Merge remote-tracking branch 'origin/main' into claude/issue-20176-aggregation-temporal-storage-rule

Author: claude

.changeset/17321-record-filter-d2-conversion.md

@@ -0,0 +1,52 @@
+---
+"@objectstack/spec": minor
+---
+
+feat(spec): a stored record-form `filter` at the converged rule-array doors is converted to the rule array wherever the mapping is lossless — the ADR-0087 D2 conversion `page-component-filter-record-to-rule-array` (#17321, ruling B)
+
+The one-filter-orthography convergence moved every page-component `filter` door onto the
+`ViewFilterRule` array and refused the MongoDB-style record it used to take — but converted
+nothing at rest. A page saved with the old form kept rendering, and the next person to open it
+in the builder and press Save was refused. This release adds the mechanical half.
+
+**What converts** — at `dataSource.filter` on any page component, at `properties.filter` on the
+`object-grid`, `object-metric`, `object-kanban`, `object-calendar`, `object-map`, `object-gantt`,
+`object-tree`, `object-timeline`, `element:number` and `element:record_picker` blocks, and at
+`properties.defaultFilters` on `object-grid`:
+
+| Stored | Becomes |
+| --- | --- |
+| `{ status: 'active' }` | `[{ field: 'status', operator: 'equals', value: 'active' }]` |
+| `{ amount: { $gt: 100 } }` | `[{ field: 'amount', operator: 'greater_than', value: 100 }]` |
+| `{ amount: { $gte: 1, $lte: 9 }, owner_id: 'u1' }` | three rules — they AND |
+| `[['owner_id', '=', '{current_user_id}']]` | `[{ field: 'owner_id', operator: 'equals', value: '{current_user_id}' }]` |
+| `{}` | `[]` |
+
+Values are carried verbatim, value placeholders and date macros included. The operator comes
+from the two tables the doors already use — a declared FilterCondition operator (`$gt`, `$nin`,
+`$notContains`, …) folded through `normalizeFilterOperator`, and an AST infix spelling (`=`,
+`!=`, `>=`, …) lowered through `parseFilterAST` — and every produced rule must parse at the
+door, so a converted page re-saves cleanly.
+
+**Where it runs.** On every stored-row read (`applyConversionsToStoredItem` replays it), so
+the metadata API already serves such a page in the rule-array form; `os migrate meta --stored --apply`
+persists it; `os migrate meta --from 17` lists the edits for author sources. It is retired from
+the authoring load path, so `defineStack` / `os validate` still refuse an author who writes the
+record form and teach the rule array — no accept-set change.
+
+**What is left exactly as stored.** A filter carrying `$and` / `$or` / `$not` is never
+flattened: the rule array only ANDs, and flattening `$or` or `$not` changes which rows the page
+selects. So is any filter with a part that has no lossless rule spelling — a `null` value (the
+renderer skips that key today, where a rule would test IS NULL), `$null` / `$exists`, an AST
+`like` / `ilike`, an array or object comparand in equality position, an AST `and` / `or` group.
+Conversion is all-or-nothing per filter: converting the mappable keys and dropping the rest
+would widen the filter. And every filter — the binding's included — of a component whose rows
+are **inline** (`data: { provider: 'value', … }`, a `data` array, or `staticData`) is left as
+stored: the `object-map`, `object-tree`, `object-calendar` and `object-gantt` renderers match
+that filter against their own rows in an in-memory data source that reads the record form but
+excludes every row for a rule array, so a rewrite there would empty the block. The same filter
+on a block that queries an object converts. Such a page keeps loading and rendering unchanged and is refused at its
+`filter` door on its next save — and for a combinator record that refusal no longer renders the
+combinator as a field (`{ field: '$or', … }`); it names the combinator and says why no rule
+spells it. `os migrate meta --stored` does not list these rows yet: a row the conversion leaves
+as stored reports there as already on protocol.

