fix(security): compose an app-declared baseline WITH the platform member_default (#7555) (#7605)

A permission set marked `isDefault: true` became the deployment's ONLY
baseline — `fallbackPermissionSet` was a single name and the app's set went
into it — so every member of a baseline-declaring app silently lost the
platform floor. Measured on the showcase: all 10 built-in Account nav entries
served, 7/7 of the objects behind them 403.

ADR-0090 D5 rules the baseline additive without exception ("The fallback cliff
is abolished. ... `everyone` is additive like any other position: baseline u
explicit, always"). The human baseline is now the list of names it always was:
the declared set PLUS `member_default`, deduped, applied in the additive step,
the post-resolution fallback, the ADR-0106 D7 metadata-plane resolution, and
the boot-time `everyone`-anchor binding.

Unchanged on purpose: agent principals keep exactly their D10 restricted
ceiling, `null` still disables the baseline entirely, `member_default`'s grant
rows and the D5/D9 high-privilege anchor gate are untouched, and an app that
declares nothing resolves `['member_default']` exactly as before.


Claude-Session: https://claude.ai/code/session_01BVc1ekPpi6yaWywAUhfzfd

Co-authored-by: Claude <noreply@anthropic.com>

Author: os-help

.changeset/baseline-composes-with-platform.md

@@ -0,0 +1,44 @@
+---
+'@objectstack/plugin-security': patch
+'@objectstack/plugin-hono-server': patch
+'@objectstack/spec': patch
+---
+
+fix(security): an app-declared permission baseline COMPOSES with the platform `member_default` instead of replacing it (#7555)
+
+A permission set marked `isDefault: true` used to become the deployment's ONLY
+baseline: `SecurityPlugin`'s `fallbackPermissionSet` held a single name, and an
+app's declared set went into it, so every member of that app silently lost the
+platform floor. Measured on the showcase (#7555): a fresh member is served all
+10 built-in Account nav entries and 7/7 of the objects behind them answer 403,
+because `showcase_member_default` names no `sys_*` object and `member_default`
+was no longer in force for anyone in that app.
+
+That is the ADR-0090 D5 fallback cliff in its second spelling — D5 rules the
+baseline additive without exception ("The fallback cliff is abolished. …
+`everyone` is additive like any other position: baseline ∪ explicit, always")
+and narrows `isDefault` to a package-authored *suggestion*, "never a runtime
+fallback".
+
+The human baseline is now the list of names it always was: the declared set
+**plus** the platform `member_default`, deduped. Both are pushed into the
+per-request resolution, both back the post-resolution fallback and the ADR-0106
+D7 metadata-plane resolution, and both are bound to the `everyone` audience
+anchor at boot so `security/explain` and the Setup UI report the default a
+request actually applies. The composed list is published as a new
+`security.baselinePermissionSets` service, which `/auth/me/permissions` and
+`/me/apps` read so the capability and tab surface cannot disagree with the data
+plane; `security.fallbackPermissionSet` is unchanged and still means "the single
+name this deployment declared".
+
+Deliberately unchanged:
+
+- **Agent principals** keep exactly their ADR-0090 D10 restricted ceiling — the
+  composed human baseline is unreachable from `principalKind: 'agent'`.
+- **`fallbackPermissionSet: null`** still disables the baseline entirely; the
+  composition never re-adds one.
+- **`member_default`'s own grant rows**, the D5/D9 high-privilege anchor-binding
+  gate, and #5491's narrowing of the platform baseline to explicit-allow.
+
+An app that declares no `isDefault` set resolves `['member_default']` and is
+byte-for-byte unaffected.

packages/plugins/plugin-hono-server/src/current-user-endpoints.ts

@@ -312,6 +312,36 @@ function isWriteOptedIn(v: boolean | { enabled?: boolean } | undefined | null):
     return v === true || (typeof v === 'object' && v !== null && v.enabled === true);
 }
 
