Merge remote-tracking branch 'origin/main' into claude/issue-24865-template-read-organization

Claude-Session: https://claude.ai/code/session_01UmqzD97e14iws6hmVhgZ5y
Co-authored-by: Claude <noreply@anthropic.com>

Author: claude

.changeset/24583-7a2-organization-less-grant-readers-retired.md

@@ -0,0 +1,22 @@
+---
+'@objectstack/core': minor
+'@objectstack/plugin-security': minor
+'@objectstack/runtime': patch
+---
+
+feat(core,plugin-security)!: a grant applies only in its own organization — an organization-less grant row confers nothing, and the Default Organization's `admin_full_access` grant is the only platform-admin anchor
+
+Clause-②: yes (narrowing)
+
+<!-- adr-0087: not-required (no-migration-prescription) No key of any metadata schema is removed, renamed or re-shaped, so there is nothing for `objectstack migrate meta` to rewrite and no tombstone. The data change this relies on is the operator's ownership ceremony, `os migrate organization-ownership`, which an upgraded database must have passed before it boots. -->
+
+**BREAKING** for a stored grant row that carries no `organization_id` (`NULL`, absent or blank), shipped as `minor` under the repo's launch-window convention for breaking changes (ADR-0131 D10). After the ownership ceremony no such row exists: it attributes every one to an organization and makes the column NOT NULL, a server refuses a database it did not create or certify, and a fresh install that registers the organization object never writes one. So on a certified or fresh database nothing resolves differently.
+
+- **`resolveUserAuthzGrants` / `resolveAuthzContext` (`@objectstack/core`).** A `sys_user_position` or `sys_user_permission_set` row applies only while its organization is the active one. FROM: a row with no organization was "global" and applied in every resolution, including one with no active organization. TO: it applies nowhere, and a resolution with no active organization gets no stored grant at all.
+- **Platform-admin standing.** FROM: under `single`, an organization-less `admin_full_access` grant anchored `platform_admin`, beside the Default Organization's. TO: only the Default Organization's grant anchors it (still in every organization, and with none active). Walled postures are unchanged: standing there comes from `OS_PLATFORM_OWNER_EMAIL` alone.
+- **`bootstrapPlatformAdmin` (`@objectstack/plugin-security`).** The existing-admin check reads only the Default Organization's grant. When no Default Organization can be named (a walled posture, or none to name), it reads no grant at all. The walled "no owner email declared" error drops its sentence about a legacy unscoped grant row.
+- **The delegated-administration gate.** A held position counts toward self-delegation only when its row belongs to the caller's active organization. An organization-less holding, or a caller with no active organization, holds nothing there, which is what the resolver grants. An organization administrator's removal of an organization-less row is refused as "not one of the organization you administer".
+- **The run-lifecycle refusal (`@objectstack/runtime`).** Under `single` it now names the Default Organization's `admin_full_access` grant as the remedy, where it named an unscoped one.
+- **What a lean composition sees.** A composition that registers no organization object (`sys_organization`, which plugin-auth ships) still stores grants without an organization, and those grants now confer nothing. No shipped composition does this: `os serve` registers the security plugin only together with plugin-auth.
+
+**What an operator does.** Nothing beyond the upgrade itself: run `os migrate organization-ownership` before serving a database that 17.x or an 18.0 pre-release created. The server refuses such a database until you do. If an embedding composes `@objectstack/plugin-security` without plugin-auth, register the organization object so that grants carry an organization.

