Merge branch 'main' of https://github.com/objectstack-ai/framework

Author: zhuangjianguo

CHANGELOG.md

@@ -8,7 +8,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 ## [Unreleased]
 
 ### Added
-- **`apps/objectos` honors `OS_DATABASE_URL` / `OS_DATABASE_DRIVER` for the project DB** — `packages/services/service-cloud/src/runtime-stack.ts` (single-project local mode) now selects the project data driver from the same env vars that the CLI's `objectstack serve` uses, with URL-scheme inference (`mongodb://` → mongodb, `postgres://` → pg, `mysql://` → mysql, `libsql://` / `https://*.turso.*` → turso, `file:` / `*.db` / `*.sqlite` / `:memory:` → sqlite). To pin the **control-plane** DB independently from the project DB, a new `OS_CONTROL_DATABASE_URL` env var is introduced and resolved in `cloud-stack.ts`; for backward compatibility the legacy `OS_DATABASE_URL` is still accepted as a fallback for the control DB when neither `OS_CONTROL_DATABASE_URL` nor an explicit `controlDriverUrl` is supplied. Verified end-to-end: `OS_DATABASE_URL=mongodb://localhost:27017/objectstack_objectos_test pnpm dev` boots `apps/objectos`, control DB stays on local sqlite (`apps/objectos/.objectstack/data/control.db`), and project records (CRUD on `/api/v1/data/...`) land in MongoDB.
+- **Phase-1 RBAC end-to-end enforcement (multi-tenant isolation)** — Every authenticated REST request now arrives at the SecurityPlugin middleware with a populated `ExecutionContext`, so RLS/FLS/CRUD checks actually fire. Three previously-silent context-drop sites were closed: (1) `@objectstack/objectql` `protocol.{find,get,create,update,delete}Data` now forward `request.context` into the engine call options; (2) `@objectstack/rest` `RestServer` gained `resolveExecCtx()` plus an `authServiceProvider` constructor hook (wired in `RestApiPlugin` from `ctx.getService('auth')`) that resolves the better-auth session for both single-kernel and multi-kernel deployments and threads `context` into all five CRUD handlers; (3) `@objectstack/plugin-hono-server` raw `/data/:object` fallback handlers now resolve the same context inline and map `PermissionDeniedError` → HTTP 403. `@objectstack/runtime` `resolveExecutionContext()` wraps plain header objects as Web `Headers` so better-auth's cookie lookup works. New seed link tables `sys_user_permission_set` / `sys_role_permission_set` (in `@objectstack/platform-objects`) plus default permission sets `admin_full_access` / `member_default` / `viewer_readonly`; `member_default` carries a wildcard `object: '*'` RLS policy (`tenant_id = current_user.tenant_id`) that SecurityPlugin rewrites onto the configured `tenantField` (default `organization_id`) and skips for tables that lack the field. Two further fixes landed alongside the wiring work: (a) `@objectstack/objectql` lost its legacy `registerTenantMiddleware` (a hardcoded `where.tenant_id = ctx.tenantId` injection that pre-dated SecurityPlugin, masked RLS bugs in older snapshots, and silently broke any table without a `tenant_id` column); SecurityPlugin is now the sole authority for tenant isolation. (b) The `tenantField` rewrite in SecurityPlugin (`tenant_id` → `organization_id` on the LHS column reference) was over-eager and was also rewriting the `current_user.tenant_id` placeholder, producing `current_user.organization_id` which `RLSUserContext` doesn't expose — silently dropping every wildcard tenant policy. The regex now anchors on a non-`.` boundary so only the column reference is rewritten. `member_default` and `viewer_readonly` also gained explicit per-object overrides for the two global tables that lack `organization_id`: `sys_organization_self` (`id = current_user.tenant_id`) and `sys_user_self` (`id = current_user.id`). Verified end-to-end on `pnpm dev:crm`: two users in different organizations each create records and only see their own org's rows on subsequent LISTs across `sys_organization`, `sys_member`, `sys_user`, and the new `sys_user_permission_set` / `sys_role_permission_set` link tables. **Known follow-up:** anonymous REST traffic still bypasses enforcement (SecurityPlugin short-circuits when `userId` is absent) — default-deny tightening, Sharing Rule evaluator, Studio RLS visual editor, per-user×org permission cache, and audit UI / denied-access logging remain queued.
