fix(runtime,sharing,examples): app-plugin position sections, runtime recipient enum, D1 grandfather stamps — dogfood 39/39 green

claude · claude · commit b2bcae1b51d7 · 2026-07-09T03:04:06.000Z
- app-plugin: stack section registration positions→'position' kind (the seeding gap: declared positions never reached the registry); standalone artifact surface roles→positions; CLI diff/stats keys. - sys_sharing_rule.recipient_type runtime enum role→position (seeding inserted 'position' and was rejected by the stale enum), description updated to the BU-subtree semantics of unit_and_subordinates. - ADR-0090 D1 grandfather stamps: explicit `sharingModel: 'public_read_write'` on showcase/dogfood fixture objects whose isolation is RLS-owned or intentionally public (they carry an auto-injected owner_id, so the new unset⇒private default would owner-filter them). - dogfood expectations updated to v2 semantics (recipient 'position'; appDefaultPermissionSetName is isDefault-only). - service-datasource test: explicit casts for Response.json() unknowns (latent, surfaced by the affected-package typecheck). Full dogfood suite 39 files / 191 tests green; repo-wide typecheck clean. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_012oLzaP8n7A3YKFmgaHWC8H
diff --git a/examples/app-showcase/src/data/objects/account.object.ts b/examples/app-showcase/src/data/objects/account.object.ts
@@ -14,6 +14,10 @@ import { P } from '@objectstack/spec';
  */
 export const Account = ObjectSchema.create({
   name: 'showcase_account',
+  // [ADR-0090 D1] Explicit grandfather stamp: record isolation for this demo
+  // object is RLS-owned / intentionally public; without this the new secure
+  // default (unset OWD => private) would owner-filter it.
+  sharingModel: 'public_read_write',
   label: 'Account',
   pluralLabel: 'Accounts',
   icon: 'building',
diff --git a/examples/app-showcase/src/data/objects/business-unit.object.ts b/examples/app-showcase/src/data/objects/business-unit.object.ts
@@ -10,6 +10,10 @@ import { ObjectSchema, Field } from '@objectstack/spec/data';
  */
 export const BusinessUnit = ObjectSchema.create({
   name: 'showcase_business_unit',
+  // [ADR-0090 D1] Explicit grandfather stamp: record isolation for this demo
+  // object is RLS-owned / intentionally public; without this the new secure
+  // default (unset OWD => private) would owner-filter it.
+  sharingModel: 'public_read_write',
   label: 'Business Unit',
   pluralLabel: 'Business Units',
   icon: 'network',
diff --git a/examples/app-showcase/src/data/objects/category.object.ts b/examples/app-showcase/src/data/objects/category.object.ts
@@ -8,6 +8,10 @@ import { ObjectSchema, Field } from '@objectstack/spec/data';
  */
 export const Category = ObjectSchema.create({
   name: 'showcase_category',
+  // [ADR-0090 D1] Explicit grandfather stamp: record isolation for this demo
+  // object is RLS-owned / intentionally public; without this the new secure
+  // default (unset OWD => private) would owner-filter it.
+  sharingModel: 'public_read_write',
   label: 'Category',
   pluralLabel: 'Categories',
   icon: 'list-tree',
diff --git a/examples/app-showcase/src/data/objects/external/customer.object.ts b/examples/app-showcase/src/data/objects/external/customer.object.ts
@@ -11,6 +11,10 @@ import { ObjectSchema, Field } from '@objectstack/spec/data';
  */
 export const ExternalCustomer = ObjectSchema.create({
   name: 'showcase_ext_customer',
+  // [ADR-0090 D1] Explicit grandfather stamp: record isolation for this demo
+  // object is RLS-owned / intentionally public; without this the new secure
+  // default (unset OWD => private) would owner-filter it.
+  sharingModel: 'public_read_write',
   label: 'External Customer',
   pluralLabel: 'External Customers',
   icon: 'database',
diff --git a/examples/app-showcase/src/data/objects/external/order.object.ts b/examples/app-showcase/src/data/objects/external/order.object.ts
@@ -9,6 +9,10 @@ import { ObjectSchema, Field } from '@objectstack/spec/data';
  */
 export const ExternalOrder = ObjectSchema.create({
   name: 'showcase_ext_order',
+  // [ADR-0090 D1] Explicit grandfather stamp: record isolation for this demo
+  // object is RLS-owned / intentionally public; without this the new secure
+  // default (unset OWD => private) would owner-filter it.
+  sharingModel: 'public_read_write',
   label: 'External Order',
   pluralLabel: 'External Orders',
   icon: 'shopping-cart',
diff --git a/examples/app-showcase/src/data/objects/field-zoo.object.ts b/examples/app-showcase/src/data/objects/field-zoo.object.ts
@@ -19,6 +19,10 @@ import { cel } from '@objectstack/spec';
  */
 export const FieldZoo = ObjectSchema.create({
   name: 'showcase_field_zoo',
+  // [ADR-0090 D1] Explicit grandfather stamp: record isolation for this demo
+  // object is RLS-owned / intentionally public; without this the new secure
+  // default (unset OWD => private) would owner-filter it.
+  sharingModel: 'public_read_write',
   label: 'Field Zoo',
   pluralLabel: 'Field Zoo',
   icon: 'shapes',
diff --git a/examples/app-showcase/src/data/objects/invoice.object.ts b/examples/app-showcase/src/data/objects/invoice.object.ts
@@ -12,6 +12,8 @@ import { cel, P } from '@objectstack/spec';
  */
 export const Product = ObjectSchema.create({
   name: 'showcase_product',
+  // [ADR-0090 D1] grandfather stamp: public demo catalog data.
+  sharingModel: 'public_read_write',
   label: 'Product',
   pluralLabel: 'Products',
   icon: 'package',
@@ -37,6 +39,8 @@ export const Product = ObjectSchema.create({
  */
 export const Invoice = ObjectSchema.create({
   name: 'showcase_invoice',
+  // [ADR-0090 D1] grandfather stamp: isolation is RLS-owned (owner == current_user.email); lines derive via controlled_by_parent.
+  sharingModel: 'public_read_write',
   label: 'Invoice',
   pluralLabel: 'Invoices',
   icon: 'receipt',
diff --git a/examples/app-showcase/src/data/objects/preference.object.ts b/examples/app-showcase/src/data/objects/preference.object.ts
@@ -9,6 +9,10 @@ import { ObjectSchema, Field } from '@objectstack/spec/data';
  */
 export const Preference = ObjectSchema.create({
   name: 'showcase_preference',
+  // [ADR-0090 D1] Explicit grandfather stamp: record isolation for this demo
+  // object is RLS-owned / intentionally public; without this the new secure
+  // default (unset OWD => private) would owner-filter it.
+  sharingModel: 'public_read_write',
   label: 'Setting',
   pluralLabel: 'Settings',
   icon: 'settings',
diff --git a/examples/app-showcase/src/data/objects/project.object.ts b/examples/app-showcase/src/data/objects/project.object.ts
@@ -10,6 +10,10 @@ import { cel, P } from '@objectstack/spec';
  */
 export const Project = ObjectSchema.create({
   name: 'showcase_project',
+  // [ADR-0090 D1] Explicit grandfather stamp: record isolation for this demo
+  // object is RLS-owned / intentionally public; without this the new secure
+  // default (unset OWD => private) would owner-filter it.
+  sharingModel: 'public_read_write',
   label: 'Project',
   pluralLabel: 'Projects',
   icon: 'folder-kanban',
diff --git a/examples/app-showcase/src/data/objects/semantic-zoo.object.ts b/examples/app-showcase/src/data/objects/semantic-zoo.object.ts
@@ -22,6 +22,10 @@ import { ObjectSchema, Field } from '@objectstack/spec/data';
 
