objectstack-ai
diff --git a/‎.changeset/ui-view-environment-ownership.md‎
Lines changed: 75 additions & 0 deletions b/‎.changeset/ui-view-environment-ownership.md‎
Lines changed: 75 additions & 0 deletions
diff --git a/‎content/docs/permissions/system-context.mdx‎
Lines changed: 1 addition & 1 deletion b/‎content/docs/permissions/system-context.mdx‎
Lines changed: 1 addition & 1 deletion
diff --git a/‎packages/qa/dogfood/test/authz-probe-blind-spot.census.ts‎
Lines changed: 17 additions & 1 deletion b/‎packages/qa/dogfood/test/authz-probe-blind-spot.census.ts‎
Lines changed: 17 additions & 1 deletion
diff --git a/‎packages/rest/src/execctx-consumer-census.test.ts‎
Lines changed: 39 additions & 12 deletions b/‎packages/rest/src/execctx-consumer-census.test.ts‎
Lines changed: 39 additions & 12 deletions
diff --git a/‎packages/rest/src/rest-exec-ctx-principal-kind.test.ts‎
Lines changed: 16 additions & 0 deletions b/‎packages/rest/src/rest-exec-ctx-principal-kind.test.ts‎
Lines changed: 16 additions & 0 deletions
@@ -0,0 +1,75 @@
+---
+"@objectstack/rest": minor
+---
+
+fix(rest): require the resolved environment to belong to the caller at `GET /api/v1/ui/view/:object/:type` (#13214)
+
+**Security floor.** This route was the one identity-touching route in
+`RestServer`'s table that resolved no identity at all: it went from
+`resolveProtocol` straight to `getUiView`, answering **200** to an anonymous
+caller, byte-identical to an entitled one, with `resolveExecCtx` called **zero**
+times — while the other 52 identity-touching routes answered 401 under an absent
+context.
+
+Because the unscoped mount lets the REQUEST name its environment (bound
+hostname, else the `X-Environment-Id` header), that made it a cross-environment
+disclosure rather than a single-tenant one. Driven on the real route table with
+a real `envRegistry` + `kernelManager`: an anonymous request naming another
+environment received **that environment's** UI view — object label plus every
+field's `name` / `label` / `type` / `required` / `readonly` — through **both**
+naming channels, with the foreign kernel acquired. The route was additionally an
+object-existence oracle for whatever environment was named, and an
+**environment-id** oracle: an unresolvable `X-Environment-Id` was not refused but
+silently fell through to the default environment and answered 200 with *that*
+environment's view, so two 200s with different bytes distinguished a real
+environment id from an invented one.
+
+Maintainer ruling 2026-08-30 (option C). Adding anonymous-deny alone was
+explicitly measured **not** to be the repair — it stops the anonymous caller and
+nothing else, because an authenticated caller could still name a foreign
+environment and nothing downstream compared the environment that was *resolved*
+with the environment the caller is *entitled to*.
+
+What the seam does now, in order: resolve the environment once through the
+shared entry point; resolve identity **in that environment**; refuse anonymity;
+then compare. The comparison reads `__authEnvironmentId` — an internal key
+`computeExecCtx` now stamps on every context it produces, naming the environment
+whose auth service actually validated the caller. It differs from the resolved
+environment in exactly the branch that crosses: when the resolved environment's
+kernel carries no `auth` service, the lookup falls back to the **default**
+environment's, and a session minted there authenticated a request naming another
+one.
+
+Both refusable shapes answer with the anonymous-deny envelope **verbatim**
+(401 `UNAUTHENTICATED`), and that is deliberate rather than tidiness: a caller
+naming a real foreign environment is already refused by the anonymous gate
+(their credential is not valid there), so giving "you do not own this
+environment" or "that environment id does not resolve" any *other* status would
+rebuild the id oracle one layer up. One shape, byte for byte, for every way a
+caller can fail to be entitled to the environment it named. The cost is
+diagnosability: an operator whose environment genuinely lacks an `auth` service
+sees the anonymous 401 rather than a wiring error.
+
+**Migration.** The published route changes from "anonymous read" to
+"authenticated **and** ownership-checked", so a caller that relied on the old
+behaviour breaks:
+
+- An **anonymous** consumer of `/ui/view/...` (for example a login screen
+  rendering a view before authentication) now receives 401. There is no opt-out;
+  the route is not on `isAuthGateAllowlisted` and was never a declared
+  control-plane exemption.
+- A caller sending `X-Environment-Id` **while on a hostname bound to a different
+  environment** now receives 401 instead of being served the hostname's
+  environment. Drop the contradictory header; the bound hostname still decides.
+- A caller sending an `X-Environment-Id` the registry cannot resolve now
+  receives 401 instead of the default environment's view.
+- A deployment where an environment's kernel carries no `auth` service of its
+  own now refuses requests naming that environment, because the credential
+  would have been validated in the default environment instead. Wire the
+  environment's `auth` service.
+
+Scoped (`/environments/:environmentId/ui/view/...`) and unscoped mounts are both
+gated; naming an environment in the URL is no more of an entitlement than naming
+it in a header. What the producer is *told* is unchanged — `getUiView` still
+receives `{ object, type }` on the unscoped mount and the route-supplied
+`environmentId` on the scoped one.
@@ -158,7 +158,7 @@ The largest single consumer — **20 of the 109 sites**.
 |:--|:---|:---|:---|:---|
 | 48 | Object API-exposure gate bypassed (`apiEnabled` / `apiMethods`) | runtime | Get: internal self-writes ignore exposure declarations — these govern **external** exposure, not engine self-writes | `action-execution.ts:136` |
 | 49 | Action `requiredPermissions` bypassed | runtime | Get: engine self-invocation runs any action | `action-execution.ts:399` |
-| 50 | `manage_metadata` bypassed on metadata writes | runtime, rest | Get: schema writes without the capability | `domains/meta.ts:471`, `:874`, `rest-server.ts:4284`, `:5647`, `:5895`, `:6258`, `:6451` |
+| 50 | `manage_metadata` bypassed on metadata writes | runtime, rest | Get: schema writes without the capability | `domains/meta.ts:471`, `:874`, `rest-server.ts:4408`, `:5771`, `:6019`, `:6382`, `:6575` |
 | 51 | The shared metadata-write verdict itself returns `allowed` | metadata-core | Get: the one function all of row 50's doors consult answers yes before any capability is examined | `meta-write-capability.ts:134` |
 | 52 | Anonymous-deny seam satisfied on the domain dispatchers and the package/federation routes | runtime, rest | Get: passes with no `userId` | `domains/actions.ts:411`, `domains/ai.ts:60`, `domains/automation.ts:989`, `domains/meta.ts:232`, `domains/security.ts:78`, `domains/packages.ts:246`, `external-datasource-routes.ts:302`, `package-routes.ts:97` |
 | 53 | MCP principal check satisfied | runtime | Get: MCP surface reachable with no user | `domains/mcp.ts:61` |
 
