wip: gate fixes (runtime string id, query-options erasure)

Author: claude

.changeset/memory-driver-read-side-tenant-scope.md

@@ -0,0 +1,17 @@
+---
+'@objectstack/driver-memory': minor
+---
+
+The in-memory driver now honours `DriverOptions.tenantId` / `tenantIds` instead of discarding them, so a scoped read no longer returns other organizations' rows.
+
+Two predicates decided "is this object tenant-scoped" and they disagreed on the default case. `Engine.buildDriverOptions` scopes unless the object opts OUT (`tenantId !== undefined && !isTenancyDisabled(schema) && !isFederated`); this driver's boot guard refuses only an explicit opt-IN (`tenancy.enabled === true`). An object that omits the `tenancy` block — the common case — was therefore scoped by the engine and invisible to the guard, and the driver did nothing with the scope: `tenantId`, `tenantIds` and `organization_id` occurred nowhere in `memory-driver.ts`. The read path knew nothing about tenants; the unique-constraint path did.
+
+Measured on one app across two drivers, same build, same seed, same account: the four objects that omit the block returned 12 / 30 / 40 / 14 rows on this driver against **0** on sqlite, and the three that declare `tenancy.enabled: false` agreed exactly. The split line was the declaration. Neither driver said a word about the disagreement.
+
+⚠️ **Every isolation measurement previously taken on this driver is void and must be re-taken.** The failure direction was toward exposure in the place where isolation is tested: a suite asserting "tenant A cannot see tenant B's rows" passed here not because isolation worked, but because both tenants' rows came back to everyone and the assertion had been written against a single tenant's fixture.
+
+The semantics are `driver-sql`'s, read off `applyTenantScope` and reproduced arm for arm rather than invented — `col = :tenantId OR col IS NULL` for the equality path, `col IN (…) OR col IS NULL` under the ADR-0105 D2 union posture, and the NULL arm keeps the #2734 global-row carve-out so a platform row that belongs to no organization stays visible to all of them. Every door that accepts a `DriverOptions` routes through one chokepoint: `find`, `findOne`, `count`, `aggregate` (both arms), `update`, `upsert`, `delete`, `updateMany`, `deleteMany`, `bulkUpdate` and `bulkDelete`. `distinct()` accepts no `DriverOptions` at all and is therefore still unscoped — the one door named rather than left to be discovered.
+
+**What changes for an existing consumer.** A caller that passes no `tenantId` — every seed script, admin path and legacy call — is unaffected down to the array it allocates. A caller that does pass one, on an object carrying a tenant column and no `tenancy` declaration, now sees its own organization's rows plus organization-less rows, where it previously saw everything. That is the fix, and it is the reason a `single`-posture deployment is affected at all: `single` constrains the wall, not the number of organizations — one measured run held 13 `sys_organization` rows.
+
+Write-side tenancy is deliberately not included: nothing stamps a tenant column on insert the way `SqlDriver.injectTenantOnInsert` does, so the boot guard still refuses a walled posture and still refuses an object declaring `tenancy.enabled: true`. `declaresTenantScope`'s docstring is corrected in the same change — its load-bearing sentence, "every object in a single-tenant deployment omits the block", was false.

packages/drivers/driver-memory/src/memory-tenancy-guard.ts

@@ -85,15 +85,18 @@ export class MemoryMultiTenantUnsupportedError extends Error {
 
   constructor(detected: string, remedy: string) {
     super(
-      `[driver-memory] Refusing to start: this driver has NO row-level tenant isolation.\n` +
+      // ⛔ No tracker id in this text: it is a RUNTIME string an operator reads,
+      // and `#NNNN` resolves to nothing for them (`pnpm check:doc-authoring`).
+      // The anchor for this driver's tenancy work is `Tracking:` below.
+      `[driver-memory] Refusing to start: this driver has only HALF of row-level tenant isolation.\n` +
         `\n` +
         `  Detected: ${detected}\n` +
         `\n` +
-        `  InMemoryDriver scopes reads, updates and deletes by \`DriverOptions.tenantId\`\n` +
-        `  (#16589), but it does NOT stamp a tenant column on writes: a record created\n` +
-        `  without an explicit organization lands with none, and a record with no\n` +
-        `  organization is visible to EVERY tenant. Rather than run half-isolated, the\n` +
-        `  driver fails at startup.\n` +
+        `  InMemoryDriver scopes reads, updates and deletes by \`DriverOptions.tenantId\`,\n` +
+        `  but it does NOT stamp a tenant column on writes: a record created without an\n` +
+        `  explicit organization lands with none, and a record with no organization is\n` +
+        `  visible to EVERY tenant. Rather than run half-isolated, the driver fails at\n` +
+        `  startup.\n` +
         `\n` +
         `  Fix one of:\n` +
         `    • Use @objectstack/driver-sql (PostgreSQL / MySQL / SQLite) for multi-tenant\n` +