 - **`@objectstack/driver-mongodb` — first-class MongoDB driver (`packages/plugins/driver-mongodb`)** — A new built-in driver that implements the full `IDataDriver` contract on top of the official `mongodb@^6` Node.js driver. Highlights: per-collection `id` strategy (16-char nanoid stored as a top-level string field with a unique index; the internal `_id` is **never** exposed to consumers — every `find`/`findOne`/`findStream` uses `projection: { _id: 0 }`); pluggable filter translator (`mongodb-filter.ts`) that maps every ObjectStack operator (`$eq`/`$ne`/`$gt`/`$gte`/`$lt`/`$lte`/`$in`/`$nin`/`$exists`/`$contains`/`$startsWith`/`$endsWith`/`$null`/`$between`/`$not`/`$and`/`$or`/`$nor`) plus the legacy `[field, op, value]` tuple form into a native MongoDB query; aggregation pipeline builder (`mongodb-aggregation.ts`) supporting `count`/`sum`/`avg`/`min`/`max`/`count_distinct`/`string_agg` with `$group + $project` flattening; declarative schema sync that creates collections + unique/lookup/text/compound indexes (`mongodb-schema.ts`); cursor-based async streaming via `findStream`; `bulkCreate`/`bulkUpdate`/`bulkDelete` powered by `bulkWrite`; multi-document transactions (requires a replica set) via `MongoClient.startSession()` + `session.withTransaction()`. Ships with **75 unit tests** (filter, aggregation, full driver) running against `mongodb-memory-server` (`onlyBuiltDependencies` whitelist updated in the root `package.json` so the postinstall is allowed). Plugin entry exports a default `onEnable` hook so it can be registered as `kernel.use(mongodbPlugin, { url })` or instantiated directly via `new MongoDBDriver({ url })` and wrapped in `DriverPlugin`.
 - **`OS_DATABASE_DRIVER` / `OS_DATABASE_URL` recognised by the CLI, with URL-scheme inference** — `packages/cli/src/commands/serve.ts` now selects the storage driver from `OS_DATABASE_URL` automatically: `mongodb://` / `mongodb+srv://` → `MongoDBDriver`, `postgres://` / `postgresql://` → `SqlDriver(client:'pg')`, `mysql://` / `mysql2://` → `SqlDriver(client:'mysql2')`, `libsql://` or `https://*.turso.…` → `TursoDriver`, `file:` / `sqlite:` / `:memory:` / `*.db` / `*.sqlite` → `SqlDriver(client:'better-sqlite3')`. `OS_DATABASE_DRIVER` remains an explicit override (`mongodb`/`mongo`/`postgres`/`pg`/`mysql`/`sqlite`/`turso`/`libsql`). The same selection logic is mirrored in `packages/services/service-cloud/src/{artifact-environment-registry,environment-registry,project-kernel-factory}.ts` so cloud-runtime nodes can also pin a project to MongoDB. `apps/objectos`, `packages/cli`, and `packages/services/service-cloud` now declare `@objectstack/driver-mongodb` (and the CLI now also declares `@objectstack/driver-turso`) as workspace dependencies so the dynamic `await import()` resolves.
 - **MongoDB end-to-end test for the CRM example** — `examples/app-crm/playwright.config.ts` + `examples/app-crm/e2e/mongodb-driver.spec.ts` boot `pnpm dev:crm` with `OS_DATABASE_URL=mongodb://localhost:27017/objectstack_crm_test` against a local mongod (driver auto-inferred from the URL scheme — no `OS_DATABASE_DRIVER` needed) and verify (1) the Studio UI responds, (2) seed data is queryable through `GET /api/v1/data/account`, and (3) a full create → read → patch → re-read → delete round-trip lands records in MongoDB. New `pnpm --filter @example/app-crm test:e2e` script wires the suite into the workspace.