+/**
+ * [#7555, ADR-0090 D5] The baseline permission-set NAMES this deployment
+ * applies to a human principal — read from SecurityPlugin, never re-derived.
+ *
+ * The plugin registers `security.baselinePermissionSets` (the app-declared
+ * baseline COMPOSED with the platform `member_default`); this file's two
+ * resolutions must ask for that list rather than the single
+ * `security.fallbackPermissionSet` name, or an app that declares an `isDefault`
+ * set gets the pre-#7555 DISPLACEMENT here — its members' capability and tab
+ * surface computed from the app set alone, disagreeing with the data plane one
+ * function call away.
+ *
+ * The `security.fallbackPermissionSet` read is kept as the fallback for a
+ * SecurityPlugin too old to register the list, and the bare `member_default`
+ * default for a stack with no SecurityPlugin at all — both pre-existing
+ * behaviours, unchanged.
+ */
+function baselinePermissionSetNames(ctx: { getService: <T>(name: string) => T | undefined }): string[] {
+    const composed = (() => {
+        try { return ctx.getService<string[] | undefined>('security.baselinePermissionSets'); }
+        catch { return undefined; }
+    })();
+    if (Array.isArray(composed)) return composed;
+    const declared: string | null = (() => {
+        try { return ctx.getService<string | null>('security.fallbackPermissionSet') ?? 'member_default'; }
+        catch { return 'member_default'; }
+    })();
+    return declared ? [declared] : [];
+}
+
 /**
  * Buckets whose user-context generic writes are guarded fail-closed at the
  * engine: `better-auth` by plugin-auth's identity write guard (ADR-0092 D2),
@@ -665,10 +695,7 @@ export function registerCurrentUserEndpoints(
                 try { return ctx.getService<any[]>('security.bootstrapPermissionSets') ?? []; }
                 catch { return []; }
             })();
-            const fallbackName: string | null = (() => {
-                try { return ctx.getService<string | null>('security.fallbackPermissionSet') ?? 'member_default'; }
-                catch { return 'member_default'; }
-            })();
+            const fallbackNames: string[] = baselinePermissionSetNames(ctx);
             // DB loader: surfaces user-defined permission sets
             // (created via the admin UI as `sys_permission_set`
             // rows) that aren't in metadata or bootstrap.
@@ -737,9 +764,9 @@ export function registerCurrentUserEndpoints(
             let resolved: ResolvedPermissionSetLike[] = await evaluator
                 .resolvePermissionSets(requested, metadata, bootstrap, dbLoader)
                 .catch(() => []);
-            if (resolved.length === 0 && fallbackName) {
+            if (resolved.length === 0 && fallbackNames.length > 0) {
                 resolved = await evaluator
-                    .resolvePermissionSets([fallbackName], metadata, bootstrap, dbLoader)
+                    .resolvePermissionSets(fallbackNames, metadata, bootstrap, dbLoader)
                     .catch(() => []);
             }
             // Most-permissive merge of `objects` and `fields` across
@@ -915,10 +942,7 @@ export function registerCurrentUserEndpoints(
                         try { return ctx.getService<any[]>('security.bootstrapPermissionSets') ?? []; }
                         catch { return []; }
                     })();
-                    const fallbackName: string | null = (() => {
-                        try { return ctx.getService<string | null>('security.fallbackPermissionSet') ?? 'member_default'; }
-                        catch { return 'member_default'; }
-                    })();
+                    const fallbackNames: string[] = baselinePermissionSetNames(ctx);
                     const requested = [
                         ...((execCtx as any).positions ?? []),
                         ...((execCtx as any).permissions ?? []),
@@ -951,9 +975,9 @@ export function registerCurrentUserEndpoints(
                     let resolved: ResolvedPermissionSetLike[] = await evaluator
                         .resolvePermissionSets(requested, metadata, bootstrap, dbLoader)
                         .catch(() => []);
-                    if (resolved.length === 0 && fallbackName) {
+                    if (resolved.length === 0 && fallbackNames.length > 0) {
                         resolved = await evaluator
-                            .resolvePermissionSets([fallbackName], metadata, bootstrap, dbLoader)
+                            .resolvePermissionSets(fallbackNames, metadata, bootstrap, dbLoader)
                             .catch(() => []);
                     }
                     const tabRank: Record<string, number> = { hidden: 0, default_off: 1, default_on: 2, visible: 3 };

packages/plugins/plugin-security/src/app-default-permission-set.ts

@@ -1,17 +1,74 @@
 // Copyright (c) 2026 ObjectStack. Licensed under the Apache-2.0 license.
 
