feat!: adopt ObjectStack Permission Model v2 (ADR-0090 / spec 13) (#438)

os-zhuang · claude · web-flow · commit d29c214ec323 · 2026-07-10T12:47:11.000+08:00
- Bump all @objectstack/* deps ^12.3.0 → ^13.0.0
- Sharing recipients: role → position; role_and_subordinates →
  position (positions are flat in v2 — hierarchy belongs to the
  business-unit tree, which this app does not model, so the grants
  target the director/manager position directly)
- Role hierarchy → flat CrmPositions (config key roles → positions);
  territory teams join the position list
- Profiles: isProfile removed (ADR-0090 D2 retired the concept); the
  six permission bundles remain plain permission sets
- Explicit sharingModel authored on all 15 objects per the D7 security
  posture linter (values follow the old decorative OrganizationDefaults:
  campaign/product/knowledge public_read, contact controlled_by_parent,
  rest private); dead OrganizationDefaults export removed
- Approval flow approvers keep type 'role' — spec 13's sole D3
  exception (better-auth sys_member.role)

Co-authored-by: Claude Fable 5 &lt;noreply@anthropic.com&gt;
diff --git a/objectstack.config.ts b/objectstack.config.ts
@@ -22,7 +22,7 @@ import {
   AccountTeamSharingRule, TerritorySharingRules,
   OpportunitySalesSharingRule,
   CaseEscalationSharingRule,
-  RoleHierarchy,
+  CrmPositions,
 } from './src/sharing/index.js';
 
 import { allHooks } from './src/hooks/index.js';
@@ -96,9 +96,8 @@ export default defineStack({
     CaseEscalationSharingRule,
     ...TerritorySharingRules,
   ],
-  roles: RoleHierarchy.roles.map((r: { name: string; label: string; parentRole: string | null }) => ({
-    name: r.name,
-    label: r.label,
-    parent: r.parentRole ?? undefined,
-  })),
+  // ADR-0090 D3: positions are flat capability-distribution groups — the v1
+  // role hierarchy's parent links are gone (hierarchy belongs to the
+  // business-unit tree, which this app does not model).
+  positions: CrmPositions,
 });
diff --git a/package.json b/package.json
@@ -26,17 +26,17 @@
   },
   "packageManager": "pnpm@10.33.0",
   "dependencies": {
-    "@objectstack/account": "^12.3.0",
-    "@objectstack/cli": "^12.3.0",
-    "@objectstack/driver-memory": "^12.3.0",
-    "@objectstack/driver-sql": "^12.3.0",
-    "@objectstack/driver-sqlite-wasm": "^12.3.0",
-    "@objectstack/metadata": "^12.3.0",
-    "@objectstack/objectql": "^12.3.0",
-    "@objectstack/runtime": "^12.3.0",
-    "@objectstack/service-analytics": "^12.3.0",
-    "@objectstack/service-automation": "^12.3.0",
-    "@objectstack/spec": "^12.3.0"
+    "@objectstack/account": "^13.0.0",
+    "@objectstack/cli": "^13.0.0",
+    "@objectstack/driver-memory": "^13.0.0",
+    "@objectstack/driver-sql": "^13.0.0",
+    "@objectstack/driver-sqlite-wasm": "^13.0.0",
+    "@objectstack/metadata": "^13.0.0",
+    "@objectstack/objectql": "^13.0.0",
+    "@objectstack/runtime": "^13.0.0",
+    "@objectstack/service-analytics": "^13.0.0",
+    "@objectstack/service-automation": "^13.0.0",
+    "@objectstack/spec": "^13.0.0"
   },
   "optionalDependencies": {
     "better-sqlite3": "^12.11.1"
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
diff --git a/src/objects/account.object.ts b/src/objects/account.object.ts
@@ -9,6 +9,9 @@ export const Account = ObjectSchema.create({
   pluralLabel: 'Accounts',
   icon: 'building',
   description: 'Companies and organizations doing business with us',
+
+  // ADR-0090 D1/D7: OWD is an authored decision. Owner + sharing rules (team/territory grants below).
+  sharingModel: 'private',
   // ADR-0079: render-only `titleFormat` retired in favor of `nameField`,
   // which names a real field. The former template composed two local fields, so
   // a `display_title` formula field reproduces it for the record title.
diff --git a/src/objects/campaign.object.ts b/src/objects/campaign.object.ts
@@ -13,6 +13,9 @@ export const Campaign = ObjectSchema.create({
   pluralLabel: 'Campaigns',
   icon: 'megaphone',
   description: 'Marketing campaigns and initiatives',
+
+  // ADR-0090 D1/D7: OWD is an authored decision. Campaign catalog is org-visible; only owners edit.
+  sharingModel: 'public_read',
   // ADR-0079: render-only `titleFormat` retired in favor of `nameField`,
   // which names a real field. The former template composed two local fields, so
   // a `display_title` formula field reproduces it for the record title.
diff --git a/src/objects/campaign_member.object.ts b/src/objects/campaign_member.object.ts
@@ -16,10 +16,12 @@ export const CampaignMember = ObjectSchema.create({
   icon: 'user-plus',
   description: 'Membership and response tracking for marketing campaigns',
 
