fix(plugin-security): judge every row of an array insert against the row-level check

A row-level `check` (declared, or defaulted from `using`) guarantees
that no stored row fails it. The write gate installed that judgement
for a single-row insert only: an array payload was excluded, so every
row of an array insert was stored unjudged, including under policies
that refuse every single-row insert.

The gate now installs the same judgement for an array insert. The
engine already hands it every live row after the `beforeInsert` chain,
so each row is judged on the image that will be stored, and one
failing row refuses the whole insert with the existing
PERMISSION_DENIED / 403 refusal. A single-row insert is unchanged.

Claude-Session: https://claude.ai/code/session_01Evb5jFDZGKQE9KG4jbMfMF
Co-authored-by: Claude <noreply@anthropic.com>

Author: claude

packages/plugins/plugin-security/src/rls-check-defaults-to-using.test.ts

@@ -164,7 +164,7 @@ const attempt = async (run: () => Promise<unknown>): Promise<Outcome> => {
   }
 };
 
-/** ⚠️ A SINGLE object, never an array: step 3.6 skips a bulk payload. */
+/** A single-row insert; the array shape is pinned in `rls-check-multi-row-writes.test.ts`. */
 const insert = (engine: ObjectQL, row: Record<string, unknown>) =>
   engine.insert('qa_ticket', { id: 't1', title: 't', ...row } as never, { context: CALLER } as never);
 

