fix(formula): refuse the bare variable root and object comparands under == / !=

A CEL predicate comparing a field to the bare `current_user` root lowered
against the whole caller context object, so a `check` written
`record.owner_id != current_user` admitted every write. The root is now
refused before resolution in both compile modes (the shape check reports it),
and a variable resolving to an object is refused per request.

Claude-Session: https://claude.ai/code/session_01CiCTczDo7tGhafXjf61dUJ
Co-authored-by: Claude <noreply@anthropic.com>

Author: claude

packages/formula/src/cel-to-filter.ts

@@ -42,7 +42,9 @@
  *   `unresolved-variable` (the "no active org" fail-closed path) — and so does a
  *   null/undefined MEMBER of a resolved membership array, which is the same
  *   unresolved value one level in. See {@link lowerMembership} for why the member
- *   is refused rather than dropped.
+ *   is refused rather than dropped. The ROOT alone (`current_user`) is the whole
+ *   context object, never a value: `==` / `!=` refuse it (see
+ *   {@link variableObjectComparandRefusal}).
  */
 
 import type { ASTNode } from '@marcbachmann/cel-js';
@@ -347,15 +349,20 @@ function lowerComparison(op: string, lNode: ASTNode, rNode: ASTNode, ctx: Ctx):
   }
   // [#19886] `==` / `!=` against a comparand that IS a list — a list literal, or
   // a `current_user` variable that resolves to an array — is refused before it
-  // is emitted. See {@link arrayComparandRefusal}.
+  // is emitted. See {@link arrayComparandRefusal}. [#19959] So is the variable
+  // root alone, and a variable that resolves to an object: see
+  // {@link variableObjectComparandRefusal}.
   if (lField) return emit((L as { path: string }).path, op, comparandOf(op, R, ctx), false);
   if (rField) return emit((R as { path: string }).path, FLIP[op] ?? op, comparandOf(op, L, ctx), false);
 
   // Neither side is a field: a constant comparison. Fold the always-true case
   // (`1 == 1`, the RLS allow-all) to "no restriction"; refuse the rest (a
-  // non-true constant must fail closed, never become allow-all).
-  const lv = resolveValue(L, ctx);
-  const rv = resolveValue(R, ctx);
+  // non-true constant must fail closed, never become allow-all). [#19959] A
+  // variable root or object operand is refused first: `current_user != 'guest'`
+  // folded to "no restriction" because an object is never strictly equal to a
+  // literal, which is the same whole-object comparison one branch over.
+  const lv = variableOperandOf(op, L, ctx);
+  const rv = variableOperandOf(op, R, ctx);
   if (ctx.mode === 'shape') return {}; // shape check: structurally fine
   const truth = constFold(op, lv, rv);
   if (truth === true) return {};
@@ -484,12 +491,87 @@ function arrayComparandRefusal(op: string, leaf: Leaf): CompileError {
 }
 
