driver-memory 完全没有行级租户隔离(#3724 的未修姊妹面):多租户下静默不隔离

[os-zhuang]

一句话说明

@objectstack/driver-memory 没有任何行级租户隔离 —— 读路径不加租户谓词,写路径不打租户戳,distinct() 甚至不接受 options。这与 #3724(driver-mongodb,同为"整个能力根本不存在")是同一类,而 #3724 已经 closed as completed。

在 #6792(PR #6908,SQL 家族读侧收口点闸门)的范围审计中测得。发现者当时判断"姊妹卡已关闭,新卡只会被以冻结为由关掉",因而没有开卡;PM 复核时发现该前提反了 —— 见下。

事实(#6908 分支基线 6595262 上实测)

$ grep -c "tenantId\|organization_id" packages/drivers/driver-memory/src/memory-driver.ts
0

零匹配。另外 distinct(object, field, query?) 的签名里没有 options 参数,所以调用方即便想传 tenantId 也无处可传。

对照 #6908 刚刚在 SQL 家族上做的事:applyTenantScope 是读侧唯一收口点,getBuilder 构造的每个读 builder 都必须路由过去,并由 scripts/check-tenant-chokepoint.mjs 从 AST 逐次重新推导。driver-memory 不在该闸门的扫描集内,而且这不是因为 #5499 冻结 —— 是因为它根本不使用这套机制(文件里 getBuilder / applyTenantScope 均为零匹配)。闸门因此对它不产生任何判定,也就没有 DEBT 行可记:是一个真实的缺席,而不是被静默豁免。

为什么"姊妹卡已关闭"不是不开卡的理由

#3724 的关闭状态是 state_reason: completed,它自己给的处置是二选一:

• A. 实现行级租户隔离 —— 对齐 SQL driver 的租户列解析 / 读谓词 / 写打戳;
• B. 显式声明不支持多租户 —— 检测到多租户模式就启动时硬失败,而不是静默地不隔离(原卡倾向 B)。

packages/drivers/driver-mongodb 现有的 mongodb-tenancy-guard.ts 正是处置 B。也就是说 #3724 是被"修好"关掉的,不是被"不修"关掉的,先例指向与"不必开卡"相反的方向。

与 #5499 冻结的关系

冻结的理由独立成立(且 #5704 已把它从测试后端迁走),但 #3724-B 恰好是能穿过冻结的那种形状:启动期拒绝不是对该 driver 能力的投资,而是消除一个静默失败模式。#3724 原文的判断在这里同样适用:

当前状态——能在多租户下启动、且不隔离——都不该保留。

是否值得动、以及走 A 还是 B,是分诊/维护者的定级问题,不是本卡替谁作的决定。本卡只负责把这个面记录下来,并纠正那条会让它被静默丢弃的前提。

关联

• driver-mongodb 完全没有行级租户隔离:读不加谓词、写不打戳,多租户下跨租户可读写 #3724 —— driver-mongodb 的同类面,closed as completed,处置 B 已落地为 mongodb-tenancy-guard.ts
• [finding][drivers] SqlDriver.findWithWindowFunctions and analyzeQuery skip applyTenantScope — a row-returning read door outside the driver's "single chokepoint" for tenant isolation #6792 / PR fix(driver-sql): route every read door through the tenant chokepoint (#6792) #6908 —— 发现处;SQL 家族读侧收口点 + AST 闸门
• [裁决] driver-memory / driver-mongodb 投入冻结 —— 维护者 2026-08-05 口径（跨单锚点） #5499 —— driver-memory / driver-mongodb 投资冻结
• driver-memory 测试面替代:项目内测试后端迁到 sqlite :memory:(#5499 重启条件 · memory 半边,维护者 2026-08-06 立项) #5704 —— 已将 driver-memory 迁出测试后端

未认领,仅作记录。

[os-project-manager]

Triage (maintainer-authorized one-off pass, 2026-08-09, registered on #6015): promoted finding → pm:queue (domain:drivers kept), direction per the closed sister's precedent: disposition B — a boot-time hard failure when multi-tenant mode meets driver-memory, mirroring mongodb-tenancy-guard.ts (which is exactly how #3724 closed completed). A guard is compatible with the #5499 freeze — it invests nothing in the frozen driver's capabilities, it stops a silent non-isolation from ever serving traffic. Implementing real row-level isolation (A) stays behind the appetite door. The filer's correction stands: "sister card closed" meant fixed via B, not rejected — the same shape deserves the same guard.

---

Generated by Claude Code

[os-zhuang]

Maintainer ruling (2026-08-10, chat): #6915 and #7117 take pm:on-hold under #5499. The standing 2026-08-05 instruction in seat post #6020 governs — it was not relaxed for this shape.

Applied: pm:queue → pm:on-hold, domain:drivers kept. Unassigned; not dispatched.

This resolves the conflict raised at 09:0xZ (seat comment 5230719256) and repeated on #7117 (comment 5233324830): triage had queued this card, the seat deferred rather than override a triage label on its own reading, and the maintainer has now settled it in favour of the freeze.

