From 8c551c63301e9abe53180755302a29abc4696d6a Mon Sep 17 00:00:00 2001 From: Claude Date: Sat, 24 Oct 2026 12:22:42 +0000 Subject: [PATCH 1/2] =?UTF-8?q?docs(adr):=20ADR-0138=20dated=20note=20?= =?UTF-8?q?=E2=80=94=20D5=20is=20built=20for=20the=20public=20form=20doors?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Claude-Session: https://claude.ai/code/session_01KzNShz7MFV7SFobNr9FWFf Co-authored-by: Claude --- ...principal-doors-grants-and-organization.md | 26 +++++++++++++++++++ 1 file changed, 26 insertions(+) diff --git a/docs/adr/0138-guest-model-anonymous-principal-doors-grants-and-organization.md b/docs/adr/0138-guest-model-anonymous-principal-doors-grants-and-organization.md index 4008d452a76..503e15d9733 100644 --- a/docs/adr/0138-guest-model-anonymous-principal-doors-grants-and-organization.md +++ b/docs/adr/0138-guest-model-anonymous-principal-doors-grants-and-organization.md @@ -25,6 +25,11 @@ D11 are unchanged. maintainer 「23267 我们的系统 和 salesforce 类似，暂时没有 没有公开站点或门户的产品计划」) — D3 item 5: the guest's bind door is built implementation-first, when a named deployment needs to grant the guest on a public surface; until then no door binds a set to `guest`, and the record carries the door's shape. +· **Note** (2026-10-24, ruling B on [#25447](https://github.com/objectstack-ai/objectstack/issues/25447), +[`6377889413`](https://github.com/objectstack-ai/objectstack/issues/25447#issuecomment-6377889413), +maintainer 「#9 同意」; card [#25574](https://github.com/objectstack-ai/objectstack/issues/25574)) — D5 is +built for the public form doors, in the shape [the note under D5](#d5--the-public-site-binding-shape-only-built-when-demand-arrives) +records; every other decision of this record is unchanged. **Decided by**: the maintainer's ruling on [#22146](https://github.com/objectstack-ai/objectstack/issues/22146) (comment [`6054113537`](https://github.com/objectstack-ai/objectstack/issues/22146#issuecomment-6054113537), decision batch #290 item 1, 2026-10-08, 「22146 同意」): **A on all eight questions, and G2 on the @@ -475,6 +480,27 @@ enforcer in the same change. The measured demand at `7b926f7600` is none: the re apps open public forms on a single organization, and the measurement round found the same in the hotcrm tree. The trigger is a named deployment that needs it. +**Note (2026-10-24): built for the public form doors.** Ruling B on +[#25447](https://github.com/objectstack-ai/objectstack/issues/25447) +([`6377889413`](https://github.com/objectstack-ai/objectstack/issues/25447#issuecomment-6377889413), +maintainer 「#9 同意」; the governing record per the reconciliation +[`6377958424`](https://github.com/objectstack-ai/objectstack/issues/25447#issuecomment-6377958424)), +verbatim: 「公共表单发布时绑定一个组织（URL 携带组织，授予通道按 #23224 解析 D4 的方式解析它），访客锚点的绑定在该组织下求值，ADR-0138 +其余不变」. The demand is a group of legal entities on one hosted environment, one organization each, each +publishing the same package's registration form. [#25641](https://github.com/objectstack-ai/objectstack/pull/25641) builds it, declaring the key with its +enforcer in the same change: + +| Element | As built | +|:--|:--| +| organization | `sharing.organizations` on the form (`@objectstack/spec/ui` `SharingConfigSchema`): a non-empty list of organization slugs the form is published to. The link names one, `/forms/SLUG?organization=ORG_SLUG`; the server reads the organization carrying a listed slug, as the system, and the submission acts in it (the write's `tenantId`: the row lands there and its number sequences count there). | +| match | the link's `organization` parameter, not a host or a path prefix. A bound form's link naming no organization, or one the form does not list, is answered as an unpublished form (`404 FORM_NOT_FOUND`) on both form doors; an unbound form's link naming one is refused the same way. Nothing falls back to the default organization. | +| guest grants | unchanged: the form doors keep the form grant (D2 class 1), now resolved under the bound organization. No set is bound to `guest` (D3 item 5). | +| allowed doors | the two public form doors (D2 class 1) only. The class 4 and 5 endpoint doors keep D4's located refusal on a multi-organization deployment. | + +A form that lists no organization keeps D4 exactly. The decision is +`packages/core/src/security/public-form-organization.ts#resolvePublicFormOrganization`; the doors ask it in +`packages/rest/src/form-routes.ts#registerFormEndpoints`. + ### D6 — Disclosure and explain: unchanged *Ruled: Q6 A.* ADR-0106 D7 stands: a caller resolving no set takes the configured fallback set on From 4512b4bb8aa856289776d12a4a1534869285069e Mon Sep 17 00:00:00 2001 From: Claude Date: Sat, 24 Oct 2026 12:29:36 +0000 Subject: [PATCH 2/2] docs(adr): name the D5 decision by its export, not a path the base does not hold yet Claude-Session: https://claude.ai/code/session_01KzNShz7MFV7SFobNr9FWFf Co-authored-by: Claude --- ...model-anonymous-principal-doors-grants-and-organization.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/docs/adr/0138-guest-model-anonymous-principal-doors-grants-and-organization.md b/docs/adr/0138-guest-model-anonymous-principal-doors-grants-and-organization.md index 503e15d9733..e5c6cea0863 100644 --- a/docs/adr/0138-guest-model-anonymous-principal-doors-grants-and-organization.md +++ b/docs/adr/0138-guest-model-anonymous-principal-doors-grants-and-organization.md @@ -497,8 +497,8 @@ enforcer in the same change: | guest grants | unchanged: the form doors keep the form grant (D2 class 1), now resolved under the bound organization. No set is bound to `guest` (D3 item 5). | | allowed doors | the two public form doors (D2 class 1) only. The class 4 and 5 endpoint doors keep D4's located refusal on a multi-organization deployment. | -A form that lists no organization keeps D4 exactly. The decision is -`packages/core/src/security/public-form-organization.ts#resolvePublicFormOrganization`; the doors ask it in +A form that lists no organization keeps D4 exactly. The decision is `resolvePublicFormOrganization` +(`@objectstack/core`, beside D4's guest-organization refusal); the doors ask it in `packages/rest/src/form-routes.ts#registerFormEndpoints`. ### D6 — Disclosure and explain: unchanged