feat(spec,objectql): unify developer-facing org identifier in hooks — organizationId is blessed (#3280)#3284
Merged
Merged
Conversation
feat(evaluator): route CEL-dialect component/action predicates to the canonical engine (#2664) objectui@2e7d7f0f7ee76b838f580e8a36b74f1309b204fc
… organizationId is blessed (#3280) The caller's active organization was surfaced to hook authors as `ctx.session.tenantId`, while the column (`organization_id`), RLS (`current_user.organizationId`), and seed rows already said `organization`. A hook author had to internalize `tenantId === organizationId` to move between surfaces. Additive, non-breaking: - `ctx.session.organizationId` added as the blessed name; `session.tenantId` kept as a deprecated alias with the identical value (both from `ExecutionContext.tenantId`, resolved from `session.activeOrganizationId`). - `ctx.user.organizationId` added to the ergonomic user shortcut; the engine now populates `ctx.user` at every hook event that carries a session, and it stays undefined for system/unauthenticated writes. Generic driver-layer tenancy (`ExecutionContext.tenantId`, `DriverOptions.tenantId`, `SqlDriver.applyTenantScope`, `TenancyConfig.tenantField`) is deliberately untouched — that layer's isolation column is configurable and can carry an environment id in database-per-tenant kernels. Docs now teach `organizationId` and distinguish the two isolation axes (org row-scoping vs environment/database-per-tenant). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
github-actions
Bot
added
documentation
Contributor
📓 Docs Drift CheckThis PR changes 2 package(s): 107 hand-written doc(s) reference the affected code and may need an implementation-accuracy re-verification:
|
This was referenced Jul 19, 2026
Merged
Merged
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #3280.
Problem
The caller's active organization was surfaced to third-party hook authors as
ctx.session.tenantId, while everything else on the developer surface — theorganization_idcolumn,current_user.organizationId(RLS/sharing), and seed rows — already saidorganization. A developer had to internalize the hidden equationtenantId === organizationIdto move between authoring modes. The ergonomicctx.usershortcut had no org field at all, forcing hook authors ontosession.tenantId.Change — additive, non-breaking
ctx.session.organizationIdadded as the blessed name;ctx.session.tenantIdkept as a@deprecatedalias carrying the identical value. Both come from the resolvedExecutionContext.tenantId(kernel-derived fromsession.activeOrganizationId).ctx.user.organizationIdadded to the ergonomicusershortcut. The engine now populatesctx.user({ id, email?, organizationId? }) at every hook event that already carries asession(before/after find/insert/update/delete); it staysundefinedfor system / unauthenticated writes.organizationIdand add a note distinguishing the two isolation axes: org row-scoping (organization_id, shared DB) vs environment / database-per-tenant (service-tenant,driver-turso).Non-goals (untouched, per the issue)
The generic driver-layer tenancy abstraction —
ExecutionContext.tenantId,DriverOptions.tenantId,SqlDriver.applyTenantScope,TenancyConfig.tenantField— is deliberately left as-is. That layer's isolation column is configurable and legitimately carries an environment id in database-per-tenant kernels; renaming it would bake an "org" assumption into a generic layer and be a wide public-API break.Acceptance criteria
ctx.user.organizationIdavailable in JS hooks (all events that populatesession), typed inHookContext(spec).ctx.session.organizationIdavailable;ctx.session.tenantIdstill works, marked deprecated in TSDoc.execCtx.tenantId— unit tests cover a populated org, the unscoped/no-org case, and the system/no-user case.organizationId.skills/objectstack-data/references/data-hooks.md).@objectstack/spec+@objectstack/objectql, patch).Verification
@objectstack/spectsc --noEmit✓; full spec suite 6765 passed.@objectstack/objectqlDTS build ✓; full engine suite 955 passed (incl. 3 new#3280tests).@objectstack/runtimesandbox body-runner 11 passed (L2 JS hooks now receive the populatedctx.user).check:docs(regeneratedhook.mdx),check:skill-refs,check:skill-docs,check:doc-authoring,check:api-surface,check:spec-changes,check:role-word,check:nul-bytes;downstream-contracttypecheck.🤖 Generated with Claude Code