|
| 1 | +// Copyright (c) 2026 ObjectStack. Licensed under the Apache-2.0 license. |
| 2 | + |
| 3 | +/** |
| 4 | + * [#13552] The RLS emptied-membership deny guard must be POLARITY-AWARE. |
| 5 | + * |
| 6 | + * `isEmptyMembershipFilter` exists so a pre-resolved membership set that |
| 7 | + * RESOLVES EMPTY drops the policy and the single-policy path fails closed via |
| 8 | + * `RLS_DENY_FILTER`. Before #13552 it shape-matched the bare positive form |
| 9 | + * (`{ f: { $in: [] } }`) only — but `not in` is a first-class pushdown shape |
| 10 | + * (`!(x in y)` → `$not` wrapping `$in`, cel-to-filter.ts), and under `$not` an |
| 11 | + * empty `$in: []` INVERTS from constant FALSE to constant TRUE: the policy the |
| 12 | + * guard exists to turn into a DENY compiled to ALLOW-ALL on the read scope. |
| 13 | + * |
| 14 | + * This suite is the triage-mandated enumeration (issue #13552, grading |
| 15 | + * comment): every negation/composition shape the guard must fire under, the |
| 16 | + * shapes it must NOT fire under (the working `not in` feature; the legitimate |
| 17 | + * positive-composite cases), and row-level evidence via the formula evaluator |
| 18 | + * that the pre-fix filter really admitted everything while the deny sentinel |
| 19 | + * admits nothing. |
| 20 | + */ |
| 21 | + |
| 22 | +import { describe, it, expect } from 'vitest'; |
| 23 | +import { isPushdownableCel, matchesFilterCondition } from '@objectstack/formula'; |
| 24 | +import { RLSCompiler, RLS_DENY_FILTER, isEmptyMembershipFilter } from './rls-compiler.js'; |
| 25 | + |
| 26 | +/** Five-row fixture: distinct owners, one null — mirrors the issue's measurement. */ |
| 27 | +const ROWS: Record<string, unknown>[] = [ |
| 28 | + { id: 'r1', owner: 'u_me', status: 'open' }, |
| 29 | + { id: 'r2', owner: 'u_other', status: 'open' }, |
| 30 | + { id: 'r3', owner: 'u_third', status: 'closed' }, |
| 31 | + { id: 'r4', owner: null, status: 'open' }, |
| 32 | + { id: 'r5', owner: 'u_fourth', status: 'closed' }, |
| 33 | +]; |
| 34 | + |
| 35 | +const admitted = (filter: Record<string, unknown>): number => |
| 36 | + ROWS.filter((row) => matchesFilterCondition(row, filter as any)).length; |
| 37 | + |
| 38 | +const policy = (using: string): any => ({ object: 'task', operation: 'select', using }); |
| 39 | + |
| 40 | +/** Context whose membership sets all RESOLVE EMPTY (the degenerate context). */ |
| 41 | +const EMPTY_CTX: any = { |
| 42 | + userId: 'u_me', |
| 43 | + tenantId: 'org-1', |
| 44 | + positions: [], |
| 45 | + org_user_ids: [], |
| 46 | + rlsMembership: { team_ids: [], blocked_ids: [] }, |
| 47 | +}; |
| 48 | + |
| 49 | +describe('[#13552] emptied membership under negation — the guard must fire (deny sentinel)', () => { |
| 50 | + const compiler = new RLSCompiler(); |
| 51 | + |
| 52 | + // ── The decisive control first: the DANGER is real at the evaluator ────── |
| 53 | + it('evaluator control: `$not` over an empty `$in` is constant TRUE — 5 of 5 rows', () => { |
| 54 | + // Independent of the guard: this pins WHY the guard must fire. The same |
| 55 | + // inversion holds at the analytics lowering (`read-scope-sql.ts`: |
| 56 | + // `$in: []` → `1 = 0`, and `NOT (1 = 0)` is TRUE for every row). |
