fix(formula,lint): current_user 收进 SCOPE_ROOTS,字段级拒绝改为按面的真规则 (#6290)

`@objectstack/formula` 对同一个根说了两套话。`introspectScope` 把
`current_user` 作为合法命名空间交给作者,`checkRoleCatalog` 的四条
position 成员判定正则也全以它打头 —— 两处都对:ADR-0068 D1 把
`current_user` 定为**规范**拼写,`buildScope` 也确实把同一个 `EvalUser`
挂在它下面。只有 `cel-engine.ts` 的 `SCOPE_ROOTS` 不认,于是严格环境把
这个被祝福的拼写读成**裸字段引用**,而它的两个别名(`user`、`ctx`)
一路放行。

三处改动:

1. `SCOPE_ROOTS` 收下 `current_user`。该表是「永不 fault」的基线,不是
   逐面契约,现在它宣告的与本包别处宣告的一致。新增行为钉:
   `introspectScope` 报出的每个根都必须能在严格环境里解析。

2. 删掉错误修法提示。旧拒绝是基线遗漏的副产物,作者拿到的是**通用**
   裸字段诊断 ——「Write `record.current_user`」。这个形状在平台的任何
   一层都不绑定,照做的作者得到的东西比原来更糟,而且照样静默。字段级
   判定现在由 `@objectstack/lint` 里一条自己的规则给出,写明真实失败链
   (未绑定 ⇒ fault ⇒ 可见性 fallback 为 `true` ⇒ 本想藏起来的字段对所有
   人恒可见,#6146),并给出**真实存在**的处方:把谓词移到选项自己的
   `visibleWhen`、在权限集上声明字段级安全
   (`fields: { '<object>.<field>': { readable: false } }`)、或改写成
   `record` 谓词。覆盖共用同一求值器的 `visibleWhen` / `readonlyWhen` /
   `requiredWhen`。

3. option 级 `visibleWhen` 首次被校验。`validate-expressions.ts` 走完
   字段级条件规则就停了,于是 `SelectOption.visibleWhen` —— 一个客户端
   过滤、服务端强制的可授权 CEL 槽 —— 穿过 compile / validate / 运行期
   无人校验。裸字段引用、指向不存在字段、语法错误、误用 template 方言
   全部静默通过,选项只是从此不再出现。现在按 option value 定位逐条走查,
   与宿主字段同为 `record` scope。

两个面**故意**对 `current_user` 给出相反判定,因为求值器不同:字段级走
`evalFieldPredicate`(`record` + `previous` + `parent`,从不绑用户),
option 级走 `resolveCascadingOptions`,对宿主 predicate scope 求值,确实
绑定它(ADR-0068 / objectui#2284)。showcase 的角色门控选项
(`'admin' in current_user.positions`)此前从未撞上本规则,现在作为合法
用法被钉住。

Sweep:option 遍历生效后,三个示例应用(`app-showcase` / `app-crm` /
`app-todo`)的 `objectstack validate` 全部通过 —— 零新增 finding,包括
同时携带 record 级联与角色门控选项的那个 showcase 对象。

