fix(objectql): enforce static readonly on INSERT too, not just UPDATE (#3043)

#2948/#3003 made static `readonly: true` fields server-enforced on UPDATE (a
non-system PATCH forging `approval_status: 'approved'` is silently stripped),
but INSERT was deliberately exempt. For approval/status/verdict columns that
exemption was the SHORTER attack: instead of the #3003 draft-then-PATCH move, a
non-system caller could POST a record already `approval_status: 'approved'` in
one step — and the UPDATE-only strip never reached it.

`stripReadonlyFields` now runs on the INSERT path as well, symmetric with the
UPDATE strip:

- Caller-supplied only: the keys the caller sent are snapshotted BEFORE the
  security middleware auto-stamps owner_id / organization_id, so those server
  stamps (and any beforeInsert-hook write to a read-only column) survive.
- Before defaults: the strip runs before applyFieldDefaults, so a stripped
  field falls back to its declared defaultValue (a forged approval_status
  re-seeds to `draft`, not NULL).
- System-context exempt: imports, seed replay, migrations and lifecycle hooks
  carry isSystem and still seed read-only columns.
- Silent (HTTP 2xx), per-row on batch inserts. `readonlyWhen` stays
  INSERT-exempt (a conditional lock needs a prior record).

Behavior change: a non-system INSERT can no longer seed a readonly column from
the caller's payload — flows that legitimately write read-only columns at
creation (import, migration, programmatic seeding) must run system-context, the
same requirement the UPDATE strip already imposed.

Contract + proof surfaces updated: field.zod `readonly` describe, spec liveness
note, public-form server-managed-fields rationale, authz-conformance matrix row
(readonly-static-write), engine #3043 integration suite, and the
showcase-static-readonly dogfood proof (insert-forge now stripped end-to-end).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01P5fRY4ctobCeFpBba1oGrz

Author: claude

.changeset/readonly-static-insert-strip.md

@@ -0,0 +1,35 @@
+---
+"@objectstack/objectql": patch
+"@objectstack/spec": patch
+---
+
+fix(objectql): enforce static `readonly` on INSERT too, not just UPDATE (#3043)
+
+#2948/#3003 made static `readonly: true` fields server-enforced on UPDATE (a
+non-system PATCH forging `approval_status: 'approved'` is silently stripped), but
+INSERT was deliberately exempt. For approval/status/verdict columns that exemption
+was the *shorter* attack: instead of the #3003 draft-then-PATCH move, a non-system
+caller could `POST` a record already `approval_status: 'approved'` in one step —
+and the UPDATE-only strip never reached it.
+
+`stripReadonlyFields` now runs on the INSERT path as well, symmetric with the
+UPDATE strip:
+
+- **Caller-supplied only.** The keys the caller sent are snapshotted *before* the
+  security middleware auto-stamps `owner_id` / `organization_id`, so those server
+  stamps — and any `beforeInsert`-hook write to a read-only column — survive; only
+  a forged read-only key the caller actually sent is dropped.
+- **Before defaults.** The strip runs before `applyFieldDefaults`, so a stripped
+  field falls back to its declared `defaultValue` (a forged `approval_status`
+  re-seeds to `draft`, the enforced initial state, not NULL).
+- **System-context exempt.** Imports, seed replay, migrations and lifecycle hooks
+  carry `isSystem` and still seed read-only columns.
+- **Silent** (HTTP 2xx), matching the UPDATE and `readonlyWhen` strips. Batch
+  inserts are stripped per row. `readonlyWhen` stays INSERT-exempt (a conditional
+  lock needs a prior record, which an insert has none of).
+
+Behavior change: a non-system INSERT can no longer seed a `readonly` column from
+the caller's payload. Flows that legitimately need to write read-only columns at
+creation (data import, migration, programmatic seeding) must run with a
+system-context (`isSystem`) — the same requirement the UPDATE strip already
+imposed.