| 57 | + expect(admitted({ $not: { owner: { $in: [] } } })).toBe(5); |
| 58 | + // …and the deny sentinel admits nothing. |
| 59 | + expect(admitted(RLS_DENY_FILTER as Record<string, unknown>)).toBe(0); |
| 60 | + }); |
| 61 | + |
| 62 | + // ── Enumeration: shapes the guard fires under, driven through authored CEL ── |
| 63 | + const MUST_DENY: Array<[label: string, cel: string]> = [ |
| 64 | + ['direct `$not` wrap — `not in` on an emptied set', |
| 65 | + '!(owner in current_user.org_user_ids)'], |
| 66 | + ['`$not` nested inside `$or`', |
| 67 | + '!(owner in current_user.team_ids) || owner == current_user.id'], |
| 68 | + ['`$not` nested inside `$and`', |
| 69 | + '!(owner in current_user.blocked_ids) && status == "open"'], |
| 70 | + ['`$not` over a composite containing the emptied membership ($and)', |
| 71 | + '!(owner in current_user.team_ids && status == "open")'], |
| 72 | + ['`$not` over a composite containing the emptied membership ($or)', |
| 73 | + '!(owner in current_user.team_ids || status == "archived")'], |
| 74 | + ['multi-level `$not`, odd (triple)', |
| 75 | + '!(!(!(owner in current_user.org_user_ids)))'], |
| 76 | + ['multi-level `$not`, even (double) — constant FALSE, sentinel preferred', |
| 77 | + '!(!(owner in current_user.org_user_ids))'], |
| 78 | + ['bare positive (the pre-#13552 behaviour, preserved)', |
| 79 | + 'owner in current_user.org_user_ids'], |
| 80 | + ]; |
| 81 | + |
| 82 | + it('every enumerated shape is an AUTHORABLE pushdown shape (isPushdownableCel ok)', () => { |
| 83 | + for (const [label, cel] of MUST_DENY) { |
| 84 | + expect(isPushdownableCel(cel), `${label}: ${cel}`).toEqual({ ok: true }); |
| 85 | + } |
| 86 | + }); |
| 87 | + |
| 88 | + for (const [label, cel] of MUST_DENY) { |
| 89 | + it(`${label} → RLS_DENY_FILTER (zero rows)`, () => { |
| 90 | + const filter = compiler.compileFilter([policy(cel)], EMPTY_CTX); |
| 91 | + expect(filter, `policy: ${cel}`).toEqual(RLS_DENY_FILTER); |
| 92 | + // Row-level: the compiled scope admits NOTHING. Before the #13552 fix |
| 93 | + // the negated shapes compiled to a constant-TRUE filter admitting 5/5. |
| 94 | + expect(admitted(filter as Record<string, unknown>), `policy: ${cel}`).toBe(0); |
| 95 | + }); |
| 96 | + } |
| 97 | + |
| 98 | + // ── Shapes the guard must NOT fire under ───────────────────────────────── |
| 99 | + it('NON-empty membership under `$not` keeps working — the `not in` feature', () => { |
| 100 | + const ctx: any = { userId: 'u_me', tenantId: 'org-1', positions: [], org_user_ids: ['u_other', 'u_third'] }; |
| 101 | + const filter = compiler.compileFilter([policy('!(owner in current_user.org_user_ids)')], ctx); |
| 102 | + expect(filter).toEqual({ $not: { owner: { $in: ['u_other', 'u_third'] } } }); |
| 103 | + // r1 (u_me), r4 (null owner — $in over null is false, $not inverts), r5 (u_fourth). |
| 104 | + expect(admitted(filter as Record<string, unknown>)).toBe(3); |
| 105 | + }); |
| 106 | + |
| 107 | + it('emptied POSITIVE membership as an `$or` arm stays inert — own rows keep flowing', () => { |
| 108 | + const filter = compiler.compileFilter( |
| 109 | + [policy('owner in current_user.team_ids || owner == current_user.id')], |
| 110 | + EMPTY_CTX, |
| 111 | + ); |
