fix(security): clamp managed-object writes in /me/permissions to permission ∩ guard (ADR-0092 complete fix)

Completes the /me/permissions consistency fix. foldWildcardSuperUser
alone fixed the false-NEGATIVE (admin couldn't see sys_user editable)
but introduced a false-POSITIVE: it reported allowEdit:true for every
better-auth identity table, including ones the identity write guard
(#2828) actually blocks (sys_member, sys_account, sys_session, …).

clampManagedObjectWrites re-applies the guard's user-context policy: a
managedBy:'better-auth' object is writable only where it opted in via
userActions.{edit,create,delete} (sys_user → edit; the field readonly
flags then narrow it to {name,image}). Only better-auth objects are
clamped — system/config/append-only have no such guard, so their
permission-set result stands (admin CAN write them; must not under-report).

Net: the Console's per-object FLS now equals real server enforcement
(permission-set ∩ guard). Verified against a running stack: sys_user
allowEdit:true + form editable; sys_member/session/account allowEdit:false
(read preserved). +4 unit tests (8 total).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01YGAN5VvvBi4YRGwpNT6e21

Author: claude

.changeset/me-permissions-wildcard-fold.md

@@ -2,7 +2,7 @@
 "@objectstack/plugin-hono-server": patch
 ---
 
-fix(security): `/me/permissions` folds the `'*'` wildcard super-user grant into per-object FLS, matching server enforcement (ADR-0057 D10)
+fix(security): `/me/permissions` now reflects permission-set ∩ identity-write-guard, matching real server enforcement (ADR-0057 D10)
 
 The `/api/v1/auth/me/permissions` per-object map merged each permission set's
 explicit `objects` entries most-permissively per key, but treated `'*'` and
@@ -13,14 +13,25 @@ enforcement (`PermissionEvaluator.checkObjectPermission` allows as soon as any
 set grants, including via the `'*'` modifyAll/viewAll super-user bypass, with
 no deny-wins).
 
-Concretely: a platform admin (`admin_full_access` → `'*': {modifyAllRecords}`)
-who also holds `organization_admin` (which denies writes on identity tables)
-resolved to `sys_user.allowEdit:false` in this payload, so the Console disabled
-the standard edit form — even though the server accepts the write (`PATCH
-/data/sys_user {name}` → 200). The new `foldWildcardSuperUser` post-pass lifts
-each per-object entry's read/write bits when the merged wildcard is a
-super-user grant, so the client mirrors the server (never broader — the
-super-user grant already covers private/managed objects server-side). This
-unblocks the ADR-0092 D4 `sys_user` profile-edit affordance for platform
-admins; the identity write guard still restricts the actual write to
-`{name, image}`.
+The real effective answer for a user-context caller is `permission-set grant ∩
+identity-write-guard policy`, and the payload now computes both:
+
+1. `foldWildcardSuperUser` lifts each per-object entry's read/write bits when
+   the merged `'*'` is a super-user grant — fixing the false-NEGATIVE where a
+   platform admin (`admin_full_access` `'*': {modifyAllRecords}`) who also holds
+   `organization_admin` (explicit identity denies) resolved to
+   `sys_user.allowEdit:false` and a disabled edit form, though the server
+   accepts the write (`PATCH /data/sys_user {name}` → 200).
+2. `clampManagedObjectWrites` re-clamps `managedBy: 'better-auth'` objects by
+   their write affordance — fixing the false-POSITIVE the fold would otherwise
+   introduce: the identity write guard (ADR-0092 D2) blocks user-context writes
+   on identity tables except where the object opted in (`userActions.edit`), so
+   `sys_member` / `sys_account` / `sys_session` stay `allowEdit:false` for the
+   admin (read stays granted). Only `better-auth` objects are clamped — the
+   guard covers only them; `system`/`config`/`append-only` objects have no such
+   guard and their permission-set result stands.
+
+Net: the Console's per-object FLS now equals real server enforcement — the
+ADR-0092 D4 `sys_user` profile-edit affordance is unblocked for platform admins
+(the guard still narrows the write to `{name, image}`), and no other identity
+table is shown as editable when the guard would reject it.

