feat(security): ADR-0058 D1 follow-through — RLS predicates migrate to canonical CEL (#2099)

The expression surface now speaks ONE language. Migrate every seeded RLS
`using`/`check` from the legacy SQL-ish dialect (`=`, `IN (...)`) to pure CEL
(`==`, `in`):
- default-permission-sets.ts (49) + app-showcase (2): all owner/tenant/self
  policies are CEL.
- rls.zod.ts RLS.ownerPolicy/tenantPolicy/allowAllPolicy helper factories now
  emit CEL templates; doc examples updated to match.

The `sqlPredicateToCel` bridge is downgraded to a DEPRECATED transitional shim:
compileExpression warns when it actually rewrites a SQL-style predicate, so
authored policies migrate, while stored/legacy SQL still compiles (no silent
deny on existing data). The bridge is IDEMPOTENT on CEL input, so the migrated
seeds pass through as no-ops with no warn.

No runtime behavior change: CEL and the old SQL form compile to the identical
FilterCondition (verified). New tests prove the bridge (SQL still compiles +
warns; CEL is silent). Green: spec 6599, plugin-security 122, plugin-sharing 65,
formula 201, dogfood 130.

Co-authored-by: Jack Zhuang <277994282+os-zhuang@users.noreply.github.com>
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>

Author: 3 people

.changeset/rls-using-to-cel.md

@@ -0,0 +1,14 @@
+---
+"@objectstack/spec": minor
+"@objectstack/plugin-security": minor
+---
+
+ADR-0058 D1 follow-through — RLS predicates are now canonical CEL. Migrated every
+seeded RLS `using`/`check` (default permission sets, showcase, and the
+`RLS.ownerPolicy`/`tenantPolicy`/`allowAllPolicy` helper factories) from the
+legacy SQL-ish form (`=`, `IN (...)`) to pure CEL (`==`, `in`), so authors and AI
+learn ONE expression language. The `sqlPredicateToCel` bridge is retained as a
+DEPRECATED transitional shim: a stored SQL-style predicate still compiles (no
+silent deny on legacy data) but emits a deprecation warn; canonical CEL passes
+through as a no-op. No runtime behavior change — CEL and the old SQL form compile
+to the identical FilterCondition.

examples/app-showcase/src/security/index.ts

@@ -60,7 +60,7 @@ export const ContributorPermissionSet = {
       description: 'Contributors can only select tasks assigned to them.',
       object: 'showcase_task',
       operation: 'select' as const,
-      using: "assignee = current_user.email",
+      using: "assignee == current_user.email",
       roles: ['contributor'],
       enabled: true,
       priority: 10,
@@ -75,7 +75,7 @@ export const ContributorPermissionSet = {
       description: "Contributors only see invoices they own; their lines follow via controlled_by_parent.",
       object: 'showcase_invoice',
       operation: 'select' as const,
-      using: "owner = current_user.email",
+      using: "owner == current_user.email",
       roles: ['contributor'],
       enabled: true,
       priority: 10,