content/docs/concepts/implementation-status.mdx

@@ -263,16 +263,17 @@ The `auth` service in `CoreServiceName` covers both **authentication** (identity
 | **Organization** | Authentication | ✅ | ❌ | ✅ | 📋 Plugin |
 | **Policy** | Authentication | ✅ | ❌ | ✅ | 📋 Plugin |
 | **SCIM** | Authentication | ✅ | ❌ | ✅ | 📋 Plugin |
-| **Permission** | Authorization | ✅ | ❌ | ✅ | 📋 Plugin |
+| **Permission** | Authorization | ✅ | ✅ Phase-1 | ✅ | ✅ `plugin-security` |
 | **Sharing** | Authorization | ✅ | ❌ | ✅ | 📋 Plugin |
-| **RLS** | Authorization | ✅ | ❌ | ✅ | 📋 Plugin |
+| **RLS** | Authorization | ✅ | ✅ Phase-1 (tenant + owner) | ✅ | ✅ `plugin-security` |
 | **Territory** | Authorization | ✅ | ❌ | ✅ | 📋 Plugin |
 
 **Notes:**
 - All security protocols (identity + permission) are delivered by a single `auth` plugin — matching `CoreServiceName`
 - Client SDK supports bearer token header — but token validation requires the auth plugin
 - Auth route (`/auth/*`) only appears in Discovery when the auth plugin is registered
 - Fine-grained authorization (RLS, sharing, territory) is internal to the auth plugin
+- **Phase-1 RBAC enforcement is live end-to-end**: REST → ObjectQL → SecurityPlugin middleware now receives a populated `ExecutionContext` (userId, tenantId, roles, permissions). Default `member_default` permission set ships a wildcard RLS rule `tenant_id = current_user.tenant_id` (rewritten to `organization_id` — only the LHS column is rewritten, the `current_user.tenant_id` placeholder is preserved) plus per-object overrides `sys_organization_self` and `sys_user_self` for the global tables that lack an `organization_id` column. The legacy `objectql.registerTenantMiddleware` (hardcoded `where.tenant_id` injection that pre-dated SecurityPlugin) has been removed; SecurityPlugin is now the sole authority for tenant isolation. Verified cross-organization isolation on `pnpm dev:crm` across `sys_organization`, `sys_member`, `sys_user`, `sys_user_permission_set`, `sys_role_permission_set`. **Anonymous traffic still bypasses enforcement** until a default-deny pass lands.
 
 ---
 
@@ -386,11 +387,17 @@ The `auth` service in `CoreServiceName` covers both **authentication** (identity
 - [ ] ETL Pipeline Plugin
 - [ ] Trigger Registry Plugin
 
-### Phase 9: Security (Plugin) 📋 **PLANNED**
-- [ ] Authentication Plugin
-- [ ] Authorization Plugin
-- [ ] Row-Level Security Plugin
-- [ ] Multi-tenancy Plugin
+### Phase 9: Security (Plugin) 🟡 **PHASE-1 LANDED**
+- [x] Authentication Plugin (`@objectstack/plugin-auth`, better-auth)
+- [x] Authorization Plugin — `@objectstack/plugin-security` enforces CRUD/FLS/RLS in the ObjectQL middleware chain; REST → ObjectQL now propagates `ExecutionContext` end-to-end (Phase-1)
+- [x] Row-Level Security — default `member_default` permission set applies a wildcard `tenant_id = current_user.tenant_id` rule (only the LHS column is rewritten to `organization_id`; the `current_user.tenant_id` placeholder is preserved) plus per-object overrides `sys_organization_self` / `sys_user_self`
+- [x] Multi-tenancy — verified cross-organization isolation on `pnpm dev:crm` (Alice@OrgAlpha vs. Bob@OrgBeta only see their own records across `sys_organization`, `sys_member`, `sys_user`, and `sys_*_permission_set` link tables)
+- [x] Legacy `objectql.registerTenantMiddleware` removed — SecurityPlugin is now the sole tenant-isolation authority
+- [ ] Default-deny for anonymous traffic
+- [ ] Sharing Rule evaluator
+- [ ] Studio RLS visual editor
+- [ ] Per-user×org permission cache
+- [ ] Audit UI / denied-access logging
 
 ### Phase 10: AI Integration 📋 **PLANNED**
 - [ ] Agent Framework

content/docs/guides/security.mdx

@@ -7,6 +7,8 @@ description: "Complete guide to implementing enterprise-grade security in Object
 
 Complete guide to implementing enterprise-grade security in ObjectStack with fine-grained permissions and data access controls.
 
