test(dogfood): probe app-authored RLS wideners on the bulk write path (#6736) (#7274)

End-to-end probe, not a fix. #6736's acceptance section names an end-to-end
measurement as the first thing needed ("the mechanism above is a code read"),
and the maintainer's 2026-08-08 ruling on #5493 (Q2 = A1) deferred the fix for
this path with a stated reason: no measured pull. This supplies the missing
measurement and pins today's behaviour so it cannot change unobserved in
either direction.

Measured on the real stack (bootStack + real SecurityPlugin + real
SharingServicePlugin + real ObjectQL engine), app-authored RLS wideners on
update and delete:

  update({multi}): declaration admits 3 rows, statement touches 1, no error
  delete({multi}): declaration admits 3 rows, statement removes 1, no error

Both narrowed by the same predicate, `{ owner_id: <caller> }`, which
buildWriteFilter contributes and the bulk branch ANDs into the AST. Zero WARN
or ERROR lines in the whole run: the affected-row count is the only signal and
it names no authority.

Two discrimination controls keep the headline numbers meaningful: the same
principal / row / widener SUCCEEDS on the by-id path (so the declaration is
live, post-#5493), and a row the widener does not admit is still refused with
the ADR-0112 envelope (so the widener has a real boundary).


Claude-Session: https://claude.ai/code/session_01BM1tNf5U3nEbHKR4fo5qVQ

Co-authored-by: Claude <noreply@anthropic.com>

Author: os-zhuang

packages/qa/dogfood/test/bulk-widener-probe.dogfood.test.ts

@@ -0,0 +1,336 @@
+// Copyright (c) 2026 ObjectStack. Licensed under the Apache-2.0 license.
+//
+// [#6736] PROBE — app-authored RLS wideners on the BULK write path.
+//
+// ⚠️ This file PINS TODAY'S BEHAVIOUR, and today's behaviour is
+// defective-by-declaration. It is NOT a fix and must never be read as one.
+// The maintainer's 2026-08-08 ruling on #5493 (Q2 = A1) deliberately deferred
+// the only shape that could cover this path — a filter-shaped authored-only
+// write `FilterCondition` OR-composed into `buildWriteFilter` — with a stated
+// reason: no measured pull. #6736's own acceptance section names the missing
+// first step: "An end-to-end probe first (the mechanism above is a code read)."
+// This file IS that probe. Its job is to produce the numbers a future pricing
+// decision can rest on, and to fail loudly the day the behaviour changes in
+// either direction.
+//
+// ── The claim under test ──────────────────────────────────────────────────
+// The bulk write path (`update({multi})` / `delete({multi})`) ANDs
+// `SharingService.buildWriteFilter` into the query AST
+// (`plugin-sharing/src/sharing-plugin.ts`, the `// Bulk (multi) write` branch).
+// An app-authored RLS write-widener lives one layer away — `plugin-security`
+// ANDs `computeRlsFilter`'s answer into the SAME `ast.where`
+// (`plugin-security/src/security-plugin.ts`, step 3 "RLS filter injection").
+// Applicable RLS policies OR-combine, so the widener widens WITHIN the RLS
+// layer and is then INTERSECTED with sharing's owner-match. It therefore
+// cannot widen the row set at all on this path — and, unlike the by-id half
+// (#5493, which refuses loudly with FORBIDDEN), nothing says so: no error, no
+// 403, no envelope field, no log on that branch. The statement silently
+// touches FEWER rows than the declaration admits.
+//
+// ── Why the fixture is shaped this way ────────────────────────────────────
+// The object is `public_read` (OWD `read`) rather than `private`, deliberately:
+//   • `buildReadFilter` returns null for a non-`private` model, so READS are
