You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
Repository navigation
Commit 1df8c63
Browse filesBrowse the repository at this point in the historyBrowse files
fix(platform-objects): the OAuth application register form offers only Web and Native, and its Redirect URLs help states the rule for each (#24773)
6
+
7
+
Clause-②: no (a form's offering: the register route still accepts every type value it accepted, and nothing on the server reads the action's param options, so no accept set or served shape moves)
8
+
9
+
Setup › OAuth Applications › Register offered four application types: Web, Native, User-agent based and Public. The OAuth provider judges only `web` and `native`, so the register route registers the other two as `web`, with a client secret. The form now offers Web and Native, and still defaults to Web.
10
+
11
+
-**Redirect URLs help.** It said "Must use https:// in production", which did not tell an admin that a local `http://localhost` callback needs the Native type. It now states the rule for each type: a Web application needs `https://` on a host other than localhost or another loopback address; a Native application may also use `http://` on exactly `localhost`, `127.0.0.1` or `[::1]`, on any port.
12
+
-**Application Type help.** New: choose Native for a desktop or mobile app, or for an app in local development that redirects to `http://localhost`.
13
+
-**Unchanged.** The register route accepts the same values as before, including `user-agent-based` and `public`. The stored `sys_oauth_application.type` column still lists all four values, so a row written under an earlier provider line keeps its value. The `public` column is unchanged.
14
+
15
+
The zh-CN, ja-JP and es-ES translations carry the new help texts.
fix(plugin-security): a `controlled_by_parent` detail write asks its master the object-level question the master's own write door asks (ADR-0055 §3)
6
+
7
+
Clause-②: no
8
+
9
+
ADR-0055 §3 says editing, deleting or creating a detail requires edit access to its master. The master-edit gate's object-level leg asked only for an object-level `update` grant on the master. It now asks what the master's own write door asks of an `update` on the master, with that door's inputs: the master's security posture must resolve, the capabilities the master requires for `update` (ADR-0066 D3) must be held, and the grant is asked under the master's posture (ADR-0066 D2). A principal the master's own write door refuses at its object gate can no longer write a detail under that master.
10
+
11
+
-**Every door that asks the leg.** An insert, a by-id update and a by-id delete of a detail answer `PERMISSION_DENIED` (403) and write nothing. `checkControlledByParentWrite`, which the comment and attachment parent gates ask, answers `deny` on the `object_permission` leg. A record-grained `security/explain` of a by-id write follows the same leg.
12
+
-**An insert answers before the reference check.** For such a principal, an insert under a master id that exists answers the same refusal as one under an id that exists nowhere. A principal that also cannot read the master, on an on-behalf-of write too, now gets this `PERMISSION_DENIED` on insert where it got the reference check's `VALIDATION_FAILED`. An insert under a master object that does not resolve answers `PERMISSION_DENIED` where it answered `OBJECT_NOT_FOUND` (404).
13
+
-**Unchanged.** A principal the master's own write door admits for an `update` keeps writing its details, and so do a super-user grant and a system context. Under a master that is `public`, resolves and requires no capability for `update`, every principal gets the answer it got before.
