Update files

Author: hotlong

packages/plugins/plugin-security/src/security-plugin.test.ts

@@ -95,11 +95,12 @@ describe('SecurityPlugin', () => {
   // multiTenant switch — single-tenant mode strips tenant policies and skips
   // organization_id auto-injection.
   // -------------------------------------------------------------------------
-  const makeMiddlewareCtx = (overrides: { permissionSets: PermissionSet[]; objectFields?: string[] }) => {
+  const makeMiddlewareCtx = (overrides: { permissionSets: PermissionSet[]; objectFields?: string[]; schemaExtra?: Record<string, any> }) => {
     const fields: Record<string, any> = {};
     for (const f of overrides.objectFields ?? ['id', 'organization_id', 'owner_id', 'name']) {
       fields[f] = { name: f };
     }
+    const baseSchema: any = { name: 'task', fields, ...(overrides.schemaExtra ?? {}) };
     let middleware: any;
     const ql = {
       registerMiddleware: (mw: any) => {
@@ -108,10 +109,10 @@ describe('SecurityPlugin', () => {
         // later in `start()`.
         if (!middleware) middleware = mw;
       },
-      getSchema: () => ({ name: 'task', fields }),
+      getSchema: () => baseSchema,
     };
     const metadata = {
-      get: async () => ({ name: 'task', fields }),
+      get: async () => baseSchema,
       list: async () => overrides.permissionSets,
     };
     const services: Record<string, any> = {
@@ -197,6 +198,70 @@ describe('SecurityPlugin', () => {
     expect(opCtx.ast.where).toEqual({ organization_id: 'org-1' });
   });
 
+  // Regression: when a schema explicitly opts out of tenancy
+  // (`tenancy.enabled === false` — e.g. `sys_package` Marketplace catalog),
+  // the wildcard `tenant_isolation` policy targeting `organization_id`
+  // must be treated as "not applicable" and SKIPPED, NOT fail-closed
+  // with RLS_DENY_FILTER. Otherwise the registry skips injecting the
+  // tenant column (correct) but the security plugin still produces zero
+  // rows on every read (wrong) — which silently broke the cloud
+  // Marketplace UI.
+  it('tenancy.enabled=false — wildcard organization_id RLS is skipped, not denied', async () => {
+    const plugin = new SecurityPlugin({ multiTenant: true, fallbackPermissionSet: 'member_default' });
+    const harness = makeMiddlewareCtx({
+      permissionSets: [tenantPolicySet],
+      // Catalog table without organization_id; opts out of tenancy.
+      objectFields: ['id', 'manifest_id', 'visibility', 'owner_org_id'],
+      schemaExtra: { tenancy: { enabled: false, strategy: 'shared' } },
+    });
+    await plugin.init(harness.ctx);
+    await plugin.start(harness.ctx);
+    const opCtx: any = {
+      object: 'task', operation: 'find', ast: { where: undefined },
+      context: { userId: 'u1', tenantId: 'org-1', roles: [], permissions: [] },
+    };
+    await harness.run(opCtx);
+    // No deny sentinel, no organization_id where clause: the read
+    // passes through and the catalog row is visible to every tenant.
+    expect(opCtx.ast.where).toBeUndefined();
+  });
+
+  it('tenancy.enabled=false via systemFields.tenant=false — also skipped', async () => {
+    const plugin = new SecurityPlugin({ multiTenant: true, fallbackPermissionSet: 'member_default' });
+    const harness = makeMiddlewareCtx({
+      permissionSets: [tenantPolicySet],
+      objectFields: ['id', 'name'],
+      schemaExtra: { systemFields: { tenant: false } },
+    });
+    await plugin.init(harness.ctx);
+    await plugin.start(harness.ctx);
+    const opCtx: any = {
+      object: 'task', operation: 'find', ast: { where: undefined },
+      context: { userId: 'u1', tenantId: 'org-1', roles: [], permissions: [] },
+    };
+    await harness.run(opCtx);
+    expect(opCtx.ast.where).toBeUndefined();
+  });
+
+  it('tenancy enabled (default) — wildcard organization_id RLS still denies when field is missing', async () => {
+    // Sanity check: dropping the deny sentinel must remain in effect
+    // for objects that did NOT opt out — otherwise a wildcard policy
+    // applied to a half-migrated table would silently expose every row.
+    const plugin = new SecurityPlugin({ multiTenant: true, fallbackPermissionSet: 'member_default' });
+    const harness = makeMiddlewareCtx({
+      permissionSets: [tenantPolicySet],
+      objectFields: ['id', 'name'], // no organization_id, no opt-out
+    });
+    await plugin.init(harness.ctx);
+    await plugin.start(harness.ctx);
+    const opCtx: any = {
+      object: 'task', operation: 'find', ast: { where: undefined },
+      context: { userId: 'u1', tenantId: 'org-1', roles: [], permissions: [] },
+    };
+    await harness.run(opCtx);
+    expect(opCtx.ast.where).toEqual(RLS_DENY_FILTER);
+  });
+
   // Post-resolution fallback: roles is non-empty (e.g. better-auth
   // sys_member.role = 'owner') but no sys_role binding maps that name to
   // a permission set, so resolvePermissionSets returns []. Without the

