fix(plugin-security): mask read-protected fields on write responses (FLS leak) (#2692)

Field-level security masking ran only on find/findOne results, so a caller with
edit-but-not-field-read could PATCH/POST a record and read a read-protected
field back out of the mutation response image. Field writes were already denied
(detectForbiddenWrites); this closes the read leak on the echoed post-image by
extending the mask to insert/update results.

Found by dogfooding the permission stack end-to-end (Studio package + permission
sets + real users): an employee permission set with hr_note readable:false could
still read hr_note via the PATCH response. Added regression tests for both
update and insert echoed records.

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

Author: os-zhuang

.changeset/fls-mask-write-response.md

@@ -0,0 +1,10 @@
+---
+"@objectstack/plugin-security": patch
+---
+
+Fix field-level-security read leak on mutation responses. The security
+middleware only masked read-protected fields on `find`/`findOne` results, so a
+caller with edit-but-not-field-read could `insert`/`update` a record and read a
+read-protected field back out of the echoed post-image (field WRITES were
+already blocked, but the response image was not masked). The mask now also
+covers `insert`/`update` results, matching read behavior.

packages/plugins/plugin-security/src/security-plugin.test.ts

@@ -796,6 +796,52 @@ describe('SecurityPlugin', () => {
     });
   });
 
+  it('FLS write — the record echoed back by an update is masked (no read-leak of hidden fields)', async () => {
+    // Regression: a caller with edit-but-not-field-read must not be able to
+    // read a read-protected field back out of the mutation response. The write
+    // itself only touches an editable field; the engine echoes the full row.
+    const plugin = new SecurityPlugin({ fallbackPermissionSet: 'member_default' });
+    const harness = makeMiddlewareCtx({
+      permissionSets: [flsPolicySet],
+      objectFields: ['id', 'owner_id', 'name', 'salary', 'ssn'],
+    });
+    await plugin.init(harness.ctx);
+    await plugin.start(harness.ctx);
+    const opCtx: any = {
+      object: 'task',
+      operation: 'update',
+      data: { name: 'edited' }, // only editable field written → passes write gate
+      // Engine's echoed post-image (pre-set; harness `next` is a no-op).
+      result: { id: 't1', name: 'edited', salary: 9999, ssn: 'secret-leak' },
+      context: { userId: 'u1', tenantId: 'org-1', roles: [], permissions: ['member_default'] },
+    };
+    await harness.run(opCtx);
+    // ssn (readable:false) stripped; salary (readable:true) retained.
+    expect(opCtx.result.ssn).toBeUndefined();
+    expect(opCtx.result.salary).toBe(9999);
+    expect(opCtx.result.name).toBe('edited');
+  });
+
+  it('FLS write — the record echoed back by an insert is masked', async () => {
+    const plugin = new SecurityPlugin({ fallbackPermissionSet: 'member_default' });
+    const harness = makeMiddlewareCtx({
+      permissionSets: [flsPolicySet],
+      objectFields: ['id', 'owner_id', 'name', 'salary', 'ssn'],
+    });
+    await plugin.init(harness.ctx);
+    await plugin.start(harness.ctx);
+    const opCtx: any = {
+      object: 'task',
+      operation: 'insert',
+      data: { name: 'A' },
+      result: { id: 't2', name: 'A', salary: 100, ssn: 'server-generated' },
+      context: { userId: 'u1', tenantId: 'org-1', roles: [], permissions: ['member_default'] },
+    };
+    await harness.run(opCtx);
+    expect(opCtx.result.ssn).toBeUndefined();
+    expect(opCtx.result.salary).toBe(100);
+  });
+
   it('fails CLOSED when permission resolution throws — denies, never bypasses (P0-2)', async () => {
     const plugin = new SecurityPlugin({ fallbackPermissionSet: 'member_default' });
     const harness = makeMiddlewareCtx({ permissionSets: [tenantPolicySet] });

packages/plugins/plugin-security/src/security-plugin.ts

@@ -797,8 +797,13 @@ export class SecurityPlugin implements Plugin {
 
       await next();
 
-      // 4. Field-level security: mask restricted fields in read results
-      if (opCtx.result && ['find', 'findOne'].includes(opCtx.operation)) {
+      // 4. Field-level security: mask restricted fields in returned records.
+      // Covers reads AND the record echoed back by a write — otherwise a caller
+      // with edit-but-not-field-read could PATCH a record and read a
+      // read-protected field back out of the mutation response (FLS bypass).
+      // Field WRITES are already blocked upstream (detectForbiddenWrites); this
+      // closes the read leak on the response image.
+      if (opCtx.result && ['find', 'findOne', 'insert', 'update'].includes(opCtx.operation)) {
         let fieldPerms = this.permissionEvaluator.getFieldPermissions(opCtx.object, permissionSets);
         // [ADR-0066 D3] AND-gate field-level requiredPermissions into the mask.
         fieldPerms = this.foldFieldRequiredPermissions(fieldPerms, secMeta.fieldRequiredPermissions, permissionSets);