Skip to content

Commit 236d39d

Browse files
committed
test(plugin-sharing): reconcile rule-criteria-org-scope with 7a-1 — no driver NULL arm, declared rules deployment-wide by marker
Claude-Session: https://claude.ai/code/session_01XFEb4fSDbe4fK94S3x5FKX Co-authored-by: Claude <noreply@anthropic.com>
1 parent 32b3d1c commit 236d39d

1 file changed

Lines changed: 15 additions & 28 deletions

File tree

‎packages/plugins/plugin-sharing/src/rule-criteria-org-scope.test.ts‎

Lines changed: 15 additions & 28 deletions
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22

33
/**
44
* [#10119] A sharing rule's CRITERIA sweep is scoped to the rule's own
5-
* organization — and a platform-global rule's is still not.
5+
* organization — and a declared rule's deployment-wide projection is not.
66
*
77
* ## The defect
88
*
@@ -49,34 +49,23 @@
4949
*
5050
* ## [ADR-0131 D2/D8] Deployment-wide is a typed marker, never a NULL
5151
*
52-
* The rule class these cases used to pin beside the org-stamped one was the
53-
* "platform-global" `organization_id = null` row (#7795), swept unscoped.
54-
* That branch is retired. A declared rule is deployment-wide by nature (D2)
55-
* and carries a typed marker on its `single` projection; under a wall it is
52+
* A declared rule is deployment-wide by nature (D2) and carries a typed
53+
* marker on its `single` projection (`deploymentWide`); under a wall it is
5654
* served once per organization, each projection inside that organization's
5755
* one predicate (D8). A STORED row with no organization, in a deployment that
5856
* has organizations, is invalid state (certification leaves none): it sweeps
5957
* nothing and grants nothing, said once, loudly. Only a composition with no
6058
* organization object at all (a lean embedding) has no organization to scope
6159
* by, and there every rule is the deployment's.
6260
*
63-
* The NULL-org RECORD is here for the third direction. [ADR-0131 D1, D14]
64-
* NULL is not an owner: `applyTenantScope` emits `field = ?` alone, since 18.x
65-
* retired the v17 `OR field IS NULL` arm after the upgrade ceremony, so an
66-
* org-stamped sweep routed through the chokepoint does NOT reach `deal_p1`,
67-
* while the platform-global sweep, which carries no scope, still does. A sweep
68-
* that kept its own copy of the retired arm would grant it.
61+
* ## The organization-less RECORD, `deal_p1`
6962
*
70-
* ## What `deal_p1` does and does NOT assert (#10103)
71-
*
72-
* It used to be justified as the platform bucket: a NULL organization marked a
73-
* platform row that had to stay visible to every tenant (#2734, ADR-0120 D3).
74-
* The ruling on #10103 superseded that reading (a row belonging to no
75-
* organization is INVALID STATE, never a platform-wide default) and kept the
76-
* arm as a driver-level compatibility note; ADR-0131 D14 retired the note with
77-
* the ceremony that removes the rows it served. `deal_p1` stays as the record
78-
* no organization's sweep reaches: a certified database holds no such row, so
79-
* this is the shape a stray one would take, not a population a tenant relies on.
63+
* [ADR-0131 D1] NULL is not an owner: the driver's tenant predicate is
64+
* `field = ?` alone, so no sweep scoped to an organization reaches `deal_p1`,
65+
* and a sweep that kept a copy of its own wider predicate would grant it. Only
66+
* the deployment-wide sweep, which carries no tenant, reaches it, and stamps
67+
* nothing on its grant. A certified database holds no such record: this is
68+
* the shape a stray one would take, not a population a tenant relies on.
8069
*/
8170

8271
import { describe, it, expect, afterEach } from 'vitest';
@@ -193,7 +182,7 @@ const open: SqlDriver[] = [];
193182
* deal_b2 ORG_B stage=won <- second one, so a count cannot pass by luck
194183
* deal_p1 (null) stage=won <- organization-less row: no org-stamped
195184
* sweep reaches it (ADR-0131 D1), the
196-
* platform-global one does — see the header.
185+
* deployment-wide one does — see the header.
197186
*/
198187
async function boot(posture?: 'single' | 'isolated' | 'group', opts: BootOptions = {}): Promise<Booted> {
199188
const driver = new SqlDriver({
@@ -340,11 +329,9 @@ describe('[#10119] sharing-rule criteria sweep is scoped to the rule\'s organiza
340329
it('a DECLARED rule under a wall is served per organization: each projection sweeps only its own', async () => {
341330
// [ADR-0131 D8] No projection sweeps the deployment under a wall: one
342331
// per organization, each inside that organization's one predicate, its
343-
// grants stamped with it. The organization-less RECORD `deal_p1` is
344-
// removed first: a certified database holds none, and whether one
345-
// answers a tenant read is the driver's predicate, not the rule service's.
346-
const { driver, rules, grantsAtRest } = await boot('isolated', { declared: [DECLARED] });
347-
await driver.delete(OBJECT, 'deal_p1');
332+
// grants stamped with it. No organization's projection reaches the
333+
// organization-less RECORD `deal_p1` (ADR-0131 D1, see the header).
334+
const { rules, grantsAtRest } = await boot('isolated', { declared: [DECLARED] });
348335
rules.setDeclaredRuleScopes([ORG_A, ORG_B]);
349336

350337
await rules.evaluateRule(DECLARED.name, SYSTEM);
@@ -360,7 +347,7 @@ describe('[#10119] sharing-rule criteria sweep is scoped to the rule\'s organiza
360347
// Invalid state — certification leaves no such row, and the engine
361348
// stamps or refuses every new one (D9) — so it is planted through the
362349
// driver. ⛔ It must not become the deployment-wide sweep: that is the
363-
// NULL arm the marker replaced.
350+
// organization-less branch the marker replaced.
364351
const { driver, rules, sharedRecordIds, errors } = await boot(undefined, { organizations: true });
365352
await driver.create('sys_sharing_rule', {
366353
id: 'srule_orgless', name: 'os10119_orgless_won', label: 'Org-less won deals', object_name: OBJECT,

0 commit comments

Comments
 (0)