Skip to content

Commit 63d5403

Browse files
os-zhuangclaude
os-zhuang
and
claude
authored
feat(spec)!: remove dead PolicySchema / definePolicy + stack policies (#1882, 11.0) (#2387)
* feat(spec)!: remove dead PolicySchema / definePolicy + stack `policies` (#1882, 11.0) PolicySchema (org security policy: password/network/session/audit) was 100% unenforced (no runtime reader). Per ADR-0049 enforce-or-remove, removed: - spec: delete security/policy.zod.ts + drop the `policies` stack field and its collection wiring (MAP_SUPPORTED_FIELDS / METADATA_ALIASES in shared/metadata-collection.zod.ts + the stack key list). - downstream-contract: drop DcPolicy fixture + contract case. - examples app-crm/app-showcase: drop unused policy defs. - regen api-surface (only the 8 Policy exports removed). Verified downstream: ../hotcrm + ../templates have ZERO Policy-API usage (templates only imports SharingRule, untouched). spec security 123 + downstream-contract 14 + objectql 718 green; api-surface check ✓; spec/examples build green. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * test(spec): drop policies↔policy mapping assertions after PolicySchema removal metadata-collection.test.ts asserted the now-removed `policies`/`policy` collection alias (PLURAL_TO_SINGULAR / pluralToSingular / singularToPlural). Full spec suite (6595) now green. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * test(app-crm): drop the 'has security policies' smoke assertion after PolicySchema removal stack.policies no longer exists. Exhaustive repo grep confirms no remaining .policies collection access or definePolicy/DcPolicy usage. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> --------- Co-authored-by: Jack Zhuang <277994282+os-zhuang@users.noreply.github.com> Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
1 parent f4aee81 commit 63d5403

18 files changed

Lines changed: 24 additions & 554 deletions

‎.changeset/v11-remove-policyschema.md‎

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
---
2+
"@objectstack/spec": major
3+
---
4+
5+
Remove the dead `PolicySchema` / `definePolicy` and the stack `policies` collection (#1882, ADR-0049).
6+
7+
`PolicySchema` (password / network / session / audit "org security policy") was
8+
**100% unenforced** — no runtime consumer ever read it. Per ADR-0049
9+
(enforce-or-remove) it is removed rather than implemented:
10+
11+
- `@objectstack/spec`: delete `security/policy.zod.ts` (`PolicySchema`,
12+
`Password/Network/Session/AuditPolicySchema`, `definePolicy`); drop the
13+
`policies` field from the stack schema and the `policies` collection wiring
14+
(`MAP_SUPPORTED_FIELDS`, `METADATA_ALIASES`).
15+
- `@objectstack/downstream-contract`: drop the `DcPolicy` fixture/case (the
16+
contract gate stays green — `SharingRule` / `PermissionSet` are unaffected).
17+
- Examples (`app-crm`, `app-showcase`): drop their unused policy definitions.
18+
19+
No migration needed for consumers: `policies` was never enforced. `SharingRule`,
20+
`PermissionSet`, RLS, and all `*PolicySchema` siblings (retry/retention/RLS/etc.)
21+
are unrelated and unchanged. Verified: hotcrm + templates have zero Policy-API
22+
usage; downstream-contract gate green.

‎examples/app-crm/objectstack.config.ts‎

Lines changed: 0 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -22,8 +22,6 @@ import {
2222
HighValueOpportunitySharingRule,
2323
RepLeadSharingRule,
2424
WonDealActivitySharingRule,
25-
CrmDefaultPolicy,
26-
CrmFinancePolicy,
2725
} from './src/security/index.js';
2826
import { CrmSeedData } from './src/data/index.js';
2927
import { LeadCsvImportMapping, ContactJsonSyncMapping } from './src/data/crm-mappings.js';
@@ -118,7 +116,6 @@ export default defineStack({
118116
RepLeadSharingRule,
119117
WonDealActivitySharingRule,
120118
],
121-
policies: [CrmDefaultPolicy, CrmFinancePolicy],
122119

123120
// API
124121
apis: [PipelineSummaryEndpoint, LeadConvertEndpoint, MarketingWebhookEndpoint],

‎examples/app-crm/src/security/crm-policy.ts‎

Lines changed: 0 additions & 59 deletions
This file was deleted.

‎examples/app-crm/src/security/index.ts‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -14,4 +14,3 @@ export {
1414
WonDealActivitySharingRule,
1515
} from './sharing-rules.js';
1616

17-
export { CrmDefaultPolicy, CrmFinancePolicy } from './crm-policy.js';

‎examples/app-crm/test/smoke.test.ts‎

Lines changed: 0 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -109,11 +109,6 @@ describe('app-crm minimal metadata bundle', () => {
109109
expect(rules.some((r) => r.type === 'owner')).toBe(true);
110110
});
111111

112-
it('has security policies', () => {
113-
const policies = stack.policies ?? [];
114-
expect(policies.length).toBeGreaterThanOrEqual(1);
115-
expect(policies.some((p) => p.isDefault)).toBe(true);
116-
});
117112

118113
it('has API endpoints', () => {
119114
expect((stack.apis ?? []).length).toBeGreaterThanOrEqual(2);