Nothing about the finding is retracted. The measurement stands as filed — driver-memory has zero row-level tenant isolation, grep -c "tenantId\|organization_id" packages/drivers/driver-memory/src/memory-driver.ts → 0, and distinct(object, field, query?) does not even accept options. What changes is only its scheduling: it is held under the investment freeze rather than queued.

The #3724-shaped question in the body (A implement isolation vs B refuse loudly at startup) is likewise not withdrawn — it stays recorded here for whenever the freeze is revisited. The argument that route B is the shape that survives a freeze, because a startup refusal removes a silent failure rather than investing in the driver's capabilities, is on the record and unaffected by this ruling.

---

Generated by Claude Code

[huangyiirene]

Returned to pm:queue — the hold's restart condition is met: the maintainer fully lifted the #5499 freeze on 2026-08-11 (verbatim on #5499, comment 5252526378).

Note for selection: this is a tenant-isolation ABSENCE card carrying the #3724 A/B shape (implement row-level isolation vs refuse loudly at startup) — the disposition question its thread already raised is still open, so it likely routes through the decision path rather than straight to a dev. Re-verify anchors on dispatch; they were last checked at hold time.

---

Generated by Claude Code

[huangyiirene]

pm:queue → needs-user-decision. The drivers seat is not dispatching this: the A/B choice the card names is a product-shape ruling, and the thing that used to decide it for us has just been removed.

Anchors re-verified on origin/main @ 9bf4dd0 (all still hold)

• grep -c 'tenantId\|organization_id' packages/drivers/driver-memory/src/memory-driver.ts → 0.
• distinct(object: string, field: string, query?: DriverQuery) — memory-driver.ts:635, still no options parameter, so a caller has nowhere to pass a tenant even deliberately.
• packages/drivers/driver-mongodb/src/mongodb-tenancy-guard.ts (+ its test) exists — driver-mongodb 完全没有行级租户隔离:读不加谓词、写不打戳,多租户下跨租户可读写 #3724 landed as route B for the sibling driver.
• scripts/check-tenant-chokepoint.mjs:119-121 scans driver-sql / driver-sqlite-wasm / driver-turso only, and its own header (:70) says driver-memory and driver-mongodb are outside it and not because of [裁决] driver-memory / driver-mongodb 投入冻结 —— 维护者 2026-08-05 口径（跨单锚点） #5499. So the absence is real, not a silent exemption — as filed.

What changed since the card was written

The card reasoned under the #5499 freeze, where route B was the only shape that could pass — a startup refusal is not an investment in the driver, it is the removal of a silent failure mode. The maintainer fully lifted #5499 on 2026-08-11 (5252526378), so route A is now permissible too. That is exactly why this can no longer be settled by precedent alone.

The two routes, costed

A — implement row-level isolation. Tenant column resolution + read predicates + write stamping, distinct() gains an options parameter, and driver-memory joins check-tenant-chokepoint.mjs's scan set so the AST gate re-derives it. Real work, M+, and it commits driver-memory to being a multi-tenant-capable deployment target.

B — refuse at startup (mirrors mongodb-tenancy-guard.ts). Detect multi-tenant mode at boot and hard-fail instead of running unisolated. One guard + test, S/M, precedented shape already in this repo, dispatchable immediately. Anyone running driver-memory multi-tenant today breaks loudly — which is the entire point, and is a behavior change on existing deployments.

Recommendation (B), and the question behind it

B, unless driver-memory is meant to be a real multi-tenant deployment target. Two drivers in the same family answering the same tenancy question differently is worse than either answer, and #3724's own words still apply verbatim: 「当前状态——能在多租户下启动、且不隔离——都不该保留。」 The freeze lift removed the constraint that forced B; it did not supply an argument for A.

What only the maintainer can settle: after #5704 moved driver-memory out of being the test backend, what is it for? A dev/demo/in-process driver takes B. A driver anyone may ship multi-tenant takes A.

One line settles it and this seat dispatches accordingly — B is ready to run as-is.

---

Generated by Claude Code

[huangyiirene]

Maintainer ruling — 2026-08-12

裁定:处置 B —— 检测到多租户姿态时启动硬失败,照抄 #3724 先例。

要点:

• 给 driver-memory 加启动期租户闸,机制对齐 driver-mongodb 现有的 mongodb-tenancy-guard.ts:多租户姿态下拒绝启动,给出定位明确的错误,而不是静默不隔离。
• ⛔ 不做处置 A(实现行级租户隔离):[裁决] driver-memory / driver-mongodb 投入冻结 —— 维护者 2026-08-05 口径（跨单锚点） #5499 投资冻结继续有效。启动期拒绝不是对该 driver 能力的投资,是消除一个静默失败模式 —— 这正是能穿过冻结的形状。
• driver-mongodb 完全没有行级租户隔离:读不加谓词、写不打戳,多租户下跨租户可读写 #3724 原卡的判断在此适用:「能在多租户下启动、且不隔离」是唯一不该保留的状态。

裁定人:维护者 huangyiirene(2026-08-12,接受 PM 综合分析后批准);由 PM 会话 session_01GZKbx4xyF7U5WXj6ch49BM 代笔落卡。转 pm:queue。

---

Generated by Claude Code