feat(security): ADR-0091 L1 — grant validity windows with resolution-time filtering#2795
Merged
Merged
Conversation
…time filtering Effective-dated grants land as data + filtering, never as a cleanup job (ADR-0049): a sys_user_position / sys_user_permission_set row outside its half-open [valid_from, valid_until) window stops resolving, fail-closed, symmetrically in every resolver. - objects: both user-grant tables gain valid_from / valid_until / reason / delegated_from / last_certified_at / certified_by (D1; null = unbounded, existing rows unchanged — zero migration) - core: shared isGrantActive/isGrantExpired predicate; resolveAuthzContext filters both tables (an expired unscoped admin_full_access grant no longer derives platform_admin); unparseable bounds fail closed - explain: buildContextForUser filters + returns expiredGrants; the principal layer reports the dedicated 'held until … — expired' contributor state (spec: ExplainLayer contributors gain optional state: active|expired) - sharing: expandPositionUsers drops expired holders from position-recipient expansion (valid_* columns ride the projection) - lint (D7): security-grant-expired-at-authoring + security-delegation-missing-reason (both error) over seed grant rows; re-export the missing SECURITY_MASTER_DETAIL_UNGRANTED - docs: authorization.mdx lifecycle section + ADR index row; ADR-0091 L1 marked landed Tests: core 94, plugin-security 265, plugin-sharing 76, lint 188, spec 6684 — all green; liveness gate passes. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_012oLzaP8n7A3YKFmgaHWC8H
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
github-actions
Bot
added
documentation
Contributor
📓 Docs Drift CheckThis PR changes 5 package(s): 105 hand-written doc(s) reference the affected code and may need an implementation-accuracy re-verification:
|
os-zhuang
marked this pull request as ready for review
July 10, 2026 15:03
This was referenced Jul 15, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
ADR-0091 L1 (accepted 2026-07-10): time becomes a first-class axis of authorization. Grant rows gain validity windows, and correctness lives in resolution-time filtering, fail-closed — never in a background cleanup job (ADR-0049).
D1 — columns (both user-grant tables)
sys_user_position+sys_user_permission_setgainvalid_from/valid_until(half-open[from, until), UTC; null = unbounded → existing rows unchanged, zero migration) plus the lifecycle-audit columnsreason,delegated_from,last_certified_at,certified_by.D2 — the shared predicate, applied symmetrically
New
isGrantActive/isGrantExpiredin@objectstack/core(grant-validity.ts), consumed by:resolveAuthzContext— both grant tables filtered before any derivation; an expired unscopedadmin_full_accessgrant no longer derivesplatform_admin.buildContextForUser— same filter; expired-but-present rows come back asexpiredGrantsand the principal layer reports the dedicated "held until … — expired" contributor state (spec:ExplainLayercontributors gain optionalstate: 'active' | 'expired'), so "why did access disappear" is self-answering.PositionGraphService.expandPositionUsers— expired holders stop receiving position-recipient shares (valid_*columns ride the projection).Present-but-unparseable bounds fail closed (deliberately stricter than API-key
isExpired— a grant row is standing authority, not a single credential).D7 lint rules (both
error, over seed data)security-grant-expired-at-authoring— avalid_untilalready past (or unparseable) at authoring time is a grant that can never resolve: dead on arrival.security-delegation-missing-reason— adelegated_fromrow withoutreasonbreaks the D3 dual audit.SECURITY_MASTER_DETAIL_UNGRANTEDconstant.Docs
authorization.mdxgrant-lifecycle section + ADR index row; ADR-0091 Phasing L1 marked landed.Tests
grant-validity.test.ts, 5 new resolver cases)Liveness gate passes. Boundary semantics covered:
valid_untilexactly at now = inactive (half-open); futurevalid_from= pending, filtered but not reported "expired".Not in this PR (L2, per ADR phasing)
delegatableflag + D12 gate self-service branch, break-glass workflow, certification-stamp write path, dogfood proof.🤖 Generated with Claude Code
https://claude.ai/code/session_012oLzaP8n7A3YKFmgaHWC8H
Generated by Claude Code