feat(rest): ADR-0056 D2 — surface fail-open anonymous posture (warn→enforce)

The data API's deny capability already exists (requireAuth=true → 401 for
anonymous; share-link / guest_portal / control-plane exempt) but the DEFAULT is
fail-open. Add a boot WARN when requireAuth is off so the insecure posture is
explicit, WITHOUT flipping the global default (release-gated; flipping would break
anonymous-dependent deployments). Proven by showcase-anonymous-deny (4/4):
anonymous read+write 401, authenticated 200, control-plane open.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01XVdnfUAx85amkerym26vdx

Author: claude

.changeset/adr-0056-d2-anonymous-deny.md

@@ -0,0 +1,15 @@
+---
+"@objectstack/rest": patch
+---
+
+feat(rest): warn on fail-open anonymous posture (ADR-0056 D2, warn→enforce)
+
+Secure-by-default work for the data API. The deny capability already exists
+(`api.requireAuth=true` rejects anonymous via `enforceAuth`, and share-link /
+`guest_portal` / control-plane routes are exempt) — but the **default is fail-open**
+(`requireAuth=false`), so an object with no OWD/RLS is world-readable with no signal.
+This adds a boot-time WARN when running in that posture, making it explicit
+(consistent with D4/D8 honesty). The global default is deliberately NOT flipped here
+— that is a release-gated decision; flipping it would 401 deployments that rely on
+anonymous reads. Proven by the `showcase-anonymous-deny` dogfood test (anonymous
+read+write → 401, authenticated → 200, control-plane open).

packages/dogfood/test/showcase-anonymous-deny.dogfood.test.ts

@@ -0,0 +1,50 @@
+// Copyright (c) 2026 ObjectStack. Licensed under the Apache-2.0 license.
+//
+// ADR-0056 D2 — secure-by-default (anonymous deny) posture, proven on the real
+// showcase HTTP stack. With `requireAuth` on, an UNAUTHENTICATED request to the
+// data API is rejected (401), while authenticated members are unaffected and the
+// control-plane (`/auth/*`) stays open (sign-up itself is an anonymous call). This
+// is the enforcement capability D2 builds on; the framework does NOT flip the
+// global default — it makes the deny posture available + warns when it is off.
+
+import { describe, it, expect, beforeAll, afterAll } from 'vitest';
+import showcaseStack from '@objectstack/example-showcase';
+import { bootStack, type VerifyStack } from '@objectstack/verify';
+
+const OBJ = '/data/showcase_private_note';
+
+describe('showcase: anonymous default-deny (ADR-0056 D2)', () => {
+  let stack: VerifyStack;
+  let memberToken: string;
+
+  beforeAll(async () => {
+    stack = await bootStack(showcaseStack); // harness runs requireAuth: true
+    await stack.signIn();
+    memberToken = await stack.signUp('d2-member@verify.test'); // anonymous /auth call → proves control-plane is open
+  }, 60_000);
+
+  afterAll(async () => { await stack?.stop(); });
+
+  it('control-plane is open for anonymous (sign-up succeeded without a token)', () => {
+    expect(memberToken, 'anonymous /auth/sign-up returned a token').toBeTruthy();
+  });
+
+  it('anonymous READ of the data API is denied (401)', async () => {
+    const r = await stack.api(OBJ, { method: 'GET' });
+    expect(r.status, 'unauthenticated data read must be 401').toBe(401);
+  });
+
+  it('anonymous WRITE of the data API is denied (401)', async () => {
+    const w = await stack.api(OBJ, {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({ title: 'anon' }),
+    });
+    expect(w.status, 'unauthenticated data write must be 401').toBe(401);
+  });
+
+  it('an AUTHENTICATED member is allowed (deny targets anonymity, not the API)', async () => {
+    const ok = await stack.apiAs(memberToken, 'GET', OBJ);
+    expect(ok.status).toBe(200);
+  });
+});

packages/rest/src/rest-api-plugin.ts

@@ -190,6 +190,20 @@ export function createRestApiPlugin(config: RestApiPluginConfig = {}): Plugin {
                 restServer.registerRoutes();
 
                 ctx.logger.info('REST API successfully registered');
+
+                // ADR-0056 D2 (warn → enforce): surface the fail-open posture.
+                // When `requireAuth` is off, anonymous requests reach the data API
+                // and read any object with no OWD/RLS — secure-by-default would deny
+                // them and route public access through share-links / `publicSharing`.
+                // We do NOT flip the default here (it would break deployments that
+                // rely on anonymous reads); we make the posture explicit instead.
+                if (!(config.api as any)?.requireAuth) {
+                    ctx.logger.warn(
+                        '[security] anonymous access to the data API is ALLOWED (api.requireAuth=false) — ' +
+                        'objects without OWD/RLS are world-readable. For secure-by-default set ' +
+                        'api.requireAuth=true and expose public records via share-links / publicSharing (ADR-0056 D2).',
+                    );
+                }
             } catch (err: any) {
                 ctx.logger.error('Failed to register REST API routes', { error: err.message } as any);
                 throw err;