.changeset/19949-mongodb-field-reference-refused.md

@@ -0,0 +1,36 @@
+---
+"@objectstack/driver-mongodb": minor
+---
+
+fix(driver-mongodb)!: `translateFilter` refuses a `{ $field }` cross-field reference instead of sending it to MongoDB as a literal value (#19949)
+
+Clause-②: no (narrowing)
+
+**BREAKING**: an accept-set narrowing, shipped as `minor` under the repo's launch-window convention for accept-set narrowings. **A filter that answered before is now refused**: any filter carrying a `{ $field }` reference gets `INVALID_FILTER` / 400 from `translateFilter`, and so from every driver door that reads a `where` (`find`, `findOne`, `count`, `updateMany`, `deleteMany`, `aggregate`, `explain`).
+
+**Security fix for RLS reads on MongoDB.** `compileCelToFilter` lowers a field-to-field comparison such as `record.s != record.t` to `{ s: { $ne: { $field: 't' } } }`. This driver has no lowering for a column-to-column comparison, and `translateFilter` sent the reference to the server as a literal sub-document. The RLS `using` clause is composed into the read after the engine's comparand checks, so nothing stopped it on the way. Measured over the rows `{ s: 'a', t: 'a' }` and `{ s: 'a', t: 'b' }`, with mingo 7.2.4 as the proxy for MongoDB's query semantics:
+
+- `$ne` against the reference selected both rows, including the one where `s` equals `t`, and `$eq` selected none;
+- `$nin: [ref]`, `$notContains: ref`, `$ne` against a reference carrying `addDays`, and `$eq` under `$not` also selected both rows;
+- through `ObjectQL`, `SecurityPlugin` with a `rowLevelSecurity` policy `using: 's != t'`, and `MongoDBDriver` over a mingo-backed collection, `find` returned both rows, `count` returned `2`, and `findOne` returned the `s == t` row. The policy's read restriction was lost.
+
+A live `mongod` was not measured, because this fleet cannot fetch the binary.
+
+**What changes.** The driver's filter walk refuses a `{ $field }` reference in every comparand position, at any depth under `$and` / `$or` / `$not`:
+
+- the whole comparand of any operator: the orderings, `$eq` / `$ne`, the string operators, `$null`, `$exists`;
+- a member of a list: `$in` / `$nin` members, either `$between` endpoint, an array given to `$ne` or `$eq`;
+- the implicit-equality position: the bare `{ field: { $field: … } }` form, or a list holding a reference;
+- a reference carrying `addDays`, and a malformed reference whose `$field` is not a string.
+
+The refusal uses the same envelope as the driver's other filter refusals. Its message names the unsupported feature (field-to-field comparison) and withholds the fields, the operator and the position, because the filter may be an access policy the caller did not write. Through the engine, an RLS read carrying such a policy is now refused with that 400, and the server is never asked. Before, it returned the unfiltered rows. A policy written `s == t`, which used to return no rows, is refused the same way.
+
+**What does not change.**
+
+- Every literal comparand translates to the same document as before, including literal `$in` / `$nin` / `$between` lists and `$not` around a literal.
+- `$ne` with an array of literal values keeps its own refusal. An array with no reference in the equality slot still passes through `translateFilter`: the shared comparand-shape face owns that slot.
+- Field-to-field comparison is not implemented on this driver. It is refused, not lowered to a MongoDB `$expr`. `driver-sql` and the in-memory evaluator are not touched.
+
+**What an affected author does.** On a MongoDB datasource, a row-level policy or filter can compare a field only against a literal value or a `current_user` value, not against another field of the same record. A policy that needs a field-to-field comparison cannot be enforced by this driver. Before this change it returned every row.
+
+<!-- adr-0087: not-required (no-migration-prescription) An accept-set narrowing at one driver's filter-compile door: no key, Zod schema, object definition or stored representation is added, removed or renamed, and FieldReferenceSchema is unchanged. What moves is which filters driver-mongodb answers. No stored policy can be converted to keep its meaning, because this driver has no field-to-field comparison to convert it to, so `objectstack migrate meta` has nothing to visit and there is no tombstone to mint. -->