+//     open and cannot confound the measurement. A `private` object would hide
+//     the cross-owner rows from the caller entirely, and a bulk write that
+//     touched nothing would be explained by read scoping rather than by the
+//     write composition — the probe would measure the wrong thing.
+//   • `buildWriteFilter` returns the owner-match for BOTH `private` and `read`
+//     (only a fully `public` object is write-open — see its doc comment). So on
+//     this object the sharing WRITE filter is the ONLY narrowing agent, which
+//     is exactly the composition under test, isolated.
+//
+// ── The discrimination controls ───────────────────────────────────────────
+// A bulk count of "1 out of 3" proves nothing on its own: an inert widener
+// (never parsed, never applicable) and a fixture that accidentally grants
+// ownership would each produce a confident-looking number. Two controls split
+// those apart, and both must hold for the headline count to mean anything:
+//   C1 the SAME principal, SAME row, SAME widener via the BY-ID path SUCCEEDS
+//      (post-#5493 / PR #6909). An inert widener would 403 here.
+//   C2 a row the widener does NOT admit is still REFUSED by-id, with the
+//      ADR-0112 envelope. A fixture that leaked ownership or disabled the gate
+//      would let this through.
+// Together: the declaration is live, it is genuinely a widener, its boundary
+// is real — and the bulk path still ignores it.
+
+import { describe, it, expect, beforeAll, afterAll } from 'vitest';
+import { defineStack, definePermissionSet } from '@objectstack/spec';
+import { ObjectSchema, Field } from '@objectstack/spec/data';
+import { bootStack, type VerifyStack } from '@objectstack/verify';
+import { resolveAuthzContext } from '@objectstack/core';
+import { SecurityPlugin, securityDefaultPermissionSets } from '@objectstack/plugin-security';
+
+// ── the app under probe ────────────────────────────────────────────────────
+
+const OBJECT = 'probe_note';
+
+/**
+ * Read-open, write-owned (`public_read` ⇒ effective OWD `read`), with the
+ * `owner_id` anchor record sharing enforces on. See the header for why this
+ * posture, and not `private`, is what isolates the composition under test.
+ */
+const ProbeNote = ObjectSchema.create({
+  name: OBJECT,
+  label: 'Probe Note',
+  pluralLabel: 'Probe Notes',
+  sharingModel: 'public_read',
+  fields: {
+    title: Field.text({ label: 'Title', required: true, maxLength: 160 }),
+    body: Field.text({ label: 'Body', maxLength: 2000 }),
+    stage: Field.text({ label: 'Stage', maxLength: 40 }),
+    owner_id: Field.lookup('sys_user', { label: 'Owner' }),
+  },
+});
+
+/**
+ * The app's declaration, in the author's own words: "any holder of this set may
+ * UPDATE a note in stage `open`, and DELETE a note in stage `stale`" — said
+ * about the ROW, never about its owner. Both policies are APP-AUTHORED (neither
+ * is the platform ownership floor `owner_only_writes` / `owner_only_deletes`),
+ * which is the provenance `checkAuthoredRowWrite` filters on.
+ *
+ * Not `isDefault` — it carries `allowDelete`, an anchor-forbidden bit
+ * (ADR-0090 D5) — so it is bound directly to the probe members below, exactly
+ * as `owner-anchor-and-bulk-writes.dogfood.test.ts` binds its delete grant.
+ */
+const ProbeWidenerSet = definePermissionSet({
+  name: 'probe_widener',
+  label: 'Probe — app-authored write wideners',
+  objects: {
+    [OBJECT]: { allowRead: true, allowCreate: true, allowEdit: true, allowDelete: true },
+  },
+  rowLevelSecurity: [
+    {
+      name: 'probe_open_stage_updates',
+      object: OBJECT,
+      operation: 'update',