 /**
- * Resolve the non-field side of a comparison, refusing a list under `==` / `!=`
- * ({@link arrayComparandRefusal}). In shape mode a variable resolves to the
- * placeholder, so only a literal list is refused there.
+ * [#19959] `==` / `!=` compare ONE value, and a variable ROOT is not one value.
+ *
+ * `record.owner_id != current_user` names the root alone, and the root is the
+ * whole context object the caller supplies — for the RLS compiler every
+ * kernel-resolved key at once, the membership arrays included. Until this
+ * refusal it lowered to `{ owner_id: { $ne: <that object> } }` (and `==` to the
+ * bare object, with `$not` around it for `!(… == current_user)`). A strict
+ * compare never equals an object, so the RLS `check` evaluator admitted every
+ * write the policy was written to refuse, and explain reported the read as
+ * narrowed while echoing the caller's membership sets in its `readFilter`.
+ *
+ * ADR-0058 D2 declares the operand opposite a field as a literal, a
+ * `current_user.*` scalar or a pre-resolved `current_user.<key>` set, and the
+ * published `$eq` / `$ne` contract (`FieldOperatorsSchema`) as a literal or a
+ * `{ $field }` reference. The root is none of them, so the refusal pulls the
+ * lowering back to the declared operand set; it narrows nothing either names.
+ *
+ * Two guards, one per point at which the fault is knowable:
+ *
+ *  - The ROOT alone is known from the source (a path of one segment), so it is
+ *    refused BEFORE resolution, in both modes: the shape check
+ *    (`isPushdownableCel`, so `isSupportedRlsExpression` and the authoring lint)
+ *    reports it before any request, exactly as it reports a list literal, and
+ *    every compile — bound variables or none — gives the same `unsupported`.
+ *  - A `current_user.<key>` that RESOLVES to an object is knowable only per
+ *    request, like a resolved array, so it is refused after resolution. No
+ *    in-tree producer binds an object-valued key (the RLS context's keys are
+ *    scalars and membership arrays); the guard closes the class for any caller
+ *    of this published compiler. A `Date` is a literal comparand in the
+ *    `$eq` / `$ne` contract and passes.
+ *
+ * Both guards apply wherever `==` / `!=` resolves an operand: opposite a field,
+ * and on either side of a constant comparison, where `current_user != 'guest'`
+ * folded to "no restriction" because an object is never strictly equal to a
+ * literal. `{ $field }` references never reach here (the field-to-field branch
+ * emits them with `isRef`), and a CEL map literal is refused by
+ * {@link classify}, so a resolved variable is the only way an object ever became
+ * a comparand. Ordering operators keep their existing lowering: they are outside
+ * the `==` / `!=` letter this refusal carries. The message names the variable
+ * PATH the author wrote and never a value.
  */
-function comparandOf(op: string, leaf: Leaf, ctx: Ctx): unknown {
+function variableObjectComparandRefusal(op: string, path: string[]): CompileError {
+  const written = path.join('.');
+  const comparand =
+    path.length === 1
+      ? `its comparand \`${written}\` is the variable root itself, the whole context object`
+      : `its comparand \`${written}\` resolves to an object`;
+  return new CompileError(
+    'unsupported',
+    `\`${op}\` compares one value, but ${comparand} — compare one of its keys instead, ` +
+      `e.g. \`record.owner_id ${op} ${path[0]}.id\` rather than \`record.owner_id ${op} ${written}\``,
+  );
+}
+
+/** A resolved value that is an object rather than one comparable value. */
+function isObjectComparand(value: unknown): boolean {
+  return value !== null && typeof value === 'object' && !Array.isArray(value) && !(value instanceof Date);
+}
+
+/**
+ * Resolve a comparison operand, refusing under `==` / `!=` a variable root
+ * before resolution and a variable resolving to an object after it
+ * ({@link variableObjectComparandRefusal}). In shape mode a variable resolves to
+ * the placeholder, so only the root is refused there.
+ */
+function variableOperandOf(op: string, leaf: Leaf, ctx: Ctx): unknown {
+  const equality = op === '==' || op === '!=';
+  if (equality && leaf.kind === 'var' && leaf.path.length === 1) throw variableObjectComparandRefusal(op, leaf.path);
   const value = resolveValue(leaf, ctx);
+  if (equality && leaf.kind === 'var' && isObjectComparand(value)) throw variableObjectComparandRefusal(op, leaf.path);
+  return value;
+}
+
+/**
+ * Resolve the non-field side of a comparison, refusing under `==` / `!=` a list
+ * ({@link arrayComparandRefusal}) and a variable root or object
+ * ({@link variableOperandOf}). In shape mode a variable resolves to the
+ * placeholder, so only a literal list and a bare root are refused there.
+ */
+function comparandOf(op: string, leaf: Leaf, ctx: Ctx): unknown {
+  const value = variableOperandOf(op, leaf, ctx);
   if ((op === '==' || op === '!=') && Array.isArray(value)) throw arrayComparandRefusal(op, leaf);
   return value;
 }