From affad7661f2f3daa5f83195e81f7c8988cfa46cd Mon Sep 17 00:00:00 2001 From: Claude Date: Thu, 30 Jul 2026 11:42:59 +0000 Subject: [PATCH 1/2] docs(formula): say why the RLS check evaluator has no token axis MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The temporal conformance matrix (#4109) gives every case a `tokenFilter` spelling, and the driver + analytics suites resolve it before asserting. This suite runs only the literal `filter`, with nothing saying why — so the absence reads as an omission, and the next person either "fixes" a non-gap or assumes coverage that cannot exist. It is architecture: an RLS `check` is a CEL expression (`check` is a string, compiled by rlsCompiler.compileFilter) where a relative date is the function today() evaluated at compile time. A {token} string never reaches this evaluator — resolveFilterTokens runs on the ObjectQL read path and the write-side check does not go through it; verified that plugin-security never calls the resolver. Comment only; the suite is unchanged and still 13/13. Co-Authored-By: Claude Fable 5 Claude-Session: https://claude.ai/code/session_01EkL3RGJrzjLEGURsLxfS2f --- ...atches-filter-temporal-conformance.test.ts | 22 +++++++++++++++++++ 1 file changed, 22 insertions(+) diff --git a/packages/formula/src/matches-filter-temporal-conformance.test.ts b/packages/formula/src/matches-filter-temporal-conformance.test.ts index a4d4e3fe8b..49b0746416 100644 --- a/packages/formula/src/matches-filter-temporal-conformance.test.ts +++ b/packages/formula/src/matches-filter-temporal-conformance.test.ts @@ -27,3 +27,25 @@ describe('matchesFilterCondition — temporal conformance', () => { }); } }); + +/** + * Why the token axis is absent here. + * + * `TemporalCase` carries a `tokenFilter` — the same filter spelled with + * `{today}` / `{current_month_end}` placeholders — which the driver and + * analytics suites resolve through `resolveFilterTokens` before asserting. This + * suite deliberately runs only `c.filter`, and that is an architectural fact + * rather than a coverage hole: + * + * an RLS `check` is a **CEL expression** (`PermissionSet.check` is a string, + * compiled by `rlsCompiler.compileFilter`), where a relative date is the + * *function* `today()` evaluated during compilation. A `{token}` string never + * reaches this evaluator — `resolveFilterTokens` runs on the ObjectQL **read** + * path (`engine.ts` resolves `ast.where`), and the write-side check does not go + * through it (`plugin-security` never calls the resolver). + * + * Asserting `tokenFilter` here would therefore test an input this backend + * cannot be handed. If that ever changes — if a `check` gains a token-bearing + * filter form — this comment is the thing to delete, and the axis is already + * sitting in the shared table ready to be consumed. + */ From b25c673ca3cf0b9b39c31920789024fe94fef3fe Mon Sep 17 00:00:00 2001 From: Claude Date: Thu, 30 Jul 2026 11:44:56 +0000 Subject: [PATCH 2/2] chore: re-trigger CI after applying skip-changeset The changeset gate is `if: !contains(labels, 'skip-changeset')`, so the label only takes effect on a fresh run. This PR is comment-only in a published package: a changeset would ship a patch CHANGELOG entry that describes no user-facing change, which is what the label exists for. Co-Authored-By: Claude Fable 5 Claude-Session: https://claude.ai/code/session_01EkL3RGJrzjLEGURsLxfS2f