.changeset/19959-cel-variable-root-comparand-refused.md

@@ -0,0 +1,25 @@
+---
+"@objectstack/formula": minor
+"@objectstack/plugin-security": minor
+"@objectstack/plugin-sharing": minor
+"@objectstack/lint": minor
+"@objectstack/spec": patch
+---
+
+A row-level or sharing-rule predicate comparing with `!=` / `==` against the bare `current_user` root is refused at the CEL lowering instead of lowering against the whole caller context object (#19959).
+
+**BREAKING** — an accept-set narrowing, shipped by `@objectstack/formula`, `@objectstack/plugin-security`, `@objectstack/plugin-sharing` and `@objectstack/lint` as `minor` under the repo's launch-window convention for accept-set narrowings. The hand-migration prescription is registered under protocol major 18 as `cel-predicate-variable-root-comparand-refused`.
+
+Clause-②: no (narrowing)
+
+**Security fix for RLS write checks.** A policy written `record.owner_id != current_user` (or `== current_user`, or `!(record.owner_id == current_user)`) named the variable root alone, which resolved to the whole caller context, and lowered to `{ owner_id: { $ne: <that object> } }` (or the bare object, or `$not` around it). A strict compare never equals an object, so a `check` so written admitted and stored every insert and by-id update it was written to refuse, a USING-only such policy admitted every insert, and explain reported the read as narrowed with the caller's membership sets echoed in its `readFilter`. A constant comparison such as `current_user != 'guest'` folded to no restriction.
+
+- `@objectstack/formula`: `compileCelToFilter` refuses `==` / `!=` whose operand is the bare variable root (`unsupported`), in both of its modes, so the authoring shape check (`isPushdownableCel`, `isSupportedRlsExpression`) reports it before any request. A variable that resolves to an object is refused per request; a `Date` still passes.
+- `@objectstack/plugin-security`: the RLS compiler drops such a policy and fails closed when no other policy applies (`RLS_DENY_FILTER`: reads return no rows, `check` writes are refused 403, explain answers `denies`).
+- `@objectstack/plugin-sharing`: a declared sharing rule with such a `condition` is still skipped at bootstrap, now with reason `unsupported` instead of `unresolved-variable`.
+- `@objectstack/lint`: the shape is reported as `rls-predicate-unenforceable` on either RLS clause, where it was silent, and as `sharing-rule-unlowerable-condition` on a sharing condition, where it was `sharing-rule-runtime-variable-condition`.
+- `@objectstack/spec`: the migration registry carries the entry.
+
+**What to change.** Compare against the key the predicate means: `record.owner_id != current_user` becomes `record.owner_id != current_user.id` (or `current_user.organization_id`, `current_user.email`); a membership test is `record.owner_id in current_user.org_user_ids`. Scalar keys, `in`, `null`, literals and field-to-field comparisons are unchanged.
+
+<!-- adr-0087: registered cel-predicate-variable-root-comparand-refused -->