packages/plugins/plugin-hono-server/src/fold-wildcard-superuser.test.ts

@@ -1,7 +1,7 @@
 // Copyright (c) 2026 ObjectStack. Licensed under the Apache-2.0 license.
 
 import { describe, it, expect } from 'vitest';
-import { foldWildcardSuperUser } from './hono-plugin.js';
+import { foldWildcardSuperUser, clampManagedObjectWrites, type ManagedSchemaLike } from './hono-plugin.js';
 
 /**
  * ADR-0057 D10 / ADR-0092 D5 — the `/me/permissions` per-object FLS map must
@@ -48,3 +48,60 @@ describe('foldWildcardSuperUser', () => {
     expect(objects.sys_user.allowEdit).toBe(false);
   });
 });
+
+/**
+ * ADR-0092 D2 — the identity write guard is a second enforcement layer the
+ * permission sets don't model. The client hint must reflect permission ∩ guard:
+ * managed (`better-auth`) objects are user-context-writable only where the
+ * object opened the affordance; others (system/config/…) are untouched.
+ */
+describe('clampManagedObjectWrites', () => {
+  const SCHEMAS: Record<string, ManagedSchemaLike> = {
+    sys_user: { managedBy: 'better-auth', userActions: { edit: true } },
+    sys_member: { managedBy: 'better-auth' },
+    sys_session: { managedBy: 'better-auth' },
+    sys_automation_run: { managedBy: 'system' }, // NOT better-auth → not guarded
+    crm_lead: { managedBy: 'platform' },
+  };
+  const schemaOf = (n: string) => SCHEMAS[n];
+
+  it('keeps write on a managed object that opened the edit affordance (sys_user)', () => {
+    const objects: Record<string, any> = { sys_user: { allowRead: true, allowEdit: true, allowCreate: true, allowDelete: true } };
+    clampManagedObjectWrites(objects, schemaOf);
+    // edit opted-in stays; create/delete were NOT opted in → clamped off.
+    expect(objects.sys_user).toMatchObject({ allowRead: true, allowEdit: true, allowCreate: false, allowDelete: false });
+  });
+
+  it('clamps write to false on managed objects the guard blocks (sys_member, sys_session)', () => {
+    const objects: Record<string, any> = {
+      sys_member: { allowRead: true, allowEdit: true, allowCreate: true, allowDelete: true },
+      sys_session: { allowRead: true, allowEdit: true },
+    };
+    clampManagedObjectWrites(objects, schemaOf);
+    expect(objects.sys_member).toMatchObject({ allowRead: true, allowEdit: false, allowCreate: false, allowDelete: false });
+    expect(objects.sys_session.allowEdit).toBe(false);
+    expect(objects.sys_session.allowRead).toBe(true); // read never clamped
+  });
+
+  it('leaves non-better-auth managed buckets untouched (system objects have no write guard)', () => {
+    const objects: Record<string, any> = { sys_automation_run: { allowEdit: true }, crm_lead: { allowEdit: true } };
+    clampManagedObjectWrites(objects, schemaOf);
+    expect(objects.sys_automation_run.allowEdit).toBe(true);
+    expect(objects.crm_lead.allowEdit).toBe(true);
+  });
+
+  it('fold + clamp compose to permission ∩ guard for a platform admin', () => {
+    // As produced for a platform admin (admin_full_access '*' modifyAll) who
+    // also holds organization_admin (explicit managed denies).
+    const objects: Record<string, any> = {
+      '*': { allowRead: true, allowEdit: true, viewAllRecords: true, modifyAllRecords: true },
+      sys_user: { allowRead: true, allowEdit: false, allowCreate: false, allowDelete: false },
+      sys_member: { allowRead: true, allowEdit: false, allowCreate: false, allowDelete: false },
+    };
+    foldWildcardSuperUser(objects);
+    clampManagedObjectWrites(objects, schemaOf);
+    expect(objects.sys_user.allowEdit).toBe(true);   // opened + admin → editable
+    expect(objects.sys_member.allowEdit).toBe(false); // guard blocks → not editable
+    expect(objects.sys_member.allowRead).toBe(true);  // read still granted by super-user
+  });
+});

packages/plugins/plugin-hono-server/src/hono-plugin.ts

@@ -120,6 +120,46 @@ export function foldWildcardSuperUser(objects: Record<string, any>): void {
     }
 }
 
