From a6342182f077175faf234caed6f58c0818a8f34b Mon Sep 17 00:00:00 2001 From: Claude Date: Mon, 7 Sep 2026 10:15:12 +0000 Subject: [PATCH] docs(rest): state the direction the read predicate rules on at the /published door MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The `GET /meta/:type/:name/published` handler's comment argued that passing the RAW tenant "is right for a READ" because `getMetaItemLayered`'s overlay lookup is org-scoped-first then env-wide, so "nothing that resolves today stops resolving". That fail-open direction is precisely the reasoning `organizationIdForMetaRead` was written to refute: an org named on a type the registry does not declare per-org overridable resurrects the phantom rows #6190 stopped minting. Since #14907 the callee gates: `getMetaItemLayered` resolves `organizationIdForMetaRead` itself, AFTER its canonical fold. So the raw tenant is correct here for a different reason than the one stated, and this door must NOT pre-gate — `req.params.type` is unfolded, and gating on it is the #10340 defect. Because the old prose read as a deliberate, reasoned decision to gate, two successive enumerations in the same series recorded this door as already gating when it does not. The `#8805` half above is untouched and still true. Comment-only and line-count-neutral: 8 comment lines out, 8 in, no executable change, so the absolute-line anchors in `content/docs/permissions/system-context.mdx` cannot move. Co-Authored-By: Claude Opus 5 Claude-Session: https://claude.ai/code/session_01YFY46JydE1gMxQG1TqBcMZ --- packages/rest/src/rest-server.ts | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) diff --git a/packages/rest/src/rest-server.ts b/packages/rest/src/rest-server.ts index 5153c8e4d3..53ec32739e 100644 --- a/packages/rest/src/rest-server.ts +++ b/packages/rest/src/rest-server.ts @@ -8205,14 +8205,14 @@ export class RestServer { // inventing org RESOLUTION here, and this reads // `tenantId` off the execution context `resolveExecCtx` // already resolves, exactly as #8803 did for the audit - // read. The raw tenant is right for a READ (the write - // doors run it through `organizationIdForMetaWrite` - // instead): `getMetaItemLayered`'s overlay layer is - // org-scoped-first, THEN env-wide, so this is fail-open - // in the safe direction — an org-less caller reads - // exactly what it reads today, and an org-scoped caller - // still falls back to the env-wide row. Nothing that - // resolves today stops resolving. + // read. [#14907] The CALLEE gates: `getMetaItemLayered` + // resolves `organizationIdForMetaRead` AFTER its canonical + // fold, so the tenant goes over RAW. ⛔ Pre-gating HERE, on + // the unfolded `:type`, would be the #10340 defect. ⛔ And + // the old "fail-open in the safe direction" reading is the + // argument the predicate refutes: an org named on a type + // the registry does not declare overridable resurrects the + // phantoms #6190 stopped minting. // // Environment scoping still holds: it comes from WHICH // protocol `resolveProtocol` hands back, not from the