| 112 | + expect(filter).toEqual({ $or: [{ owner: { $in: [] } }, { owner: 'u_me' }] }); |
| 113 | + expect(admitted(filter as Record<string, unknown>)).toBe(1); // r1 only |
| 114 | + }); |
| 115 | + |
| 116 | + it('deliberate allow-all stays authorable as literal `true`', () => { |
| 117 | + const filter = compiler.compileFilter([policy('true')], EMPTY_CTX); |
| 118 | + expect(filter).toEqual({}); |
| 119 | + expect(admitted(filter as Record<string, unknown>)).toBe(5); |
| 120 | + }); |
| 121 | + |
| 122 | + it('multi-policy: a dropped negated-empty policy removes only its grant — the sibling still grants', () => { |
| 123 | + const filter = compiler.compileFilter( |
| 124 | + [policy('!(owner in current_user.org_user_ids)'), policy('owner == current_user.id')], |
| 125 | + EMPTY_CTX, |
| 126 | + ); |
| 127 | + // The degenerate policy contributes nothing; the sibling's grant survives. |
| 128 | + expect(filter).toEqual({ owner: 'u_me' }); |
| 129 | + expect(admitted(filter as Record<string, unknown>)).toBe(1); |
| 130 | + }); |
| 131 | +}); |
| 132 | + |
| 133 | +describe('[#13552] guard shape tests — FilterCondition forms CEL cannot author', () => { |
| 134 | + // The guard's contract is over the compiled FilterCondition, which is wider |
| 135 | + // than what cel-to-filter emits today. Direct shape pins so the defensive |
| 136 | + // arms are not phantom checks. |
| 137 | + const fires = (f: Record<string, unknown>) => isEmptyMembershipFilter(f); |
| 138 | + |
| 139 | + it('multi-key implicit AND under `$not` (constant TRUE by De Morgan) fires', () => { |
| 140 | + expect(fires({ $not: { owner: { $in: [] }, status: 'open' } })).toBe(true); |
| 141 | + // Evaluator agreement: NOT(FALSE AND …) admits everything. |
| 142 | + expect(admitted({ $not: { owner: { $in: [] }, status: 'open' } })).toBe(5); |
| 143 | + }); |
| 144 | + |
| 145 | + it('bare `{ $not: { $in: [] } }` still fires — pre-#13552 guard parity', () => { |
| 146 | + expect(fires({ $not: { $in: [] } })).toBe(true); |
| 147 | + }); |
| 148 | + |
| 149 | + it('empty `$nin` (intrinsically constant TRUE) fires at positive polarity', () => { |
| 150 | + // Not emitted by cel-to-filter today; recognised so a future lowering |
| 151 | + // cannot fail open through the same blind spot ($nin: [] → `1 = 1` at the |
| 152 | + // read-scope SQL lowering). |
| 153 | + expect(fires({ owner: { $nin: [] } })).toBe(true); |
| 154 | + expect(fires({ $or: [{ owner: { $nin: [] } }, { status: 'open' }] })).toBe(true); |
| 155 | + }); |
| 156 | + |
| 157 | + it('non-membership shapes do not fire', () => { |
| 158 | + expect(fires({ owner: 'u_me' })).toBe(false); |
| 159 | + expect(fires({ $not: { owner: { $in: ['a'] } } })).toBe(false); |
| 160 | + expect(fires({ $not: { owner: { $null: true } } })).toBe(false); |
| 161 | + expect(fires({ $and: [{ owner: { $in: [] } }, { status: 'open' }] })).toBe(false); // constant FALSE — denies by itself |
| 162 | + expect(fires({})).toBe(false); |
| 163 | + }); |
| 164 | + |
| 165 | + it('even-`$not` emptied membership NESTED in a composite stays inert (constant FALSE arm)', () => { |
| 166 | + expect(fires({ $or: [{ $not: { $not: { owner: { $in: [] } } } }, { owner: 'u_me' }] })).toBe(false); |
| 167 | + }); |
| 168 | +}); |
0 commit comments