethods = {
           );
         }
         const forward = await probeTenantIsolation({
+          selection,
           table,
           viewer: userB,
           viewerLabel: "user B",
@@ -2291,6 +2319,7 @@ var assertMethods = {
           );
         }
         const reverse = await probeTenantIsolation({
+          selection,
           table,
           viewer: userA,
           viewerLabel: "user A",