fix(plugin-security): protect platform/package-stamped sys_position rows (#2926 ①)

The system-row write gate (#2918/#2930) keyed sys_position provenance on the
legacy managed_by values (system/config), but the A4 vocab unification (#2934)
stamps and boot-normalizes rows to platform/package — so the gate silently
stopped firing for positions, letting admins physically delete the everyone/
guest audience anchors once their bindings were removed. Guard both the
canonical and legacy vocabularies, update the gate tests to the canonical
values, add legacy-row regressions, and correct the stale 'no runtime path
branches on legacy values' safety comments.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017bJWtKmZ2mFpRFAmmmoeqe

Author: claude

.changeset/security-2926-position-gate-vocab.md

@@ -0,0 +1,5 @@
+---
+'@objectstack/plugin-security': patch
+---
+
+fix(plugin-security): re-arm the sys_position system-row write gate after the A4 managed_by rename (#2926 ①). The gate's provenance map still keyed on the legacy `system`/`config` values while rows are now stamped (and boot-normalized to) `platform`/`package`, so platform/package-managed positions — including the `everyone`/`guest` audience anchors — could be physically deleted through the data API once their bindings were removed. The map now guards both the canonical and legacy vocabularies, and the misleading "no runtime path branches on legacy values" safety notes were corrected.

packages/plugins/plugin-security/src/normalize-managed-by.ts

@@ -17,10 +17,12 @@
  * `'config'` / `'user'`. Built-in position rows and declared package sets
  * self-heal on their own bootstrap upsert, so this only mops up the rest.
  *
- * Safe by construction: NO runtime path branches on the legacy values (every
- * read keys on `'package'` or `'platform'`, both unchanged by the rename), so
- * this is a pure display-vocabulary migration — it never changes an access
- * decision. Idempotent: canonical rows are skipped, so a re-run is a no-op.
+ * NOT purely cosmetic: the system-row write gate's provenance map
+ * (SYSTEM_ROW_PROVENANCE in security-plugin.ts) branches on `managed_by`
+ * values, so it must recognize BOTH the canonical and the legacy vocabulary —
+ * renaming a stored value without updating that map silently disarms the gate
+ * (#2926 ①). Keep the two in lockstep whenever this vocabulary changes.
+ * Idempotent: canonical rows are skipped, so a re-run is a no-op.
  * Best-effort and non-fatal, like the sibling boot reconcilers.
  *
  * Runs on `kernel:ready` after the seeders, as `isSystem` (the field is

packages/plugins/plugin-security/src/objects/sys-position.object.ts

@@ -224,9 +224,10 @@ export const SysPosition = ObjectSchema.create({
     // built-in identity position (seeded by bootstrapBuiltinRoles, read-only);
     // `package` = stack/package-declared; `admin` = tenant-created in Setup.
     // Back-compat: legacy rows may carry system (== platform) / config (== package)
-    // / user (== admin); no runtime path branches on those (every read keys on
-    // 'package' / 'platform'), and the boot normalizer heals them to the canonical
-    // vocab. Built-in (`platform`) rows self-heal on the next bootstrap upsert.
+    // / user (== admin); the boot normalizer heals them to the canonical vocab, and
+    // the system-row write gate (SYSTEM_ROW_PROVENANCE, security-plugin.ts) guards
+    // both vocabularies — keep it in lockstep with any change here (#2926 ①).
+    // Built-in (`platform`) rows self-heal on the next bootstrap upsert.
     managed_by: Field.select({
       label: 'Managed By',
       readonly: true,

packages/plugins/plugin-security/src/security-plugin.test.ts

@@ -1428,24 +1428,48 @@ describe('SecurityPlugin', () => {
       return harness.run(opCtx);
     };
 
-    it('DENIES deleting a platform-managed position (sys_position managed_by:system)', async () => {
+    it('DENIES deleting a platform-managed position (sys_position managed_by:platform)', async () => {
       const opCtx: any = {
         object: 'sys_position', operation: 'delete',
         options: { where: { id: 'pos_admin' } }, context: adminCtx,
       };
       await expect(
-        runGate(opCtx, () => ({ id: 'pos_admin', name: 'platform_admin', managed_by: 'system' })),
+        runGate(opCtx, () => ({ id: 'pos_admin', name: 'platform_admin', managed_by: 'platform' })),
       ).rejects.toMatchObject({ name: 'PermissionDeniedError' });
     });
 