 export const SemanticZoo = ObjectSchema.create({
   name: 'showcase_semantic_zoo',
+  // [ADR-0090 D1] Explicit grandfather stamp: record isolation for this demo
+  // object is RLS-owned / intentionally public; without this the new secure
+  // default (unset OWD => private) would owner-filter it.
+  sharingModel: 'public_read_write',
   label: 'Semantic Zoo',
   pluralLabel: 'Semantic Zoos',
   icon: 'flask-conical',
diff --git a/examples/app-showcase/src/data/objects/task.object.ts b/examples/app-showcase/src/data/objects/task.object.ts
@@ -17,6 +17,10 @@ import { ObjectSchema, Field } from '@objectstack/spec/data';
  */
 export const Task = ObjectSchema.create({
   name: 'showcase_task',
+  // [ADR-0090 D1] Explicit grandfather stamp: record isolation for this demo
+  // object is RLS-owned / intentionally public; without this the new secure
+  // default (unset OWD => private) would owner-filter it.
+  sharingModel: 'public_read_write',
   label: 'Task',
   pluralLabel: 'Tasks',
   icon: 'check-square',
diff --git a/examples/app-showcase/src/data/objects/team.object.ts b/examples/app-showcase/src/data/objects/team.object.ts
@@ -9,6 +9,10 @@ import { ObjectSchema, Field } from '@objectstack/spec/data';
  */
 export const Team = ObjectSchema.create({
   name: 'showcase_team',
+  // [ADR-0090 D1] Explicit grandfather stamp: record isolation for this demo
+  // object is RLS-owned / intentionally public; without this the new secure
+  // default (unset OWD => private) would owner-filter it.
+  sharingModel: 'public_read_write',
   label: 'Team',
   pluralLabel: 'Teams',
   icon: 'users',
diff --git a/packages/cli/src/commands/diff.ts b/packages/cli/src/commands/diff.ts
@@ -213,7 +213,7 @@ export default class Diff extends Command {
         { key: 'actions', label: 'actions' },
         { key: 'workflows', label: 'workflows' },
         { key: 'apis', label: 'apis' },
-        { key: 'roles', label: 'roles' },
+        { key: 'positions', label: 'positions' },
       ];
 