.changeset/24728-filterable-fields-residue.md

@@ -0,0 +1,43 @@
+---
+'@objectstack/lint': minor
+'@objectstack/metadata-protocol': patch
+'@objectstack/metadata-core': patch
+---
+
+fix(lint)!: `os lint` and the react-page props check report the retired list-view `filterableFields` by name, and the readers that still treated it as a field position go
+
+Clause-②: yes (narrowing)
+
+<!-- adr-0087: not-required (already-registered view-list-filterable-fields-removed, list-view-filterable-fields-retired) The key's retirement, its D2 conversion and its D3 entry are already registered by the change that tombstoned it, which shipped in 18.0.0. This change adds no key, conversion or stored shape: it makes `os lint` and the react-page props check give the verdict `os validate` and `os build` already give the list-view key, with the tombstone's own prescription. -->
+
+**BREAKING** (an authoring narrowing), shipped as `minor` under the launch-window convention for breaking changes.
+
+`@objectstack/spec` 18 retired the list view's `filterableFields` with a `retiredKey()` tombstone, so `os validate` and `os build` refuse it at the parse. Two authoring checks still read it as a live field position:
+
+- **`os lint`** never parses: it judges the normalized stack, and the conversion that strips the key is retired from the load path. On a JSON, YAML or raw-object source the key reached the list-view field-reference rule as written. A valid field name passed `os lint`, and a stale one was reported as an unknown field (`list-view-field-unknown` / `list-view-field-dotted`), never as the retirement.
+- **The react-page props check** read `<ListView filterableFields={[…]}>` as a field-bearing prop. A react page's source is parsed against no list-view schema, so `os validate`, `os build` and `os lint` passed the prop whenever its names resolved.
+
+Both now refuse the key by name, as an `error`, whatever it names:
+
+- a list view (every rung: an object's `listViews`, a `defineView` container's `list` / `listViews`, the flattened list overlay and the view item record) reports `list-view-key-retired` at `….filterableFields`, whether or not its object binding resolves;
+- `<ListView filterableFields>` on a react page reports `react-prop-retired`.
+
+The message names the retirement and the hint is the tombstone's own "Delete the key" sentence, read from `ListViewSchema` rather than retyped. The new rule id is exported from the package root as `LIST_VIEW_KEY_RETIRED`.
+
+### FROM → TO
+
+| before | after |
+| --- | --- |
+| `filterableFields: ['status']` on a list view in a non-`defineStack` source: `os lint` passed | `os lint` fails with `list-view-key-retired` |
+| `filterableFields: ['ghost']` on such a list view: `list-view-field-unknown` | `list-view-key-retired` |
+| `<ListView filterableFields={['status']} />` on a react page: passed every authoring command | `react-prop-retired` |
+
+**The one-line fix:** delete `filterableFields` (the key or the prop). For a curated end-user filter bar, declare `userFilters: { element: 'dropdown', fields: [{ field: 'status' }] }`; the Filter panel offers every field the user may read. `os migrate meta --from 17` lists the edits for existing metadata sources; a react page's source is yours to edit by hand.
+
+### The residue readers that go
+
+- **`@objectstack/lint`**: the list-view field-reference rule no longer walks `filterableFields` as a filter position (its severity and dotted-path maps), the field-consumer rule no longer counts it as a behavioural read, and `os explain list-view-field-unknown` / `list-view-field-dotted` no longer name it as a checked position.
+- **`@objectstack/metadata-protocol`**: `computeViewReferenceDiagnostics` no longer walks `filterableFields`, the same deletion its retired sibling `tabs` had. A stored body has the key stripped by the conversion replay before it is served, and the write door refuses it.
+- **`@objectstack/metadata-core`**: the ADR-0106 field-security scrub no longer classifies `filterableFields` as a list-view name list. A body that still carries the key goes the unclassified way and fails closed: a list view whose `filterableFields` names a field the caller may not read is dropped whole, where the scrub used to remove the name.
+
+⛔ **Untouched:** `userFilters` and `searchableFields` keep their meaning and their checks.