packages/objectql/src/engine.ts

@@ -2195,6 +2195,15 @@ export class ObjectQL implements IDataEngine {
       context: options?.context,
     };
 
+    // [#3043] Snapshot the keys the CALLER supplied per row, BEFORE the security
+    // middleware auto-stamps server-managed columns (owner_id / organization_id)
+    // into `opCtx.data`. The static-`readonly` INSERT strip below (symmetric
+    // with the #2948 UPDATE strip) drops only caller-supplied read-only writes,
+    // so those middleware / hook stamps — never in this set — survive.
+    const suppliedKeysPerRow: ReadonlySet<string>[] = (
+      Array.isArray(data) ? (data as Record<string, unknown>[]) : [data as Record<string, unknown>]
+    ).map((row) => new Set(Object.keys((row ?? {}) as Record<string, unknown>)));
+
     await this.executeWithMiddleware(opCtx, async () => {
       // Resolve field `defaultValue`s (including the `current_user` token)
       // BEFORE the beforeInsert hook runs, so a hook that DERIVES one field
@@ -2204,6 +2213,39 @@ export class ObjectQL implements IDataEngine {
       // fills fields left `undefined`, so client-supplied values are untouched.
       const nowSnap = new Date();
       const isBatch = Array.isArray(opCtx.data);
+
+      // [#3043] Enforce STATIC `readonly` on the INSERT write path for non-system
+      // callers — symmetric with the #2948 UPDATE strip, and closing a step
+      // SHORTER attack than #3003: a create could directly SEED a readonly column
+      // (`approval_status: 'approved'`, a forged audit stamp, a squatted id) in a
+      // single POST, which the UPDATE-only strip never reached (it acts on UPDATE).
+      // We drop caller-supplied writes to statically-`readonly` fields. Two things
+      // keep every legitimate write intact:
+      //  - `suppliedKeysPerRow` (captured pre-middleware) — only keys the CALLER
+      //    sent are candidates, so the security middleware's owner/tenant stamps
+      //    and any beforeInsert-hook server stamp survive.
+      //  - system context — import replay, migrations and lifecycle writes carry
+      //    `isSystem` and legitimately seed read-only columns, so they skip it.
+      // Runs BEFORE `applyFieldDefaults` so a stripped field falls back to its
+      // `defaultValue` (a forged `approval_status` re-seeds to `draft`, not NULL)
+      // — the enforced initial state, not the attacker's — and before the
+      // beforeInsert hook, which may still stamp read-only columns.
+      // `readonlyWhen` stays INSERT-exempt (a conditional lock needs a prior
+      // record, which insert has none of); only static `readonly` is enforced here.
+      if (!opCtx.context?.isSystem) {
+        const insertSchema = this._registry.getObject(object);
+        opCtx.data = isBatch
+          ? (opCtx.data as Record<string, unknown>[]).map((row, i) =>
+              stripReadonlyFields(insertSchema as any, row, suppliedKeysPerRow[i], this.logger),
+            )
+          : stripReadonlyFields(
+              insertSchema as any,
+              opCtx.data as Record<string, unknown>,
+              suppliedKeysPerRow[0],
+              this.logger,
+            );
+      }
+
       const defaultedData = isBatch
         ? (opCtx.data as any[]).map((row) =>
             this.applyFieldDefaults(object, row as Record<string, unknown>, opCtx.context, nowSnap),

packages/objectql/src/plugin.integration.test.ts

@@ -1380,6 +1380,103 @@ describe('ObjectQLPlugin - Metadata Service Integration', () => {
     });
   });
 