+  // ADR-0090 D1/D7: OWD is an authored decision. Follows the campaign team's ownership; lookup child (not master-detail).
+  sharingModel: 'private',
+
   // @objectstack 12: the dead object-level `enable.trackHistory` flag was
   // removed (ADR-0049) — per-field history is opt-in via `Field.trackHistory`
-  // (ADR-0052), set on `status` below. Master-detail children still inherit the
-  // master's sharing automatically (sharingModel enum has no controlled-by-parent).
+  // (ADR-0052), set on `status` below.
 
   highlightFields: ['crm_campaign', 'crm_lead', 'crm_contact', 'status', 'response_date'],
 
diff --git a/src/objects/case.object.ts b/src/objects/case.object.ts
@@ -10,6 +10,9 @@ export const Case = ObjectSchema.create({
   icon: 'life-buoy',
   description: 'Customer support cases and service requests',
 
+  // ADR-0090 D1/D7: OWD is an authored decision. Owner + escalation sharing rule.
+  sharingModel: 'private',
+
   fieldGroups: [
     { key: 'basic',       label: 'Case Information', icon: 'info' },
     { key: 'origin',      label: 'Origin & Routing', icon: 'route' },
diff --git a/src/objects/contact.object.ts b/src/objects/contact.object.ts
@@ -9,6 +9,9 @@ export const Contact = ObjectSchema.create({
   pluralLabel: 'Contacts',
   icon: 'user',
   description: 'People associated with accounts',
+
+  // ADR-0090 D1/D7: OWD is an authored decision. Master-detail child of crm_account — inherits the account's sharing.
+  sharingModel: 'controlled_by_parent',
   
   fieldGroups: [
     { key: 'identity',        label: 'Identity',             icon: 'user' },
diff --git a/src/objects/contract.object.ts b/src/objects/contract.object.ts
@@ -13,6 +13,9 @@ export const Contract = ObjectSchema.create({
   pluralLabel: 'Contracts',
   icon: 'file-pen-line',
   description: 'Legal contracts and agreements',
+
+  // ADR-0090 D1/D7: OWD is an authored decision. Legal documents — owner only.
+  sharingModel: 'private',
   // ADR-0079: render-only `titleFormat` retired in favor of `nameField`.
   // Original template was '{contract_number} - {crm_account.name}'. The
   // `crm_account.name` segment is a lookup DOT-WALK, which a formula field
diff --git a/src/objects/forecast.object.ts b/src/objects/forecast.object.ts
@@ -27,6 +27,9 @@ export const Forecast = ObjectSchema.create({
   pluralLabel: 'Forecasts',
   icon: 'trending-up',
   description: 'Periodic pipeline snapshot by owner used for revenue forecasting.',
+
+  // ADR-0090 D1/D7: OWD is an authored decision. Forecasts are personal to the owner.
+  sharingModel: 'private',
   // ADR-0079: render-only `titleFormat` retired in favor of `nameField`.
   // The former template led with `{owner}`, a lookup — DROPPED here because a
   // formula cannot dot-walk a lookup (ADR-0072). The `display_title` formula
diff --git a/src/objects/knowledge_article.object.ts b/src/objects/knowledge_article.object.ts
@@ -18,6 +18,9 @@ export const KnowledgeArticle = ObjectSchema.create({
   pluralLabel: 'Knowledge Articles',
   icon: 'book-open',
   description: 'Reusable knowledge base articles for self-service and AI grounding',
+
+  // ADR-0090 D1/D7: OWD is an authored decision. Knowledge base is org-readable; authors edit.
+  sharingModel: 'public_read',
   // ADR-0079: render-only `titleFormat` retired in favor of `nameField`,
   // which names a real field. The former template composed two local fields, so
   // a `display_title` formula field reproduces it for the record title.
diff --git a/src/objects/lead.object.ts b/src/objects/lead.object.ts
@@ -9,6 +9,9 @@ export const Lead = ObjectSchema.create({
   pluralLabel: 'Leads',
   icon: 'user-plus',
   description: 'Potential customers not yet qualified',
+
+  // ADR-0090 D1/D7: OWD is an authored decision. Owner-worked queue.
+  sharingModel: 'private',
   
