feat(app-showcase): public-read OWD scenario + proof (ADR-0056)

Sibling of the private-note scenario: showcase_announcement declares
sharingModel: 'read' (everyone reads, only owner edits) — no RLS authored.
Proof showcase-public-read-owd (3 tests) shows cross-owner READ allowed but
cross-owner WRITE denied, contrasting the private note's hidden rows.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01XVdnfUAx85amkerym26vdx

Author: claude

.changeset/showcase-private-owd.md

@@ -2,14 +2,19 @@
 "@objectstack/example-showcase": minor
 ---
 
-feat(app-showcase): declarative owner-private object (`showcase_private_note`, ADR-0056)
-
-Adds the canonical **declarative `private` OWD** scenario: `showcase_private_note`
-declares `sharingModel: 'private'` and an `owner_id` field — and nothing else (no
-RLS policy, no owner predicate, no permission-set rule). The engine derives owner
-scoping from the OWD baseline + the auto-stamped `owner_id`, so a user sees and
-edits only the notes they own. This is the declarative counterpart to the invoice's
-hand-written `owner = current_user.email` escape-hatch — for plain "my records are
-mine" ownership, an object declares one word and the platform enforces it. Proven
-end-to-end (two users, owner isolation on read + by-id read/write) by the new
-`showcase-private-owd` dogfood test.
+feat(app-showcase): declarative OWD scenarios — owner-private + public-read (ADR-0056)
+
+Adds the two canonical Org-Wide-Default scenarios, each declaring its access policy
+in ONE word with no authored RLS:
+
+- `showcase_private_note` — `sharingModel: 'private'`: a user sees and edits only
+  the notes they own (owner-only read + write).
+- `showcase_announcement` — `sharingModel: 'read'`: every member reads every
+  announcement, but only the owner may edit/delete it (public-read).
+
+Both derive scoping from the OWD baseline + the auto-stamped `owner_id` — the
+declarative counterpart to the invoice's hand-written `owner = current_user.email`
+escape-hatch. Proven end-to-end (two users, real HTTP) by the new
+`showcase-private-owd` and `showcase-public-read-owd` dogfood tests, which together
+demonstrate the OWD read-visibility axis (`private` hides others' rows; `read`
+shows them but still protects writes).

examples/app-showcase/src/objects/announcement.object.ts

@@ -0,0 +1,31 @@
+// Copyright (c) 2026 ObjectStack. Licensed under the Apache-2.0 license.
+
+import { ObjectSchema, Field } from '@objectstack/spec/data';
+
+/**
+ * Team Announcement — the canonical PUBLIC-READ object (ADR-0056 OWD).
+ *
+ * Declares `sharingModel: 'read'`: every member can READ every announcement,
+ * but only the OWNER may edit or delete it (the engine derives "everyone reads,
+ * owner writes" from the OWD baseline + the auto-stamped `owner_id`). No RLS
+ * policy is authored. This is the sibling of `showcase_private_note`
+ * (`sharingModel: 'private'`, owner-only read): together the two objects
+ * demonstrate the OWD read-visibility axis — `private` hides others' rows,
+ * `read` shows them but still protects writes.
+ */
+export const Announcement = ObjectSchema.create({
+  name: 'showcase_announcement',
+  label: 'Announcement',
+  pluralLabel: 'Announcements',
+  icon: 'megaphone',
+  description: 'A team announcement everyone can read but only its owner can edit — `read` OWD (ADR-0056).',
+
+  // Everyone reads; owner writes. No RLS authored.
+  sharingModel: 'read',
+
+  fields: {
+    title: Field.text({ label: 'Title', required: true, searchable: true, maxLength: 160 }),
+    body: Field.text({ label: 'Body', maxLength: 2000 }),
+    owner_id: Field.lookup('sys_user', { label: 'Owner' }),
+  },
+});

examples/app-showcase/src/objects/index.ts

@@ -9,3 +9,4 @@ export { Product, Invoice, InvoiceLine } from './invoice.object.js';
 export { FieldZoo } from './field-zoo.object.js';
 export { Preference } from './preference.object.js';
 export { PrivateNote } from './private-note.object.js';
+export { Announcement } from './announcement.object.js';

packages/dogfood/test/showcase-public-read-owd.dogfood.test.ts

@@ -0,0 +1,60 @@
+// Copyright (c) 2026 ObjectStack. Licensed under the Apache-2.0 license.
+//
+// ADR-0056 — `read` (public-read) OWD proof on the REAL showcase app.
+// `showcase_announcement` declares `sharingModel: 'read'` and nothing else: every
+// member READS every announcement, but only the OWNER may edit/delete it — derived
+// from the OWD baseline + auto-stamped `owner_id`, no RLS authored. This is the
+// sibling of the `private` proof: same owner-write protection, but rows are
+// VISIBLE across owners (the read-visibility axis of OWD).
+
+import { describe, it, expect, beforeAll, afterAll } from 'vitest';
+import showcaseStack from '@objectstack/example-showcase';
+import { bootStack, type VerifyStack } from '@objectstack/verify';
+
+const OBJ = '/data/showcase_announcement';
+const idOf = (b: any) => b?.id ?? b?.record?.id ?? b?.data?.id ?? b?.recordId;
+
+describe('showcase: public-read OWD (ADR-0056)', () => {
+  let stack: VerifyStack;
+  let aToken: string;
+  let bToken: string;
+  let aAnnId: string;
+
+  beforeAll(async () => {
+    stack = await bootStack(showcaseStack);
+    await stack.signIn();
+    aToken = await stack.signUp('pr-alice@verify.test');
+    bToken = await stack.signUp('pr-bob@verify.test');
+
+    const a = await stack.apiAs(aToken, 'POST', OBJ, { title: 'Alice announces', body: 'hello team' });
+    expect(a.status).toBeLessThan(300);
+    aAnnId = idOf(await a.json());
+    expect(aAnnId).toBeTruthy();
+  }, 60_000);
+
+  afterAll(async () => { await stack?.stop(); });
+
+  it('every member READS another owner’s announcement (public-read)', async () => {
+    const byId = await stack.apiAs(bToken, 'GET', `${OBJ}/${aAnnId}`);
+    expect(byId.status, 'bob reads alice announcement by id').toBe(200);
+
+    const list = await stack.apiAs(bToken, 'GET', OBJ);
+    const titles: string[] = ((await list.json()).records ?? []).map((x: any) => x.title);
+    expect(titles, 'bob sees alice announcement in the list').toContain('Alice announces');
+  });
+
+  it('but only the OWNER may edit it', async () => {
+    const foreign = await stack.apiAs(bToken, 'PATCH', `${OBJ}/${aAnnId}`, { body: 'tampered' });
+    expect(foreign.status, 'bob must not edit alice announcement').not.toBeLessThan(300);
+
+    const own = await stack.apiAs(aToken, 'PATCH', `${OBJ}/${aAnnId}`, { body: 'edited by owner' });
+    expect(own.status, 'alice edits her own announcement').toBeLessThan(300);
+  });
+
+  it('contrast with private: read-visibility is the distinguishing axis', async () => {
+    // (sanity) the announcement is readable cross-owner — the very thing the
+    // private note forbids — confirming `read` vs `private` are distinct OWDs.
+    const r = await stack.apiAs(bToken, 'GET', `${OBJ}/${aAnnId}`);
+    expect(r.status).toBe(200);
+  });
+});