-    it('DENIES updating a package-declared position (sys_position managed_by:config)', async () => {
+    it('DENIES updating a package-declared position (sys_position managed_by:package)', async () => {
       const opCtx: any = {
         object: 'sys_position', operation: 'update',
         data: { id: 'pos_sales', label: 'renamed' }, options: { where: { id: 'pos_sales' } },
         context: adminCtx,
       };
       await expect(
-        runGate(opCtx, () => ({ id: 'pos_sales', name: 'sales_rep', managed_by: 'config' })),
+        runGate(opCtx, () => ({ id: 'pos_sales', name: 'sales_rep', managed_by: 'package' })),
+      ).rejects.toMatchObject({ name: 'PermissionDeniedError' });
+    });
+
+    // [#2926 ①] Regression: the A4 rename (system→platform, config→package) once
+    // disarmed this gate because the provenance map only knew the legacy values.
+    // Rows the boot normalizer has not healed yet must STAY protected too.
+    it('KEEPS denying legacy-vocab managed positions (managed_by:system, pre-normalizer rows)', async () => {
+      const opCtx: any = {
+        object: 'sys_position', operation: 'delete',
+        options: { where: { id: 'pos_legacy' } }, context: adminCtx,
+      };
+      await expect(
+        runGate(opCtx, () => ({ id: 'pos_legacy', name: 'everyone', managed_by: 'system' })),
+      ).rejects.toMatchObject({ name: 'PermissionDeniedError' });
+    });
+
+    it('KEEPS denying legacy-vocab managed positions (managed_by:config, pre-normalizer rows)', async () => {
+      const opCtx: any = {
+        object: 'sys_position', operation: 'update',
+        data: { id: 'pos_legacy2', label: 'renamed' }, options: { where: { id: 'pos_legacy2' } },
+        context: adminCtx,
+      };
+      await expect(
+        runGate(opCtx, () => ({ id: 'pos_legacy2', name: 'sales_rep', managed_by: 'config' })),
       ).rejects.toMatchObject({ name: 'PermissionDeniedError' });
     });
 
@@ -1470,13 +1494,23 @@ describe('SecurityPlugin', () => {
       ).rejects.toMatchObject({ name: 'PermissionDeniedError' });
     });
 
-    it('ALLOWS deleting an admin-authored position (sys_position managed_by:user)', async () => {
+    it('ALLOWS deleting an admin-authored position (sys_position managed_by:admin)', async () => {
       const opCtx: any = {
         object: 'sys_position', operation: 'delete',
         options: { where: { id: 'pos_user' } }, context: adminCtx,
       };
       await expect(
-        runGate(opCtx, () => ({ id: 'pos_user', name: 'my_team', managed_by: 'user' })),
+        runGate(opCtx, () => ({ id: 'pos_user', name: 'my_team', managed_by: 'admin' })),
+      ).resolves.toBeDefined();
+    });
+
+    it('ALLOWS deleting a legacy admin-authored position (managed_by:user, pre-normalizer)', async () => {
+      const opCtx: any = {
+        object: 'sys_position', operation: 'delete',
+        options: { where: { id: 'pos_user_legacy' } }, context: adminCtx,
+      };
+      await expect(
+        runGate(opCtx, () => ({ id: 'pos_user_legacy', name: 'my_team', managed_by: 'user' })),
       ).resolves.toBeDefined();
     });
 
@@ -1502,10 +1536,18 @@ describe('SecurityPlugin', () => {
       ).resolves.toBeDefined();
     });
 