+  // #3043 — static `readonly:true` fields must not be SEEDABLE via a NON-system
+  // INSERT either. Symmetric with the #2948 UPDATE strip: a create could
+  // otherwise POST a record already `approval_status:'approved'` — a step
+  // SHORTER than the #3003 draft→PATCH move, and one the UPDATE strip never
+  // reached. The strip runs BEFORE defaults (a stripped field re-seeds to its
+  // `defaultValue`) and captures caller keys BEFORE middleware, so server stamps
+  // (a beforeInsert-hook write, owner/tenant injection) survive; system exempt.
+  describe('Static readonly seed enforcement on INSERT (#3043)', () => {
+    async function bootWithInsertCapture() {
+      const inserts: Record<string, any>[] = [];
+      const mockDriver = {
+        name: 'ro-ins-capture', version: '1.0.0',
+        connect: async () => {}, disconnect: async () => {},
+        find: async () => [], findOne: async () => null,
+        create: async (_o: string, d: any) => { inserts.push({ ...d }); return { id: 'rec-1', ...d }; },
+        bulkCreate: async (_o: string, rows: any[]) => {
+          rows.forEach((r) => inserts.push({ ...r }));
+          return rows.map((r, i) => ({ id: `rec-${i + 1}`, ...r }));
+        },
+        update: async (_o: string, _i: any, d: any) => ({ id: _i, ...d }),
+        delete: async () => true, syncSchema: async () => {},
+      };
+      await kernel.use({
+        name: 'ro-ins-capture-plugin', type: 'driver', version: '1.0.0',
+        init: async (ctx) => { ctx.registerService('driver.ro-ins-capture', mockDriver); },
+      });
+      await kernel.use(new ObjectQLPlugin());
+      await kernel.bootstrap();
+      const objectql = kernel.getService('objectql') as any;
+      const obj: ObjectSchema = {
+        name: 'ro_ins_obj', label: 'RO Ins Obj', datasource: 'ro-ins-capture',
+        fields: {
+          name: { name: 'name', label: 'Name', type: 'text' },
+          // an approval/status column: readonly, with an enforced initial state
+          approval_status: { name: 'approval_status', label: 'Approval Status', type: 'text', readonly: true, defaultValue: 'draft' } as any,
+          // a provenance stamp a beforeInsert hook fills — readonly, no default
+          source: { name: 'source', label: 'Source', type: 'text', readonly: true } as any,
+        },
+      };
+      objectql.registry.registerObject(obj, 'test', 'test');
+      return { objectql, inserts };
+    }
+
+    it('drops a user-context seed of a static readonly field, re-seeding its defaultValue; editable sibling lands', async () => {
+      const { objectql, inserts } = await bootWithInsertCapture();
+      await objectql.insert(
+        'ro_ins_obj',
+        { name: 'Probe', approval_status: 'approved' },
+        { context: { userId: 'user-9', tenantId: 'org-1' } },
+      );
+      expect(inserts.length).toBe(1);
+      const data = inserts[0];
+      expect(data.name).toBe('Probe');              // editable field written
+      expect(data.approval_status).toBe('draft');   // forged 'approved' stripped, default re-seeded
+    });
+
+    it('ALLOWS a system-context seed of the same static readonly field', async () => {
+      const { objectql, inserts } = await bootWithInsertCapture();
+      await objectql.insert(
+        'ro_ins_obj',
+        { name: 'Seed', approval_status: 'approved' },
+        { context: { isSystem: true } },
+      );
+      expect(inserts.length).toBe(1);
+      expect(inserts[0].approval_status).toBe('approved'); // system seed honored (import/migration)
+    });
+
+    it('keeps a beforeInsert-hook write to a readonly field (server stamp, not caller-supplied)', async () => {
+      const { objectql, inserts } = await bootWithInsertCapture();
+      objectql.registerHook('beforeInsert', async (ctx: any) => {
+        ctx.input.data.source = 'system-hook';
+      }, { object: 'ro_ins_obj' });
+      await objectql.insert(
+        'ro_ins_obj',
+        { name: 'Probe', source: 'attacker' },       // caller forges the readonly stamp
+        { context: { userId: 'user-9' } },
+      );
+      expect(inserts.length).toBe(1);
+      expect(inserts[0].source).toBe('system-hook'); // caller forge stripped, hook stamp survives
+    });
+
+    it('strips per-row on a BATCH insert', async () => {
+      const { objectql, inserts } = await bootWithInsertCapture();
+      await objectql.insert(
+        'ro_ins_obj',
+        [
+          { name: 'A', approval_status: 'approved' },
+          { name: 'B', approval_status: 'approved' },
+        ],
+        { context: { userId: 'user-9' } },
+      );
+      expect(inserts.length).toBe(2);
+      expect(inserts.map((r) => r.approval_status)).toEqual(['draft', 'draft']);
+      expect(inserts.map((r) => r.name)).toEqual(['A', 'B']);
+    });
+  });
+
   // #3042 — conditional `readonlyWhen` must be enforced on the BULK
   // (updateMany) path too, not only the single-id path. The bulk strip reads
   // the matched rows' prior state and drops a field locked in ≥1 of them.