.changeset/24760-action-state-visibility.md

@@ -0,0 +1,17 @@
+---
+'@objectstack/platform-objects': patch
+---
+
+fix(platform-objects): Setup no longer offers Ban with Unban, Revoke with Restore, or Unlock on every account, whatever the record's state
+
+Clause-②: no (an action's offering: `visible` is judged in the console, and no server door reads it, so no accept set or served shape moves; if the dev measures a door that does, the dev stops, and the seat re-declares)
+
+Five row and record-header actions judged only the caller's standing, so Setup offered both halves of each pair on every row. Each now also reads the record's state, in the form `sys_oauth_application`'s Disable / Enable pair already uses:
+
+- `sys_user` (Setup › Users): *Ban User* is offered when `banned` is not true, *Unban User* when it is. A timed ban past `ban_expires` still reads banned until better-auth clears it at the user's next sign-in, so Unban stays offered for as long as the row says banned.
+- `sys_user`: *Unlock Account* is offered when `locked_until` is set, or when the user has two-factor enabled. Unlock also clears the second-factor lock, which lives on `sys_two_factor` and not on the user row, so a two-factor user keeps the button. An expired `locked_until` keeps it too: the failed-attempt counter stays at the threshold until Unlock or a successful sign-in resets it.
+- `sys_api_key` (Setup › API Keys): *Revoke API Key* is offered on a live key, *Restore API Key* on a revoked one.
+
+The `sys_user` actions keep their platform-admin standing (`current_user.isPlatformAdmin == true`) first. A row that does not carry the field offers neither action of a pair. The console asks for every field an object action's predicate reads, so the default Users list carries `banned` without showing it.
+
+Unchanged: labels, texts, targets and params, and what the ban, unban, unlock and key routes accept and answer. Who may restore a key that a forced password reset revoked is still decided by the server.

packages/cloud-connection/src/cloud-connection-auth-gate.pin.test.ts

@@ -267,17 +267,22 @@ const APP = {
 };
 const LEDGER_FILE = 'com.acme.gated.json';
 
-/** Every test user holds the authoring capability, so a refusal below is the gate's alone. */
+/**
+ * Every test user holds the authoring capability, so a refusal below is the gate's alone:
+ * the `admin_full_access` grant owned by the Default Organization, which applies with no
+ * active organization.
+ */
 function grantRows(): Record<string, any[]> {
     return {
+        sys_organization: [{ id: 'org_default', slug: 'default' }],
         sys_user: Object.keys(POSTURES).map((id) => ({ id, email: `${id}@acme.test` })),
         sys_member: [],
         sys_user_position: [],
         sys_position: [],
         sys_metadata_activation: [],
         sys_position_permission_set: [],
         sys_user_permission_set: Object.keys(POSTURES).map((id, i) => ({
-            id: `ups${i}`, user_id: id, permission_set_id: 'ps1', permission_set: 'admin_full_access', organization_id: null,
+            id: `ups${i}`, user_id: id, permission_set_id: 'ps1', permission_set: 'admin_full_access', organization_id: 'org_default',
         })),
         sys_permission_set: [{ id: 'ps1', name: 'admin_full_access', system_permissions: ['manage_metadata', 'studio.access', 'setup.access'] }],
     };

packages/cloud-connection/src/cloud-connection-plugin.test.ts

@@ -56,19 +56,24 @@ function makeC(url: string, body?: any) {
     };
 }
 
+/** The organization the sessions act in, and the one {@link setupAccessEngine}'s grant is owned by. */
+const ORG = 'o1';
+
 const sessionAuth = (userId?: string) => ({
-    api: { getSession: async () => (userId ? { user: { id: userId } } : null) },
+    api: { getSession: async () => (userId ? { user: { id: userId }, session: { activeOrganizationId: ORG } } : null) },
 });
 
 /**
  * [#24148] A data engine under which `userId` holds `setup.access` — what
  * `/status` serves its full answer behind. Real permission-set rows, read by
- * the shared resolver through `find`.
+ * the shared resolver through `find`. The grant is owned by {@link ORG}, the
+ * organization the session acts in: a grant applies only in its own
+ * organization.
  */
 const setupAccessEngine = (userId: string) => {
     const rows: Record<string, any[]> = {
         sys_user: [{ id: userId, email: `${userId}@example.test` }],
-        sys_user_permission_set: [{ id: 'ups_1', user_id: userId, permission_set_id: 'ps_1', permission_set: 'setup_admin', organization_id: null }],
+        sys_user_permission_set: [{ id: 'ups_1', user_id: userId, permission_set_id: 'ps_1', permission_set: 'setup_admin', organization_id: ORG }],
         sys_permission_set: [{ id: 'ps_1', name: 'setup_admin', system_permissions: ['setup.access'] }],
     };
     return bindCatalogFromTables({ find: async (object: string) => rows[object] ?? [] }, rows);

packages/cloud-connection/src/cloud-connection-runtime-version.pin.test.ts

@@ -35,10 +35,11 @@ const CC = '/api/v1/cloud-connection';
 const ORIGIN = 'https://env.example.test';
 const CLOUD = 'http://cloud.test';
 