packages/plugins/plugin-security/src/objects/default-permission-sets.ts

@@ -157,7 +157,7 @@ export const defaultPermissionSets: PermissionSet[] = [
         name: 'tenant_isolation',
         object: '*',
         operation: 'all',
-        using: 'organization_id = current_user.organization_id',
+        using: 'organization_id == current_user.organization_id',
       },
       // ── better-auth system tables that lack `organization_id` and would
       //    otherwise be denied by the wildcard policy. Same self-only
@@ -167,79 +167,79 @@ export const defaultPermissionSets: PermissionSet[] = [
         name: 'sys_organization_self',
         object: 'sys_organization',
         operation: 'all',
-        using: 'id = current_user.organization_id',
+        using: 'id == current_user.organization_id',
       },
       {
         name: 'sys_user_self',
         object: 'sys_user',
         operation: 'select',
-        using: 'id = current_user.id',
+        using: 'id == current_user.id',
       },
       {
         name: 'sys_user_org_members',
         object: 'sys_user',
         operation: 'select',
-        using: 'id IN (current_user.org_user_ids)',
+        using: 'id in current_user.org_user_ids',
       },
       {
         name: 'sys_session_self',
         object: 'sys_session',
         operation: 'all',
-        using: 'user_id = current_user.id',
+        using: 'user_id == current_user.id',
       },
       {
         name: 'sys_account_self',
         object: 'sys_account',
         operation: 'select',
-        using: 'user_id = current_user.id',
+        using: 'user_id == current_user.id',
       },
       {
         name: 'sys_team_member_self',
         object: 'sys_team_member',
         operation: 'select',
-        using: 'user_id = current_user.id',
+        using: 'user_id == current_user.id',
       },
       {
         name: 'sys_two_factor_self',
         object: 'sys_two_factor',
         operation: 'all',
-        using: 'user_id = current_user.id',
+        using: 'user_id == current_user.id',
       },
       {
         name: 'sys_user_preference_self',
         object: 'sys_user_preference',
         operation: 'all',
-        using: 'user_id = current_user.id',
+        using: 'user_id == current_user.id',
       },
       {
         name: 'sys_api_key_self',
         object: 'sys_api_key',
         operation: 'all',
-        using: 'user_id = current_user.id',
+        using: 'user_id == current_user.id',
       },
       {
         name: 'sys_device_code_self',
         object: 'sys_device_code',
         operation: 'all',
-        using: 'user_id = current_user.id',
+        using: 'user_id == current_user.id',
       },
       {
         name: 'sys_oauth_access_token_self',
         object: 'sys_oauth_access_token',
         operation: 'select',
-        using: 'user_id = current_user.id',
+        using: 'user_id == current_user.id',
       },
       {
         name: 'sys_oauth_refresh_token_self',
         object: 'sys_oauth_refresh_token',
         operation: 'select',
-        using: 'user_id = current_user.id',
+        using: 'user_id == current_user.id',
       },
       {
         name: 'sys_oauth_consent_self',
         object: 'sys_oauth_consent',
         operation: 'all',
-        using: 'user_id = current_user.id',
+        using: 'user_id == current_user.id',
       },
       // OAuth applications a user has registered themselves (self-service
       // developer flow exposed in the Account app's Developer section).
@@ -249,7 +249,7 @@ export const defaultPermissionSets: PermissionSet[] = [
         name: 'sys_oauth_application_self',
         object: 'sys_oauth_application',
         operation: 'all',
-        using: 'user_id = current_user.id',
+        using: 'user_id == current_user.id',
       },
       // Org-scoped visibility for organization-owned identity-adjacent
       // tables. Org admins may inspect their own org's invitations and
@@ -258,19 +258,19 @@ export const defaultPermissionSets: PermissionSet[] = [
         name: 'sys_member_org',
         object: 'sys_member',
         operation: 'select',
-        using: 'organization_id = current_user.organization_id',
+        using: 'organization_id == current_user.organization_id',
       },
       {
         name: 'sys_invitation_org',
         object: 'sys_invitation',
         operation: 'select',
-        using: 'organization_id = current_user.organization_id',
+        using: 'organization_id == current_user.organization_id',
       },
       {
         name: 'sys_team_org',
         object: 'sys_team',
         operation: 'select',
-        using: 'organization_id = current_user.organization_id',
+        using: 'organization_id == current_user.organization_id',
       },
     ],
   }),
@@ -293,7 +293,7 @@ export const defaultPermissionSets: PermissionSet[] = [
         name: 'tenant_isolation',
         object: '*',
         operation: 'all',
-        using: 'organization_id = current_user.organization_id',
+        using: 'organization_id == current_user.organization_id',
       },
       // Owner-scoped writes/deletes for rank-and-file members: you may modify
       // and delete the records you created, not other users'. Keyed on
@@ -311,13 +311,13 @@ export const defaultPermissionSets: PermissionSet[] = [
         name: 'owner_only_writes',
         object: '*',
         operation: 'update',
-        using: 'created_by = current_user.id',
+        using: 'created_by == current_user.id',
       },
       {
         name: 'owner_only_deletes',
         object: '*',
         operation: 'delete',
-        using: 'created_by = current_user.id',
+        using: 'created_by == current_user.id',
       },
       // ── better-auth system tables that lack `organization_id` and would
       //    otherwise be left unprotected by the wildcard rule above. ────
@@ -334,13 +334,13 @@ export const defaultPermissionSets: PermissionSet[] = [
         name: 'sys_organization_self',
         object: 'sys_organization',
         operation: 'all',
-        using: 'id = current_user.organization_id',
+        using: 'id == current_user.organization_id',
       },
       {
         name: 'sys_user_self',
         object: 'sys_user',
         operation: 'select',
-        using: 'id = current_user.id',
