chore(auth): sweep the archaeological requireAuth comments — and one dead code block (#3963)

Follow-up cleanup after retiring the opt-out. Most were stale comments asserting
behaviour that no longer exists ("no-op when requireAuth is off", "when
requireAuth is set", "requireAuth=true deployments"), updated to the unconditional
anonymous-deny posture across rest-server, the runtime domains, plugin-security,
plugin-approvals, and metadata-protocol.

One was NOT just a comment: plugin-hono-server still computed
`const requireAuth = restConfig?.api?.requireAuth ?? true` and logged a boot
warning off it — dead plumbing, since denyAnonymous stopped reading requireAuth.
Removed. hono suite green (116).

Also merges origin/main (rest.test.ts discovery-route conflict — the route is
control-plane/allowlisted, so it takes the serviceExists constructor from main
and drops the unnecessary auth injection).

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01TzLE9cw4gZKNyPN2ZP4iTt

Author: claude

packages/metadata-protocol/src/protocol.ts

@@ -2664,8 +2664,8 @@ export class ObjectStackProtocolImplementation implements
         // it was not swept into the implicit-filter bucket either: a caller's
         // `context` survived this spread and, because the assignment below is
         // conditional, became the operation's execution context whenever no
-        // server context resolved (an anonymous request on a deployment that
-        // set `requireAuth: false`).
+        // server context resolved (before #3963 an anonymous request on a
+        // `requireAuth: false` deployment; the invariant holds regardless).
         //
         // What rides on it is total: plugin-security's middleware opens with
         // `if (opCtx.context?.isSystem) return next()` — the entire RLS / FLS /

packages/plugins/plugin-approvals/src/approval-service.ts

@@ -639,9 +639,10 @@ export class ApprovalService implements IApprovalService {
    * (having also put them on the context). Those are the only two callers that
    * hold a trustworthy actor with no session behind them.
    *
-   * A caller with NO identity at all cannot act. That case is reachable: the
-   * REST anonymous-deny only fires when `api.requireAuth` is set, so without it
-   * an anonymous request previously decided approvals outright by naming one.
+   * A caller with NO identity at all cannot act. Belt-and-suspenders: the REST
+   * anonymous-deny now denies every anonymous request (#3963), but this service
+   * must not rely on a caller upstream — an anonymous actor could otherwise
+   * decide approvals outright by naming one.
    */
   private async resolveActor(
     actorId: string | undefined,

packages/plugins/plugin-hono-server/src/hono-plugin.ts

@@ -813,22 +813,9 @@ export class HonoServerPlugin implements Plugin {
         // failing. Gating here makes the deny decision a property of THIS entry
         // point too, so security no longer depends on who registered first.
         //
-        // Secure-by-default: `requireAuth` mirrors `rest-server.ts`'s `?? true`
-        // (ADR-0056 D2). A deployment that intentionally serves data publicly
-        // sets `restConfig.api.requireAuth = false` (a boot warning is logged, as
-        // in the REST plugin). No-op in that case — the previously-public surface
-        // is unchanged. An authenticated / system caller always passes.
-        //
-        // `requireAuth` is not in the typed `api` shape (rest-server.ts reads it
-        // via the same `as any` cast), so widen locally.
-        const requireAuth =
-            (this.options.restConfig?.api as { requireAuth?: boolean } | undefined)?.requireAuth ?? true;
-        if (!requireAuth) {
-            ctx.logger.warn(
-                'Hono standard /data endpoints: requireAuth is OFF — anonymous callers can read/write object data. ' +
-                'This is a deliberate opt-out; set restConfig.requireAuth=true to deny anonymous access (ADR-0056 D2, #2567).',
-            );
-        }
+        // [#3963] Anonymous access to object data is denied unconditionally —
+        // the `requireAuth` opt-out is retired, so there is no posture to read
+        // or warn about here. An authenticated / system caller always passes.
         // Returns a 401 Response when the caller is anonymous, else null
         // (caller proceeds). Delegates the decision to the
         // shared `shouldDenyAnonymous` (#2567) so every HTTP seam stays in