-/** Holds `setup.access`, which the two bind doors demand. */
+/** Holds `setup.access`, which the two bind doors demand — in {@link ORG}, the organization the session acts in. */
 const ADMIN = 'u_admin';
+const ORG = 'o1';
 const GRANTS: Record<string, any[]> = {
-    sys_user_permission_set: [{ id: 'ups_1', user_id: ADMIN, permission_set_id: 'ps_1', permission_set: 'setup_admin', organization_id: null }],
+    sys_user_permission_set: [{ id: 'ups_1', user_id: ADMIN, permission_set_id: 'ps_1', permission_set: 'setup_admin', organization_id: ORG }],
     sys_permission_set: [{ id: 'ps_1', name: 'setup_admin', system_permissions: ['setup.access'] }],
 };
 
@@ -95,7 +96,7 @@ async function mount(mode: Mode, discovery: Discovery) {
         post: (p: string, h: Handler) => routes.set(`POST ${p}`, h),
     };
     const hooks = new Map<string, any>();
-    const auth = { api: { getSession: async () => ({ user: { id: ADMIN }, session: { id: 'sess_admin' } }) } };
+    const auth = { api: { getSession: async () => ({ user: { id: ADMIN }, session: { id: 'sess_admin', activeOrganizationId: ORG } }) } };
     const objectql = bindCatalogFromTables({ find: async (object: string) => GRANTS[object] ?? [] }, GRANTS);
     const protocol = discovery === 'real'
         ? discoveryProducer()

packages/cloud-connection/src/cloud-connection-setup-access.pin.test.ts

@@ -38,20 +38,22 @@ import { bindCatalogFromTables } from './__tests__/security-catalog.testkit.js';
 const CC = '/api/v1/cloud-connection';
 const ORIGIN = 'https://env.example.test';
 
-/** Holds `setup.access` through an unscoped grant (the platform-admin shape). */
+/** Holds `setup.access` through the Default Organization's `admin_full_access` grant (the platform-admin shape: it applies with no active organization). */
 const ADMIN = 'u_setup_admin';
 /** Holds `setup.access` through a grant scoped to the organization its session is active in (the organization-admin shape). */
 const ORG_ADMIN = 'u_org_admin';
-/** Signed in, holds a permission set, and the set carries no `setup.access`. */
+/** Signed in, holds a permission set in the organization its session is active in, and the set carries no `setup.access`. */
 const MEMBER = 'u_member';
-/** Holds `setup.access`, but the ADR-0069 policy holds the session. */
+/** Holds `setup.access` (the platform-admin shape, as {@link ADMIN}), but the ADR-0069 policy holds the session. */
 const HELD_ADMIN = 'u_held_admin';
 
 const ORG = 'org_a';
+/** The Default Organization — the owner of the one `admin_full_access` grant that anchors platform standing. */
+const DEFAULT_ORG = 'org_default';
 const SESSIONS: Record<string, { activeOrganizationId?: string; authGate?: { code: string; message: string } }> = {
     [ADMIN]: {},
     [ORG_ADMIN]: { activeOrganizationId: ORG },
-    [MEMBER]: {},
+    [MEMBER]: { activeOrganizationId: ORG },
     [HELD_ADMIN]: { authGate: { code: 'PASSWORD_EXPIRED', message: 'You must change your password before continuing.' } },
 };
 
