feat(plugin-sharing): 姿态感知的组织门 —— 有墙姿态下缺权威组织即拒绝展开 DEPTH (#5859)

按 #5859 裁决(C)追加:`SharingService` 新增 late-bound `tenancy` 姿态探针(读法与
SecurityPlugin 为 Layer-0 墙读 `tenancy` 服务一致,由 SharingServicePlugin 接线),
按 ADR-0105 D1 的既有分叉决定「没有活动组织」意味着什么:

- `single`(纯单租户,无组织):行为不变,DEPTH 照常 —— 那是唯一隐含租户,不是「所有组织」;
- `group` / `isolated`:权威组织缺失/空白 → 不咨询 resolver,回落 owner-only,
  warn 点名 ADR-0095 D1 / ADR-0105 D1 与 #5973 的 fail-closed 契约义务;
- 姿态解析不出(未接线/抛错/词表外)→ 按有墙处理,未知姿态不是 single 的证据。

测试两个方向都钉:single+无组织仍 widened(先绿保持绿)、walled+无组织拒绝(先红后绿)、
姿态不可解析拒绝、legacy `isolationActive:false` 视为无墙、空白组织在两侧各自的表现。

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01JwwiU9bjhwy2SWj13ho8uv

Author: claude

.changeset/sharing-hierarchy-org-authority.md

@@ -34,5 +34,21 @@ RLS 的部署,跨组织 edit/delete 同样放行**。
 - resolver 抛错的静默回退改为**留声**(`logger.warn`):此前「resolver 炸了」和
   「层级里确实没有别人」在外部完全同形,这也是本缺陷长期不可见的原因之一。
 
-安全收紧:按组织收窄 owner 集合的 resolver(企业版即是)从此真正拿到组织,
-跨组织的 share 管理 / edit / delete / 批量写全部按组织边界闭合。
+## 姿态感知的组织门(user-visible 行为变化)
+
+`SharingService` 新增一个 late-bound 的 `tenancy` 姿态探针(读法与 `SecurityPlugin`
+为 Layer-0 墙读 `tenancy` 服务的完全一致,由 `SharingServicePlugin` 自动接线),
+按 **ADR-0105 D1** 的既有分叉决定「没有活动组织」意味着什么 —— 与
+`computeTenantLayer0Filter` 对同一问题给出的答案逐条同形:
+
+- **`single`**(纯单租户,无组织):**行为不变**,DEPTH 照常widened。此处「没有组织」
+  是那一个隐含租户,不是「所有组织」。
+- **`group` / `isolated`**(有墙):权威组织缺失/空白 → **拒绝**,根本不咨询 resolver,
+  回落 owner-only 并打一条点名 ADR-0095 D1 / ADR-0105 D1 与 #5973 契约义务的 `warn`。
+  即:有墙部署里,缺组织的 owner-scope 解析从「按无租户约束展开」变为「拒绝展开」。
+- **姿态解析不出**(未接线 / 探针抛错 / 词表外的值)→ 按**有墙**处理。未知姿态不是
+  `single` 的证据,否则恰恰在配置已经可疑的部署上恢复了展开。
+
+对已有部署的影响:`single` 部署零变化;`group` / `isolated` 部署中,一个**没有活动
+组织**的调用方将不再通过 DEPTH 拿到跨组织的 owner 集合(共享管理 / edit / delete /
+批量写四条路径同时闭合)。

packages/plugins/plugin-sharing/src/sharing-plugin.ts

@@ -449,6 +449,16 @@ export class SharingServicePlugin implements Plugin {
           try { return ctx.getService<any>('security'); }
           catch { return null; }
         },
+        // [ADR-0105 D1 / #5859] Late-bound tenancy posture — read exactly the
+        // way SecurityPlugin reads it for the Layer 0 wall, so the two layers
+        // can never disagree about whether an organization wall is in force.
+        // Absent (no plugin-auth) → the org gate assumes WALLED and refuses to
+        // widen a hierarchy scope that carries no organization; an unresolvable
+        // posture is not evidence of `single`.
+        tenancy: () => {
+          try { return ctx.getService<any>('tenancy'); }
+          catch { return null; }
+        },
       });
       ctx.registerService('sharing', this.service);
 

packages/plugins/plugin-sharing/src/sharing-service.test.ts

@@ -2,7 +2,7 @@
 
 import { describe, it, expect, beforeEach, vi } from 'vitest';
 import { assertEngineDeleteDispatch } from '@objectstack/objectql';
-import { SharingService } from './sharing-service.js';
+import { SharingService, type SharingServiceOptions } from './sharing-service.js';
 import { buildSharingMiddleware } from './sharing-plugin.js';
 import { bootRequestContext } from './exec-context-seam.testkit.js';
 