packages/plugins/plugin-security/src/rls-check-multi-row-writes.test.ts

@@ -0,0 +1,227 @@
+// Copyright (c) 2026 ObjectStack. Licensed under the Apache-2.0 license.
+
+/**
+ * [ADR-0058 D4] A row-level `check` judges EVERY row a write stores — on an
+ * ARRAY insert as on a single-row one.
+ *
+ * ## The guarantee
+ *
+ * `RowLevelSecurityPolicySchema.check` (declared, or defaulted from `using`) is
+ * the write-side half of a row-level policy: a row the check refuses is never
+ * stored. An ARRAY insert (`insert(object, [rows])`, which `createManyData`
+ * calls) escaped it: step 3.6 of the security middleware excluded an array
+ * payload, so no judgement was installed at all.
+ *
+ * ## What this file pins, on both SQL driver families
+ *
+ * - the repro, failing first: `[admitted, refused]` is refused on the ADR-0112
+ *   envelope (`PERMISSION_DENIED` / 403) and NOTHING is stored;
+ * - the over-fix controls: an array whose every row passes is admitted and
+ *   stored; the single insert answers exactly as before;
+ * - the configurations that refuse EVERY single insert refuse the array insert
+ *   too (an unresolvable sole `using`, an unresolvable declared `check`).
+ *
+ * Ground truth is read under a system context: "the gate refused" and "nothing
+ * was stored" are separate facts, and both are asserted.
+ */
+
+import { describe, it, expect, afterEach, vi } from 'vitest';
+import { ObjectQL } from '@objectstack/objectql';
+import { SqlDriver } from '@objectstack/driver-sql';
+import { SqliteWasmDriver } from '@objectstack/driver-sqlite-wasm';
+import { PermissionSetSchema } from '@objectstack/spec/security';
+import type { PermissionSet } from '@objectstack/spec/security';
+import { SecurityPlugin } from './security-plugin.js';
+import { defaultPermissionSets } from './objects/default-permission-sets.js';
+
+const OBJECTS = [
+  {
+    name: 'qa_ticket',
+    label: 'Ticket',
+    sharingModel: 'public_read_write',
+    fields: {
+      id: { name: 'id', type: 'text', primaryKey: true },
+      title: { name: 'title', type: 'text' },
+      status: { name: 'status', type: 'text' },
+      priority: { name: 'priority', type: 'text' },
+      owner: { name: 'owner', type: 'text' },
+    },
+  },
+];
+
+const ME = 'a@e.example';
+const SOMEONE_ELSE = 'b@e.example';
+
+/** The #19964 repro's predicate. */
+const NOT_ARCHIVED = "record.status != 'archived'";
+/**
+ * A `current_user.*` key no resolver publishes: the compiler cannot resolve it,
+ * drops the policy, and the gate falls back to the deny sentinel — so every
+ * single insert under it is refused.
+ */
+const UNRESOLVABLE = 'record.status in current_user.no_such_membership_key';
+
+type Policy = { name: string; operation: string; using?: string; check?: string };
+
+function permissionSet(policies: Policy[]): PermissionSet {
+  return PermissionSetSchema.parse({
+    name: 'qa_writer',
+    objects: { qa_ticket: { allowRead: true, allowCreate: true, allowEdit: true } },
+    rowLevelSecurity: policies.map((p) => ({ object: 'qa_ticket', ...p })),
+  });
+}
+
+const MEMBER_DEFAULT = defaultPermissionSets.find((p) => p.name === 'member_default')!;
+const SYS_CTX = { isSystem: true, userId: 'usr_system' };
+const CALLER = {
+  userId: 'usr_a',
+  email: ME,
+  positions: ['writer'],
+  permissions: ['qa_writer'],
+  posture: 'MEMBER',
+};
+
+const engines: ObjectQL[] = [];
+afterEach(async () => {
+  while (engines.length) {
+    try { await engines.pop()?.destroy(); } catch { /* noop */ }
+  }
+});
+
+const SEED = [
+  { id: 't1', title: 'one', status: 'open', priority: 'low', owner: ME },
+  { id: 't2', title: 'two', status: 'open', priority: 'high', owner: ME },
+  { id: 't3', title: 'three', status: 'open', priority: 'low', owner: SOMEONE_ELSE },
+];
+
+async function boot(makeDriver: () => unknown, ps: PermissionSet): Promise<ObjectQL> {
+  const engine = new ObjectQL();
+  engine.registerDriver(makeDriver() as never, true);
+  await engine.init();
+  engine.registerApp({
+    id: 'com.objectstack.qa.rls-check-multi-row-writes',
+    name: 'RLS check on multi-row writes',
+    version: '1.0.0',
+    type: 'plugin',
+    scope: 'system',
+    objects: OBJECTS,
+  } as never);
+  await engine.syncSchemas();
+  engines.push(engine);
+  const services: Record<string, unknown> = {
+    manifest: { register: vi.fn() },
+    objectql: engine,
+    metadata: {
+      get: async (_type: string, name: string) => engine.getSchema(name) ?? null,
+      list: async () => [MEMBER_DEFAULT, ps],
+    },
+  };
+  const ctx = {
+    logger: { info: vi.fn(), warn: vi.fn(), error: vi.fn(), debug: vi.fn() },
+    registerService: vi.fn(),
+    getService: (name: string) => {
+      if (!(name in services)) throw new Error(`service not registered: ${name}`);
+      return services[name];
+    },
+  };
+  const plugin = new SecurityPlugin({ fallbackPermissionSet: 'member_default' });
+  await plugin.init(ctx as never);
+  await plugin.start(ctx as never);
+  // The expected refusals log at WARN through the engine's own logger.
+  vi.spyOn((engine as unknown as { logger: { warn: () => void } }).logger, 'warn').mockImplementation(() => undefined);