+      using: "stage == 'open'",
+    },
+    {
+      name: 'probe_stale_stage_deletes',
+      object: OBJECT,
+      operation: 'delete',
+      using: "stage == 'stale'",
+    },
+  ],
+});
+
+const probeApp = defineStack({
+  manifest: {
+    id: 'com.example.bulkwidenerprobe',
+    namespace: 'probe',
+    version: '0.0.1',
+    type: 'app',
+    name: 'Bulk Widener Probe',
+    engines: { protocol: '^17' },
+  },
+  objects: [ProbeNote],
+  permissions: [ProbeWidenerSet],
+});
+
+const SYS = { isSystem: true } as const;
+
+interface Row { id: string; title: string; stage: string; owner_id: string; body?: string }
+
+describe('[#6736 PROBE] app-authored RLS wideners on the bulk write path', () => {
+  let stack: VerifyStack;
+  let ql: any;
+  let security: any;
+  let sharing: any;
+  let bobToken: string;
+  let bobId: string;
+  let aliceId: string;
+  let bobCtx: any;
+
+  /** The SAME authz context the REST entry point builds — never a hand-rolled principal. */
+  const authzFor = async (token: string) => {
+    const authService: any = await stack.kernel.getServiceAsync('auth');
+    let api: any = authService?.api;
+    if (!api && typeof authService?.getApi === 'function') api = await authService.getApi();
+    const headers = new Headers({ authorization: `Bearer ${token}` });
+    return resolveAuthzContext({
+      ql,
+      headers,
+      getSession: async (h: any) => api?.getSession?.({ headers: h }),
+    });
+  };
+
+  const seed = async (row: Row) =>
+    ql.insert(OBJECT, { ...row }, { context: { ...SYS } });
+
+  const rowsBySystem = async (where: Record<string, unknown> = {}): Promise<Row[]> =>
+    (await ql.find(OBJECT, { where, context: { ...SYS } })) as Row[];
+
+  const rowById = async (id: string): Promise<Row | null> =>
+    (await ql.findOne(OBJECT, { where: { id }, context: { ...SYS } })) as Row | null;
+
+  beforeAll(async () => {
+    stack = await bootStack(probeApp, {
+      // The app's own set must be resolvable alongside the platform seeds; the
+      // fallback stays the platform `member_default` so nothing about this
+      // fixture's baseline differs from an ordinary deployment's.
+      security: new SecurityPlugin({
+        defaultPermissionSets: [...securityDefaultPermissionSets, ProbeWidenerSet as any],
+        fallbackPermissionSet: 'member_default',
+      }),
+    });
+    await stack.signIn();                                   // seed dev admin (platform admin)
+    bobToken = await stack.signUp('probe-bob@verify.test');  // plain member
+    await stack.signUp('probe-alice@verify.test');           // plain member (row owner only)
+
+    ql = await stack.kernel.getServiceAsync('objectql');
+    security = await stack.kernel.getServiceAsync('security');
+    sharing = await stack.kernel.getServiceAsync('sharing');
+
+    const uid = async (email: string) =>
+      (await ql.findOne('sys_user', { where: { email }, context: { ...SYS } }))?.id;
+    bobId = await uid('probe-bob@verify.test');
+    aliceId = await uid('probe-alice@verify.test');
+    expect(bobId).toBeTruthy();
+    expect(aliceId).toBeTruthy();
+
+    const setRow = await ql.findOne('sys_permission_set', {
+      where: { name: 'probe_widener' }, context: { ...SYS },
+    });
+    expect(setRow?.id, 'the app-declared widener set is seeded').toBeTruthy();
+    await ql.insert('sys_user_permission_set',
+      { user_id: bobId, permission_set_id: setRow.id }, { context: { ...SYS } });
+
+    // UPDATE fixture: three rows the declaration admits (`stage: 'open'`), one
+    // of them Bob's; one row it does not admit, to bound the widener.