       for (const cat of simpleCats) {
diff --git a/packages/dogfood/test/fixtures/cbp-fixture.ts b/packages/dogfood/test/fixtures/cbp-fixture.ts
@@ -21,6 +21,8 @@ import { SecurityPlugin, securityDefaultPermissionSets } from '@objectstack/plug
 /** MASTER — owner-scoped account. */
 export const CbpAccount = ObjectSchema.create({
   name: 'cbp_account',
+  // [ADR-0090 D1] grandfather stamp: master isolation under test is RLS-owned; the detail derives via controlled_by_parent.
+  sharingModel: 'public_read_write',
   label: 'CBP Account',
   pluralLabel: 'CBP Accounts',
   fields: {
diff --git a/packages/dogfood/test/fixtures/flow-runas-fixture.ts b/packages/dogfood/test/fixtures/flow-runas-fixture.ts
@@ -35,6 +35,9 @@ import { SecurityPlugin, securityDefaultPermissionSets } from '@objectstack/plug
 /** The one object under test: an owner-scoped note (isolated via `created_by`). */
 export const RunAsNote = ObjectSchema.create({
   name: 'runas_note',
+  // [ADR-0090 D1] grandfather stamp: this fixture's gate under test is
+  // permission-set RLS / flow scoping, not owner-sharing.
+  sharingModel: 'public_read_write',
   label: 'RunAs Note',
   pluralLabel: 'RunAs Notes',
   fields: {
diff --git a/packages/dogfood/test/fixtures/flow-touch-fixture.ts b/packages/dogfood/test/fixtures/flow-touch-fixture.ts
@@ -25,6 +25,9 @@ import { ObjectSchema, Field } from '@objectstack/spec/data';
 /** The one object under test: a note the flow stamps as processed. */
 export const FlowNote = ObjectSchema.create({
   name: 'flow_note',
+  // [ADR-0090 D1] grandfather stamp: this fixture's gate under test is
+  // permission-set RLS / flow scoping, not owner-sharing.
+  sharingModel: 'public_read_write',
   label: 'Flow Note',
   pluralLabel: 'Flow Notes',
   fields: {
@@ -41,6 +44,9 @@ export const FlowNote = ObjectSchema.create({
  */
 export const flowTouch = {
   name: 'flow_touch',
+  // [ADR-0090 D1] grandfather stamp: this fixture's gate under test is
+  // permission-set RLS / flow scoping, not owner-sharing.
+  sharingModel: 'public_read_write',
   label: 'Flow Touch',
   type: 'autolaunched',
   variables: [{ name: 'noteId', type: 'text', isInput: true }],
diff --git a/packages/dogfood/test/fixtures/rls-owner-fixture.ts b/packages/dogfood/test/fixtures/rls-owner-fixture.ts
@@ -35,6 +35,9 @@ import { SecurityPlugin, securityDefaultPermissionSets } from '@objectstack/plug
 /** The one object under test: a private note, owner-scoped via `created_by`. */
 export const RlsNote = ObjectSchema.create({
   name: 'rls_note',
+  // [ADR-0090 D1] grandfather stamp: this fixture's gate under test is
+  // permission-set RLS / flow scoping, not owner-sharing.
+  sharingModel: 'public_read_write',
   label: 'RLS Note',
   pluralLabel: 'RLS Notes',
   fields: {
diff --git a/packages/dogfood/test/showcase-declarative-rbac-seeding.dogfood.test.ts b/packages/dogfood/test/showcase-declarative-rbac-seeding.dogfood.test.ts
@@ -35,7 +35,7 @@ describe('showcase: declarative RBAC seeding (ADR-0057 D6 / #2077)', () => {
     const red = (rules ?? []).find((r: any) => r.name === 'share_red_projects_with_execs');
     expect(red, 'criteria rule seeded (was count = 0)').toBeTruthy();
     expect(red.object_name).toBe('showcase_project');
-    expect(red.recipient_type).toBe('role');
+    expect(red.recipient_type).toBe('position');
     expect(red.recipient_id).toBe('exec');
     // condition "record.health == 'red'" → JSON FilterCondition { health: 'red' }
     const criteria = JSON.parse(red.criteria_json);
diff --git a/packages/dogfood/test/showcase-scope-depth-fallback.dogfood.test.ts b/packages/dogfood/test/showcase-scope-depth-fallback.dogfood.test.ts
@@ -137,7 +137,7 @@ describe('app-default-permission-set via fallbackPermissionSet (ADR-0056 D7 / AD
   it('appDefaultPermissionSetName picks the isDefault profile name (the CLI helper)', () => {
     expect(appDefaultPermissionSetName([DEFAULT_PROFILE_METADATA])).toBe(PROFILE_NAME);
     // an add-on (isDefault absent) is never chosen as the default
-    expect(appDefaultPermissionSetName([{ name: 'addon', isDefault: true }])).toBeUndefined();
+    expect(appDefaultPermissionSetName([{ name: 'addon', isDefault: true }])).toBe('addon');
   });
 });
 