packages/plugins/plugin-security/src/security-plugin.ts

@@ -96,6 +96,17 @@ export class SecurityPlugin implements Plugin {
    * invalidation — a kernel restart drops the cache.
    */
   private readonly fieldNamesCache = new Map<string, Set<string> | null>();
+  /**
+   * Per-object cache of tenancy opt-out. `true` means the schema
+   * explicitly disabled multi-tenancy (`tenancy.enabled === false` or
+   * `systemFields.tenant === false`). Wildcard policies that target
+   * the conventional tenant column (`organization_id`) are treated as
+   * *not applicable* on these tables instead of triggering the
+   * field-missing deny sentinel — without this, every read of a
+   * cross-org catalog (e.g. `sys_package`, the Marketplace) returns
+   * zero rows.
+   */
+  private readonly tenancyDisabledCache = new Map<string, boolean>();
 
   constructor(options: SecurityPluginOptions = {}) {
     this.bootstrapPermissionSets =
@@ -389,13 +400,25 @@ export class SecurityPlugin implements Plugin {
         // When the schema lookup itself fails we keep all policies (drivers
         // will surface column errors clearly during compilation).
         const objectFields = await this.getObjectFieldNames(metadata, opCtx.object, ql);
+        const tenancyDisabled = this.tenancyDisabledCache.get(opCtx.object) === true;
         let dropped = 0;
         const compilable = objectFields
           ? allRlsPolicies.filter((p) => {
               const targetField = this.extractTargetField(p.using);
-              const ok = targetField ? objectFields.has(targetField) : true;
-              if (!ok) dropped++;
-              return ok;
+              if (!targetField) return true;
+              if (objectFields.has(targetField)) return true;
+              // Schema-level opt-out: when the object explicitly
+              // disabled tenancy (`tenancy.enabled === false`), the
+              // wildcard `tenant_isolation` policy targeting
+              // `organization_id` was never meant to apply. Treat as
+              // "not applicable" — skip silently without contributing
+              // to the deny sentinel, mirroring how the registry skips
+              // injecting the column itself for these tables.
+              if (tenancyDisabled && targetField === 'organization_id') {
+                return false;
+              }
+              dropped++;
+              return false;
             })
           : allRlsPolicies;
         let rlsFilter = this.rlsCompiler.compileFilter(compilable, opCtx.context);
@@ -710,6 +733,15 @@ export class SecurityPlugin implements Plugin {
         obj = await metadata?.get?.('object', objectName);
       }
       if (!obj || !obj.fields) return null;
+      // Populate the tenancy opt-out cache alongside the field set so
+      // the RLS filter pass can decide whether a wildcard
+      // `organization_id` policy is genuinely "applicable but
+      // uncompilable" (deny) versus "not applicable on this object"
+      // (skip without contributing to the deny sentinel).
+      const tenancyDisabled =
+        (obj as any)?.tenancy?.enabled === false ||
+        (obj as any)?.systemFields?.tenant === false;
+      this.tenancyDisabledCache.set(objectName, !!tenancyDisabled);
       const set = new Set<string>(['id']);
       if (Array.isArray(obj.fields)) {
         for (const f of obj.fields) {