@@ -231,7 +231,23 @@ export const PROBE_FILE_CENSUS: readonly ProbeFileReading[] = [
     reachable: 19,
     blindSpot: 61,
     populationRule: '`this.routeManager.register(` call sites; reachable = those inside registerMetadataEndpoints',
-    controls: { 'private register*Endpoints(': 17, 'this.routeManager.register(': 80, enforceAuth: 61 },
+    // [#13214] `enforceAuth` 61 -> 64. ⛔ RE-ANCHORED, not relaxed: the control
+    // exists to prove this census is still reading the file it thinks it is, and
+    // a rising `enforceAuth` is precisely what the 2026-08-30 ruling on #13214
+    // was supposed to cause — `registerUiEndpoints` was the ONE route in this
+    // file that resolved no identity, and it is now guarded. The move is +3 over
+    // the whole file (`occurrences` counts the bare term, comments included):
+    // one new call site — `if (this.enforceAuth(req, res, context)) return;`,
+    // 52 -> 53 — plus two prose mentions in the new doc-comments. ⛔ Kept as an
+    // EXACT count rather than a range or a floor: a range would stop this row
+    // noticing the next move, which is the only thing it is for.
+    //
+    // ⚠️ The three sibling numbers were re-derived and did NOT move, which is
+    // what says this is a guard change and not a surface change: `population`
+    // 80, `reachable` 19, `private register*Endpoints(` 17 and
+    // `this.routeManager.register(` 80 are all unchanged — #13214 added no route
+    // and no registrar. `blindSpot` therefore stays 61 as well.
+    controls: { 'private register*Endpoints(': 17, 'this.routeManager.register(': 80, enforceAuth: 64 },
     note:
       'The single non-tripwire probe names ONE registrar of 17. The other 16 can never mint a key: ' +
       'registerCrudEndpoints, registerApprovalsEndpoints, registerDataActionEndpoints, registerReportsEndpoints, ' +
 
