diff --git a/‎.changeset/22800-identity-import-exposure.md‎
Lines changed: 21 additions & 0 deletions b/‎.changeset/22800-identity-import-exposure.md‎
Lines changed: 21 additions & 0 deletions
diff --git a/‎packages/core/src/security/second-object-read-exposure.pin.test.ts‎
Lines changed: 8 additions & 1 deletion b/‎packages/core/src/security/second-object-read-exposure.pin.test.ts‎
Lines changed: 8 additions & 1 deletion
diff --git a/‎packages/core/src/utils/import-runner.ts‎
Lines changed: 3 additions & 3 deletions b/‎packages/core/src/utils/import-runner.ts‎
Lines changed: 3 additions & 3 deletions
diff --git a/‎packages/plugins/plugin-auth/src/admin-import-users.test.ts‎
Lines changed: 114 additions & 0 deletions b/‎packages/plugins/plugin-auth/src/admin-import-users.test.ts‎
Lines changed: 114 additions & 0 deletions
diff --git a/‎packages/plugins/plugin-auth/src/admin-import-users.ts‎
Lines changed: 25 additions & 2 deletions b/‎packages/plugins/plugin-auth/src/admin-import-users.ts‎
Lines changed: 25 additions & 2 deletions
@@ -0,0 +1,21 @@
+---
+'@objectstack/plugin-auth': minor
+---
+
+fix(plugin-auth)!: the identity import asks each lookup target its declared exposure before matching a cell, like every other `runImport` caller (#22800)
+
+Clause-②: no (narrowing)
+
+<!-- adr-0087: not-required (no-migration-prescription) No metadata moves: no spec key, authorable spelling, export or stored shape is removed, renamed or re-shaped, so there is nothing for `objectstack migrate meta` to rewrite. What narrows is one runtime read: the identity import stops matching cells against a lookup target whose existing `enable` declaration already refuses `list` on every data route (the remedy is the declaration the author already wrote). The other categories are closed on facts: the package publishes (not unpublished); no ADR-0087 id is named or touched (not registered or already-registered); and no exported declaration is removed or narrowed (not runtime-interface-only or type-surface-only); `IdentityImportDeps` keeps its shape and only its doc comment changes. -->
+
+**BREAKING** (an accept-set narrowing), shipped as `minor` under the launch-window convention for breaking changes.
+
+The identity import (`runAdminImportUsers`) parses its payload with `prepareImportRequest` and runs its rows through `runImport`, with a run protocol of its own that writes through better-auth. Its `sys_user` field map, which decides which cells are references, is read through the import's declaration reader (`IdentityImportDeps.getMetaItem`).
+
+**FROM.** The run protocol was built without that reader, so `runImport`'s `servesReferenceTarget` answered "served" without asking: a lookup cell was matched against its TARGET object even when the target's declaration refuses `list` (`enable.apiEnabled: false`, or an `apiMethods` whitelist without `list`). A cell naming an existing record resolved and a cell naming none answered `reference_not_found`, so the row report told the two apart.
+
+**TO.** The run protocol carries the same reader the parser is handed (one binding, so whenever a cell is a reference its target is judged). A target the spec's decision (`canServeApiOperation`, for `list`) does not serve answers every cell, naming a record or not, a pasted id included, `reference_not_found`, and nothing of the target is read. A target with no `enable` block, or a whitelist that grants `list`, resolves exactly as before. The decision takes no caller, so the system identity the import's reads run under is answered like any other caller. No new error code, no status change.
+
+**Measured producers.** `sys_user` declares two lookups: `manager_id` into `sys_user` (the import strips that column before `runImport`; its own second pass links managers) and `primary_business_unit_id` into `sys_business_unit`. Both targets serve `list`, and the registry injects no columns into `sys_user` (`managedBy: 'better-auth'`), so no shipped import answer changes. Deployed object extensions of `sys_user` were NOT MEASURED.
+
+**Fix, if an import relied on the old answer:** the target's own declaration decides. Grant `list` in its `enable.apiMethods`, or drop `enable.apiEnabled: false`, if the object is meant to be matched by import.
@@ -48,7 +48,14 @@
  * targets are resolved inside `relationConditionSites` (`@objectstack/core`),
  * which is the caller classified below. The bridge asks each target the
  * decision for `list` (`enforceRelationTargetExposure`, #22777), held by its
- * own package's pin rather than by a row here.
+ * own package's pin rather than by a row here. Nor, for the same reason, a
+ * door that drives `runImport` with a protocol of its own: plugin-auth's
+ * identity import takes its cells' targets from the `import-field-meta.ts` map
+ * classified below, and its run protocol carries the declaration reader the
+ * import already holds, so `servesReferenceTarget` asks each target the
+ * decision for `list` there too (#22800), held by its own package's pin
+ * (`plugin-auth/src/admin-import-users.test.ts`, its `[#22800]` block) rather
+ * than by a row here.