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_019Q7oc7ASjh8yxyS3Yz78We

Author: claude

.changeset/current-user-scope-root.md

@@ -0,0 +1,56 @@
+---
+"@objectstack/formula": patch
+"@objectstack/lint": patch
+---
+
+fix(formula,lint): `current_user` becomes a declared root, and its field-level rejection becomes a real rule (#6290)
+
+`@objectstack/formula` told two stories about one root. `introspectScope` handed
+`current_user` to authors as a legal namespace and `checkRoleCatalog`'s four
+position-membership regexes all lead with it — both correct, because ADR-0068 D1
+makes `current_user` THE canonical spelling and `buildScope` really does mount
+the same `EvalUser` under it. Only `cel-engine.ts`'s `SCOPE_ROOTS` disagreed, so
+the strict environment read the blessed spelling as a BARE FIELD REFERENCE while
+its two aliases (`user`, `ctx`) passed unremarked.
+
+Three things change.
+
+**1. `SCOPE_ROOTS` declares `current_user`.** That list is a "never faults"
+baseline, not a per-surface contract, and it now advertises exactly what the
+package advertises elsewhere. A new pin asserts the property directly: every
+root `introspectScope` reports must resolve in the strict env.
+
+**2. The wrong prescription is gone.** Because the rejection used to fall out of
+the baseline's omission, the author got the GENERIC bare-field diagnostic —
+"Write `record.current_user`". That shape binds on no layer of the platform, so
+an author who followed the message ended up with something strictly worse than
+what they started with, still silent. The field-level verdict now comes from a
+rule of its own in `@objectstack/lint`, which names the real failure (unbound ⇒
+fault ⇒ visibility falls back to `true` ⇒ the field a `current_user` test was
+meant to hide stays visible for everyone, #6146) and prescribes surfaces that
+exist: move the predicate to the option's own `visibleWhen`, declare field-level
+security on a permission set (`fields: { '<object>.<field>': { readable: false } }`),
+or rewrite it against `record`. It covers `visibleWhen`, `readonlyWhen` and
+`requiredWhen`, which share the one evaluator.
+
+**3. Per-option `visibleWhen` is validated at all.** `validate-expressions.ts`
+walked field-level conditional rules and stopped there, so `SelectOption.visibleWhen`
+— an authorable CEL slot the client filters on AND the server enforces — reached
+compile, validate and run time checked by nobody. A bare field reference, a
+reference to a field that does not exist, a syntax error or a template-dialect
+predicate in an option all shipped in silence, and the option simply never
+offered itself. Options are now walked, located by option value, on the same
+`record` scope as their host field.
+
+The two surfaces deliberately give opposite verdicts on `current_user`, because
+their evaluators differ: field-level rules go through `evalFieldPredicate`
+(`record` + `previous` + `parent`, never a user), options through
+`resolveCascadingOptions` against the host's predicate scope, which does bind it
+(ADR-0068 / objectui#2284). The showcase's role-gated option
+(`'admin' in current_user.positions`) had never met this rule before and is now
+pinned as the legal usage it is.
+
+Sweep: `objectstack validate` is clean on all three example apps
+(`app-showcase`, `app-crm`, `app-todo`) with the option walk active — zero new
+findings, including the showcase object that carries both a record-scoped
+cascade and the role-gated option.

packages/formula/src/cel-engine.ts

@@ -66,8 +66,40 @@ const SCOPE_ROOTS = [
   // (the submit-time snapshot) and `vars`. Declared here so the strict lint
   // env doesn't misread `current.x` as a bare field reference.
   'current',
+  // ADR-0068 D1's CANONICAL user root, and the last one this list was missing
+  // (#6290). `buildScope` mounts the same `EvalUser` object under
+  // `current_user` / `user` / `ctx.user` / `os.user` whenever the evaluation
+  // carries a user, and this package already told the rest of the platform so:
+  // `introspectScope` lists `current_user` among the roots it hands an author,
+  // and `checkRoleCatalog`'s four position-membership regexes all lead with it.
+  // Only this list disagreed — so the one spelling ADR-0068 calls canonical was
+  // the one spelling the strict env read as a BARE FIELD, while its two aliases
+  // (`user`, `ctx`) passed. One package, two accounts of the same root.
+  'current_user',
 ] as const;
 