"tests": "commands run + pass/fail evidence (real output excerpts); ablation only where a tested behaviour changed: rebuild + on-disk mutation proof",
372
372
"gates": "local subset: each command + exit code captured before any pipe + --ran reconciliation; every family CI runs: the PR's check-runs (name + conclusion) cited, not re-run locally",
373
+
"dogfood_battery": "n/a — no `!` in the PR title and no (narrowing) arm | <head sha> · the lock's VERDICT line · Test Files N/N · Tests M/M · every failure named",
373
374
"mcp_calls": "<n> — MCP GitHub calls with tool names; a write tool in the list = this report is refused",
374
375
"api_writes": "<n> — REST proxy writes, each endpoint listed",
Copy file name to clipboardExpand all lines: docs/adr/0123-no-active-organization-session-semantics.md
+9-2Lines changed: 9 additions & 2 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -1,6 +1,13 @@
1
1
# ADR-0123: An authenticated session with no active organization is a legal state — reads resolve to nothing, tenant-scoped writes are refused loudly
2
2
3
3
**Status**: Accepted (2026-08-13)
4
+
> **Amendment (2026-10-20) — D2's refusal also answers two inserts its scope paragraph did not name, and the "What does not change" line no longer lists platform operators whole (#24823; PR #24819, `8a058d85a`, and PR #24868, `98c3d00447`).** Both arms are D2's own refusal — `403 PERMISSION_DENIED`, naming the missing active organization (D4) — thrown from the one place it is spelled (`packages/plugins/plugin-security/src/security-plugin.ts#refuseNoActiveOrganization`, step 3.7). Neither changes an outcome: each insert was already refused by the engine's organization check (ADR-0131 D9) as an organization-less system write, answered `500 ERR_SYSTEM_WRITE_ORGANIZATION_REQUIRED` with its prose withheld from the wire. Only the answer moved, to the one this record gives the state.
5
+
>
6
+
> 1.*A union-scope insert with no active organization (PR #24819).* Under `group`, the scope pre-test reads the membership set, so a member whose session has no active organization passes it — rightly, for reads, and for updates and deletes of rows the membership wall selected, which keep the organization they already have. An insert needs somewhere new to land, and a new row lands in the active organization: the engine stamps it from `tenantId` (ADR-0105 D5). With none, the insert is refused, as `isolated` already refused the same session.
7
+
> 2.*A platform operator crossing the wall (PR #24868).* A platform operator crossing the wall on a posture-permitting object (ADR-0095 D3) has no Layer 0 there, so neither the pre-test nor arm 1 reaches it, under `isolated` or `group`. Crossing lets it read every organization's rows and update them where they are; it gives a new row no organization. From a session with no active organization, its insert is refused. ADR-0131 D9 refused that write already: "Nothing defaults to any owner other than the derivable one."
8
+
>
9
+
> Both arms judge the insert's stored image — the rows after the `beforeInsert` chain, the ones the engine's check reads next — so they refuse exactly the rows that met the 500. A stored row that names an organization (a hook placed it) is not refused by either arm and is judged as before; one row that names none refuses the whole write. Reads, updates of existing rows, deletes, inserts from a session with an active organization, and system contexts are unchanged. D2's scope paragraph is kept as written, with a pointer here: its operator clause and its "empty membership set" sentence still bound the scope pre-test. The **What does not change** line is corrected in place.
10
+
4
11
**Deciders**: ObjectStack Protocol Architects (maintainer ruling on [#8247](https://github.com/objectstack-ai/objectstack/issues/8247), 2026-08-13)
5
12
**Builds on**: [ADR-0095](./0095-authz-kernel-tenant-layer-and-posture-ladder.md) (D1 — Layer 0 is an independent, always-first, AND-composed tenant filter; W1/W2), [ADR-0105](./0105-group-tenancy-posture-and-first-class-org-scope.md) (D1/D2 — the posture spectrum and the `group` union wall; "empty/absent scope → deny"), [ADR-0093](./0093-tenancy-mode-and-membership-lifecycle.md) (D1/D2 — the membership reconciler as the single owner of the "every user gets a membership" invariant, and the `session.create.before` hook that resolves `activeOrganizationId` from `sys_member`), [ADR-0112](./0112-error-code-vocabulary-and-ledger.md) (D3 — the closed error-code vocabulary this refusal draws from rather than extending), [ADR-0049](./0049-no-unenforced-security-properties.md) (enforce-or-remove — a declared wall the write path does not meet is the defect this record closes)
@@ -57,7 +64,7 @@ So both halves were individually defensible and jointly produced a write that su
57
64
-*Writes that place or move a row* — `insert` and `update` — are **refused**, with `PERMISSION_DENIED` / HTTP 403 and a message that **names the missing active organization**. The code comes from ADR-0112's standard catalog rather than a new registration: the condition is a permission-class refusal, and ADR-0112 D3 directs a generic condition to the catalog instead of a synonym. This is the same code and status PR #8237 put on the wire for the same state, which is what makes "#8158 conforms" a measured statement rather than an assertion.