packages/services/service-settings/README.md

@@ -0,0 +1,43 @@
+# @objectstack/service-settings
+
+Settings service for ObjectStack. Implements ADR-0007: a generic
+namespace **manifest** mechanism + a single K/V table (`sys_setting`) +
+a resolver that layers `Env > Tenant > User > Default`.
+
+## What it gives you
+
+- `SettingsServicePlugin` — registers the `sys_setting` schema, exposes
+  a `settings` service in the kernel, and mounts REST routes on the
+  HTTP server (when one is available).
+- `SettingsService` (`kernel.getService('settings')`)
+  - `get(ns, key, ctx)` / `getNamespace(ns, ctx)` — resolved values with
+    `{ value, source, locked }`.
+  - `set(ns, key, value, scope, ctx)` / `setMany(...)` — writes that
+    persist into `sys_setting`. Throws when the effective value is
+    locked by env.
+  - `registerManifest(manifest)` / `listManifests()` / `getManifest(ns)`.
+  - `runAction(ns, actionId, input, ctx)` — for "test connection",
+    "rotate", etc. declared in `action_button` specifiers.
+- REST routes (default base path `/api/settings`):
+  - `GET    /api/settings`                       → manifests visible to caller
+  - `GET    /api/settings/:namespace`            → `{ manifest, values }`
+  - `PUT    /api/settings/:namespace`            → batch upsert
+  - `POST   /api/settings/:namespace/:actionId`  → invoke declared action
+
+## Env override
+
+`process.env[NAMESPACE_KEY]` (uppercased) takes precedence over any
+stored value. Such fields are returned with `source: 'env', locked:
+true` and writes (service or REST) fail with HTTP 409.
+
+## Encryption
+
+`Specifier.encrypted: true` (implicit for `password`) round-trips the
+value through a pluggable `CryptoAdapter`. The default
+`NoopCryptoAdapter` is a base64 wrapper — production deployments must
+provide a real KMS adapter via plugin options.
+
+## Audit
+
+Every write emits a `sys_audit_log` row (when the audit service is
+present). Encrypted values are masked with `'<encrypted>'` + checksum.

packages/services/service-settings/package.json

@@ -0,0 +1,40 @@
+{
+  "name": "@objectstack/service-settings",
+  "version": "0.1.0",
+  "license": "Apache-2.0",
+  "description": "Settings service for ObjectStack — manifest registry + K/V resolver (Env > Tenant > User > Default) + REST routes. See ADR-0007.",
+  "type": "module",
+  "main": "dist/index.js",
+  "types": "dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js",
+      "require": "./dist/index.cjs"
+    }
+  },
+  "scripts": {
+    "build": "tsup --config ../../../tsup.config.ts",
+    "test": "vitest run"
+  },
+  "dependencies": {
+    "@objectstack/core": "workspace:*",
+    "@objectstack/platform-objects": "workspace:*",
+    "@objectstack/spec": "workspace:*"
+  },
+  "devDependencies": {
+    "@types/node": "^25.9.1",
+    "typescript": "^6.0.3",
+    "vitest": "^4.1.7"
+  },
+  "keywords": ["objectstack", "service", "settings", "config"],
+  "author": "ObjectStack",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/objectstack-ai/framework.git",
+    "directory": "packages/services/service-settings"
+  },
+  "publishConfig": { "access": "public" },
+  "files": ["dist", "README.md"],
+  "engines": { "node": ">=18.0.0" }
+}