+> **Implementation status — Phase-1 RBAC is live.** REST → ObjectQL now propagates a populated `ExecutionContext` (userId, tenantId, roles, permissions) into the SecurityPlugin middleware, so CRUD / FLS / RLS checks actually fire on every authenticated request. The default `member_default` permission set ships a wildcard RLS rule `tenant_id = current_user.tenant_id` (rewritten onto the configured `tenantField`, default `organization_id` — only the LHS column is rewritten, the `current_user.tenant_id` placeholder is preserved) plus explicit per-object overrides `sys_organization_self` (`id = current_user.tenant_id`) and `sys_user_self` (`id = current_user.id`) for the two global tables that lack an `organization_id` column. The legacy `objectql.registerTenantMiddleware` (a hardcoded `where.tenant_id` injection that pre-dated SecurityPlugin) has been removed; SecurityPlugin is now the sole authority for tenant isolation. End-to-end verified on `pnpm dev:crm` across `sys_organization`, `sys_member`, `sys_user`, `sys_user_permission_set`, `sys_role_permission_set`. **Anonymous traffic still bypasses enforcement** until a default-deny pass lands; Sharing Rules, Studio RLS visual editor, per-user×org permission cache, and audit UI for denied access are queued. See `CHANGELOG.md` and `concepts/implementation-status.mdx` for the latest matrix.
+
 ## Table of Contents
 
 1. [Security Architecture](#security-architecture)

content/docs/references/system/translation.mdx

@@ -109,6 +109,8 @@ Translation data for a single object
 | **pluralLabel** | `string` | optional | Translated plural label |
 | **description** | `string` | optional | Translated object description |
 | **fields** | `Record<string, Object>` | optional | Field-level translations |
+| **_views** | `Record<string, Object>` | optional | View translations keyed by view name |
+| **_actions** | `Record<string, Object>` | optional | Action translations keyed by action name |
 
 
 ---
@@ -192,6 +194,7 @@ Translation data for objects, apps, and UI messages
 | **apps** | `Record<string, Object>` | optional | App translations keyed by app name |
 | **messages** | `Record<string, string>` | optional | UI message translations keyed by message ID |
 | **validationMessages** | `Record<string, string>` | optional | Translatable validation error messages keyed by rule name (e.g., `{"discount_limit": "折扣不能超过40%"}`) |
+| **globalActions** | `Record<string, Object>` | optional | Global action translations keyed by action name |
 | **dashboards** | `Record<string, Object>` | optional | Dashboard translations keyed by dashboard name |
 
 

packages/objectql/src/plugin.ts

@@ -197,8 +197,13 @@ export class ObjectQLPlugin implements Plugin {
     // Register built-in audit hooks
     this.registerAuditHooks(ctx);
 
-    // Register tenant isolation middleware
-    this.registerTenantMiddleware(ctx);
+    // Tenant isolation is now handled by `@objectstack/plugin-security`
+    // via the `member_default` permission set's RLS rule (with field-existence
+    // guards and configurable tenantField rewrite). The legacy hard-coded
+    // `tenant_id` filter middleware was removed because it (a) collided with
+    // the SecurityPlugin RLS pipeline and (b) blindly filtered tables that
+    // don't have a `tenant_id` column (e.g. `sys_organization`), returning
+    // 0 rows instead of all rows.
 
     ctx.logger.info('ObjectQL engine started', {
         driversRegistered: this.ql?.['drivers']?.size || 0,
@@ -316,35 +321,13 @@ export class ObjectQLPlugin implements Plugin {
   }
 