@@ -173,6 +173,15 @@ const ENTITLED = {
     isSystem: false,
     tenantId: 'org_census',
     systemPermissions: ['manage_metadata', 'studio.access', 'setup.access'],
+    // [#13214] The internal key `computeExecCtx` stamps on every context it
+    // produces, naming the environment whose auth service actually validated
+    // the caller. `enforceEnvironmentOwnership` — the new guard on the UI-view
+    // site this census now counts — compares it against the environment the
+    // request resolved to, which under `makeServer` is `env_census`.
+    // `instrument()` replaces `resolveExecCtx` wholesale, so a synthetic
+    // context has to model the key or it is a caller anchored NOWHERE, which
+    // that seam refuses. Every other site in this census ignores it.
+    __authEnvironmentId: 'env_census',
 };
 const OBJECT_DOC = { name: 'acct', type: 'object', fields: {}, groups: [] };
 
@@ -300,54 +309,72 @@ describe('[#13160] §1 the production supplier fulfils with `undefined` rather t
 // ---------------------------------------------------------------------------
 
 describe('[#13160] §2 the consumer surface, counted from the tree', () => {
-    it('72 invocation sites, 89 mentions — the thread\'s two control numbers hold', () => {
-        expect(SITES.length).toBe(72);
-        expect(SOURCE.split('resolveExecCtx').length - 1).toBe(89);
+    it('73 invocation sites, 92 mentions — the thread\'s two control numbers hold', () => {
+        // [#13214] 72 → 73 sites / 89 → 92 mentions. `registerUiEndpoints` was
+        // the ONE metadata-touching route in the table that resolved no
+        // identity at all — the exception this census surfaced — and the
+        // 2026-08-30 ruling closed it. It joins as a BARE site behind the
+        // shared floor, which is the family the next two cases describe.
+        //
+        // ⚠️ The two numbers moved by DIFFERENT amounts (+1 and +3) and that is
+        // the point of counting both: one is the call site, the other two are
+        // prose mentions in the new doc-comments (the registrar's, recording
+        // that this route used to call `resolveExecCtx` zero times, and the
+        // ownership guard's, recording that adding `resolveExecCtx` +
+        // `enforceAuth` was measured NOT to be the repair). A mention count
+        // that tracked the site count exactly would be measuring one thing
+        // twice.
+        expect(SITES.length).toBe(73);
+        expect(SOURCE.split('resolveExecCtx').length - 1).toBe(92);
     });
 
-    it('the split is 20 locally caught / 52 bare — NOT 16 / 52, which does not add to 72', () => {
+    it('the split is 20 locally caught / 53 bare — NOT 16 / 53, which does not add to 73', () => {
         // 16 sites spell the catch on the invocation line; 4 more spell it on
         // the continuation line. A single-line grep sees 16 and the arithmetic
         // silently loses four sites.
+        //
+        // [#13214] The new site is BARE, and that is a decision the next case
+        // enforces: a locally-caught site sitting behind the shared floor would
+        // be the first of its kind and would break the structural claim below.
         const sameLine = CAUGHT.filter((s) => SOURCE.split('\n')[s.line - 1].includes('.catch('));
         expect(sameLine.length).toBe(16);
         expect(CAUGHT.length).toBe(20);
-        expect(BARE.length).toBe(52);
+        expect(BARE.length).toBe(53);
         expect(CAUGHT.length + BARE.length).toBe(SITES.length);
     });
 