  *
  * The scan surface and its prefilter follow `row-serving-door-exposure.pin.test.ts`
  * in this directory: git's authored-file list, never a directory crawl, and `.ts`
 
@@ -211,9 +211,9 @@ export interface ImportProtocolLike {
    * [#22739] The object-declaration read, the one the door's import template
    * and the connector pull already make. The reference resolution reads a
    * lookup TARGET's `enable` block through it ({@link servesReferenceTarget}).
-   * A protocol without it (plugin-auth's identity import, whose reads run
-   * under the system identity) has no declaration to judge, and none is
-   * fabricated for it.
+   * A protocol without it has no declaration to judge, and none is fabricated
+   * for it; plugin-auth's identity import, whose reads run under the system
+   * identity, carries it like every other caller (#22800).
    */
   getMetaItem?(request: GetMetaItemRequest): Promise<unknown>;
 }
 
@@ -660,3 +660,117 @@ describe('[#17422] the import protocol literal is typed BY `ImportProtocolLike`'
     });
   }
 });
+
+/**
+ * [#22800] The identity import's lookup cells are judged like every other
+ * `runImport` caller's: the run protocol carries the declaration reader the
+ * import already holds (the one the parser reads `sys_user`'s fields through),
+ * so `servesReferenceTarget` (`@objectstack/core`, #22739) asks each lookup
+ * TARGET its declared exposure for `list` before a cell is matched against it.
+ *
+ * A target whose declaration refuses `list` answers as a target the caller
+ * cannot read: `reference_not_found` for a cell naming a record, a cell naming
+ * none and a pasted id alike, and nothing of the target is read. A serving
+ * target is unchanged. The import's reads run under the system identity, which
+ * is no exemption: the decision takes no caller.
+ *
+ * Fixture objects only. The decision's own matrix (every refusing and serving
+ * declaration, fail-closed) is pinned once, in
+ * `packages/core/src/utils/import-runner-reference-exposure.test.ts`; this
+ * block pins that THIS door asks it. The engine is `makeDeps`' pinned double,
+ * with only its `find` overridden to answer the fixture target.
+ */
+describe('[#22800] the identity import asks each lookup target its declared exposure, for list', () => {
+  const TARGET = 'fx_unit';
+  const RECORD = { id: 'fx_1', name: 'Existing' };
+  const LOOKUP = 'fx_unit_id';
+  /** The `sys_user` declaration the reader serves: two plain columns and one lookup into the fixture target. */
+  const SYS_USER = {
+    name: 'sys_user',
+    fields: {
+      email: { type: 'text', label: 'Email' },
+      name: { type: 'text', label: 'Name' },
+      [LOOKUP]: { type: 'lookup', label: 'Unit', reference: TARGET },
+    },
+  };
+  /** A cell naming the record, a cell naming none, and the record's id. */
+  const ROWS = [
+    { email: 'a@fx.test', [LOOKUP]: 'Existing' },
+    { email: 'b@fx.test', [LOOKUP]: 'Missing' },
+    { email: 'c@fx.test', [LOOKUP]: 'fx_1' },
+  ];
+
+  /** The target's declaration is `enable` (absent = no `enable` block); `reader: false` composes no declaration reader at all. */
+  function exposureDeps(enable: unknown, opts: { reader?: boolean } = {}) {
+    const m = makeDeps();
+    const engine = m.deps.getDataEngine()!;
+    const find = vi.fn(async (object: string, q: { where?: Record<string, unknown> }) => {
+      if (object !== TARGET) return engine.find(object, q);
+      const [[field, value]] = Object.entries(q.where ?? {});
+      return (RECORD as Record<string, unknown>)[field] === value ? [RECORD] : [];
+    });
+    const getMetaItem = vi.fn(async ({ name }: { type: string; name: string }) => {
+      if (name === 'sys_user') return { type: 'object', name, item: SYS_USER };
+      if (name === TARGET) return { type: 'object', name, item: { name, ...(enable === undefined ? {} : { enable }) } };
+      return { type: 'object', name, item: undefined };
+    });
+    const deps: IdentityImportDeps = {
+      ...m.deps,
+      getDataEngine: () => ({ ...engine, find }),
+      ...(opts.reader === false ? {} : { getMetaItem }),
+    };
+    return { ...m, deps, find, getMetaItem };
+  }
+
+  type RowVerdict = { ok: boolean; code?: string; field?: string };
+  const verdict = (r: RowVerdict) => ({ ok: r.ok, code: r.code, field: r.field });
+  const NOT_FOUND = { ok: false, code: 'reference_not_found', field: LOOKUP };
+  const OK = { ok: true, code: undefined, field: undefined };
+  const targetReads = (h: ReturnType<typeof exposureDeps>) => h.find.mock.calls.filter(([object]) => object === TARGET);
+
+  async function rowVerdicts(h: ReturnType<typeof exposureDeps>) {