   fieldGroups: [
     { key: 'identity',     label: 'Identity',           icon: 'user-plus' },
diff --git a/src/objects/opportunity.object.ts b/src/objects/opportunity.object.ts
@@ -9,6 +9,9 @@ export const Opportunity = ObjectSchema.create({
   pluralLabel: 'Opportunities',
   icon: 'dollar-sign',
   description: 'Sales opportunities and deals in the pipeline',
+
+  // ADR-0090 D1/D7: OWD is an authored decision. Owner + high-value management sharing rule.
+  sharingModel: 'private',
   // ADR-0079: render-only `titleFormat` retired in favor of `nameField`.
   // `stage` is a select — the formula references its stored value directly
   // (no label resolution), matching ADR-0079 guidance.
diff --git a/src/objects/opportunity_line_item.object.ts b/src/objects/opportunity_line_item.object.ts
@@ -18,6 +18,9 @@ export const OpportunityLineItem = ObjectSchema.create({
   icon: 'package',
   description: 'A single product line on an Opportunity',
 
+  // ADR-0090 D1/D7: OWD is an authored decision. Follows the opportunity owner; lookup child (not master-detail).
+  sharingModel: 'private',
+
   // @objectstack 12: the dead object-level `enable.trackHistory` flag was
   // removed (ADR-0049) — per-field history is opt-in via `Field.trackHistory`
   // (ADR-0052), set on quantity/unit_price/discount below. Master-detail
diff --git a/src/objects/product.object.ts b/src/objects/product.object.ts
@@ -13,6 +13,9 @@ export const Product = ObjectSchema.create({
   pluralLabel: 'Products',
   icon: 'box',
   description: 'Products and services offered by the company',
+
+  // ADR-0090 D1/D7: OWD is an authored decision. Product catalog is org-visible; only owners edit.
+  sharingModel: 'public_read',
   // ADR-0079: render-only `titleFormat` retired in favor of `nameField`,
   // which names a real field. The former template composed two local fields, so
   // a `display_title` formula field reproduces it for the record title.
diff --git a/src/objects/quote.object.ts b/src/objects/quote.object.ts
@@ -13,6 +13,9 @@ export const Quote = ObjectSchema.create({
   pluralLabel: 'Quotes',
   icon: 'file-text',
   description: 'Price quotes for customers',
+
+  // ADR-0090 D1/D7: OWD is an authored decision. Owner only.
+  sharingModel: 'private',
   // ADR-0079: render-only `titleFormat` retired in favor of `nameField`,
   // which names a real field. The former template composed two local fields, so
   // a `display_title` formula field reproduces it for the record title.
diff --git a/src/objects/quote_line_item.object.ts b/src/objects/quote_line_item.object.ts
@@ -17,6 +17,9 @@ export const QuoteLineItem = ObjectSchema.create({
   icon: 'package',
   description: 'A single product line on a Quote',
 
+  // ADR-0090 D1/D7: OWD is an authored decision. Follows the quote owner; lookup child (not master-detail).
+  sharingModel: 'private',
+
   // @objectstack 12: the dead object-level `enable.trackHistory` flag was
   // removed (ADR-0049) — per-field history is opt-in via `Field.trackHistory`
   // (ADR-0052), set on quantity/unit_price/discount below. Master-detail
diff --git a/src/objects/task.object.ts b/src/objects/task.object.ts
@@ -10,6 +10,9 @@ export const Task = ObjectSchema.create({
   icon: 'check-square',
   description: 'Activities and to-do items',
 