-    it('⭐ every one of the 52 bare sites is guarded on the VERY NEXT LINE, and none of the 20 caught ones is', () => {
+    it('⭐ every one of the 53 bare sites is guarded on the VERY NEXT LINE, and none of the 20 caught ones is', () => {
         // This inverts the reason the thread gave for doing the bare sites
         // first ("no local signal that a fault becomes an anonymous subject").
         // The bare sites are bare BECAUSE the shared anonymous floor is the
         // next statement; the locally-caught ones carry a `.catch` because
         // they are NOT behind that floor and each must decide for itself.
-        expect(BARE.filter((s) => s.nextLine === ENFORCE_AUTH_GUARD).length).toBe(52);
+        expect(BARE.filter((s) => s.nextLine === ENFORCE_AUTH_GUARD).length).toBe(53);
         expect(CAUGHT.filter((s) => s.nextLine === ENFORCE_AUTH_GUARD).length).toBe(0);
     });
 });
 
 // ---------------------------------------------------------------------------
-// 3. The 52 bare sites, driven
+// 3. The 53 bare sites, driven
 // ---------------------------------------------------------------------------
 
-describe('[#13160] §3 the 52 bare sites — driven, every one of them', () => {
-    it('all 52 are reached by the mounted route table, so none is classified by inference', async () => {
+describe('[#13160] §3 the 53 bare sites — driven, every one of them', () => {
+    it('all 53 are reached by the mounted route table, so none is classified by inference', async () => {
         const reached = sitesOf(await sweep(undefined, 'FULL'));
         const unreached = BARE.map((s) => s.line).filter((l) => !reached.has(l));
         // ⛔ A bare site that stopped being reachable must show up as a
         // shrinking census, never as a row silently inherited from a neighbour.
         expect(unreached).toEqual([]);
     }, 120_000);
 
-    it('an absent context is the ANONYMOUS SUBJECT at all 52: 401 UNAUTHENTICATED, and the same instrument serves an entitled caller', async () => {
+    it('an absent context is the ANONYMOUS SUBJECT at all 53: 401 UNAUTHENTICATED, and the same instrument serves an entitled caller', async () => {
         const fault = await sweep(undefined, 'FULL');
         const control = await sweep(ENTITLED, 'FULL');
         const bareLines = new Set(BARE.map((s) => s.line));
         const controlByRoute = new Map(control.map((r) => [r.route, r]));
 
         const rows = fault.filter((r) => r.sites.some((l) => bareLines.has(l)));
-        expect(rows.length).toBeGreaterThanOrEqual(52);
+        expect(rows.length).toBeGreaterThanOrEqual(53);
 
         for (const row of rows) {
             expect(row.status, `${row.route} under an absent context`).toBe(ANONYMOUS_DENY_STATUS);
 
@@ -293,6 +293,22 @@ describe('#6216 — the REST face assembles through the SHARED assembler, output
             // it, so it is an assembled field now and absent for the same reason
             // every other unset field is: this session carries no gate.
             '__kernel',
+            // [#13214] The SECOND post-assembly internal key, added by the
+            // 2026-08-30 security ruling and named here rather than left to a
+            // subset check — this pin exists precisely to make a key ARRIVING
+            // as loud as a key going missing, and this one arrived.
+            //
+            // It carries the environment whose auth service actually validated
+            // the caller, which is the left-hand side of the ownership
+            // comparison `enforceEnvironmentOwnership` makes at
+            // `GET /ui/view/:object/:type`. ⚠️ Unlike `__kernel` it IS an
+            // authorization input, at exactly one reader inside `rest-server.ts`
+            // — ⛔ nothing downstream of this transport may branch on it, and
+            // it is deliberately NOT an `ExecutionContext` field because it
+            // describes how the context was OBTAINED, not what the principal
+            // may do. The assembled field set is unchanged; this sits beside it,
+            // in the same `as any` the class doc-comment already covers.
+            '__authEnvironmentId',
         ]));
     });