@@ -1206,6 +1206,15 @@ describe('[#5859] resolveOwnerScopeIds fills the AUTHORITATIVE organization', ()
     });
   }
 
+  /**
+   * [ADR-0105 D1] The deployment posture, stated the way the `tenancy` service
+   * states it. `single` = no organization wall (the pure single-tenant end of
+   * the spectrum the ADR-0057 D1 proofs boot); `group` / `isolated` = a wall is
+   * in force. Every fixture below says which deployment it is talking about,
+   * because after #5859 the answer to "no active organization" depends on it.
+   */
+  const posture = (p: string) => () => ({ posture: p });
+
   let engine: ReturnType<typeof makeFakeEngine>;
   beforeEach(() => {
     engine = makeFakeEngine({ account: ACCOUNT_SCHEMA, sys_record_share: {} });
@@ -1233,6 +1242,7 @@ describe('[#5859] resolveOwnerScopeIds fills the AUTHORITATIVE organization', ()
       engine,
       securityService: () => MANAGER_PROBE,
       hierarchyResolver: orgScopedResolver(seen),
+      tenancy: posture('isolated'),
     });
     const bob = await bootRequestContext({ userId: 'bob', activeOrganizationId: 'org_a' });
 
@@ -1252,6 +1262,7 @@ describe('[#5859] resolveOwnerScopeIds fills the AUTHORITATIVE organization', ()
       engine,
       securityService: () => MANAGER_PROBE,
       hierarchyResolver: orgScopedResolver(seen),
+      tenancy: posture('group'),
     });
     const bob = await bootRequestContext({
       userId: 'bob',
@@ -1275,6 +1286,7 @@ describe('[#5859] resolveOwnerScopeIds fills the AUTHORITATIVE organization', ()
     const svc = new SharingService({
       engine,
       hierarchyResolver: orgScopedResolver(seen),
+      tenancy: posture('group'),
       // NO securityService: no `modifyAllRecords` bypass, and no owner-only RLS
       // anywhere — the sharing service is the ONLY gate in this fixture, which
       // is the deployment shape #5852 named as unprotected (the probe app was
@@ -1296,31 +1308,99 @@ describe('[#5859] resolveOwnerScopeIds fills the AUTHORITATIVE organization', ()
     expect(filter).toEqual({ owner_id: { $in: ['alice', 'bob'] } });
   });
 
-  it('no active organization is reported as an HONEST null — never the deprecated alias, never a stand-in', async () => {
+  // ── [ADR-0105 D1] The posture fork on "no active organization" ────────
+  // Same caller, same absent org, two deployments, two answers — the same
+  // fork Layer 0 already makes (`computeTenantLayer0Filter`: `single` inert,
+  // walled postures deny). Both directions are pinned; neither is a default.
+
+  it('single posture: no organization at all → DEPTH still widens, and the null is HONEST', async () => {
     const seen: any[] = [];
     const svc = new SharingService({
       engine,
       securityService: () => MANAGER_PROBE,
       hierarchyResolver: orgScopedResolver(seen),
+      // The pure single-tenant end of the spectrum — the shape the verify
+      // harness boots deliberately (`autoDefaultOrganization: false`) and the
+      // ADR-0057 D1 dogfood proofs run in. "No org" here is the one implicit
+      // tenant, not "every org", so refusing would retire DEPTH for every
+      // org-less deployment.
+      tenancy: posture('single'),
     });
-    // A session with no active organization — the supported pure-single-tenant
-    // shape (the verify harness boots it deliberately: `autoDefaultOrganization:
-    // false`), not an anomaly this layer invents a verdict for.
     const orgless = await bootRequestContext({ userId: 'bob', activeOrganizationId: null });
     expect((orgless as any).tenantId).toBeUndefined();
 