+  await engine.insert('qa_ticket', SEED.map((r) => ({ ...r })) as never, { context: SYS_CTX } as never);
+  return engine;
+}
+
+const DRIVERS: Array<[string, () => unknown]> = [
+  ['driver-sql (better-sqlite3 :memory:)',
+    () => new SqlDriver({ client: 'better-sqlite3', connection: { filename: ':memory:' }, useNullAsDefault: true } as never)],
+  ['driver-sqlite-wasm (:memory:)', () => new SqliteWasmDriver({ filename: ':memory:' } as never)],
+];
+
+interface Outcome { ok: boolean; code?: string; status?: number; developerMessage?: string }
+
+const attempt = async (run: () => Promise<unknown>): Promise<Outcome> => {
+  try {
+    await run();
+    return { ok: true };
+  } catch (e) {
+    const err = e as { code?: string; statusCode?: number; status?: number; developerMessage?: string };
+    return { ok: false, code: err.code, status: err.statusCode ?? err.status, developerMessage: err.developerMessage };
+  }
+};
+
+/** The 3.6 gate's refusal, on the ADR-0112 envelope — never a bare throw. */
+const expectCheckRefusal = (outcome: Outcome, verb: 'insert' | 'update') => {
+  expect(outcome.ok, `expected a refusal, got a completed ${verb}`).toBe(false);
+  expect(outcome.code, 'ADR-0112 error code').toBe('PERMISSION_DENIED');
+  expect(outcome.status, 'ADR-0112 HTTP status').toBe(403);
+  expect(outcome.developerMessage, 'the developer half names the check gate and the verb')
+    .toContain(`the ${verb} would violate a row-level CHECK`);
+};
+
+/** Every row, id → the columns under test, read past every scope. */
+const stored = async (engine: ObjectQL) => {
+  const rows = (await engine.find('qa_ticket', { context: SYS_CTX } as never)) as Array<Record<string, unknown>>;
+  return Object.fromEntries(
+    rows.map((r) => [r.id, { title: r.title, status: r.status, owner: r.owner }]),
+  ) as Record<string, { title: unknown; status: unknown; owner: unknown }>;
+};
+
+for (const [driverName, makeDriver] of DRIVERS) {
+  describe(`[#19964] an ARRAY insert is judged row by row — ${driverName}`, () => {
+    const insertMany = (engine: ObjectQL, rows: Array<Record<string, unknown>>) =>
+      engine.insert('qa_ticket', rows as never, { context: CALLER } as never);
+    const insertOne = (engine: ObjectQL, row: Record<string, unknown>) =>
+      engine.insert('qa_ticket', row as never, { context: CALLER } as never);
+
+    it('the repro: `[admitted, refused]` is refused on the check envelope, and neither row is stored', async () => {
+      const engine = await boot(makeDriver, permissionSet([{ name: 'not_archived', operation: 'insert', check: NOT_ARCHIVED }]));
+      expectCheckRefusal(
+        await attempt(() => insertMany(engine, [
+          { id: 'n1', title: 'n1', status: 'closed' },
+          { id: 'n2', title: 'n2', status: 'archived' },
+        ])),
+        'insert',
+      );
+      expect(Object.keys(await stored(engine)).sort()).toEqual(['t1', 't2', 't3']);
+    });
+
+    it('⭐ over-fix control: an array whose every row passes is admitted and stored', async () => {
+      const engine = await boot(makeDriver, permissionSet([{ name: 'not_archived', operation: 'all', check: NOT_ARCHIVED }]));
+      expect((await attempt(() => insertMany(engine, [
+        { id: 'n1', title: 'n1', status: 'closed' },
+        { id: 'n2', title: 'n2', status: 'open' },
+      ]))).ok).toBe(true);
+      const after = await stored(engine);
+      expect([after.n1?.status, after.n2?.status]).toEqual(['closed', 'open']);
+    });
+
+    it('⭐ the single insert answers exactly as before', async () => {
+      const engine = await boot(makeDriver, permissionSet([{ name: 'not_archived', operation: 'insert', check: NOT_ARCHIVED }]));
+      expectCheckRefusal(await attempt(() => insertOne(engine, { id: 'n2', title: 'n2', status: 'archived' })), 'insert');
+      expect((await attempt(() => insertOne(engine, { id: 'n1', title: 'n1', status: 'closed' }))).ok).toBe(true);
+      expect(Object.keys(await stored(engine)).sort()).toEqual(['n1', 't1', 't2', 't3']);
+    });
+
+    const REFUSE_EVERY_INSERT: Array<[string, Policy]> = [
+      ['an unresolvable sole `using` on `insert`', { name: 'bad_using', operation: 'insert', using: UNRESOLVABLE }],
+      ['an unresolvable sole `using` on `all`', { name: 'bad_using', operation: 'all', using: UNRESOLVABLE }],
+      ['an unresolvable declared `check`', { name: 'bad_check', operation: 'insert', check: UNRESOLVABLE }],
+    ];
+    for (const [label, policy] of REFUSE_EVERY_INSERT) {
+      it(`${label}: every single insert is refused, and so is the array insert`, async () => {
+        const engine = await boot(makeDriver, permissionSet([policy]));
+        expectCheckRefusal(await attempt(() => insertOne(engine, { id: 'n1', title: 'n1', status: 'open' })), 'insert');
+        expectCheckRefusal(
+          await attempt(() => insertMany(engine, [
+            { id: 'n1', title: 'n1', status: 'open' },
+            { id: 'n2', title: 'n2', status: 'closed' },
+          ])),
+          'insert',
+        );
+        expect(Object.keys(await stored(engine)).sort()).toEqual(['t1', 't2', 't3']);
+      });
+    }
+  });
+}