+/** Minimal schema shape the managed-write clamp needs. */
+export interface ManagedSchemaLike {
+    managedBy?: string;
+    userActions?: { create?: boolean; edit?: boolean; delete?: boolean } | null;
+}
+
+/**
+ * Re-clamp a `/me/permissions` `objects` map by the SECOND server-side
+ * enforcement layer that permission sets don't model: the identity write guard
+ * (ADR-0092 D2). The guard fail-closed rejects USER-CONTEXT insert/update/delete
+ * on every `managedBy: 'better-auth'` object except where the object opted a
+ * write affordance in (`userActions.{create,edit,delete}` — e.g. sys_user opens
+ * `edit` for its profile fields; the field-level `readonly` flags then narrow it
+ * to `{name, image}`).
+ *
+ * Without this clamp, {@link foldWildcardSuperUser} would report `allowEdit:true`
+ * for a platform admin on identity tables the guard actually blocks (sys_member,
+ * sys_account, …) — a false-POSITIVE that mirrors, inverted, the false-negative
+ * the fold fixes. The real effective answer for a user-context caller is
+ * `permission-set grant ∩ guard policy`, and the guard policy for a managed
+ * object is exactly its resolved CRUD affordance. Only `better-auth` objects are
+ * clamped — the guard covers only them; `system`/`config`/`append-only` objects
+ * have no such guard, so their permission-set result stands (an admin CAN write
+ * them via the data API, and the hint must not under-report that).
+ */
+export function clampManagedObjectWrites(
+    objects: Record<string, any>,
+    schemaOf: (objectName: string) => ManagedSchemaLike | undefined,
+): void {
+    for (const [obj, acc] of Object.entries(objects) as Array<[string, any]>) {
+        if (obj === '*' || !acc) continue;
+        const schema = schemaOf(obj);
+        if (schema?.managedBy !== 'better-auth') continue;
+        const ua = schema.userActions ?? {};
+        if (ua.edit !== true) acc.allowEdit = false;
+        if (ua.create !== true) acc.allowCreate = false;
+        if (ua.delete !== true) acc.allowDelete = false;
+    }
+}
+
 export class HonoServerPlugin implements Plugin {
     name = 'com.objectstack.server.hono';
     type = 'server';
@@ -835,10 +875,21 @@ export class HonoServerPlugin implements Plugin {
                         }
                     }
                 }
-                // Fold the `'*'` wildcard super-user grant into every per-object
-                // entry (see foldWildcardSuperUser) so the client's per-object FLS
-                // matches the server's actual enforcement (ADR-0057 D10).
+                // Make the client's per-object FLS reflect the server's ACTUAL
+                // effective enforcement = permission-set grant ∩ identity write
+                // guard (ADR-0057 D10). (1) Fold the `'*'` super-user grant into
+                // every object so an admin's wildcard is not shadowed by another
+                // set's explicit deny; (2) re-clamp `better-auth` managed objects
+                // by their write affordance, since the guard (ADR-0092 D2) blocks
+                // user-context writes there except where the object opted in
+                // (sys_user → edit). Together these remove both the false-negative
+                // (admin sees sys_user editable) and the false-positive (admin does
+                // NOT see sys_member editable, matching the guard).
                 foldWildcardSuperUser(objects);
+                clampManagedObjectWrites(objects, (name) => {
+                    try { return ql?.getSchema?.(name) as ManagedSchemaLike | undefined; }
+                    catch { return undefined; }
+                });
                 return c.json({
                     authenticated: true,
                     userId: execCtx.userId,