-    await svc.canManageShares('account', 'a1', orgless);
+    expect(await svc.canManageShares('account', 'a1', orgless)).toBe(true);
     expect(seen).toHaveLength(1);
-    // `string | null` per the contract: the producer states the absence rather
-    // than omitting the key (which is what let #5852's resolver read
-    // `undefined` and query unscoped without anyone noticing).
+    // `string | null` per the contract: the producer STATES the absence rather
+    // than omitting the key (omission is what let a resolver read `undefined`
+    // and query unscoped without anyone noticing). What a resolver must then do
+    // with that null is its own obligation — cloud#1148's half.
     expect(seen[0]).toHaveProperty('organizationId');
     expect(seen[0].organizationId).toBeNull();
-    // What the resolver must DO with that null is its own contract obligation
-    // ("Fail CLOSED on a missing organization … 'no org' is not 'every org'",
-    // IHierarchyScopeResolver.resolveOwnerIds) — cloud#1148's half. Whether the
-    // OPEN edition should additionally refuse to consult it is the open
-    // tenancy-posture question on #5859; deliberately not decided here.
+  });
+
+  it.each(['group', 'isolated'])(
+    '%s posture: no active organization → the resolver is NOT consulted, loudly',
+    async (p) => {
+      const seen: any[] = [];
+      const warn = vi.fn();
+      const svc = new SharingService({
+        engine,
+        securityService: () => MANAGER_PROBE,
+        hierarchyResolver: orgScopedResolver(seen),
+        tenancy: posture(p),
+        logger: { warn },
+      });
+      const orgless = await bootRequestContext({ userId: 'bob', activeOrganizationId: null });
+
+      // A wall is in force and the caller carries no organization to scope by:
+      // owner-only, never widened — and the resolver is not even asked, so an
+      // out-of-tree implementation cannot answer for every org on its own.
+      expect(await svc.canManageShares('account', 'a1', orgless)).toBe(false);
+      expect(await svc.canEdit('account', 'b1', { ...(orgless as any), __writeScope: 'unit' })).toBe(false);
+      expect(seen).toHaveLength(0);
+      expect(warn).toHaveBeenCalled();
+      const [message, meta] = warn.mock.calls[0];
+      expect(String(message)).toContain('organization wall is in force');
+      expect(String(message)).toContain('ADR-0095 D1 / ADR-0105 D1');
+      expect(meta).toMatchObject({ userId: 'bob' });
+    },
+  );
+
+  it('an UNRESOLVABLE posture is not evidence of `single` — it refuses too', async () => {
+    const orgless = await bootRequestContext({ userId: 'bob', activeOrganizationId: null });
+    const probes: Array<SharingServiceOptions['tenancy']> = [
+      undefined,                                      // no `tenancy` wired at all
+      () => null,                                     // service not registered
+      () => { throw new Error('tenancy unavailable'); },
+      () => ({ posture: 'not-a-posture' }),           // outside the vocabulary
+    ];
+    for (const tenancy of probes) {
+      const seen: any[] = [];
+      const svc = new SharingService({
+        engine,
+        securityService: () => MANAGER_PROBE,
+        hierarchyResolver: orgScopedResolver(seen),
+        tenancy,
+      });
+      expect(await svc.canManageShares('account', 'a1', orgless)).toBe(false);
+      expect(seen).toHaveLength(0);
+    }
+  });
+
+  it('the legacy `isolationActive: false` shape still states "no wall" (single)', async () => {
+    const seen: any[] = [];
+    const svc = new SharingService({
+      engine,
+      securityService: () => MANAGER_PROBE,
+      hierarchyResolver: orgScopedResolver(seen),
+      // Pre-ADR-0105 `tenancy` shape — a POSITIVE statement that no wall is
+      // enforced, unlike a missing/unknown posture.
+      tenancy: () => ({ isolationActive: false }),
+    });
+    const orgless = await bootRequestContext({ userId: 'bob', activeOrganizationId: null });
+    expect(await svc.canManageShares('account', 'a1', orgless)).toBe(true);
+    expect(seen).toHaveLength(1);
   });
 