58
65
-*`delete`* places nothing and decides no tenant. Its target is selected through the Layer 0 row wall, which already resolves to nothing — so a delete under this state matches no row and is governed by the read rule, deliberately. This boundary is stated so the next author does not read its absence as an oversight.
59
66
60
-
**The scope of the refusal is exactly the state, and no wider.** It fires only for an authenticated, non-system caller, on an object the posture actually walls (a tenant object under `isolated`/`group`; never a `tenancy.enabled:false` platform-global object, never an object with no `organization_id` column, never a federated phantom anchor), who is not a platform operator crossing the wall by ADR-0095 D3. System contexts — boot seeding, reconcile hooks, backfills, imports — short-circuit the security middleware entirely and are untouched. Under `group`, "no organization scope" means an **empty membership set**, matching ADR-0105 D2's own fail-closed rule.
67
+
**The scope of the refusal is exactly the state, and no wider.** It fires only for an authenticated, non-system caller, on an object the posture actually walls (a tenant object under `isolated`/`group`; never a `tenancy.enabled:false` platform-global object, never an object with no `organization_id` column, never a federated phantom anchor), who is not a platform operator crossing the wall by ADR-0095 D3. System contexts — boot seeding, reconcile hooks, backfills, imports — short-circuit the security middleware entirely and are untouched. Under `group`, "no organization scope" means an **empty membership set**, matching ADR-0105 D2's own fail-closed rule. *(Amended 2026-10-20 — the operator clause and the "empty membership set" sentence bound the scope pre-test, not every write. Two inserts from a session with no active organization, of a row that names no organization, are refused past them: a `group` member's with a non-empty membership set, and a platform operator's crossing the wall. See the amendment in the status block above.)*
61
68
62
69
**D3 — ⛔ No silent NULL stamping, and the ledger carve-out is paid for by ordering.** Under the state this record governs — an authenticated caller with **no active organization** — no path may write a tenant-scoped row with a NULL tenant and report success, in any subsystem; D2's refusal is what makes that hold, and no layer gets an exemption from it.
63
70
@@ -75,7 +82,7 @@ The reconciler is idempotent, yields to any pre-existing membership, and never t
75
82
76
83
**What changes.** An authenticated caller with no active organization, writing to a walled tenant object, now gets `403 PERMISSION_DENIED` naming the missing organization where they previously got `2xx` and an unreadable row. This is a **wire-visible behaviour change** on a security boundary; it is breaking in the direction of refusing something that used to silently corrupt.
77
84
78
-
**What does not change.** Reads. System contexts. Platform operators. Single-posture deployments (no wall, Layer 0 inert). Objects that opted out of tenancy. The supplied-`organization_id` forge guard, which keeps its own semantics and its own message. #8158's landed fix.
85
+
**What does not change.** Reads. System contexts. ~~Platform operators.~~ Platform operators' reads, their updates of existing rows, and their inserts from a session with an active organization. *(Corrected by the 2026-10-20 amendment — a crossing operator's insert from a session with no active organization, of a row that names no organization, now gets D2's 403 where the engine answered 500; see the status block above.)* Single-posture deployments (no wall, Layer 0 inert). Objects that opted out of tenancy. The supplied-`organization_id` forge guard, which keeps its own semantics and its own message. #8158's landed fix.
79
86
80
87
**Dispositions this record carries.**#8208 becomes the D2 refusal — the silent NULL stamp is unreachable. #8245 becomes the D3 ordering fix — the first session mints with its organization, so its ledger rows carry a tenant.
helpText: "One URL per line. Must use https:// in production."
1533
+
helpText: "One URL per line. Web applications need https:// on a host other than localhost or another loopback address. Native applications may also use http:// on exactly localhost, 127.0.0.1 or [::1], on any port."
1534
1534
},
1535
1535
type: {
1536
1536
label: "Application Type",
1537
+
helpText: "Choose Native for a desktop or mobile app, or for an app in local development that redirects to http://localhost.",
0 commit comments