packages/plugins/plugin-security/src/security-plugin.ts

@@ -771,7 +771,7 @@ export class SecurityPlugin implements Plugin {
       // form's declared target (set by the rest-server form-submit route). It
       // authorizes ONLY create + the immediate read-back on THAT object — never
       // anything else, and never the anonymous fall-open. This lets public forms
-      // work under secure-by-default (requireAuth) WITHOUT a deployment-configured
+      // work under secure-by-default (anonymous-deny) WITHOUT a deployment-configured
       // `guest_portal`, scoped to exactly the declared object (the field
       // allow-list is enforced at the route; the context is request-scoped).
       const formGrant = opCtx.context?.publicFormGrant;

packages/rest/src/rest-server.ts

@@ -1222,8 +1222,9 @@ export class RestServer {
     }
 
     /**
-     * Reject anonymous requests with HTTP 401 when `api.requireAuth` is set.
-     * Returns `true` if the response was sent and the caller should stop
+     * Reject anonymous requests with HTTP 401 — unconditionally (#3963: the
+     * `api.requireAuth` opt-out is retired). Returns `true` if the response was
+     * sent and the caller should stop
      * processing. Returns `false` to continue.
      *
      * The check is intentionally narrow: only `context?.userId` counts as
@@ -1232,7 +1233,7 @@ export class RestServer {
      */
     private enforceAuth(req: any, res: any, context: any): boolean {
         // ADR-0069 — authentication-policy gate (password expiry, enforced MFA).
-        // Independent of `requireAuth`: a gated session (carrying `authGate`) is
+        // Independent of the anonymous-deny: a gated session (carrying `authGate`) is
         // blocked from protected resources, while the core allow-list keeps auth
         // + remediation reachable. Runs before the anonymous check.
         const gate = context?.authGate;
@@ -2544,23 +2545,22 @@ export class RestServer {
     }
 
