feat(showcase,docs): ADR-0090 permission-model zoo + full docs alignment#2739
Merged
Conversation
Showcase now exercises the complete Permission Model v2 authoring surface (positions via typed factories, CRUD+FLS+RLS, org-depth read/write asymmetry, VAMA, systemPermissions, the isDefault everyone-suggestion, guest-safe capability, adminScope delegated administration anchored on a seeded sys_business_unit tree, externalSharingModel dials) and opts into the D6 access-matrix snapshot gate; guarded end-to-end by a new dogfood test. defineStack cross-reference validation learns that platform-provided (sys_/cloud_/ai_) objects are legitimate permission-grant and seed targets (ADR-0090 D12 delegated-admin shape; seed-loader parity), with tests. Docs: protocol/objectql/security.mdx rewritten to the v2 vocabulary; isProfile scrubbed from all authoring examples; dead identity/role reference link fixed; stale zod docstrings (rls/territory/sharing/tool/agent) rewritten and the security/ai references regenerated (adds the missing explain.mdx page). Deliberately NOT demoed (declared ≠ enforced): hierarchy depth scopes (enterprise hierarchy-security), tabPermissions (single-app package, ADR-0019 D3), owner-type sharing rules (seed-skipped [experimental]). Rename misses and platform bugs found while verifying are tracked in #2722 #2723 #2724 (vocabulary leftovers) and #2734 #2735 #2737 (fresh-boot org-RLS visibility, JSON-field seed batch inserts, count-scope leak). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
github-actions
Bot
added
documentation
Contributor
📓 Docs Drift CheckThis PR changes 4 package(s): 95 hand-written doc(s) reference the affected code and may need an implementation-accuracy re-verification:
|
This was referenced Jul 10, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Closes the "showcase + docs" follow-up to the ADR-0090 Permission Model v2 waves (#2697 #2708 #2711 #2716 #2717).
Showcase permission zoo (
examples/app-showcase)src/security/restructured intopositions.ts/permission-sets.ts/sharing-rules.ts(CRM convention), exercising the FULL v2 authoring surface:definePosition(stale pre-D3parentremoved)using+ write-timecheck)showcase_contributorreadScope: 'org'/writeScope: 'own')showcase_manager,showcase_executivepublic_readrepair)showcase_auditor/showcase_opssystemPermissions(setup.access)showcase_opsisDefaulteveryone-suggestion (D5), incl. personal data on aprivate-OWD objectshowcase_member_defaultguestanchor (D9)showcase_guest_portaladminScopedelegated administration (D12), BU-subtree + allowlistshowcase_field_ops_delegateexternalSharingModel(D11)private), account (public_read)sys_business_unitorg tree seeded with explicit idssrc/data/seed/unit_and_subordinates, enforced)share_new_inquiries_with_field_opsaccess-matrix.jsonDeliberately NOT demoed (declared ≠ enforced, Prime Directive #10): hierarchy depths (
own_and_reports/unit/unit_and_below— enterprisehierarchy-security; the open runtime fails closed anddefineStacknow errors on them),tabPermissions(an 'app' package carries at most one app, ADR-0019 D3), owner-type sharing rules (seed-skipped[experimental], kept as authoring-shape example with an honest comment).Runtime guard:
packages/dogfood/test/showcase-permission-zoo.dogfood.test.ts(12 tests) proves on the served stack: BU-tree seeding,admin_scopepersistence, OWD-private isolation, VAMA bypass (+ auditor write denial), explain-engine attribution of the granting set, delegated-admin positive/negative (subtree, allowlist incl. self,manageBindings: false), and the audience-anchor gate (everyone×high-privilege rejected, guest×guest-safe accepted). The D7 canary inshowcase-d7-default-profilemoved fromprivate_notetoshowcase_contact(the baseline now deliberately grants private notes).Spec
defineStackstrict cross-reference validation now treats platform-provided objects (sys_/cloud_/ai_) as legitimate permission-grant and seed targets — required by the D12 delegated-admin shape (CRUD on RBAC link tables) and by seeding the BU tree; mirrors the seed loader's own platform classification; typo net intact for the stack's own objects (tests added).Docs
content/docs/protocol/objectql/security.mdx— full rewrite of the stale sections (profiles removed, positions, canonical OWD four + D1 private default +externalSharingModel, position-scoped RLS, enforced sharing recipients +[experimental]honesty note).isProfilescrubbed fromui/forms.mdx,getting-started/common-patterns.mdx,concepts/architecture.mdx;ui/role-based-interfaces.mdxretitled "Audience-based interfaces"; dead/docs/references/identity/rolelink fixed toidentity/position;releases/implementation-status.mdxno longer claims OWD aliases parse; AI actor snippets usepositions(matchesToolExecutionContext); plugin-security README aligned; showcase security tour rewritten.rls/territory/sharing/tool/agent) andcontent/docs/references/**regenerated — including the previously never-generatedsecurity/explain.mdx(D6 contract reference).Verified
objectstack validate+compilegreen; D7 posture linter runs (one intentionalsecurity-private-no-readscopeinfo); D6 gate proven to fail on grant drift with the semantic diff ("showcase_member_defaultgains access toshowcase_private_note(create, read, edit)") before the snapshot was regenerated.everyone/guestanchors; member sees only their own private note while the auditor sees all (VAMA) — screenshots in session; FLS budget write 400 vs name 200; ops repairs another owner's announcement via Modify-All (member 403); anchor gate rejects everyone×auditor over REST with a self-explanatory 403; anonymous traffic default-denied while the public inquiry form (Option A) accepts 201.Out-of-scope findings filed
rolefield #2722RLSUserContextSchema.role(D3 miss, dead surface) · ADR-0090 D2 removal miss: PortalSchema still gates access byprofiles#2723 portalprofiles(D2 miss) · ADR-0090 D3 leftovers in plugin-sharing: sys_record_sharerolerecipient enum + "角色及下级" translations #2724sys_record_shareroleenum + stale translationsobjectstack devboot: tenant admin sees ZERO rows in sys_position / sys_permission_set / sys_business_unit over REST (Setup Access Control renders empty) #2734 fresh-boot tenant-RLS hides all RBAC rows from the admin (Setup Access Control empty) · Seed loader: JSON-object field values (location/hq) crash batch insert — showcase account/task/field_zoo seeds silently fail #2735 JSON-field seeds crash the batch insert path · Listtotalis not scoped by the read filter (row-count oracle) + platform-admin '*' wildcard VAMA does not widen private-object reads #2737 listtotalnot scoped by the read filter + platform-admin wildcard VAMA not widening private reads🤖 Generated with Claude Code