+    await seed({ id: 'n_bob_open',     title: 'bob open',     stage: 'open',   owner_id: bobId,   body: 'seed' });
+    await seed({ id: 'n_alice_open_1', title: 'alice open 1', stage: 'open',   owner_id: aliceId, body: 'seed' });
+    await seed({ id: 'n_alice_open_2', title: 'alice open 2', stage: 'open',   owner_id: aliceId, body: 'seed' });
+    await seed({ id: 'n_alice_closed', title: 'alice closed', stage: 'closed', owner_id: aliceId, body: 'seed' });
+
+    // DELETE fixture, same shape on the delete widener's own stage.
+    await seed({ id: 'd_bob_stale',     title: 'bob stale',     stage: 'stale', owner_id: bobId });
+    await seed({ id: 'd_alice_stale_1', title: 'alice stale 1', stage: 'stale', owner_id: aliceId });
+    await seed({ id: 'd_alice_stale_2', title: 'alice stale 2', stage: 'stale', owner_id: aliceId });
+
+    bobCtx = await authzFor(bobToken);
+  }, 180_000);
+
+  afterAll(async () => { await stack?.stop(); });
+
+  // ── probe integrity ──────────────────────────────────────────────────────
+  //
+  // Everything below is worthless if the fixture quietly handed Bob ownership
+  // or the widener never reached the resolver. Assert both BEFORE measuring.
+
+  it('[integrity] Bob holds the app-authored set and owns exactly ONE row of each fixture', async () => {
+    expect(bobCtx?.userId, 'the resolved principal is Bob').toBe(bobId);
+    expect(bobCtx?.permissions, 'the app-authored set resolved onto the context')
+      .toContain('probe_widener');
+    expect(bobCtx?.isSystem, 'the probe never runs as system').toBeFalsy();
+
+    const open = await rowsBySystem({ stage: 'open' });
+    const stale = await rowsBySystem({ stage: 'stale' });
+    expect(open.map((r) => r.id).sort()).toEqual(['n_alice_open_1', 'n_alice_open_2', 'n_bob_open']);
+    expect(stale.map((r) => r.id).sort()).toEqual(['d_alice_stale_1', 'd_alice_stale_2', 'd_bob_stale']);
+    expect(open.filter((r) => r.owner_id === bobId).map((r) => r.id)).toEqual(['n_bob_open']);
+    expect(stale.filter((r) => r.owner_id === bobId).map((r) => r.id)).toEqual(['d_bob_stale']);
+  });
+
+  // ── C1 / C2 — the discrimination controls ────────────────────────────────
+
+  it('[C1] the widener is LIVE: by-id, Bob updates a row he does not own but the declaration admits', async () => {
+    // Sharing refuses on its own terms; the middleware consults the authored
+    // verdict and defers (#5493 step 2 / PR #6909). If the widener were inert
+    // — unparsed, inapplicable, wrong object — this would be a 403 and every
+    // number below would be meaningless.
+    await expect(
+      sharing.checkEdit(OBJECT, 'n_alice_open_1', bobCtx),
+    ).resolves.toBe('deny');
+    await expect(
+      security.checkAuthoredRowWrite(OBJECT, 'n_alice_open_1', 'update', bobCtx),
+    ).resolves.toBe('admit');
+
+    const res = await stack.apiAs(bobToken, 'PATCH', `/data/${OBJECT}/n_alice_open_1`, { body: 'by-id-widened' });
+    expect(res.status, await res.text().catch(() => '')).toBeLessThan(300);
+    expect((await rowById('n_alice_open_1'))?.body).toBe('by-id-widened');
+
+    // put it back so the bulk measurement starts from a clean field
+    await ql.update(OBJECT, { body: 'seed' }, { where: { id: 'n_alice_open_1' }, context: { ...SYS } });
+  });
+
+  it('[C2] the widener has a BOUNDARY: by-id, a row it does NOT admit is still refused (ADR-0112 envelope)', async () => {
+    await expect(
+      security.checkAuthoredRowWrite(OBJECT, 'n_alice_closed', 'update', bobCtx),
+    ).resolves.toBe('abstain');
+
+    const res = await stack.apiAs(bobToken, 'PATCH', `/data/${OBJECT}/n_alice_closed`, { body: 'should-not-land' });
