feat(security): ADR-0056 Option A — declaration-derived public-form authorization

[os-zhuang]

What (ADR-0056 — Option A: declaration-derived public-form authorization)

Implements the recommended fix for the one blocker of the requireAuth default flip: public forms.

Today a public form submit relies on the anonymous fail-open (+ an optional, not-built-in guest_portal profile). Under secure-by-default that breaks. Option A makes the form self-authorizing from its declaration:

• The form-submit route derives a narrow publicFormGrant: { object } from the matched form's target object.
• The SecurityPlugin honors it as a least-privilege capability — create + the immediate read-back on that object only, with no userId, no deployment guest_portal, and crucially not the anonymous fall-open.
• The field allow-list is still enforced at the route; guest_portal/anonymous stay on the context for back-compat with guest-detection hooks.

This lets public forms work under requireAuth without any per-deployment config, scoped to exactly the declared object — and generalizes the platform principle "public access = declared + runtime-derived scoped grant" (the same shape share-links already use: validate → narrow grant, never a standing broad profile relied on by fail-open).

Verification

form-self-auth dogfood 3/3: create on the form target authorized (no userId / no guest_portal); cross-object create denied (narrow, not fall-open); update/delete denied. Regression: plugin-security 108, rest 121, full dogfood 98 — clean. Build 76/76.

Relation to ADR-0056

This satisfies the requireAuth-flip prerequisite documented in the D10 conformance matrix (#2071). With it, the only remaining step for the flip is the release-gated rollout (warn→enforce + migration note). Follow-on: update the matrix's requireAuth-default-flip note to point at this (both must be in main first).

🤖 Generated with Claude Code

---

Generated by Claude Code

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
spec	Ready	Preview, Comment	Jun 20, 2026 10:00am

[github-actions]

📓 Docs Drift Check

This PR changes 3 package(s): @objectstack/dogfood, @objectstack/plugin-security, @objectstack/rest.

9 hand-written doc(s) reference the affected code and may need an implementation-accuracy re-verification:

• content/docs/concepts/implementation-status.mdx (via @objectstack/plugin-security, @objectstack/rest)
• content/docs/concepts/packages.mdx (via @objectstack/plugin-security, @objectstack/rest)
• content/docs/getting-started/cli.mdx (via @objectstack/plugin-security)
• content/docs/guides/api-reference.mdx (via @objectstack/rest)
• content/docs/guides/cheatsheets/permissions-matrix.mdx (via packages/plugins/plugin-security)
• content/docs/guides/metadata/dashboard.mdx (via @objectstack/plugin-security)
• content/docs/guides/packages.mdx (via @objectstack/plugin-security, @objectstack/rest)
• content/docs/guides/plugins.mdx (via @objectstack/plugin-security, @objectstack/rest)
• content/docs/guides/security.mdx (via @objectstack/plugin-security)

Advisory only. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs origin/main → pass the list as args.docs.