22
33/**
44 * [#10119] A sharing rule's CRITERIA sweep is scoped to the rule's own
5- * organization — and a platform-global rule's is still not.
5+ * organization — and a declared rule's deployment-wide projection is not.
66 *
77 * ## The defect
88 *
4949 *
5050 * ## [ADR-0131 D2/D8] Deployment-wide is a typed marker, never a NULL
5151 *
52- * The rule class these cases used to pin beside the org-stamped one was the
53- * "platform-global" `organization_id = null` row (#7795), swept unscoped.
54- * That branch is retired. A declared rule is deployment-wide by nature (D2)
55- * and carries a typed marker on its `single` projection; under a wall it is
52+ * A declared rule is deployment-wide by nature (D2) and carries a typed
53+ * marker on its `single` projection (`deploymentWide`); under a wall it is
5654 * served once per organization, each projection inside that organization's
5755 * one predicate (D8). A STORED row with no organization, in a deployment that
5856 * has organizations, is invalid state (certification leaves none): it sweeps
5957 * nothing and grants nothing, said once, loudly. Only a composition with no
6058 * organization object at all (a lean embedding) has no organization to scope
6159 * by, and there every rule is the deployment's.
6260 *
63- * The NULL-org RECORD is here for the third direction. [ADR-0131 D1, D14]
64- * NULL is not an owner: `applyTenantScope` emits `field = ?` alone, since 18.x
65- * retired the v17 `OR field IS NULL` arm after the upgrade ceremony, so an
66- * org-stamped sweep routed through the chokepoint does NOT reach `deal_p1`,
67- * while the platform-global sweep, which carries no scope, still does. A sweep
68- * that kept its own copy of the retired arm would grant it.
61+ * ## The organization-less RECORD, `deal_p1`
6962 *
70- * ## What `deal_p1` does and does NOT assert (#10103)
71- *
72- * It used to be justified as the platform bucket: a NULL organization marked a
73- * platform row that had to stay visible to every tenant (#2734, ADR-0120 D3).
74- * The ruling on #10103 superseded that reading (a row belonging to no
75- * organization is INVALID STATE, never a platform-wide default) and kept the
76- * arm as a driver-level compatibility note; ADR-0131 D14 retired the note with
77- * the ceremony that removes the rows it served. `deal_p1` stays as the record
78- * no organization's sweep reaches: a certified database holds no such row, so
79- * this is the shape a stray one would take, not a population a tenant relies on.
63+ * [ADR-0131 D1] NULL is not an owner: the driver's tenant predicate is
64+ * `field = ?` alone, so no sweep scoped to an organization reaches `deal_p1`,
65+ * and a sweep that kept a copy of its own wider predicate would grant it. Only
66+ * the deployment-wide sweep, which carries no tenant, reaches it, and stamps
67+ * nothing on its grant. A certified database holds no such record: this is
68+ * the shape a stray one would take, not a population a tenant relies on.
8069 */
8170
8271import { describe , it , expect , afterEach } from 'vitest' ;
@@ -193,7 +182,7 @@ const open: SqlDriver[] = [];
193182 * deal_b2 ORG_B stage=won <- second one, so a count cannot pass by luck
194183 * deal_p1 (null) stage=won <- organization-less row: no org-stamped
195184 * sweep reaches it (ADR-0131 D1), the
196- * platform-global one does — see the header.
185+ * deployment-wide one does — see the header.
197186 */
198187async function boot ( posture ?: 'single' | 'isolated' | 'group' , opts : BootOptions = { } ) : Promise < Booted > {
199188 const driver = new SqlDriver ( {
@@ -340,11 +329,9 @@ describe('[#10119] sharing-rule criteria sweep is scoped to the rule\'s organiza
340329 it ( 'a DECLARED rule under a wall is served per organization: each projection sweeps only its own' , async ( ) => {
341330 // [ADR-0131 D8] No projection sweeps the deployment under a wall: one
342331 // per organization, each inside that organization's one predicate, its
343- // grants stamped with it. The organization-less RECORD `deal_p1` is
344- // removed first: a certified database holds none, and whether one
345- // answers a tenant read is the driver's predicate, not the rule service's.
346- const { driver, rules, grantsAtRest } = await boot ( 'isolated' , { declared : [ DECLARED ] } ) ;
347- await driver . delete ( OBJECT , 'deal_p1' ) ;
332+ // grants stamped with it. No organization's projection reaches the
333+ // organization-less RECORD `deal_p1` (ADR-0131 D1, see the header).
334+ const { rules, grantsAtRest } = await boot ( 'isolated' , { declared : [ DECLARED ] } ) ;
348335 rules . setDeclaredRuleScopes ( [ ORG_A , ORG_B ] ) ;
349336
350337 await rules . evaluateRule ( DECLARED . name , SYSTEM ) ;
@@ -360,7 +347,7 @@ describe('[#10119] sharing-rule criteria sweep is scoped to the rule\'s organiza
360347 // Invalid state — certification leaves no such row, and the engine
361348 // stamps or refuses every new one (D9) — so it is planted through the
362349 // driver. ⛔ It must not become the deployment-wide sweep: that is the
363- // NULL arm the marker replaced.
350+ // organization-less branch the marker replaced.
364351 const { driver, rules, sharedRecordIds, errors } = await boot ( undefined , { organizations : true } ) ;
365352 await driver . create ( 'sys_sharing_rule' , {
366353 id : 'srule_orgless' , name : 'os10119_orgless_won' , label : 'Org-less won deals' , object_name : OBJECT ,
0 commit comments