packages/plugins/plugin-security/src/rls-phantom-column-negation.test.ts

@@ -319,10 +319,9 @@ for (const [driverName, makeDriver] of DRIVERS) {
 
   describe(`[#17042] WRITE face, end to end — ${driverName}`, () => {
     /**
-     * ⚠️ A SINGLE object, never an array. Step 3.6 is guarded by
-     * `!Array.isArray(opCtx.data)`, so a bulk payload skips the check gate
-     * entirely and every cell below would read "permitted" for a reason that
-     * has nothing to do with this card.
+     * A single-row insert, so each cell reads one row's verdict. (An array
+     * insert is judged row by row too; that shape is pinned in
+     * `rls-check-multi-row-writes.test.ts`.)
      */
     const insert = (engine: ObjectQL, isPrivate: boolean) =>
       engine.insert(

packages/plugins/plugin-security/src/security-plugin.test.ts

@@ -30,13 +30,14 @@ import { BUILTIN_OPERATION_MESSAGES } from '@objectstack/spec/system';
  *
  * So the executor honours the seam the way the engine does: the flag first (it
  * answers "did the seam run", never "did the write pass"), then the judgement.
- * These doubles run no hooks, so the row that would be stored IS `opCtx.data`.
+ * These doubles run no hooks, so the rows an insert would store ARE
+ * `opCtx.data` — each element of an array insert ([#19964]).
  */
 const runEngineWriteBody = async (opCtx: any): Promise<void> => {
   const seam = opCtx?.postHookWriteImageCheck;
   if (!seam) return;
   seam.honoured = true;
-  await seam.evaluate([opCtx.data]);
+  await seam.evaluate(Array.isArray(opCtx.data) ? opCtx.data : [opCtx.data]);
 };
 
 // ---------------------------------------------------------------------------

packages/plugins/plugin-security/src/security-plugin.ts

@@ -2993,11 +2993,21 @@ export class SecurityPlugin implements Plugin {
       // checked field must arrive from the caller — is REFUSED, not deferred:
       // it institutionalises the contradiction (the caller sending the value the
       // hook exists to make un-sendable) and needs a permanent lint to keep it.
+      //
+      // ── [#19964] EVERY row an insert stores ───────────────────────────────
+      //
+      // The check is a guarantee about each stored row, so an insert that
+      // stores several rows is judged once per row, and ONE failing row
+      // refuses the whole write. An ARRAY insert used to be excluded by a
+      // non-array guard here, so no judgement was installed and every row was
+      // stored unjudged. The seam already receives every live row of an array
+      // insert, so the guard now admits an array for `insert` (an `update`
+      // still takes one payload).
       if (
         (opCtx.operation === 'insert' || opCtx.operation === 'update') &&
         opCtx.data &&
         typeof opCtx.data === 'object' &&
-        !Array.isArray(opCtx.data) &&
+        (opCtx.operation === 'insert' || !Array.isArray(opCtx.data)) &&
         permissionSets.length > 0 &&
         !!opCtx.context?.userId
       ) {
@@ -3051,8 +3061,10 @@ export class SecurityPlugin implements Plugin {
             checkParts.every((f) => matchesFilterCondition(image as any, f as any));
 
           if (opCtx.operation === 'insert') {
-            // [#16608] Install the judgement; the engine runs it on the row the
-            // `beforeInsert` chain produced. The compiled filter is captured
+            // [#16608] Install the judgement; the engine runs it on the rows the
+            // `beforeInsert` chain produced — [#19964] every row of an array
+            // insert, and the first that fails refuses the whole write. The
+            // compiled filter is captured
             // HERE — while the caller's permission sets, the delegator's, the
             // staged membership and this request's context are all resolved —
             // and only the IMAGE is deferred. Deferring the compilation too