|
| 1 | +{ |
| 2 | + "category": "security", |
| 3 | + "_note": "Liveness classification for authorable security metadata. Seeded from docs/audits/2026-06-security-identity-property-liveness.md (file:line evidence) plus targeted greps for schemas the audit did not cover. Statuses: live | experimental | planned | dead | (schema-level) internal. 'dead' = parsed, no runtime consumer → enforce-or-remove (security ADR). Security-critical: a 'dead' boundary prop = false compliance.", |
| 4 | + "schemas": { |
| 5 | + "ObjectPermission": { |
| 6 | + "props": { |
| 7 | + "allowCreate": { "status": "live", "evidence": "packages/plugins/plugin-security/src/permission-evaluator.ts:8" }, |
| 8 | + "allowRead": { "status": "live", "evidence": "packages/plugins/plugin-security/src/permission-evaluator.ts:8" }, |
| 9 | + "allowEdit": { "status": "live", "evidence": "packages/plugins/plugin-security/src/permission-evaluator.ts:8" }, |
| 10 | + "allowDelete": { "status": "live", "evidence": "packages/plugins/plugin-security/src/permission-evaluator.ts:8" }, |
| 11 | + "viewAllRecords": { "status": "live", "evidence": "packages/plugins/plugin-security/src/permission-evaluator.ts" }, |
| 12 | + "modifyAllRecords": { "status": "live", "evidence": "packages/plugins/plugin-security/src/permission-evaluator.ts" }, |
| 13 | + "allowTransfer": { "status": "dead", "evidence": "permission-evaluator.ts:8-16 (absent from OPERATION_TO_PERMISSION)", "note": "destructive op (ownership transfer) NOT gated by RBAC — enforce-or-remove. Spec marks experimental." }, |
| 14 | + "allowRestore": { "status": "dead", "evidence": "permission-evaluator.ts:8-16 (absent)", "note": "undelete NOT gated — enforce-or-remove." }, |
| 15 | + "allowPurge": { "status": "dead", "evidence": "permission-evaluator.ts:8-16 (absent)", "note": "hard-delete/GDPR purge NOT gated — enforce-or-remove." } |
| 16 | + } |
| 17 | + }, |
| 18 | + "FieldPermission": { |
| 19 | + "props": { |
| 20 | + "readable": { "status": "live", "evidence": "packages/plugins/plugin-security/src/permission-evaluator.ts", "note": "FLS read-mask enforced." }, |
| 21 | + "editable": { "status": "live", "evidence": "packages/plugins/plugin-security/src/permission-evaluator.ts", "note": "FLS write-deny enforced." } |
| 22 | + } |
| 23 | + }, |
| 24 | + "PermissionSet": { |
| 25 | + "props": { |
| 26 | + "name": { "status": "live", "evidence": "permission-evaluator.ts", "note": "registration/assignment key." }, |
| 27 | + "label": { "status": "live", "note": "display metadata (admin forms), not a security boundary." }, |
| 28 | + "objects": { "status": "live", "evidence": "packages/plugins/plugin-security/src/permission-evaluator.ts:8" }, |
| 29 | + "fields": { "status": "live", "evidence": "packages/plugins/plugin-security/src/permission-evaluator.ts" }, |
| 30 | + "rowLevelSecurity": { "status": "live", "evidence": "packages/plugins/plugin-security/src/rls-compiler.ts", "note": "enforced on find + analytics raw-SQL." }, |
| 31 | + "systemPermissions": { "status": "live", "evidence": "packages/plugins/plugin-hono-server/src/hono-plugin.ts", "note": "PARTIAL — enforced only for app-entry/nav visibility, NOT as a general capability gate (e.g. manage_users unchecked in data path)." }, |
| 32 | + "tabPermissions": { "status": "live", "note": "PARTIAL — only 'hidden' is read; default_on/default_off ignored; UI-only, not a boundary." }, |
| 33 | + "isProfile": { "status": "dead", "evidence": "audit: profile-vs-permset never gates anything", "note": "enforce-or-remove." }, |
| 34 | + "contextVariables": { "status": "dead", "evidence": "rls-compiler.ts never reads it", "note": "RLS uses only current_user.* built-ins; doc claim of runtime evaluation is false." } |
| 35 | + } |
| 36 | + }, |
| 37 | + "RowLevelSecurityPolicy": { |
| 38 | + "props": { |
| 39 | + "name": { "status": "live", "evidence": "packages/plugins/plugin-security/src/rls-compiler.ts" }, |
| 40 | + "object": { "status": "live", "evidence": "packages/plugins/plugin-security/src/rls-compiler.ts" }, |