     /**
-     * Register the metadata routes behind the SAME `requireAuth` gate the
+     * Register the metadata routes behind the SAME anonymous-deny gate the
      * `/data` routes use.
      *
      * `registerMetadataEndpoints` builds ~17 `/meta/*` routes but — unlike the
      * `/data` handlers — never calls {@link enforceAuth}: its handlers assumed
-     * the `requireAuth` gate rejected anonymous callers "upstream", yet nothing
-     * upstream covers `/meta`, so on a `requireAuth` deployment an anonymous
-     * caller could read object / field schemas. On a tenant-less runtime host
-     * those are SYSTEM-object schemas and the host is publicly reachable — a
-     * real leak.
+     * the anonymous-deny rejected anonymous callers "upstream", yet nothing
+     * upstream covers `/meta`, so an anonymous caller could read object / field
+     * schemas. On a tenant-less runtime host those are SYSTEM-object schemas and
+     * the host is publicly reachable — a real leak.
      *
      * Rather than add the gate to every handler (and have the next new route
      * forget it — the exact failure mode that caused this), wrap the route
      * registrar for the duration of registration so every meta route, present
-     * and future, inherits it. The check is a no-op when `requireAuth` is off
-     * (demo / single-tenant), so the previously-public metadata surface there
-     * is unchanged; an authenticated user passes exactly as on `/data`.
+     * and future, inherits it. An authenticated user passes exactly as on
+     * `/data`; the one exception is the declaration-derived public-book read
+     * (#3963), handled just below.
      */
     private registerMetadataEndpoints(basePath: string): void {
         const realRouteManager = this.routeManager;
@@ -2579,7 +2579,7 @@ export class RestServer {
                         const context = await this.resolveExecCtx(environmentId, req).catch(() => undefined);
                         // [#3963] `audience: 'public'` is a DECLARED capability, so it
                         // must not depend on a deployment flipping its whole data plane
-                        // open (`requireAuth: false`). An anonymous read of the
+                        // open. An anonymous read of the
                         // book/doc surface skips the anonymous-deny and is authorized
                         // instead by the ADR-0046 §6.7 audience gate inside the handler
                         // — the same declaration-derived shape ADR-0056 Option A chose
@@ -2756,7 +2756,7 @@ export class RestServer {
                         // privileged apps (Studio, Setup, etc.) and gated nav
                         // items are stripped before reaching the client. We
                         // intentionally leave anonymous responses untouched —
-                        // the existing `requireAuth` gate (when enabled) blocks
+                        // the anonymous-deny gate blocks
                         // them upstream; when disabled, the demo / public
                         // surface keeps its prior behaviour.
                         //
@@ -5091,14 +5091,14 @@ export class RestServer {
      *   GET  {basePath}/forms/:slug          → resolved form spec
      *   POST {basePath}/forms/:slug/submit   → INSERT record (no auth required)
      *
-     * Both routes bypass `enforceAuth` even when `requireAuth=true` on the
+     * Both routes bypass `enforceAuth` even though anonymous-deny is on for the
      * deployment (e.g. ObjectOS multi-tenant). Security is delegated to the
      * `guest_portal` permission set carried on the execution context — the
      * SecurityPlugin enforces INSERT-only access to the target object. If
      * the deployment hasn't registered a `guest_portal` profile, the
      * security middleware falls open with `permissions: []` (no userId),
      * matching the existing anonymous-access semantics; deployers must
-     * keep `requireAuth=true` deployments paired with a `guest_portal`
+     * keep secure-by-default deployments paired with a `guest_portal`
      * profile (the CRM example does this) to enforce the INSERT-only
      * contract.
      *
@@ -5370,7 +5370,7 @@ export class RestServer {
                     // form — a narrow create grant scoped to exactly this form's target
                     // object. The SecurityPlugin honors `publicFormGrant` (create + the
                     // immediate read-back, that object ONLY), so public forms work under
-                    // secure-by-default (requireAuth) WITHOUT a deployment-configured
+                    // secure-by-default (anonymous-deny) WITHOUT a deployment-configured
                     // `guest_portal`. `guest_portal` + `anonymous` are kept for back-compat
                     // with object hooks (guest detection via falsy `ctx.user?.id`).
                     const context: any = {
@@ -5728,8 +5728,8 @@ export class RestServer {
                 const context = await this.resolveExecCtx(environmentId, req);
                 if (this.enforceAuth(req, res, context)) return;
                 if (!context?.userId) {
-                    // Even on requireAuth=false deployments the explain surface
-                    // stays authenticated-only — it is an admin diagnosis tool.
+                    // The explain surface stays authenticated-only — it is an
+                    // admin diagnosis tool. (Anonymous is already 401ed above.)
                     return res.status(401).json({
                         code: 'UNAUTHORIZED',
                         message: 'The access-explanation endpoint requires an authenticated caller.',
@@ -7125,7 +7125,7 @@ export class RestServer {
                         // (ADR-0049) was enforced on A while B was written. Zod also
                         // strips unknown keys, which keeps a body `context` from
                         // becoming the execution context on a deployment where none
-                        // resolves (anonymous-reachable `requireAuth: false`).
+                        // resolves (e.g. an anonymous public-book read, #3963).
                         const { UpdateManyDataRequestSchema } = await import('@objectstack/spec/api');
                         const updateManyInput = { ...(req.body ?? {}), object: req.params.object };
                         const parsedUpdate = (UpdateManyDataRequestSchema as any).safeParse(updateManyInput);

packages/runtime/src/domains/security.ts

@@ -50,11 +50,10 @@ export async function handleSecurityRequest(
     }
 
     const ec = context.executionContext;
-    // Admin surface — anonymous is denied UNCONDITIONALLY (`requireAuth:
-    // true` hardcoded), independent of the deployment posture: even a
-    // `requireAuth: false` demo must not let anonymous callers list or
-    // confirm audience bindings. Shares the decision + body with every
-    // other HTTP seam (#2567).
+    // Admin surface — anonymous is denied UNCONDITIONALLY (#2567, #3963):
+    // even before the opt-out was retired this seam never honoured it, so an
+    // anonymous caller could never list or confirm audience bindings. Shares
+    // the decision + body with every other HTTP seam.
     if (shouldDenyAnonymous({ userId: ec?.userId, isSystem: ec?.isSystem })) {
         return {
             handled: true,