+  // ADR-0090 D1/D7: OWD is an authored decision. Personal activity records.
+  sharingModel: 'private',
+
   fields: {
     // Task Information
     subject: Field.text({
diff --git a/src/profiles/guest-portal.profile.ts b/src/profiles/guest-portal.profile.ts
@@ -16,7 +16,6 @@
 export const GuestPortalProfile = {
   name: 'guest_portal',
   label: 'Guest (Public Forms)',
-  isProfile: true,
   description:
     'Anonymous visitors submitting public Web-to-Lead / Web-to-Case forms. ' +
     'INSERT-only on lead and case; no read/edit/delete on any object.',
diff --git a/src/profiles/marketing-user.profile.ts b/src/profiles/marketing-user.profile.ts
@@ -3,7 +3,6 @@
 export const MarketingUserProfile = {
   name: 'marketing_user',
   label: 'Marketing User',
-  isProfile: true,
   objects: {
     crm_lead:        { allowCreate: true,  allowRead: true,  allowEdit: true,  allowDelete: false, viewAllRecords: true,  modifyAllRecords: false },
     crm_account:     { allowCreate: false, allowRead: true,  allowEdit: false, allowDelete: false, viewAllRecords: true,  modifyAllRecords: false },
diff --git a/src/profiles/sales-manager.profile.ts b/src/profiles/sales-manager.profile.ts
@@ -3,7 +3,6 @@
 export const SalesManagerProfile = {
   name: 'sales_manager',
   label: 'Sales Manager',
-  isProfile: true,
   objects: {
     crm_lead:        { allowCreate: true,  allowRead: true, allowEdit: true,  allowDelete: true,  viewAllRecords: true,  modifyAllRecords: true },
     crm_account:     { allowCreate: true,  allowRead: true, allowEdit: true,  allowDelete: true,  viewAllRecords: true,  modifyAllRecords: true },
diff --git a/src/profiles/sales-rep.profile.ts b/src/profiles/sales-rep.profile.ts
@@ -3,7 +3,6 @@
 export const SalesRepProfile = {
   name: 'sales_rep',
   label: 'Sales Representative',
-  isProfile: true,
   objects: {
     crm_lead:        { allowCreate: true,  allowRead: true,  allowEdit: true,  allowDelete: false, viewAllRecords: false, modifyAllRecords: false },
     crm_account:     { allowCreate: true,  allowRead: true,  allowEdit: true,  allowDelete: false, viewAllRecords: false, modifyAllRecords: false },
diff --git a/src/profiles/service-agent.profile.ts b/src/profiles/service-agent.profile.ts
@@ -3,7 +3,6 @@
 export const ServiceAgentProfile = {
   name: 'service_agent',
   label: 'Service Agent',
-  isProfile: true,
   objects: {
     crm_lead:        { allowCreate: false, allowRead: true,  allowEdit: false, allowDelete: false, viewAllRecords: false, modifyAllRecords: false },
     crm_account:     { allowCreate: false, allowRead: true,  allowEdit: false, allowDelete: false, viewAllRecords: false, modifyAllRecords: false },
diff --git a/src/profiles/system-admin.profile.ts b/src/profiles/system-admin.profile.ts
@@ -3,7 +3,6 @@
 export const SystemAdminProfile = {
   name: 'system_admin',
   label: 'System Administrator',
-  isProfile: true,
   objects: {
     crm_lead:        { allowCreate: true, allowRead: true, allowEdit: true, allowDelete: true, viewAllRecords: true, modifyAllRecords: true },
     crm_account:     { allowCreate: true, allowRead: true, allowEdit: true, allowDelete: true, viewAllRecords: true, modifyAllRecords: true },
diff --git a/src/sharing/account.sharing.ts b/src/sharing/account.sharing.ts
@@ -9,7 +9,7 @@ export const AccountTeamSharingRule = {
   type: 'criteria' as const,
   condition: P`record.type == "customer" && record.is_active == true`,
   accessLevel: 'edit' as const,
-  sharedWith: { type: 'role' as const, value: 'sales_manager' },
+  sharedWith: { type: 'position' as const, value: 'sales_manager' },
 };
 
 /** Territory-Based Sharing (criteria-based, by billing country) */
@@ -21,7 +21,7 @@ export const TerritorySharingRules = [
     type: 'criteria' as const,
     condition: P`record.billing_address.country in ["US", "CA", "MX"]`,
     accessLevel: 'edit' as const,
-    sharedWith: { type: 'role' as const, value: 'na_sales_team' },
+    sharedWith: { type: 'position' as const, value: 'na_sales_team' },
   },
   {
     name: 'europe_territory',
@@ -30,6 +30,6 @@ export const TerritorySharingRules = [
     type: 'criteria' as const,
     condition: P`record.billing_address.country in ["UK", "DE", "FR", "IT", "ES"]`,
     accessLevel: 'edit' as const,
-    sharedWith: { type: 'role' as const, value: 'eu_sales_team' },
+    sharedWith: { type: 'position' as const, value: 'eu_sales_team' },
   },
 ];
diff --git a/src/sharing/case.sharing.ts b/src/sharing/case.sharing.ts
@@ -1,13 +1,17 @@
 import { P } from '@objectstack/spec';
 // Copyright (c) 2025 ObjectStack. Licensed under the Apache-2.0 license.
 