   /**
-   * Register tenant isolation middleware that auto-injects tenant_id filter
-   * for multi-tenant operations.
+   * Tenant isolation moved to `@objectstack/plugin-security`'s
+   * `member_default` permission set RLS (with field-existence guards and
+   * configurable `tenantField`). The legacy `registerTenantMiddleware`
+   * method was removed because it (a) collided with SecurityPlugin's RLS
+   * pipeline and (b) blindly filtered tables that don't have a `tenant_id`
+   * column (e.g. `sys_organization`), returning 0 rows instead of all rows.
    */
-  private registerTenantMiddleware(ctx: PluginContext) {
-    if (!this.ql) return;
-
-    this.ql.registerMiddleware(async (opCtx, next) => {
-      // Only apply to operations with tenantId that are not system-level
-      if (!opCtx.context?.tenantId || opCtx.context?.isSystem) {
-        return next();
-      }
-
-      // Read operations: inject tenant_id filter into AST
-      if (['find', 'findOne', 'count', 'aggregate'].includes(opCtx.operation)) {
-        if (opCtx.ast) {
-          const tenantFilter = { tenant_id: opCtx.context.tenantId };
-          if (opCtx.ast.where) {
-            opCtx.ast.where = { $and: [opCtx.ast.where, tenantFilter] };
-          } else {
-            opCtx.ast.where = tenantFilter;
-          }
-        }
-      }
-
-      await next();
-    });
-
-    ctx.logger.debug('Tenant isolation middleware registered');
-  }
 
   /**
    * Synchronize all registered object schemas to the database.

packages/objectql/src/protocol.ts

@@ -505,8 +505,14 @@ export class ObjectStackProtocolImplementation implements ObjectStackProtocol {
         }
     }
 
-    async findData(request: { object: string, query?: any }) {
+    async findData(request: { object: string, query?: any, context?: any }) {
         const options: any = { ...request.query };
+        // Forward the dispatcher's ExecutionContext so RBAC/RLS middleware
+        // can apply per-request enforcement. The protocol layer is purely
+        // a normalizer — it must never strip security context.
+        if (request.context !== undefined) {
+            options.context = request.context;
+        }
 
         // ====================================================================
         // Normalize legacy params → QueryAST standard (where/fields/orderBy/offset/expand)
@@ -643,10 +649,13 @@ export class ObjectStackProtocolImplementation implements ObjectStackProtocol {
         };
     }
 
-    async getData(request: { object: string, id: string, expand?: string | string[], select?: string | string[] }) {
+    async getData(request: { object: string, id: string, expand?: string | string[], select?: string | string[], context?: any }) {
         const queryOptions: any = {
             where: { id: request.id }
         };
+        if (request.context !== undefined) {
+            queryOptions.context = request.context;
+        }
 
         // Support fields for single-record retrieval
         if (request.select) {
@@ -677,28 +686,34 @@ export class ObjectStackProtocolImplementation implements ObjectStackProtocol {
         throw new Error(`Record ${request.id} not found in ${request.object}`);
     }
 
-    async createData(request: { object: string, data: any }) {
-        const result = await this.engine.insert(request.object, request.data);
+    async createData(request: { object: string, data: any, context?: any }) {
+        const result = await this.engine.insert(
+            request.object,
+            request.data,
+            request.context !== undefined ? { context: request.context } as any : undefined,
+        );
         return {
             object: request.object,
             id: result.id,
             record: result
         };
     }
 
-    async updateData(request: { object: string, id: string, data: any }) {
-        // Adapt: update(obj, id, data) -> update(obj, data, options)
-        const result = await this.engine.update(request.object, request.data, { where: { id: request.id } });
+    async updateData(request: { object: string, id: string, data: any, context?: any }) {
+        const opts: any = { where: { id: request.id } };
+        if (request.context !== undefined) opts.context = request.context;
+        const result = await this.engine.update(request.object, request.data, opts);
         return {
             object: request.object,
             id: request.id,
             record: result
         };
     }
 
-    async deleteData(request: { object: string, id: string }) {
-        // Adapt: delete(obj, id) -> delete(obj, options)
-        await this.engine.delete(request.object, { where: { id: request.id } });
+    async deleteData(request: { object: string, id: string, context?: any }) {
+        const opts: any = { where: { id: request.id } };
+        if (request.context !== undefined) opts.context = request.context;
+        await this.engine.delete(request.object, opts);
         return {
             object: request.object,
             id: request.id,