+    const res = await runAdminImportUsers(h.deps, makeRequest({ passwordPolicy: 'none', format: 'json', rows: ROWS }), ACTOR);
+    expect(res.status).toBe(200);
+    return (res.body.data as { rows: RowVerdict[] }).rows.map(verdict);
+  }
+
+  for (const [label, enable] of [
+    ['apiEnabled: false', { apiEnabled: false }],
+    ['a whitelist granting get but not list', { apiMethods: ['get'] }],
+  ] as const) {
+    it(`${label}: a match, a miss and an id all answer reference_not_found, and the target is never read`, async () => {
+      const h = exposureDeps(enable);
+      expect(await rowVerdicts(h)).toEqual([NOT_FOUND, NOT_FOUND, NOT_FOUND]);
+      expect(targetReads(h)).toEqual([]);
+      expect(h.createUser).not.toHaveBeenCalled();
+    });
+  }
+
+  for (const [label, enable] of [
+    ['no enable block', undefined],
+    ['a whitelist granting list', { apiMethods: ['list'] }],
+  ] as const) {
+    it(`CONTROL ${label}: a match and an id resolve, a miss is reported, as before`, async () => {
+      const h = exposureDeps(enable);
+      expect(await rowVerdicts(h)).toEqual([OK, NOT_FOUND, OK]);
+      expect(targetReads(h).length).toBeGreaterThan(0);
+      expect(h.createUser).toHaveBeenCalledTimes(2);
+    });
+  }
+
+  it('the target is asked through the reader the import holds, once per import, by its own name', async () => {
+    const h = exposureDeps({ apiEnabled: false });
+    await rowVerdicts(h);
+    expect(h.getMetaItem.mock.calls.map(([ref]) => ref)).toEqual([
+      { type: 'object', name: 'sys_user' },
+      { type: 'object', name: TARGET },
+    ]);
+  });
+
+  it('CONTROL without a declaration reader no cell is a reference: the target is neither asked nor read', async () => {
+    const h = exposureDeps({ apiEnabled: false }, { reader: false });
+    expect(await rowVerdicts(h)).toEqual([OK, OK, OK]);
+    expect(h.getMetaItem).not.toHaveBeenCalled();
+    expect(targetReads(h)).toEqual([]);
+  });
+});
@@ -159,7 +159,12 @@ export interface IdentityImportDeps {
   /** better-auth server api (createUser + requestPasswordReset). */
   getAuthApi(): Promise<any>;
   getDataEngine(): IdentityImportEngine | undefined;
-  /** Optional metadata reader for field coercion (best-effort). */
+  /**
+   * Optional object-declaration reader. It feeds field coercion (best-effort:
+   * without it no cell is coerced and none is a reference), and [#22800] it is
+   * the run protocol's `getMetaItem`, so each lookup target is asked its
+   * declared exposure before a cell is matched against it.
+   */
   getMetaItem?(ref: { type: string; name: string }): Promise<any>;
   phoneNumberEnabled(): boolean;
   emailServiceAvailable(): boolean;
@@ -441,6 +446,17 @@ export async function runAdminImportUsers(
   const engine = deps.getDataEngine();
   if (!engine) return fail(503, 'SERVICE_UNAVAILABLE', 'Data engine unavailable');
 
+  // [#22800] The ONE object-declaration reader this import holds, handed to
+  // both halves that read declarations: the parser, which reads `sys_user`'s
+  // fields (so lookup cells become references at all), and the run protocol
+  // below, through which `runImport`'s reference resolution asks each lookup
+  // TARGET its declared exposure (`servesReferenceTarget`, #22739). One
+  // binding, so the two can never disagree: whenever a cell is a reference,
+  // its target is judged. "Reads run under the system identity" is no
+  // exemption from that decision, which takes no caller.
+  const metaReader: Pick<ImportProtocolLike, 'getMetaItem'> =
+    deps.getMetaItem ? { getMetaItem: deps.getMetaItem } : {};
+
   // ── Payload parsing (shared generic-import parser) ───────────────────
   const prep = await prepareImportRequest(
     {
@@ -453,7 +469,7 @@ export async function runAdminImportUsers(
       skipBlankMatchKey: true,
     },
     {
-      p: { ...(deps.getMetaItem ? { getMetaItem: deps.getMetaItem } : {}) },
+      p: metaReader,
       objectName: 'sys_user',
       maxRows: IMPORT_USERS_MAX_ROWS,
     },
@@ -507,6 +523,13 @@ export async function runAdminImportUsers(
   }
 
   const protocol: ImportProtocolLike = {
+    // [#22800] The declaration reader the parser was handed above. With it,
+    // a lookup cell's target is asked its exposure for `list` before any
+    // `findData` matches the cell; a target that refuses answers as one the
+    // caller cannot read (`reference_not_found`), as for every other
+    // `runImport` caller.
+    ...metaReader,
+
     // [#16638] findExisting path: the CANONICAL QueryAST against sys_user.
     // `runImport` hands this handle a `FindDataRequest`, and the `QuerySchema`
     // that request declares carries `where` / `limit` — it declares neither