   it('fail closed: a THROWING resolver falls back to owner-only and SAYS so', async () => {
@@ -1331,6 +1411,7 @@ describe('[#5859] resolveOwnerScopeIds fills the AUTHORITATIVE organization', ()
       hierarchyResolver: () => ({
         async resolveOwnerIds(): Promise<string[]> { throw new Error('resolver exploded'); },
       }),
+      tenancy: posture('isolated'),
       logger: { warn },
     });
     const bob = await bootRequestContext({ userId: 'bob', activeOrganizationId: 'org_a' });
@@ -1348,6 +1429,7 @@ describe('[#5859] resolveOwnerScopeIds fills the AUTHORITATIVE organization', ()
       engine,
       securityService: () => MANAGER_PROBE,
       hierarchyResolver: orgScopedResolver(seen),
+      tenancy: posture('single'),
     });
     const blank = await bootRequestContext({ userId: 'bob', activeOrganizationId: '   ' });
     await svc.canManageShares('account', 'a1', blank);
@@ -1356,4 +1438,17 @@ describe('[#5859] resolveOwnerScopeIds fills the AUTHORITATIVE organization', ()
     // a literal that silently matches no rows and reads as "scoped" in a log.
     expect(seen[0].organizationId).toBeNull();
   });
+
+  it('a blank organization is ALSO an absent one under a wall (same normalization, refusing side)', async () => {
+    const seen: any[] = [];
+    const svc = new SharingService({
+      engine,
+      securityService: () => MANAGER_PROBE,
+      hierarchyResolver: orgScopedResolver(seen),
+      tenancy: posture('isolated'),
+    });
+    const blank = await bootRequestContext({ userId: 'bob', activeOrganizationId: '   ' });
+    expect(await svc.canManageShares('account', 'a1', blank)).toBe(false);
+    expect(seen).toHaveLength(0);
+  });
 });

packages/plugins/plugin-sharing/src/sharing-service.ts

@@ -8,6 +8,11 @@ import type {
   SharingExecutionContext,
   ShareAccessLevel,
 } from '@objectstack/spec/contracts';
+import {
+  normalizeTenancyPosture,
+  postureEnforcesWall,
+  type TenancyPosture,
+} from '@objectstack/spec/security';
 import { WRITE_ACCESS_LEVELS, normalizeAccessLevel } from './access-level.js';
 import {
   deleteRowsForDeletedRecords,
@@ -156,6 +161,20 @@ const RECORD_SHARE_SWEEP_SUBJECT = {
   issue: '#5103',
 } as const;
 
+/**
+ * [ADR-0105 D1 / #5859] The narrow slice of the `tenancy` service the
+ * organization gate needs — the deployment's posture, i.e. whether an
+ * organization wall is enforced at all. Kept structural (and identical in shape
+ * to what `SecurityPlugin` reads) so a stack without `@objectstack/plugin-auth`
+ * needs no adapter, and so a unit test can state a posture without a kernel.
+ */
+export interface SharingTenancyProbe {
+  /** `single` | `group` | `isolated` (the legacy `multi` spelling normalizes). */
+  readonly posture?: TenancyPosture | string;
+  /** Pre-ADR-0105 shape: "is the hard organization wall on?" */
+  readonly isolationActive?: boolean;
+}
+
 export interface SharingServiceOptions {
   engine: SharingEngine;
   /** Object names that bypass sharing — typically platform internals. */
@@ -172,6 +191,16 @@ export interface SharingServiceOptions {
    * null → management authority fails CLOSED to owner-only.
    */
   securityService?: () => SharingSecurityProbe | null | undefined;
+  /**
+   * [ADR-0105 D1 / #5859] Late-bound lookup for the `tenancy` service — the
+   * single source of truth for which posture is IN FORCE. Read ONLY to decide
+   * whether a missing authoritative organization must refuse a hierarchy scope
+   * (see {@link SharingService.organizationScopeRequired}).
+   *
+   * Absent / throwing / posture-less → the gate assumes a WALLED deployment and
+   * refuses: an unresolvable posture must not be read as "no wall, carry on".
+   */
+  tenancy?: () => SharingTenancyProbe | null | undefined;
   /** [#5103] Optional logger for the record-delete cascade / orphan sweep. */
   logger?: { info?: Function; warn?: Function; error?: Function; debug?: Function };
 }
@@ -189,12 +218,14 @@ export class SharingService implements ISharingService {
   private readonly bypassObjects: Set<string>;
   private readonly hierarchyResolver?: () => IHierarchyScopeResolver | null | undefined;
   private readonly securityService?: () => SharingSecurityProbe | null | undefined;
+  private readonly tenancy?: () => SharingTenancyProbe | null | undefined;
   private readonly logger?: SharingServiceOptions['logger'];
 