.changeset/20050-view-page-size-default-50.md

@@ -0,0 +1,38 @@
+---
+'@objectstack/spec': minor
+---
+
+feat(spec): a view that declares no page size now shows 50 per page — `PaginationConfigSchema.pageSize` defaults to 50 (was 25)
+
+The platform display page size is 50 (maintainer ruling on objectui#9853,
+「9853 默认页大小改为50」). It is declared in one place, the view contract's
+`PaginationConfigSchema.pageSize`, and the renderer reads that spec default
+rather than keeping a number of its own — so the change lands in the protocol
+first.
+
+**What changes for an author who omits the page size:**
+
+- A view whose `pagination` block does not set `pageSize` now parses to
+  `pageSize: 50` where it parsed to `25`: 50 rows per page on a paged view, and
+  a fetch ceiling of 50 on a view with no pager (kanban, gallery, timeline).
+- A view with no `pagination` block at all parses with none, before and after;
+  its page size comes from the renderer, which takes this spec default (the
+  Console does so once objectui#9853 lands).
+
+**What does not change:** the accept set. `pageSize` is still a positive
+integer; `0`, negatives and fractions are refused exactly as before, and every
+page size an author wrote parses to the number they wrote.
+
+### Migration: FROM → TO
+
+| FROM | TO |
+| :--- | :--- |
+| a view that declares no page size and relied on 25 rows per page | write it: `pagination: { pageSize: 25 }` |
+| a view that declares no page size and should follow the platform default | change nothing — it now shows 50 |
+| reading `PaginationConfigParsed.pageSize` after parsing a `pagination` block without `pageSize` | it yields `50` where it yielded `25`; the type is unchanged |
+| reading the published JSON Schema's `default` for `ui/PaginationConfig` `pageSize` | it is `50` |
+
+The move is declared in `DEFAULT_CHANGES_BY_MAJOR`
+(`packages/spec/scripts/lib/default-changes.ts`, `ui/PaginationConfig:pageSize`
+25 → 50) and carried on the upgrade path as the semantic entry
+`view-pagination-page-size-default-50`.

.changeset/20078-field-predicate-reference-traversal-refused.md

@@ -0,0 +1,43 @@
+---
+'@objectstack/lint': minor
+'@objectstack/spec': minor
+---
+
+fix(lint)!: a field-level predicate that reads through a reference field is refused at `objectstack validate` (#20078)
+
+<!-- adr-0087: registered field-predicate-reference-traversal-refused -->
+
+**BREAKING** in the accept-set sense — a stack that validates today can fail tomorrow. Landing in
+the launch window as `minor` (`major` is refused by `check-changeset-no-major`); breaking-ness is
+carried by this banner, the `!` above and the ADR-0087 registration.
+
+Clause-②: no
+
+A field `requiredWhen` / `readonlyWhen`, or a select option's `visibleWhen`, that reads THROUGH a
+`lookup` / `master_detail` / `user` / `tree` field — `record.account.tier` — passed `objectstack
+validate`, `build` and `lint`. It cannot work: the field level is never hydrated, so the reference
+holds the related record's bare id and every read through it faults. At run time a traversing
+`requiredWhen` refuses every write that reaches it, a traversing `readonlyWhen` refuses every
+update that writes its field (ADR-0137 D2), and a traversing option predicate is never enforced
+(option visibility is fail-open). The authoring pass now refuses all three as
+`expression-invalid`, naming the slot, the reference path and the related column, before deploy.
+
+What to write instead — the refusal says the same:
+
+- **A `record.<reference>.<column>` read** — express the check as a `validations[]` rule of
+  `type: 'script'`. Its `condition` is the one predicate the server reads one hop through a
+  reference, and it states the FAILURE: for `requiredWhen: P` on `po_number`,
+  `P && (record.po_number == null || record.po_number == '')`; for `readonlyWhen: P` on
+  `discount`, `P && record.discount != previous.discount` with `events: ['update']`; for an
+  option gated by `P`, that option picked while `P` does not hold (the option is then offered to
+  everyone and refused on save). Or read a column the object itself declares.
+- **A `previous.<reference>.<column>` or `parent.<reference>.<column>` read** — no seam hydrates
+  either root, a validation rule included, so read a column the bound record declares.
+
+Unchanged: the same traversal inside a `validations[]` `script` rule is accepted, as is reading
+the reference itself (`record.account == 'acc_1'`, `record.account != null`), an object-valued
+field that is not a reference (`record.ship_to.city`), and an option gated on `current_user`
+(including `current_user.can(…)`). The runtime is untouched, and an object already stored in
+`sys_metadata` is not re-validated by this. `@objectstack/spec` states the rule on the three
+slots' `.describe()` text and registers the ADR-0087 semantic entry
+`field-predicate-reference-traversal-refused`.