packages/services/service-settings/src/crypto-adapter.ts

@@ -0,0 +1,50 @@
+// Copyright (c) 2025 ObjectStack. Licensed under the Apache-2.0 license.
+
+/**
+ * Pluggable adapter for at-rest encryption of `Specifier.encrypted: true`
+ * values. The default {@link NoopCryptoAdapter} provides a transparent
+ * base64 wrapping suitable for development and tests; production
+ * deployments MUST inject a real KMS-backed adapter.
+ *
+ * encrypt/decrypt are async to leave room for KMS round-trips.
+ */
+export interface CryptoAdapter {
+  /** Returns the ciphertext blob to store in `sys_setting.value_enc`. */
+  encrypt(plaintext: string, ctx: { namespace: string; key: string }): Promise<string>;
+  /** Returns the plaintext used by the resolver. */
+  decrypt(ciphertext: string, ctx: { namespace: string; key: string }): Promise<string>;
+  /**
+   * Stable, short, non-reversible digest used for audit-log entries so
+   * operators can correlate value changes without leaking secrets.
+   */
+  digest(plaintext: string): string;
+}
+
+/**
+ * Development / test default. Base64-wraps the plaintext so the column
+ * isn't a literal mirror but provides no real confidentiality.
+ *
+ * Operators are expected to override this via
+ * `SettingsServicePluginOptions.crypto`.
+ */
+export class NoopCryptoAdapter implements CryptoAdapter {
+  async encrypt(plaintext: string): Promise<string> {
+    return 'b64:' + Buffer.from(plaintext, 'utf8').toString('base64');
+  }
+  async decrypt(ciphertext: string): Promise<string> {
+    if (!ciphertext.startsWith('b64:')) {
+      // Tolerate legacy plaintext rows during the dev rollout.
+      return ciphertext;
+    }
+    return Buffer.from(ciphertext.slice(4), 'base64').toString('utf8');
+  }
+  digest(plaintext: string): string {
+    // FNV-1a 32-bit — short, stable, non-cryptographic. Audit-only.
+    let h = 0x811c9dc5;
+    for (let i = 0; i < plaintext.length; i++) {
+      h ^= plaintext.charCodeAt(i);
+      h = (h + ((h << 1) + (h << 4) + (h << 7) + (h << 8) + (h << 24))) >>> 0;
+    }
+    return 'fnv32:' + h.toString(16).padStart(8, '0');
+  }
+}

packages/services/service-settings/src/index.ts

@@ -0,0 +1,48 @@
+// Copyright (c) 2025 ObjectStack. Licensed under the Apache-2.0 license.
+
+/**
+ * Public entrypoint for `@objectstack/service-settings`.
+ * See ADR-0007 and `README.md`.
+ */
+
+export { SettingsService } from './settings-service.js';
+export {
+  type CryptoAdapter,
+  NoopCryptoAdapter,
+} from './crypto-adapter.js';
+export {
+  type SettingsActionHandler,
+  type SettingsAuditSink,
+  type SettingsContext,
+  type SettingsEngine,
+  type SettingsRow,
+  type SettingsServiceOptions,
+  envKeyOf,
+  SettingsLockedError,
+  UnknownKeyError,
+  UnknownNamespaceError,
+} from './settings-service.types.js';
+export {
+  SettingsServicePlugin,
+  type SettingsServicePluginOptions,
+} from './settings-service-plugin.js';
+export {
+  registerSettingsRoutes,
+  type SettingsRoutesOptions,
+} from './settings-routes.js';
+export {
+  settingsObjects,
+  settingsPluginManifestHeader,
+  SETTINGS_PLUGIN_ID,
+  SETTINGS_PLUGIN_VERSION,
+} from './manifest.js';
+
+// Re-export the spec types for convenience so plugin authors only need
+// one import.
+export type {
+  SettingsManifest,
+  ResolvedSettingValue,
+  SettingsNamespacePayload,
+  SettingsActionResult,
+  SpecifierScope,
+} from '@objectstack/spec/system';

packages/services/service-settings/src/manifest.ts

@@ -0,0 +1,21 @@
+// Copyright (c) 2025 ObjectStack. Licensed under the Apache-2.0 license.
+
+import { SysSetting } from '@objectstack/platform-objects/system';
+
+export const SETTINGS_PLUGIN_ID = 'com.objectstack.service.settings';
+export const SETTINGS_PLUGIN_VERSION = '0.1.0';
+
+/** Objects owned by service-settings. Currently just the K/V store. */
+export const settingsObjects: any[] = [SysSetting];
+
+/** Manifest header shared by compile-time config and runtime registration. */
+export const settingsPluginManifestHeader = {
+  id: SETTINGS_PLUGIN_ID,
+  namespace: 'sys',
+  version: SETTINGS_PLUGIN_VERSION,
+  type: 'plugin' as const,
+  scope: 'project' as const,
+  name: 'Settings Service',
+  description:
+    'Generic settings registry + K/V resolver with Env > Tenant > User > Default precedence. ADR-0007.',
+};