-    it('DENIES an admin-door insert that forges platform provenance (sys_position managed_by:system)', async () => {
+    it('DENIES an admin-door insert that forges platform provenance (sys_position managed_by:platform)', async () => {
+      const opCtx: any = {
+        object: 'sys_position', operation: 'insert',
+        data: { name: 'forged', managed_by: 'platform' }, context: adminCtx,
+      };
+      await expect(runGate(opCtx)).rejects.toMatchObject({ name: 'PermissionDeniedError' });
+    });
+
+    it('DENIES an admin-door insert that forges LEGACY platform provenance (managed_by:system)', async () => {
       const opCtx: any = {
         object: 'sys_position', operation: 'insert',
-        data: { name: 'forged', managed_by: 'system' }, context: adminCtx,
+        data: { name: 'forged_legacy', managed_by: 'system' }, context: adminCtx,
       };
       await expect(runGate(opCtx)).rejects.toMatchObject({ name: 'PermissionDeniedError' });
     });
@@ -1549,14 +1591,14 @@ describe('SecurityPlugin', () => {
         context: adminCtx,
       };
       await expect(
-        runGate(opCtx, () => ({ id: 'pos_admin', managed_by: 'system' })),
+        runGate(opCtx, () => ({ id: 'pos_admin', managed_by: 'platform' })),
       ).rejects.toMatchObject({ name: 'PermissionDeniedError' });
     });
 
     it('ALLOWS a filter delete that matches only admin-authored rows (probe finds none)', async () => {
       const opCtx: any = {
         object: 'sys_position', operation: 'delete',
-        options: { where: { managed_by: 'user' } },
+        options: { where: { managed_by: 'admin' } },
         context: adminCtx,
       };
       // The managed-row probe finds nothing → the write proceeds.
@@ -1570,7 +1612,7 @@ describe('SecurityPlugin', () => {
         context: {}, // no roles, no permissions, no userId, not isSystem
       };
       await expect(
-        runGate(opCtx, () => ({ id: 'pos_admin', name: 'platform_admin', managed_by: 'system' })),
+        runGate(opCtx, () => ({ id: 'pos_admin', name: 'platform_admin', managed_by: 'platform' })),
       ).rejects.toMatchObject({ name: 'PermissionDeniedError' });
     });
 
@@ -1581,7 +1623,7 @@ describe('SecurityPlugin', () => {
         context: { isSystem: true },
       };
       await expect(
-        runGate(opCtx, () => ({ id: 'pos_admin', name: 'platform_admin', managed_by: 'system' })),
+        runGate(opCtx, () => ({ id: 'pos_admin', name: 'platform_admin', managed_by: 'platform' })),
       ).resolves.toBeDefined();
     });
   });

packages/plugins/plugin-security/src/security-plugin.ts

@@ -113,13 +113,18 @@ const EMPTY_REQUIRED_PERMISSIONS: NormalizedRequiredPermissions = Object.freeze(
  * [ADR-0066 / #2918] Provenance spec for the platform/application asset objects
  * whose managed rows are write-protected by {@link SecurityPlugin.assertSystemRowWriteGate}.
  *
- * The two objects use DIFFERENT `managed_by` vocabularies but the same ownership
- * idea — a row authored by the platform or an application package is not the
- * admin's to delete or rewrite:
- *   • sys_position.managed_by   — `system` (platform built-in) / `config`
- *     (package declared) are managed; `user`/∅ (tenant-authored) are the admin's.
- *   • sys_capability.managed_by — `platform` / `package` are managed; `admin`
- *     (created in Setup) is the admin's.
+ * Both objects share the unified A4 (#2920) `managed_by` vocabulary — a row
+ * authored by the platform or an application package is not the admin's to
+ * delete or rewrite:
+ *   • `platform` / `package` are managed; `admin`/∅ (tenant-authored) rows are
+ *     the admin's.
+ *   • sys_position additionally keeps its LEGACY values `system` (→ platform)
+ *     and `config` (→ package) in the managed map: the boot normalizer
+ *     (normalize-managed-by.ts) heals stored rows to the canonical vocabulary,
+ *     but rows written before the normalizer runs — or in a store it has not
+ *     touched yet — must not lose protection in the interim. Dropping the
+ *     legacy keys here is what silently disarmed this gate for sys_position
+ *     after the A4 rename (#2926 ①).
  * The map value for each managed `managed_by` is the human owner label used in
  * the (business-message-only) deny text.
  */
@@ -130,7 +135,13 @@ const SYSTEM_ROW_PROVENANCE: Record<
   sys_position: {
     noun: 'position',
     pluralNoun: 'positions',
-    managed: { system: 'the platform', config: 'an application package' },
+    managed: {
+      platform: 'the platform',
+      package: 'an application package',
+      // Legacy pre-A4 values — keep guarded until every store is normalized.
+      system: 'the platform',
+      config: 'an application package',
+    },
   },
   sys_capability: {
     noun: 'capability',