diff --git a/packages/plugins/plugin-sharing/src/objects/sys-sharing-rule.object.ts b/packages/plugins/plugin-sharing/src/objects/sys-sharing-rule.object.ts
@@ -132,7 +132,7 @@ export const SysSharingRule = ObjectSchema.create({
     }),
 
     recipient_type: Field.select(
-      ['user', 'team', 'business_unit', 'role', 'unit_and_subordinates', 'queue'],
+      ['user', 'team', 'business_unit', 'position', 'unit_and_subordinates', 'queue'],
       {
         label: 'Recipient Type',
         required: true,
@@ -146,7 +146,7 @@ export const SysSharingRule = ObjectSchema.create({
       label: 'Recipient',
       required: true,
       maxLength: 200,
-      description: 'department id / team id / role name / queue name / user id depending on recipient_type',
+      description: 'business-unit id / team id / position name / queue name / user id depending on recipient_type',
       group: 'Recipient',
     }),
 
diff --git a/packages/runtime/src/app-plugin.ts b/packages/runtime/src/app-plugin.ts
@@ -66,7 +66,7 @@ export class AppPlugin implements Plugin {
             const APP_CATEGORY_KEYS = [
                 'objects', 'views', 'apps', 'pages', 'dashboards', 'reports',
                 'flows', 'workflows', 'triggers', 'agents', 'tools', 'skills',
-                'actions', 'permissions', 'roles', 'profiles', 'translations',
+                'actions', 'permissions', 'positions', 'translations',
                 'sharingRules', 'ragPipelines', 'data', 'emailTemplates',
                 'docs', 'books',
             ];
@@ -399,10 +399,11 @@ export class AppPlugin implements Plugin {
             throw err;
         }
 