‎examples/app-showcase/objectstack.config.ts‎

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -33,7 +33,6 @@ import {
3333
allRoles,
3434
allPermissionSets,
3535
allSharingRules,
36-
allPolicies,
3736
} from './src/security/index.js';
3837
import { allThemes } from './src/themes/index.js';
3938
import { ShowcaseTranslationBundle } from './src/translations/index.js';
@@ -174,7 +173,6 @@ export default defineStack({
174173
roles: allRoles,
175174
permissions: allPermissionSets,
176175
sharingRules: allSharingRules,
177-
policies: allPolicies,
178176

179177
// Seed data
180178
data: ShowcaseSeedData,

‎examples/app-showcase/src/security/index.ts‎

Lines changed: 0 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -172,24 +172,7 @@ export const ContributorTaskSharingRule = {
172172
active: true,
173173
};
174174

175-
// ── Org security policy ─────────────────────────────────────────────────────
176-
export const ShowcasePolicy = {
177-
name: 'showcase_default_policy',
178-
password: {
179-
minLength: 12,
180-
requireUppercase: true,
181-
requireLowercase: true,
182-
requireNumbers: true,
183-
requireSymbols: true,
184-
expirationDays: 90,
185-
historyCount: 5,
186-
},
187-
session: { idleTimeout: 30, absoluteTimeout: 480, forceMfa: false },
188-
audit: { logRetentionDays: 365, sensitiveFields: ['budget', 'spent'], captureRead: false },
189-
isDefault: true,
190-
};
191175

192176
export const allRoles = [ContributorRole, ManagerRole, ExecRole];
193177
export const allPermissionSets = [ContributorPermissionSet, MemberDefaultProfile];
194178
export const allSharingRules = [RedProjectSharingRule, HighValueRedProjectRule, ContributorTaskSharingRule];
195-
export const allPolicies = [ShowcasePolicy];

‎packages/downstream-contract/src/additional-domains.fixtures.ts‎

Lines changed: 1 addition & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@
77
// and DO NOT edit them to make a failing spec change pass — see the README.
88
import type { DatasourceInput, MappingInput, CubeInput, ObjectExtensionInput } from '@objectstack/spec/data';
99
import type { ConnectorInput } from '@objectstack/spec/integration';
10-
import type { PolicyInput, SharingRuleInput, PermissionSetInput } from '@objectstack/spec/security';
10+
import type { SharingRuleInput, PermissionSetInput } from '@objectstack/spec/security';
1111
import type { RoleInput } from '@objectstack/spec/identity';
1212
import type { EmailTemplateDefinitionInput, TranslationBundleInput } from '@objectstack/spec/system';
1313
import type { WebhookInput } from '@objectstack/spec/automation';
@@ -43,13 +43,6 @@ export const DcConnector: ConnectorInput = {
4343
],
4444
};
4545

46-
export const DcPolicy: PolicyInput = {
47-
name: 'dc_default_policy',
48-
isDefault: true,
49-
password: { minLength: 12, requireUppercase: true, requireNumbers: true },
50-
session: { idleTimeout: 30, absoluteTimeout: 480 },
51-
};
52-
5346
export const DcSharingRule: SharingRuleInput = {
5447
type: 'criteria',
5548
name: 'dc_share_customers',

‎packages/downstream-contract/test/contract.test.ts‎

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@ import { describe, it, expect } from 'vitest';
44
import { ActionSchema, ReportSchema, PageSchema, ThemeSchema } from '@objectstack/spec/ui';
55
import { DatasourceSchema, MappingSchema, CubeSchema, ObjectExtensionSchema } from '@objectstack/spec/data';
66
import { ConnectorSchema } from '@objectstack/spec/integration';
7-
import { PolicySchema, SharingRuleSchema, PermissionSetSchema } from '@objectstack/spec/security';
7+
import { SharingRuleSchema, PermissionSetSchema } from '@objectstack/spec/security';
88
import { RoleSchema } from '@objectstack/spec/identity';
99
import { EmailTemplateDefinitionSchema, TranslationBundleSchema } from '@objectstack/spec/system';
1010
import { WebhookSchema } from '@objectstack/spec/automation';
@@ -35,7 +35,6 @@ describe('downstream consumer contract (#2035)', () => {
3535
const cases: Array<[string, { parse: (v: unknown) => unknown }, unknown]> = [
3636
['Datasource', DatasourceSchema, more.DcDatasource],
3737
['Connector', ConnectorSchema, more.DcConnector],
38-
['Policy', PolicySchema, more.DcPolicy],
3938
['SharingRule', SharingRuleSchema, more.DcSharingRule],
4039
['Role', RoleSchema, more.DcRole],
4140
['PermissionSet', PermissionSetSchema, more.DcPermissionSet],

‎packages/spec/api-surface-signatures.json‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -14,7 +14,6 @@
1414
"defineObjectExtension": "sha256:5286253308912bb1",
1515
"definePage": "sha256:e80363c256809a11",
1616
"definePermissionSet": "sha256:67b188ae181994cd",
17-
"definePolicy": "sha256:f66d2be4a3d5fe98",
1817
"defineReport": "sha256:f7e85ba0996a5824",
1918
"defineRole": "sha256:40b8e11786c4ecbb",
2019
"defineSharingRule": "sha256:03347645bbda2880",

0 commit comments

Comments
 (0)