@@ -61,18 +63,20 @@ const ADMIN_KEY = 'osk_setup_admin_key_24148';
 function grantRows(): Record<string, any[]> {
     return {
         sys_user: Object.keys(SESSIONS).map((id) => ({ id, email: `${id}@example.test` })),
+        sys_organization: [{ id: DEFAULT_ORG, slug: 'default' }, { id: ORG, slug: 'org-a' }],
         sys_member: [{ id: 'mem_1', user_id: ORG_ADMIN, organization_id: ORG, role: 'admin' }],
         sys_user_position: [],
         sys_position: [],
         sys_metadata_activation: [],
         sys_position_permission_set: [],
         sys_user_permission_set: [
-            { id: 'ups_admin', user_id: ADMIN, permission_set_id: 'ps_setup', permission_set: 'setup_admin', organization_id: null },
+            { id: 'ups_admin', user_id: ADMIN, permission_set_id: 'ps_full', permission_set: 'admin_full_access', organization_id: DEFAULT_ORG },
             { id: 'ups_org_admin', user_id: ORG_ADMIN, permission_set_id: 'ps_setup', permission_set: 'setup_admin', organization_id: ORG },
-            { id: 'ups_held', user_id: HELD_ADMIN, permission_set_id: 'ps_setup', permission_set: 'setup_admin', organization_id: null },
-            { id: 'ups_member', user_id: MEMBER, permission_set_id: 'ps_member', permission_set: 'member_basic', organization_id: null },
+            { id: 'ups_held', user_id: HELD_ADMIN, permission_set_id: 'ps_full', permission_set: 'admin_full_access', organization_id: DEFAULT_ORG },
+            { id: 'ups_member', user_id: MEMBER, permission_set_id: 'ps_member', permission_set: 'member_basic', organization_id: ORG },
         ],
         sys_permission_set: [
+            { id: 'ps_full', name: 'admin_full_access', system_permissions: ['manage_metadata', 'studio.access', 'setup.access'] },
             { id: 'ps_setup', name: 'setup_admin', system_permissions: ['setup.access'] },
             { id: 'ps_member', name: 'member_basic', system_permissions: ['export_data'] },
         ],

packages/cloud-connection/src/connection-credential-store.test.ts

@@ -55,15 +55,18 @@ function makeRawApp() {
         post: (p: string, h: Handler) => routes.set(`POST ${p}`, h),
     };
 }
-const sessionAuth = (userId?: string) => ({ api: { getSession: async () => (userId ? { user: { id: userId } } : null) } });
+/** The organization the sessions act in, and the one {@link ADMIN_GRANTS}' grant is owned by. */
+const ORG = 'o1';
+const sessionAuth = (userId?: string) => ({ api: { getSession: async () => (userId ? { user: { id: userId }, session: { activeOrganizationId: ORG } } : null) } });
 /**
  * [#24148] The suites below sign in as `admin`, who must hold `setup.access` to
  * reach the connection-changing doors (their subject is the credential, not the
  * permission — that is `cloud-connection-setup-access.pin.test.ts`). Real
- * permission-set rows, read by the shared resolver through `find`.
+ * permission-set rows, read by the shared resolver through `find`; the grant is
+ * owned by {@link ORG}, the organization the session acts in.
  */
 const ADMIN_GRANTS: Record<string, any[]> = {
-    sys_user_permission_set: [{ id: 'ups_1', user_id: 'admin', permission_set_id: 'ps_1', permission_set: 'setup_admin', organization_id: null }],
+    sys_user_permission_set: [{ id: 'ups_1', user_id: 'admin', permission_set_id: 'ps_1', permission_set: 'setup_admin', organization_id: ORG }],
     sys_permission_set: [{ id: 'ps_1', name: 'setup_admin', system_permissions: ['setup.access'] }],
 };
 /**

packages/cloud-connection/src/error-envelope.conformance.test.ts

@@ -189,12 +189,13 @@ async function mountCloudConnection(opts: {
     const hooks = new Map<string, any>();
     const auth = {
         api: {
-            getSession: async () => (opts.userId ? { user: { id: opts.userId }, session: {} } : null),
+            // The session acts in `o1`, the organization the grant below is owned by.
+            getSession: async () => (opts.userId ? { user: { id: opts.userId }, session: { activeOrganizationId: 'o1' } } : null),
         },
     };
     const grantRows: Record<string, any[]> = opts.userId && opts.setupAccess !== false
         ? {
-            sys_user_permission_set: [{ id: 'ups_1', user_id: opts.userId, permission_set_id: 'ps_1', permission_set: 'setup_admin', organization_id: null }],
+            sys_user_permission_set: [{ id: 'ups_1', user_id: opts.userId, permission_set_id: 'ps_1', permission_set: 'setup_admin', organization_id: 'o1' }],
             sys_permission_set: [{ id: 'ps_1', name: 'setup_admin', system_permissions: ['setup.access'] }],
         }
         : {};