   constructor(options: SharingServiceOptions) {
     this.engine = options.engine;
     this.hierarchyResolver = options.hierarchyResolver;
     this.securityService = options.securityService;
+    this.tenancy = options.tenancy;
     this.logger = options.logger;
     this.bypassObjects = new Set([
       'sys_record_share',
@@ -911,15 +942,11 @@ export class SharingService implements ISharingService {
    * organization** … 'no org' is not 'every org'. Return owner-only (or throw,
    * which the sharing layer treats the same way); never widen."
    *
-   * An additional REFUSAL here (not consulting the resolver at all on a null
-   * org) is deliberately NOT implemented yet: "no active organization" is the
-   * normal state of the supported pure-single-tenant deployment — the verify
-   * harness boots exactly that shape on purpose (`autoDefaultOrganization:
-   * false`) and the ADR-0057 D1 dogfood proofs pin hierarchy DEPTH working in
-   * it. Whether the open edition should refuse there is a tenancy-posture
-   * question (ADR-0105 D1: `single` → no wall; `isolated`/`group` → a missing
-   * org denies, cf. `computeTenantLayer0Filter`), and the sharing service holds
-   * no posture today — see #5859 for the open decision.
+   * On top of that, a WALLED deployment refuses outright: when an organization
+   * wall is in force and the authoritative org is missing, the resolver is not
+   * consulted at all and the caller falls back to owner-only, loudly — see
+   * {@link SharingService.organizationScopeRequired} for why the refusal is
+   * posture-scoped rather than unconditional.
    */
   private async resolveOwnerScopeIds(
     context: SharingExecutionContext,
@@ -931,6 +958,17 @@ export class SharingService implements ISharingService {
     if (!resolver) return [me];
 
     const organizationId = activeOrganizationId(context);
+    if (organizationId === null && this.organizationScopeRequired()) {
+      this.logger?.warn?.(
+        '[sharing] hierarchy scope NOT widened: an organization wall is in force but the caller ' +
+          'context carries no active organization — failing closed to owner-only. ' +
+          '"No org" is not "every org" (IHierarchyScopeResolver.resolveOwnerIds, #5973); ' +
+          'the same rule walls Layer 0 (ADR-0095 D1 / ADR-0105 D1).',
+        { userId: me, scope },
+      );
+      return [me];
+    }
+
     try {
       const ids = await resolver.resolveOwnerIds(
         {
@@ -959,6 +997,47 @@ export class SharingService implements ISharingService {
     }
   }
 
+  /**
+   * [ADR-0105 D1 / #5859] Must a hierarchy scope be refused when the caller
+   * carries no authoritative organization?
+   *
+   * The answer is the deployment's TENANCY POSTURE, not a constant — which is
+   * the same answer Layer 0 already gives to the same question
+   * (`computeTenantLayer0Filter`, ADR-0095 D1 / ADR-0105 D1):
+   *
+   *  - `single` → **no**. There is no organization dimension at all; "no org"
+   *    there means "the one implicit tenant", not "every org", and hierarchy
+   *    DEPTH is pinned working in exactly that shape (the ADR-0057 D1 proofs
+   *    boot a pure single-tenant stack on purpose — `@objectstack/verify`'s
+   *    harness sets `autoDefaultOrganization: false` to model it). Refusing
+   *    here would retire DEPTH for every org-less deployment.
+   *  - `group` / `isolated` → **yes**. A wall is in force, so a caller with no
+   *    active organization has no tenancy constraint to scope an owner set by,
+   *    and widening one would hand out exactly the cross-organization reach
+   *    #5852 measured. Layer 0 denies in the same situation; this is that rule,
+   *    applied one layer up where the sharing gates read.
+   *
+   * Fails CLOSED on an unresolvable posture (no `tenancy` probe wired, a
+   * throwing probe, or a value outside the vocabulary): an unknown posture is
+   * NOT evidence of `single`, and reading it as such would restore the widening
+   * on precisely the deployments whose configuration is already suspect.
+   */
+  private organizationScopeRequired(): boolean {
+    let probe: SharingTenancyProbe | null | undefined;
+    try {
+      probe = this.tenancy?.();
+    } catch {
+      return true; // unresolvable → assume walled
+    }
+    if (!probe) return true;
+    const posture = normalizeTenancyPosture(probe.posture);
+    if (posture) return postureEnforcesWall(posture);
+    // Pre-ADR-0105 shape: only `isolationActive === false` is a positive
+    // statement that no wall is enforced. `undefined` stays unresolved.
+    if (probe.isolationActive === false) return false;
+    return true;
+  }
+
   private shouldBypass(object: string, context: SharingExecutionContext): boolean {
     if (context?.isSystem) return true;
     if (this.bypassObjects.has(object)) return true;