packages/objectql/src/validation/rule-validator.ts

@@ -281,21 +281,27 @@ export function stripReadonlyWhenFieldsMulti(
 }
 
 /**
- * Strip CALLER-SUPPLIED writes to statically `readonly: true` fields from an
- * UPDATE payload (#2948). Unlike `readonlyWhen` (conditional, handled above), a
- * static `readonly` field was never enforced on the server write path: the
- * record validator only SKIPS it from validation, so a user-context update
- * could overwrite audit stamps, provenance, or any other read-only column. We
- * STRIP the change (symmetric with `readonlyWhen`) rather than reject it, for
- * compatibility.
+ * Strip CALLER-SUPPLIED writes to statically `readonly: true` fields from a
+ * write payload. Shared by BOTH server write paths: UPDATE (#2948) and INSERT
+ * (#3043) — a create could otherwise directly SEED a readonly column
+ * (`approval_status: 'approved'`, a forged audit stamp, a squatted id) a step
+ * shorter than the #3003 draft-then-PATCH move. Unlike `readonlyWhen`
+ * (conditional, handled above), a static `readonly` field was never enforced on
+ * the server write path: the record validator only SKIPS it from validation, so
+ * a user-context write could overwrite audit stamps, provenance, or any other
+ * read-only column. We STRIP the change (symmetric with `readonlyWhen`) rather
+ * than reject it, for compatibility.
  *
  * Two guards keep every legitimate write intact:
  *  - `suppliedKeys` — only keys the CALLER sent are candidates. Server stamps
- *    applied by beforeUpdate hooks or write middleware (e.g. `updated_by` /
- *    `updated_at`, plugin.ts) land in `data` but are NOT in `suppliedKeys`, so
- *    they survive. A caller that *explicitly* forges e.g. `updated_by` simply
- *    has it dropped for that request (the last-modified stamp is left unchanged
- *    — safe).
+ *    applied by before-hooks or write middleware (e.g. `updated_by` /
+ *    `updated_at` on update, `owner_id` / `organization_id` on insert) land in
+ *    `data` but are NOT in `suppliedKeys`, so they survive. A caller that
+ *    *explicitly* forges e.g. `updated_by` simply has it dropped for that
+ *    request (the server-managed value is left to stand — safe). On INSERT the
+ *    caller keys are snapshotted before the security middleware stamps, and the
+ *    strip runs before `defaultValue` resolution so a stripped field falls back
+ *    to its declared default rather than NULL.
  *  - system context — the caller passes this strip only for NON-system writes;
  *    system-context writes (import, seed replay, approvals, lifecycle hooks —
  *    all `isSystem: true`) legitimately set read-only columns and skip it.