+        using: 'id == current_user.id',
       },
       // Org collaborators: members can see other users in the same
       // organization. Without this, owner/assignee lookups, @-mention
@@ -354,67 +354,67 @@ export const defaultPermissionSets: PermissionSet[] = [
         name: 'sys_user_org_members',
         object: 'sys_user',
         operation: 'select',
-        using: 'id IN (current_user.org_user_ids)',
+        using: 'id in current_user.org_user_ids',
       },
       {
         name: 'sys_session_self',
         object: 'sys_session',
         operation: 'all',
-        using: 'user_id = current_user.id',
+        using: 'user_id == current_user.id',
       },
       {
         name: 'sys_account_self',
         object: 'sys_account',
         operation: 'select',
-        using: 'user_id = current_user.id',
+        using: 'user_id == current_user.id',
       },
       {
         name: 'sys_team_member_self',
         object: 'sys_team_member',
         operation: 'select',
-        using: 'user_id = current_user.id',
+        using: 'user_id == current_user.id',
       },
       {
         name: 'sys_two_factor_self',
         object: 'sys_two_factor',
         operation: 'all',
-        using: 'user_id = current_user.id',
+        using: 'user_id == current_user.id',
       },
       {
         name: 'sys_user_preference_self',
         object: 'sys_user_preference',
         operation: 'all',
-        using: 'user_id = current_user.id',
+        using: 'user_id == current_user.id',
       },
       {
         name: 'sys_api_key_self',
         object: 'sys_api_key',
         operation: 'all',
-        using: 'user_id = current_user.id',
+        using: 'user_id == current_user.id',
       },
       {
         name: 'sys_device_code_self',
         object: 'sys_device_code',
         operation: 'all',
-        using: 'user_id = current_user.id',
+        using: 'user_id == current_user.id',
       },
       {
         name: 'sys_oauth_access_token_self',
         object: 'sys_oauth_access_token',
         operation: 'select',
-        using: 'user_id = current_user.id',
+        using: 'user_id == current_user.id',
       },
       {
         name: 'sys_oauth_refresh_token_self',
         object: 'sys_oauth_refresh_token',
         operation: 'select',
-        using: 'user_id = current_user.id',
+        using: 'user_id == current_user.id',
       },
       {
         name: 'sys_oauth_consent_self',
         object: 'sys_oauth_consent',
         operation: 'all',
-        using: 'user_id = current_user.id',
+        using: 'user_id == current_user.id',
       },
       // OAuth applications a user has registered themselves (Account →
       // Developer → OAuth Applications). `sys_oauth_application` has no
@@ -424,7 +424,7 @@ export const defaultPermissionSets: PermissionSet[] = [
         name: 'sys_oauth_application_self',
         object: 'sys_oauth_application',
         operation: 'all',
-        using: 'user_id = current_user.id',
+        using: 'user_id == current_user.id',
       },
     ],
   }),
@@ -449,87 +449,87 @@ export const defaultPermissionSets: PermissionSet[] = [
         name: 'tenant_isolation',
         object: '*',
         operation: 'select',
-        using: 'organization_id = current_user.organization_id',
+        using: 'organization_id == current_user.organization_id',
       },
       {
         name: 'sys_organization_self',
         object: 'sys_organization',
         operation: 'select',
-        using: 'id = current_user.organization_id',
+        using: 'id == current_user.organization_id',
       },
       {
         name: 'sys_user_self',
         object: 'sys_user',
         operation: 'select',
-        using: 'id = current_user.id',
+        using: 'id == current_user.id',
       },
       // Org collaborators (read-only): see `sys_user_org_members` in
       // `member_default` for rationale.
       {
         name: 'sys_user_org_members',
         object: 'sys_user',
         operation: 'select',
-        using: 'id IN (current_user.org_user_ids)',
+        using: 'id in current_user.org_user_ids',
       },
       {
         name: 'sys_session_self',
         object: 'sys_session',
         operation: 'select',
-        using: 'user_id = current_user.id',
+        using: 'user_id == current_user.id',
       },
       {
         name: 'sys_account_self',
         object: 'sys_account',
         operation: 'select',
-        using: 'user_id = current_user.id',
+        using: 'user_id == current_user.id',
       },
       {
         name: 'sys_team_member_self',
         object: 'sys_team_member',
         operation: 'select',
-        using: 'user_id = current_user.id',
+        using: 'user_id == current_user.id',
       },
       {
         name: 'sys_two_factor_self',
         object: 'sys_two_factor',
         operation: 'select',
-        using: 'user_id = current_user.id',
+        using: 'user_id == current_user.id',
       },
       {
         name: 'sys_user_preference_self',
         object: 'sys_user_preference',
         operation: 'select',
-        using: 'user_id = current_user.id',
+        using: 'user_id == current_user.id',
       },
       {
         name: 'sys_api_key_self',
         object: 'sys_api_key',
         operation: 'select',
-        using: 'user_id = current_user.id',
+        using: 'user_id == current_user.id',
       },
       {
         name: 'sys_device_code_self',
         object: 'sys_device_code',
         operation: 'select',
-        using: 'user_id = current_user.id',
+        using: 'user_id == current_user.id',
       },
       {
         name: 'sys_oauth_access_token_self',
         object: 'sys_oauth_access_token',
         operation: 'select',
-        using: 'user_id = current_user.id',
+        using: 'user_id == current_user.id',
       },
       {
         name: 'sys_oauth_refresh_token_self',
         object: 'sys_oauth_refresh_token',
         operation: 'select',
-        using: 'user_id = current_user.id',
+        using: 'user_id == current_user.id',
       },
       {
         name: 'sys_oauth_consent_self',
         object: 'sys_oauth_consent',
         operation: 'select',
-        using: 'user_id = current_user.id',
+        using: 'user_id == current_user.id',
       },
     ],
   }),