+    expect(res.status, 'a row outside the declaration must be refused').toBeGreaterThanOrEqual(400);
+    const envelope: any = await res.json().catch(() => ({}));
+    expect(
+      JSON.stringify(envelope),
+      'the refusal carries a real error envelope, not a bare throw',
+    ).toMatch(/FORBIDDEN|PERMISSION_DENIED/);
+    expect((await rowById('n_alice_closed'))?.body, 'the row is untouched').toBe('seed');
+  });
+
+  // ── the measurement ──────────────────────────────────────────────────────
+
+  it('[MEASURE update({multi})] the declaration admits 3 rows; the bulk statement touches 1, silently', async () => {
+    const declaredAdmitted: string[] = [];
+    for (const id of ['n_bob_open', 'n_alice_open_1', 'n_alice_open_2', 'n_alice_closed']) {
+      const verdict = await security.checkAuthoredRowWrite(OBJECT, id, 'update', bobCtx);
+      const owned = (await rowById(id))?.owner_id === bobId;
+      if (verdict === 'admit' || owned) declaredAdmitted.push(id);
+    }
+
+    // The exact narrowing predicate, named rather than inferred.
+    const writeFilter = await sharing.buildWriteFilter(OBJECT, bobCtx, 'update');
+
+    let threw: unknown = null;
+    let affected: unknown = null;
+    try {
+      affected = await ql.update(
+        OBJECT, { body: 'bulk-widened' },
+        { where: { stage: 'open' }, multi: true, context: bobCtx },
+      );
+    } catch (e) { threw = e; }
+
+    const touched = (await rowsBySystem({ stage: 'open' }))
+      .filter((r) => r.body === 'bulk-widened').map((r) => r.id).sort();
+
+    // eslint-disable-next-line no-console
+    console.log('[#6736 PROBE update]', JSON.stringify({
+      declaredAdmitted, writeFilter, affected, touched,
+      threw: threw ? String((threw as Error).message ?? threw) : null,
+    }, null, 2));
+
+    expect(declaredAdmitted.sort()).toEqual(['n_alice_open_1', 'n_alice_open_2', 'n_bob_open']);
+    expect(threw, 'the narrowing is SILENT — no error, no 403').toBeNull();
+    expect(touched, 'ONLY the caller-owned row is touched').toEqual(['n_bob_open']);
+    expect(affected, 'the affected-row count is the ONLY signal, and it names no authority').toBe(1);
+  });
+
+  it('[MEASURE delete({multi})] same reading on the delete path — 3 admitted, 1 removed, silently', async () => {
+    const declaredAdmitted: string[] = [];
+    for (const id of ['d_bob_stale', 'd_alice_stale_1', 'd_alice_stale_2']) {
+      const verdict = await security.checkAuthoredRowWrite(OBJECT, id, 'delete', bobCtx);
+      const owned = (await rowById(id))?.owner_id === bobId;
+      if (verdict === 'admit' || owned) declaredAdmitted.push(id);
+    }
+    const deleteFilter = await sharing.buildWriteFilter(OBJECT, bobCtx, 'delete');
+
+    let threw: unknown = null;
+    let affected: unknown = null;
+    try {
+      affected = await ql.delete(OBJECT, { where: { stage: 'stale' }, multi: true, context: bobCtx });
+    } catch (e) { threw = e; }
+
+    const survivors = (await rowsBySystem({ stage: 'stale' })).map((r) => r.id).sort();
+
+    // eslint-disable-next-line no-console
+    console.log('[#6736 PROBE delete]', JSON.stringify({
+      declaredAdmitted, deleteFilter, affected, survivors,
+      threw: threw ? String((threw as Error).message ?? threw) : null,
+    }, null, 2));
+
+    expect(declaredAdmitted.sort()).toEqual(['d_alice_stale_1', 'd_alice_stale_2', 'd_bob_stale']);
+    expect(threw, 'the narrowing is SILENT on delete too').toBeNull();
+    expect(survivors, "the two rows the declaration admits survive").toEqual(['d_alice_stale_1', 'd_alice_stale_2']);
+    expect(affected, 'again, only a count').toBe(1);
+  });
+});