packages/qa/dogfood/test/authz-conformance.matrix.ts

@@ -91,10 +91,10 @@ export const AUTHZ_CONFORMANCE: AuthzPrimitive[] = [
     note: 'Surface posture: system (trusted-implicit), pre-wiring — no end-user transport exists (handleUpgrade unimplemented, no REST subscribe route, client RealtimeAPI is a placeholder); the only subscribers are server-internal plugins (webhook auto-enqueuer, knowledge sync). Structural defect: Subscription carries no principal, matchesSubscription filters only by object+eventTypes (RealtimeSubscriptionOptions.filter is declared but never read), and the engine publishes the FULL after-row — so any future external subscriber would receive record bodies cross-tenant that its own find would hide. ADMISSION REQUIREMENT before any WebSocket/SSE/subscribe transport ships: per-recipient RLS/FLS/tenant re-check on delivery (subscription carries the subscriber ExecutionContext) OR id-only payload + client re-fetch. The transport tripwire probes in authz-conformance.test.ts turn a wired transport into an UNCLASSIFIED surface → red CI until this row is upgraded with the enforcement site.' },
   { id: 'default-profile', summary: 'app-declared default profile (isDefault)', state: 'enforced',
     enforcement: 'plugin-security/security-plugin.ts fallback resolution', proof: 'showcase-default-profile.dogfood.test.ts' },
-  { id: 'readonly-static-write', summary: 'static `readonly: true` stripped from non-system UPDATE payloads (#2948 / #3003 — a direct PATCH cannot forge approval/status/amount columns the UI never renders)', state: 'enforced',
-    enforcement: 'objectql/engine.ts update — stripReadonlyFields on both the single-id and multi-row paths (caller-supplied keys only, so audit-hook/middleware server stamps survive; isSystem exempt; symmetric with the readonlyWhen strip)',
+  { id: 'readonly-static-write', summary: 'static `readonly: true` stripped from non-system UPDATE (#2948 / #3003) AND INSERT (#3043) payloads — neither a direct PATCH nor a direct POST can forge approval/status/amount columns the UI never renders', state: 'enforced',
+    enforcement: 'objectql/engine.ts — stripReadonlyFields on the update single-id + multi-row paths (#2948) and on the insert path (#3043, before applyFieldDefaults so a stripped field re-seeds to its defaultValue); caller-supplied keys only (insert snapshots them before the security middleware stamps owner/tenant), so server stamps survive; isSystem exempt; symmetric with the readonlyWhen strip',
     proof: 'showcase-static-readonly.dogfood.test.ts',
-    note: 'The #3003 field report: `readonly: true` used to be UI-only, so a logged-in non-admin self-approved a 4-stage approval (approval_status/approval_stage/confirmed_total) with one same-session REST PATCH on a draft record — RECORD_LOCKED only guards pending flows, and the draft never entered one. The strip is SILENT (HTTP 200, persisted value kept — reject-vs-strip decided in #2948 for readonlyWhen symmetry). INSERT is deliberately exempt (create may seed a readonly column: defaultValue, import, migration), also symmetric with readonlyWhen. Engine-level unit/integration proof in objectql/plugin.integration.test.ts (#2948 suite: forge stripped, server stamp survives, system context allowed).' },
+    note: 'The #3003 field report: `readonly: true` used to be UI-only, so a logged-in non-admin self-approved a 4-stage approval (approval_status/approval_stage/confirmed_total) with one same-session REST PATCH on a draft record — RECORD_LOCKED only guards pending flows, and the draft never entered one. #3043 is the INSERT face: the same non-admin could skip the draft entirely and POST a record already `approval_status:"approved"` — a step SHORTER than #3003, and one the UPDATE strip never reached. The strip is SILENT on both paths (HTTP 2xx, forged value dropped; a stripped INSERT field falls back to its defaultValue). `readonlyWhen` stays INSERT-exempt (a conditional lock needs a prior record). System-context writes (import, seed replay, migration) still seed readonly columns. Engine-level unit/integration proof in objectql/plugin.integration.test.ts (#2948 UPDATE suite + #3043 INSERT suite: forge stripped, default re-seeded, server stamp survives, system context allowed, batch rows covered).' },
 
   // ── ADR-0057 — ERP authorization core (enforced + e2e proven) ──────────
   { id: 'scope-depth', summary: 'permission-grant access DEPTH (own/own_and_reports/unit/unit_and_below/org)', state: 'enforced',