packages/drivers/driver-memory/src/memory-tenant-scope.test.ts

@@ -30,14 +30,22 @@
  */
 
 import { describe, it, expect } from 'vitest';
+import type { DriverQuery } from '@objectstack/spec/contracts';
 import { InMemoryDriver } from './memory-driver.js';
 import { tenantScopePredicate } from './memory-tenant-scope.js';
 
+/** The shape the fixtures below declare — no wider than they need. */
+interface SeedSchema {
+  name: string;
+  fields: Record<string, { type: string }>;
+  tenancy?: { enabled?: boolean; tenantField?: string };
+}
+
 const ORG_A = 'org_a';
 const ORG_B = 'org_b';
 
 /** The card's case exactly: a tenant column, and NO `tenancy` block at all. */
-const EMPLOYER_SCHEMA = {
+const EMPLOYER_SCHEMA: SeedSchema = {
   name: 'ats_employer',
   fields: {
     id: { type: 'string' },
@@ -48,7 +56,7 @@ const EMPLOYER_SCHEMA = {
 };
 
 /** ADR-0066's platform-global posture — the objects that AGREED across drivers. */
-const LICENSE_SCHEMA = {
+const LICENSE_SCHEMA: SeedSchema = {
   name: 'sys_license',
   fields: {
     id: { type: 'string' },
@@ -58,13 +66,13 @@ const LICENSE_SCHEMA = {
 };
 
 /** No tenant column at all: nothing to scope by, on any driver. */
-const NOTE_SCHEMA = {
+const NOTE_SCHEMA: SeedSchema = {
   name: 'note',
   fields: { id: { type: 'string' }, body: { type: 'string' } },
 };
 
 /** A wall drawn by a column that deliberately is not the platform's. */
-const WORKSPACE_ITEM_SCHEMA = {
+const WORKSPACE_ITEM_SCHEMA: SeedSchema = {
   name: 'workspace_item',
   fields: {
     id: { type: 'string' },
@@ -82,10 +90,10 @@ const WORKSPACE_ITEM_SCHEMA = {
  * without the global carve-out answers `[a1, a2]`; a broken scope answers `[]`.
  * All four are distinguishable, which is the point.
  */
-async function seed(driver: InMemoryDriver, schema: Record<string, unknown> = EMPLOYER_SCHEMA) {
-  const object = schema.name as string;
+async function seed(driver: InMemoryDriver, schema: SeedSchema = EMPLOYER_SCHEMA) {
+  const object = schema.name;
   await driver.syncSchema(object, schema);
-  const tenantField = (schema as any).tenancy?.tenantField ?? 'organization_id';
+  const tenantField = schema.tenancy?.tenantField ?? 'organization_id';
   await driver.bulkCreate(object, [
     { id: 'a1', name: 'A one', [tenantField]: ORG_A },
     { id: 'a2', name: 'A two', [tenantField]: ORG_A },
@@ -244,7 +252,7 @@ describe('#16589 — the in-memory driver honours DriverOptions.tenantId', () =>
       // AST arm — what objectql's engine sends.
       const ast = await driver.aggregate(
         object,
-        { aggregations: [{ function: 'count', field: 'id', alias: 'n' }] } as any,
+        { aggregations: [{ function: 'count', field: 'id', alias: 'n' }] } satisfies DriverQuery,
         { tenantId: ORG_A },
       );
       expect(ast[0]?.n).toBe(3);