.changeset/20126-currency-mode-describe.md

@@ -0,0 +1,16 @@
+---
+'@objectstack/spec': patch
+---
+
+docs(spec): the `currencyConfig.currencyMode` description says what the runtime does with each mode, and no longer calls `dynamic` "user selectable" (#20126)
+
+Clause-②: no
+
+The old text read "dynamic (user selectable) or fixed (single currency)". No key, stored value or runtime path lets anyone pick a currency per record. The value is a bare number in both modes (ADR-0104 D1), and the currency code lives in field config. What the runtime does, and what the description now says:
+
+- **`fixed`**: the field has one currency, `defaultCurrency`.
+- **`dynamic`** (the default): the field has no currency of its own. Amounts display in the tenant default currency, which is the `localization.currency` setting. When that setting is not set, amounts display as a plain number. `defaultCurrency` is not read.
+
+The field faces follow this rule, and so do analytics dataset measure columns and the publish-time precision check.
+
+Only the description text changes. The accepted keys and values, the defaults (`dynamic`, `CNY`) and parse output are the same as before. The generated reference page `content/docs/references/data/field.mdx` is regenerated from the new text.

content/docs/api/data-api.mdx

@@ -464,8 +464,16 @@ The **cube's metric/dimension definition** (`MetricSchema.label` / `MetricSchema
 ([#6442](https://github.com/objectstack-ai/objectstack/issues/6442)). So a client that
 renders table headers or formats amounts takes `label` / `format` / `currency` /
 `percentScale` off the query result's `fields[]`: those are resolved server-side (the
-ADR-0053 currency chain, the percent-scale chain), and `format` is not reachable through
+currency chain below, the percent-scale chain), and `format` is not reachable through
 the metadata endpoint at all.
+
+The currency chain runs on the dataset query (`POST /analytics/dataset/query`). A
+monetary measure column takes the measure's own `currency`; then, only when the source
+field is `currencyMode: 'fixed'`, that field's `currencyConfig.defaultCurrency`; then the
+tenant default currency (the `localization.currency` setting), if one is set. A
+`dynamic` field (the default mode) never lends its `defaultCurrency` — only `fixed` does —
+so its column shows the tenant default. The cube query on this page carries no column
+`currency`.
 </Callout>
 
 ### `GET /analytics/meta`

content/docs/data-modeling/validation-rules.mdx

@@ -152,10 +152,10 @@ These properties apply to **all** field types and are validated by the base `Fie
 | `min` | `number` | — | Minimum monetary value |
 | `max` | `number` | — | Maximum monetary value |
 | `currencyConfig.precision` | `number` | `2` | Decimal places (0–10) |
-| `currencyConfig.currencyMode` | `enum` | `dynamic` | `dynamic` (user-selectable) or `fixed` (single currency) |
-| `currencyConfig.defaultCurrency` | `string` | `CNY` | 3-character currency code (ISO 4217 or crypto) |
+| `currencyConfig.currencyMode` | `enum` | `dynamic` | `fixed` pins the field to `defaultCurrency`, and an authored `precision` must agree with that currency's ISO 4217 fraction digits; `dynamic` displays the tenant default currency (the `localization.currency` setting). Not a per-record choice |
+| `currencyConfig.defaultCurrency` | `string` | `CNY` | 3-character currency code (ISO 4217 or crypto): the field's currency under `fixed`; not the displayed currency under `dynamic` |
 
-**Default constraints:** Stored as a **bare number** (a finite numeric scalar — `valueSchemaFor` routes `currency` to `z.number().finite()`); there is no `{ value, currency }` envelope on the value path. The per-record currency **code** is a separate concern, carried by `currencyConfig` above. Precision defaults to 2 decimal places.
+**Default constraints:** Stored as a **bare number** (a finite numeric scalar — `valueSchemaFor` routes `currency` to `z.number().finite()`); there is no `{ value, currency }` envelope on the value path. The currency **code** is never stored per record: it is field configuration, carried by `currencyConfig` above. Precision defaults to 2 decimal places.
 
 ### `percent`