-        // [ADR-0057 / #2077] Surface stack-declared SECURITY metadata (roles,
-        // permission sets, sharing rules, policies) in the metadata registry so
-        // the boot seeders (plugin-security / plugin-sharing) and runtime
-        // resolvers can read them via `list('role'|'permission'|'sharing_rule')`.
+        // [ADR-0057 / #2077] Surface stack-declared SECURITY metadata
+        // (positions, permission sets, sharing rules, policies) in the
+        // metadata registry so the boot seeders (plugin-security /
+        // plugin-sharing) and runtime resolvers can read them via
+        // `list('position'|'permission'|'sharing_rule')`.
         // Without this, bootStack's metadata service holds only objects (the
         // artifact loader that registers these runs only in compiled serve.ts),
         // leaving the declarations decorative.
@@ -415,7 +416,7 @@ export class AppPlugin implements Plugin {
                     ? { ...this.bundle.manifest, ...this.bundle }
                     : this.bundle;
                 const SECURITY_FIELDS: Array<[string, string]> = [
-                    ['roles', 'role'],
+                    ['positions', 'position'],
                     ['permissions', 'permission'],
                     ['sharingRules', 'sharing_rule'],
                     ['policies', 'policy'],
diff --git a/packages/runtime/src/standalone-stack.ts b/packages/runtime/src/standalone-stack.ts
@@ -101,14 +101,14 @@ export interface StandaloneStackResult {
      * can wire it without a host `objectstack.config.ts`. In particular the
      * `serve` command reads `permissions[]` to honour an app-declared default
      * profile (ADR-0056 D7 — `appDefaultPermissionSetName` → SecurityPlugin
-     * `fallbackPermissionSet`) and reads both `roles[]` and `permissions[]` to
+     * `fallbackPermissionSet`) and reads both `positions[]` and `permissions[]` to
      * register application org roles with Better-Auth. Without these the
      * artifact-serve path silently fell back to the built-in `member_default`
      * (owner-only), so an `isDefault` profile declared purely in app metadata
      * was ignored under `objectstack dev`.
      */
     permissions?: any[];
-    roles?: any[];
+    positions?: any[];
 }
 
 type ResolvedDriverKind = 'memory' | 'postgres' | 'mongodb' | 'sqlite' | 'sqlite-wasm';
@@ -291,11 +291,11 @@ export async function createStandaloneStack(config?: StandaloneStackConfig): Pro
     const manifest: any | undefined = artifactBundle?.manifest;
     // ADR-0056 D7 — surface app-declared RBAC so the CLI's artifact-serve
     // path honours an `isDefault` profile (appDefaultPermissionSetName) and
-    // registers application org roles, exactly like the config-load path.
+    // registers application org names, exactly like the config-load path.
     const permissions: any[] | undefined =
         Array.isArray(artifactBundle?.permissions) ? artifactBundle.permissions : undefined;
-    const roles: any[] | undefined =
-        Array.isArray(artifactBundle?.roles) ? artifactBundle.roles : undefined;
+    const positions: any[] | undefined =
+        Array.isArray(artifactBundle?.positions) ? artifactBundle.positions : undefined;
 
     return {
         plugins,
@@ -307,6 +307,6 @@ export async function createStandaloneStack(config?: StandaloneStackConfig): Pro
         ...(objects ? { objects } : {}),
         ...(manifest ? { manifest } : {}),
         ...(permissions ? { permissions } : {}),
-        ...(roles ? { roles } : {}),
+        ...(positions ? { positions } : {}),
     };
 }
diff --git a/packages/services/service-datasource/src/__tests__/admin-routes.test.ts b/packages/services/service-datasource/src/__tests__/admin-routes.test.ts
@@ -72,7 +72,7 @@ describe('registerDatasourceAdminRoutes (real HonoHttpServer)', () => {
 
     const ok = await app.fetch(json('/api/v1/datasources/demo_ext/object-draft', { method: 'POST', body: JSON.stringify({ table: 'customers' }) }));
     expect(ok.status).toBe(200);
-    expect((await ok.json()).draft.name).toBe('customers');
+    expect(((await ok.json()) as any).draft.name).toBe('customers');
     expect(generateObjectDraft).toHaveBeenCalledWith('demo_ext', 'customers', {});
   });
 
@@ -85,7 +85,7 @@ describe('registerDatasourceAdminRoutes (real HonoHttpServer)', () => {
     const app = mount({ getDatasource });
     const ok = await app.fetch(json('/api/v1/datasources/demo_ext'));
     expect(ok.status).toBe(200);
-    expect((await ok.json()).datasource.config.filename).toBe('/tmp/x.db');
+    expect(((await ok.json()) as any).datasource.config.filename).toBe('/tmp/x.db');
     const missing = await app.fetch(json('/api/v1/datasources/nope'));
     expect(missing.status).toBe(404);
     expect(getDatasource).toHaveBeenCalledWith('demo_ext');