+/*
+ * Why widening this list is the safe direction, and where the narrow verdict
+ * lives instead (#6290).
+ *
+ * This list is a "never faults" BASELINE, not a per-surface contract — the
+ * doc-comment above says so, and every entry is generous by construction. A
+ * surface that binds a CLOSED set of roots does not express that by hoping the
+ * baseline omits the others; it says so at the surface, through
+ * `collectCelRootIdentifiers` (that helper reads the AST and is completely
+ * independent of this list — see the approval-node approvers in #3447 P2, and
+ * `@objectstack/lint`'s field-level `*When` gate for `current_user`).
+ *
+ * That matters here because field- and section-level `visibleWhen` genuinely do
+ * NOT bind `current_user` (#6146, measured at both ends: `evalFieldPredicate`
+ * binds `record` + `previous` + `parent` and nothing else). Before #6290 that
+ * surface's rejection came out of this list's omission as a SIDE EFFECT, and it
+ * showed: the diagnostic was the generic bare-field one, so it prescribed
+ * "Write `record.current_user`" — a shape that binds on no layer at all. A
+ * verdict that belongs to one surface now reads as that surface's own rule,
+ * with that surface's own prescription.
+ */
+
 /**
  * A `record`-scoped environment (`unlistedVariablesAreDyn: false`) for detecting
  * bare field references. It reuses the real stdlib so function calls don't fault;

packages/formula/src/validate.test.ts

@@ -1,5 +1,6 @@
 import { describe, it, expect } from 'vitest';
 import { validateExpression, introspectScope, expectedDialect, inferExpressionType } from './validate';
+import { firstUndeclaredReference } from './cel-engine';
 
 describe('validateExpression (ADR-0032)', () => {
   describe('predicates (CEL)', () => {
@@ -343,6 +344,51 @@ describe('validateExpression (ADR-0032)', () => {
       expect(scope.roots).toContain('record');
       expect(scope.functions).toContain('daysFromNow');
     });
+
+    /**
+     * [#6290] The package must give ONE answer about what a root is.
+     *
+     * `introspectScope` is the roots list this package HANDS an author (and the
+     * agent authoring tool); `firstUndeclaredReference` is the strict env that
+     * JUDGES what an author wrote, off `cel-engine.ts`'s `SCOPE_ROOTS`. Nothing
+     * kept the two in step, and they had drifted on exactly the root ADR-0068
+     * D1 calls canonical: `current_user` was advertised here and read as a bare
+     * field reference there — so the one spelling the ADR blesses was the one
+     * spelling the validator refused, while its two aliases (`user`, `ctx`)
+     * passed.
+     *
+     * Pinned as behaviour rather than as list equality: `SCOPE_ROOTS` is a
+     * generous baseline and stays free to declare MORE than it advertises (it
+     * carries `trigger`, `step`, `parent`, … for sites this introspection does
+     * not describe). What it may never do again is advertise a root it then
+     * faults on. Delete `'current_user'` from `SCOPE_ROOTS` and this goes red.
+     */
+    it('every root `introspectScope` advertises really resolves in the strict env (#6290)', () => {
+      const advertised = introspectScope('predicate').roots;
+      expect(advertised).toContain('current_user');
+      const faulting = advertised.filter((root) => firstUndeclaredReference(`${root}.x`) !== null);
+      expect(faulting).toEqual([]);
+    });
+
+    /**
+     * [#6290] The same drift, seen from `checkRoleCatalog`'s side: its four
+     * position-membership regexes accept `current_user` / `user` / `ctx.user`
+     * as the user subject, so a role-catalog verdict on a `current_user`
+     * predicate was only ever reachable at sites that do not run the
+     * `record`-scope bare-ref check. All three spellings now reach it.
+     */
+    it('a role-catalog verdict is reachable through every ADR-0068 user spelling (#6290)', () => {
+      for (const subject of ['current_user', 'user', 'ctx.user']) {
+        const r = validateExpression('predicate', `'org_admni' in ${subject}.positions`, {
+          scope: 'record',
+          roleCatalog: ['org_admin', 'org_member'],
+        });
+        expect(r.ok).toBe(false);
+        // The role typo is the finding — not a bare reference to the subject.
+        expect(r.errors.map((e) => e.message).join('\n')).toContain('unknown role `org_admni`');
+        expect(r.errors.map((e) => e.message).join('\n')).not.toContain('bare reference');
+      }
+    });
   });
 });