| 41 | + "operation": { "status": "live", "evidence": "packages/plugins/plugin-security/src/rls-compiler.ts" }, |
| 42 | + "using": { "status": "live", "evidence": "packages/plugins/plugin-security/src/rls-compiler.ts", "note": "compiled into find + analytics SQL." }, |
| 43 | + "check": { "status": "live", "evidence": "packages/plugins/plugin-security/src/rls-compiler.ts" }, |
| 44 | + "roles": { "status": "live", "evidence": "packages/plugins/plugin-security/src/rls-compiler.ts", "note": "flat role match — no subordinate rollup." }, |
| 45 | + "enabled": { "status": "live", "evidence": "packages/plugins/plugin-security/src/rls-compiler.ts" }, |
| 46 | + "priority": { "status": "live", "evidence": "packages/plugins/plugin-security/src/rls-compiler.ts", "note": "policy ordering." }, |
| 47 | + "label": { "status": "live", "note": "display metadata." }, |
| 48 | + "description": { "status": "live", "note": "display metadata." }, |
| 49 | + "tags": { "status": "live", "note": "organizational metadata (not a boundary)." } |
| 50 | + } |
| 51 | + }, |
| 52 | + "Policy": { |
| 53 | + "_note": "PolicySchema is 100% DEAD — not even registered as a metadata type; better-auth runs its own hardcoded config (packages/plugins/plugin-auth/src/index.ts). Authoring a compliance Policy = false compliance.", |
| 54 | + "props": { |
| 55 | + "name": { "status": "experimental", "evidence": "spec describe(): [EXPERIMENTAL — not enforced]" }, |
| 56 | + "password": { "status": "dead", "evidence": "auth: better-auth hardcoded scrypt/session", "note": "false compliance — enforce or remove." }, |
| 57 | + "network": { "status": "dead", "evidence": "no consumer", "note": "IP allow-list/VPN unenforced." }, |
| 58 | + "session": { "status": "dead", "evidence": "auth: better-auth hardcoded session", "note": "idle/absolute timeout + forceMfa unenforced." }, |
| 59 | + "audit": { "status": "dead", "evidence": "no consumer", "note": "retention/redaction unenforced." }, |
| 60 | + "isDefault": { "status": "dead", "evidence": "no consumer" }, |
| 61 | + "assignedProfiles": { "status": "dead", "evidence": "no consumer" } |
| 62 | + } |
| 63 | + }, |
| 64 | + "PasswordPolicy": { "_schema": "dead", "_note": "Policy.password subtree — better-auth hardcoded; unenforced. enforce-or-remove.", "props": {} }, |
| 65 | + "SessionPolicy": { "_schema": "dead", "_note": "Policy.session subtree — idle/absoluteTimeout/forceMfa all unenforced; better-auth hardcoded. forceMfa=true is a silent no-op (false compliance).", "props": {} }, |
| 66 | + "NetworkPolicy": { "_schema": "dead", "_note": "Policy.network subtree — trustedRanges/blockUnknown/vpnRequired unenforced.", "props": {} }, |
| 67 | + "AuditPolicy": { "_schema": "dead", "_note": "Policy.audit subtree — logRetentionDays/sensitiveFields/captureRead unenforced.", "props": {} }, |
| 68 | + "OwnerSharingRule": { "_schema": "dead", "_note": "Spec SharingRule has NO runtime consumer; runtime enforces a divergent sys_sharing_rule model (packages/plugins/plugin-sharing/src/sharing-plugin.ts). Authoring the spec rule has no effect — reconcile to one contract.", "props": {} }, |
| 69 | + "RLSConfig": { "_schema": "dead", "_note": "No runtime consumer (grep). RLS enforcement reads RowLevelSecurityPolicy via rls-compiler.ts, not this config object.", "props": {} }, |
| 70 | + "RLSAuditConfig": { "_schema": "dead", "_note": "No runtime consumer (grep).", "props": {} }, |
| 71 | + "Territory": { "_schema": "dead", "_note": "Salesforce-style territory management — no runtime consumer (grep).", "props": {} }, |
| 72 | + "TerritoryModel": { "_schema": "dead", "_note": "No runtime consumer (grep).", "props": {} }, |
| 73 | + "RLSEvaluationResult": { "_schema": "internal", "_note": "RLS runtime evaluation result — not authorable metadata." }, |
| 74 | + "RLSAuditEvent": { "_schema": "internal", "_note": "RLS runtime audit event — not authorable metadata." }, |
| 75 | + "RLSUserContext": { "_schema": "internal", "_note": "RLS runtime user context — not authorable metadata." } |
| 76 | + } |
| 77 | +} |
0 commit comments