+/**
+ * [ADR-0090 D5, #7555] The PLATFORM's own human baseline permission set.
+ *
+ * Every authenticated human principal resolves this set in addition to whatever
+ * else they hold. It is the platform floor: read on the better-auth identity
+ * tables and self-service on the caller's own preference rows — the grants that
+ * keep `/auth/me`, the org switcher and the built-in Account app working for a
+ * member who holds no application profile at all. A platform app's platform
+ * object belongs here (maintainer ruling, 2026-08-11).
+ */
+export const PLATFORM_BASELINE_PERMISSION_SET = 'member_default';
+
+/**
+ * [#7555] The human baseline as the LIST of set names it actually is: the
+ * app/deployment-declared baseline COMPOSED WITH the platform baseline — never
+ * one displacing the other.
+ *
+ * ADR-0090 D5 rules the baseline additive without exception ("The fallback
+ * cliff is abolished. … `everyone` is additive like any other position:
+ * baseline ∪ explicit, always"), and narrows `isDefault` to "a package-authored
+ * *suggestion* consumed once at install time … never a runtime fallback". The
+ * interim wiring below (`appSecurityPluginOptions`) nevertheless funnels an
+ * app's `isDefault` set into a SINGLE `fallbackPermissionSet` name, so
+ * declaring one silently REPLACED `member_default` for every member of that
+ * app. That is the D5 cliff in its other spelling — an app-authoring decision
+ * costing members the entire platform floor — and #7555 measured what it does:
+ * on the showcase, all 10 built-in Account nav entries are served and 7/7 of
+ * the objects behind them answer 403, because the declared set names no `sys_*`
+ * object and `member_default` was no longer in force.
+ *
+ * The composition is safe by construction in one direction only, which is the
+ * direction that matters: the evaluator merges sets most-permissively, so
+ * adding the platform baseline back can only ADD grants for human principals.
+ * It is deliberately NOT a way to widen anything else —
+ *
+ *   • `null` still means "no baseline at all" and composes to `[]`. That is the
+ *     one escape hatch, and it is all-or-nothing on purpose: a deployment that
+ *     wants a floor NARROWER than the platform's states it by unbinding
+ *     `member_default` from the `everyone` anchor (the D5 end state), not by
+ *     naming a different set here.
+ *   • AGENT principals never reach this list at all — ADR-0090 D10 gives them a
+ *     restricted CEILING, not a human floor, and `resolvePermissionSetsForContext`
+ *     branches before it is consulted.
+ *
+ * Order is app-set-first, platform-second, and load-bearing only for the
+ * explain surface's reading order; the merge itself is order-independent.
+ */
+export function composeHumanBaselinePermissionSets(
+  configured: string | null | undefined,
+): string[] {
+  if (!configured) return [];
+  return configured === PLATFORM_BASELINE_PERMISSION_SET
+    ? [PLATFORM_BASELINE_PERMISSION_SET]
+    : [configured, PLATFORM_BASELINE_PERMISSION_SET];
+}
+
 /**
  * ADR-0090 D5 (interim wiring, supersedes ADR-0056 D7) — resolve the
  * app-declared default permission-set NAME from a stack's `permissions[]`.
  *
  * A permission set marked `isDefault` declares the app's suggested default
  * access posture. Until the built-in `everyone` position lands (ADR-0090 P2),
- * the CLI keeps using this name as the runtime fallback for users with no
- * explicit grants; P2 replaces the fallback mechanism with an install-time
- * suggestion bound to `everyone`.
+ * the CLI keeps using this name as the app's runtime baseline — composed with
+ * the platform baseline, never replacing it (see
+ * {@link composeHumanBaselinePermissionSets}, #7555); P2 replaces the mechanism
+ * with an install-time suggestion bound to `everyone`.
  *
  * Returns the first `isDefault` set's `name`, or `undefined` when none is
- * declared (callers then keep the built-in `member_default` fallback).
+ * declared (callers then run on the platform baseline alone).
  */
 export function appDefaultPermissionSetName(permissions: unknown): string | undefined {
   if (!Array.isArray(permissions)) return undefined;