-/** Share escalated/critical cases with service managers */
+/**
+ * Share escalated/critical cases with service managers.
+ * ADR-0090 D3: `role_and_subordinates` is gone (positions are flat); the
+ * grant now targets the manager position itself.
+ */
 export const CaseEscalationSharingRule = {
   name: 'case_escalation_sharing',
   label: 'Escalated Cases Sharing',
   object: 'crm_case',
   type: 'criteria' as const,
   condition: P`record.priority == "critical" && record.is_closed == false`,
   accessLevel: 'edit' as const,
-  sharedWith: { type: 'role_and_subordinates' as const, value: 'service_manager' },
+  sharedWith: { type: 'position' as const, value: 'service_manager' },
 };
diff --git a/src/sharing/defaults.sharing.ts b/src/sharing/defaults.sharing.ts
diff --git a/src/sharing/index.ts b/src/sharing/index.ts
@@ -5,6 +5,5 @@
  */
 export { AccountTeamSharingRule, TerritorySharingRules } from './account.sharing';
 export { CaseEscalationSharingRule } from './case.sharing';
-export { OrganizationDefaults } from './defaults.sharing';
 export { OpportunitySalesSharingRule } from './opportunity.sharing';
-export { RoleHierarchy } from './role-hierarchy';
+export { CrmPositions } from './positions';
diff --git a/src/sharing/opportunity.sharing.ts b/src/sharing/opportunity.sharing.ts
@@ -1,13 +1,17 @@
 import { P } from '@objectstack/spec';
 // Copyright (c) 2025 ObjectStack. Licensed under the Apache-2.0 license.
 
-/** Share high-value open opportunities with management */
+/**
+ * Share high-value open opportunities with the sales director.
+ * ADR-0090 D3: `role_and_subordinates` is gone (positions are flat); the
+ * grant now targets the director position itself.
+ */
 export const OpportunitySalesSharingRule = {
   name: 'opportunity_sales_sharing',
   label: 'Opportunity Sales Team Sharing',
   object: 'crm_opportunity',
   type: 'criteria' as const,
   condition: P`!(record.stage in ["closed_won", "closed_lost"]) && record.amount >= 100000`,
   accessLevel: 'read' as const,
-  sharedWith: { type: 'role_and_subordinates' as const, value: 'sales_director' },
+  sharedWith: { type: 'position' as const, value: 'sales_director' },
 };
diff --git a/src/sharing/positions.ts b/src/sharing/positions.ts
@@ -0,0 +1,25 @@
+// Copyright (c) 2025 ObjectStack. Licensed under the Apache-2.0 license.
+
+/**
+ * CRM Positions (ADR-0090 D3 — formerly the role hierarchy).
+ *
+ * Positions are deliberately FLAT: no parent, no hierarchy. The v1 role
+ * tree's reporting lines belong on the business-unit tree / manager chain,
+ * which this app does not model — so the old `parentRole` links were
+ * dropped rather than translated.
+ */
+export const CrmPositions = [
+  { name: 'executive',          label: 'Executive' },
+  { name: 'sales_director',     label: 'Sales Director' },
+  { name: 'sales_manager',      label: 'Sales Manager' },
+  { name: 'sales_rep',          label: 'Sales Representative' },
+  { name: 'service_director',   label: 'Service Director' },
+  { name: 'service_manager',    label: 'Service Manager' },
+  { name: 'service_agent',      label: 'Service Agent' },
+  { name: 'marketing_director', label: 'Marketing Director' },
+  { name: 'marketing_manager',  label: 'Marketing Manager' },
+  { name: 'marketing_user',     label: 'Marketing User' },
+  // Territory groupings referenced by the account sharing rules.
+  { name: 'na_sales_team',      label: 'NA Sales Team' },
+  { name: 'eu_sales_team',      label: 'EU Sales Team' },
+];
diff --git a/src/sharing/role-hierarchy.ts b/src/sharing/role-hierarchy.ts
