driver-memory 完全没有行级租户隔离(#3724 的未修姊妹面):多租户下静默不隔离

[os-zhuang]

一句话说明

@objectstack/driver-memory 没有任何行级租户隔离 —— 读路径不加租户谓词,写路径不打租户戳,distinct() 甚至不接受 options。这与 #3724(driver-mongodb,同为"整个能力根本不存在")是同一类,而 #3724 已经 closed as completed。

在 #6792(PR #6908,SQL 家族读侧收口点闸门)的范围审计中测得。发现者当时判断"姊妹卡已关闭,新卡只会被以冻结为由关掉",因而没有开卡;PM 复核时发现该前提反了 —— 见下。

事实(#6908 分支基线 6595262 上实测)

$ grep -c "tenantId\|organization_id" packages/drivers/driver-memory/src/memory-driver.ts
0

零匹配。另外 distinct(object, field, query?) 的签名里没有 options 参数,所以调用方即便想传 tenantId 也无处可传。

对照 #6908 刚刚在 SQL 家族上做的事:applyTenantScope 是读侧唯一收口点,getBuilder 构造的每个读 builder 都必须路由过去,并由 scripts/check-tenant-chokepoint.mjs 从 AST 逐次重新推导。driver-memory 不在该闸门的扫描集内,而且这不是因为 #5499 冻结 —— 是因为它根本不使用这套机制(文件里 getBuilder / applyTenantScope 均为零匹配)。闸门因此对它不产生任何判定,也就没有 DEBT 行可记:是一个真实的缺席,而不是被静默豁免。

为什么"姊妹卡已关闭"不是不开卡的理由

#3724 的关闭状态是 state_reason: completed,它自己给的处置是二选一:

• A. 实现行级租户隔离 —— 对齐 SQL driver 的租户列解析 / 读谓词 / 写打戳;
• B. 显式声明不支持多租户 —— 检测到多租户模式就启动时硬失败,而不是静默地不隔离(原卡倾向 B)。

packages/drivers/driver-mongodb 现有的 mongodb-tenancy-guard.ts 正是处置 B。也就是说 #3724 是被"修好"关掉的,不是被"不修"关掉的,先例指向与"不必开卡"相反的方向。

与 #5499 冻结的关系

冻结的理由独立成立(且 #5704 已把它从测试后端迁走),但 #3724-B 恰好是能穿过冻结的那种形状:启动期拒绝不是对该 driver 能力的投资,而是消除一个静默失败模式。#3724 原文的判断在这里同样适用:

当前状态——能在多租户下启动、且不隔离——都不该保留。

是否值得动、以及走 A 还是 B,是分诊/维护者的定级问题,不是本卡替谁作的决定。本卡只负责把这个面记录下来,并纠正那条会让它被静默丢弃的前提。

关联

• driver-mongodb 完全没有行级租户隔离:读不加谓词、写不打戳,多租户下跨租户可读写 #3724 —— driver-mongodb 的同类面,closed as completed,处置 B 已落地为 mongodb-tenancy-guard.ts
• [finding][drivers] SqlDriver.findWithWindowFunctions and analyzeQuery skip applyTenantScope — a row-returning read door outside the driver's "single chokepoint" for tenant isolation #6792 / PR fix(driver-sql): route every read door through the tenant chokepoint (#6792) #6908 —— 发现处;SQL 家族读侧收口点 + AST 闸门
• [裁决] driver-memory / driver-mongodb 投入冻结 —— 维护者 2026-08-05 口径（跨单锚点） #5499 —— driver-memory / driver-mongodb 投资冻结
• driver-memory 测试面替代:项目内测试后端迁到 sqlite :memory:(#5499 重启条件 · memory 半边,维护者 2026-08-06 立项) #5704 —— 已将 driver-memory 迁出测试后端

未认领,仅作记录。

[os-project-manager]

Triage (maintainer-authorized one-off pass, 2026-08-09, registered on #6015): promoted finding → pm:queue (domain:drivers kept), direction per the closed sister's precedent: disposition B — a boot-time hard failure when multi-tenant mode meets driver-memory, mirroring mongodb-tenancy-guard.ts (which is exactly how #3724 closed completed). A guard is compatible with the #5499 freeze — it invests nothing in the frozen driver's capabilities, it stops a silent non-isolation from ever serving traffic. Implementing real row-level isolation (A) stays behind the appetite door. The filer's correction stands: "sister card closed" meant fixed via B, not rejected — the same shape deserves the same guard.

---

Generated by Claude Code

[os-zhuang]

Maintainer ruling (2026-08-10, chat): #6915 and #7117 take pm:on-hold under #5499. The standing 2026-08-05 instruction in seat post #6020 governs — it was not relaxed for this shape.

Applied: pm:queue → pm:on-hold, domain:drivers kept. Unassigned; not dispatched.

This resolves the conflict raised at 09:0xZ (seat comment 5230719256) and repeated on #7117 (comment 5233324830): triage had queued this card, the seat deferred rather than override a triage label on its own reading, and the maintainer has now settled it in favour of the freeze.

Nothing about the finding is retracted. The measurement stands as filed — driver-memory has zero row-level tenant isolation, grep -c "tenantId\|organization_id" packages/drivers/driver-memory/src/memory-driver.ts → 0, and distinct(object, field, query?) does not even accept options. What changes is only its scheduling: it is held under the investment freeze rather than queued.

The #3724-shaped question in the body (A implement isolation vs B refuse loudly at startup) is likewise not withdrawn — it stays recorded here for whenever the freeze is revisited. The argument that route B is the shape that survives a freeze, because a startup refusal removes a silent failure rather than investing in the driver's capabilities, is on the record and unaffected by this ruling.

---

Generated by Claude Code