From 45b3d5c63bb484f7e5cef7922c81ead8997c5f0d Mon Sep 17 00:00:00 2001 From: Jack Zhuang <277994282+os-zhuang@users.noreply.github.com> Date: Mon, 27 Jul 2026 09:09:13 +0800 Subject: [PATCH] test(dogfood): reclassify flow runAs as enforced in the authz conformance ledger (#1888) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The authz-conformance ledger still filed `flow-run-as` under "Removed — by ADR-0049 (roadmap M2)", contradicting the live enforcement: #1888 implemented runAs for flow data nodes (crud-nodes.ts honors flow.runAs — system → RLS-bypassing, user → trigger identity), proven by flow-runas.dogfood.test.ts and flow-runas-schedule.dogfood.test.ts. Moved the entry to the "Enforced (unit-proven; e2e proof is a follow-on)" section with its runtime enforcement site + dogfood proof, satisfying the ledger's enforced-has-site / proof-exists invariants (authz-conformance.test.ts 9/9 green). Surfaced by the 2026-07 security-props recheck (#1878). Co-Authored-By: Claude Fable 5 --- .changeset/authz-ledger-flow-runas.md | 12 ++++++++++++ packages/qa/dogfood/test/authz-conformance.matrix.ts | 5 ++++- 2 files changed, 16 insertions(+), 1 deletion(-) create mode 100644 .changeset/authz-ledger-flow-runas.md diff --git a/.changeset/authz-ledger-flow-runas.md b/.changeset/authz-ledger-flow-runas.md new file mode 100644 index 0000000000..76d188e4d7 --- /dev/null +++ b/.changeset/authz-ledger-flow-runas.md @@ -0,0 +1,12 @@ +--- +--- + +test(dogfood): reclassify flow `runAs` as enforced in the authz conformance ledger (#1888) + +The `authz-conformance.matrix.ts` ledger still filed `flow-run-as` under +"Removed — by ADR-0049 (roadmap M2)", but #1888 implemented runAs for flow data +nodes (create/update/delete/query execute under the run's effective identity — +`system` bypasses RLS, `user` enforces it as the trigger user). Moved the entry +to the enforced section with its runtime site (`service-automation` engine → +`runtime-identity` → `crud-nodes`) and its dogfood proof +(`flow-runas.dogfood.test.ts`). Test-only ledger correctness; releases nothing. diff --git a/packages/qa/dogfood/test/authz-conformance.matrix.ts b/packages/qa/dogfood/test/authz-conformance.matrix.ts index b949961721..dbe33b9b3c 100644 --- a/packages/qa/dogfood/test/authz-conformance.matrix.ts +++ b/packages/qa/dogfood/test/authz-conformance.matrix.ts @@ -152,6 +152,10 @@ export const AUTHZ_CONFORMANCE: AuthzPrimitive[] = [ { id: 'secure-by-default-posture', summary: 'ADR-0066 ④ — sensitive system objects opt out of the wildcard grant (access.default: private)', state: 'enforced', enforcement: 'plugin-security/permission-evaluator.ts resolveObjectPermission (plain wildcard does not cover a private object) + posture-gated superuser bypass; declarations in platform-objects (sys_secret, sys_jwks, sys_verification, sys_oauth_access_token, sys_oauth_refresh_token, sys_device_code) + sys_scim_provider D3 capability gate', note: 'Primitive enforcement unit-proven in plugin-security/security-plugin.test.ts (ADR-0066 posture suite); the per-object declarations are pinned by platform-objects.test.ts "secure-by-default posture" so dropping the flag from a secret store fails CI, not review. Member self-service objects (sys_session, sys_api_key, sys_oauth_application, sys_two_factor) deliberately stay public-posture — the Account app reads them with a member context; row scoping (owner/tenant RLS + _self carve-outs) is their guard.' }, + { id: 'flow-run-as', summary: 'flow runAs — data nodes execute under the run\'s effective identity (#1888)', state: 'enforced', + enforcement: 'service-automation/engine.ts runAs authorization envelope → runtime-identity.ts → builtin/crud-nodes.ts (runAs:\'system\' → RLS-bypassing; runAs:\'user\' → trigger identity, RLS enforced as that user)', + proof: 'flow-runas.dogfood.test.ts', + note: 'ADR-0049 originally classified runAs as roadmap M2, but #1888 implemented it for flow data nodes (create/update/delete/query run under the chosen identity). Also proven for scheduled flows in flow-runas-schedule.dogfood.test.ts.' }, // ── Experimental — declared, NOT enforced (ADR-0049/0056 D8) ─────────── { id: 'field-encryption', summary: 'at-rest field encryption', state: 'experimental', @@ -174,5 +178,4 @@ export const AUTHZ_CONFORMANCE: AuthzPrimitive[] = [ // ── Removed — by ADR-0049 (roadmap M2) ───────────────────────────────── { id: 'allow-transfer-restore-purge', summary: 'transfer/restore/purge ops (RBAC gate pre-mapped)', state: 'removed', note: 'ADR-0049 → roadmap M2. #1883: the ops still do not exist in ObjectQL, but the evaluator PRE-MAPS them (OPERATION_TO_PERMISSION transfer/restore/purge → allowTransfer/allowRestore/allowPurge, modifyAllRecords bypass, unmapped destructive ops fail closed) — there is no ungated window when the ops ship. Unit-proven in plugin-security/security-plugin.test.ts.' }, - { id: 'flow-run-as', summary: 'flow runAs', state: 'removed', note: 'ADR-0049 → roadmap M2' }, ];