fix(plugin-sharing): re-evaluate position and team sharing rules for the user whose membership changed

A write to sys_user_position, to the sys_member.role transition source, or
to sys_team_member now re-evaluates every sharing rule whose recipient the
row names, for the one user the row names, in the same write path. A new
holder gains the rule's grants and a former holder loses them before the
write returns.

WIP: tests and changeset follow.

Claude-Session: https://claude.ai/code/session_01KqkTQNLcxVc588eZpJmp1r
Co-authored-by: Claude <noreply@anthropic.com>

Author: claude

packages/plugins/plugin-sharing/src/bu-tree-recompute.ts

@@ -51,7 +51,9 @@
  * Everything else is deliberately NOT recomputed. That exclusion is a
  * requirement, not an optimisation: a fix that recomputed every rule on every
  * BU write would close the security hole and replace it with a load problem —
- * see {@link BU_TREE_RECIPIENT_TYPES}.
+ * see {@link BU_TREE_RECIPIENT_TYPES}. The `position` and `team` kinds are
+ * recomputed by writes to THEIR membership tables instead, per affected user —
+ * `recipient-membership-recompute.ts`.
  *
  * ## The design: synchronous revoke, asynchronous re-grant
  *

packages/plugins/plugin-sharing/src/position-graph.ts

@@ -3,10 +3,26 @@
 import { isGrantActive } from '@objectstack/core';
 
 import type { SharingEngine } from './sharing-service.js';
-import { TeamGraphService } from './team-graph.js';
+import { TeamGraphService, holdsRole } from './team-graph.js';
 
 const SYSTEM_CTX = { isSystem: true, positions: [], permissions: [] } as const;
 
+/**
+ * The `sys_user_position` predicate "assignments of `positionName`", scoped to
+ * `scopeOrg` when one is given — ONE spelling for the rule-wide expansion
+ * ({@link PositionGraphService.expandPositionUsers}) and the user-scoped check
+ * ({@link PositionGraphService.holdsPosition}), so the two can never disagree
+ * about which assignment rows count.
+ */
+function positionAssignmentPredicate(positionName: string, scopeOrg: string | null | undefined): Record<string, unknown> {
+  const filter: Record<string, unknown> = { position: positionName };
+  if (scopeOrg) filter.organization_id = scopeOrg;
+  return filter;
+}
+
+/** The columns both reads project: the holder and the ADR-0091 D2 validity window. */
+const ASSIGNMENT_FIELDS = ['user_id', 'valid_from', 'valid_until'];
+
 type PositionCache = {
   expand?: Map<string, string[]>;
 };
@@ -73,16 +89,14 @@ export class PositionGraphService {
     const users = new Set<string>();
 
     // 1) Platform assignment table (source of truth).
-    const filter: Record<string, unknown> = { position: positionName };
     const scopeOrg = organizationId ?? this.organizationId;
-    if (scopeOrg) filter.organization_id = scopeOrg;
     try {
       // valid_from / valid_until ride the projection so the ADR-0091 D2
       // validity filter below sees them — expired holders stop receiving
       // position-recipient shares at resolution time, fail-closed.
       const rows = await this.engine.find('sys_user_position', {
-        filter,
-        fields: ['user_id', 'valid_from', 'valid_until'],
+        filter: positionAssignmentPredicate(positionName, scopeOrg),
+        fields: ASSIGNMENT_FIELDS,
         limit: 10000,
         context: SYSTEM_CTX,
       });
@@ -105,4 +119,42 @@ export class PositionGraphService {
     this.cache.expand!.set(key, result);
     return result;
   }
+
+  /**
+   * Does `userId` hold `positionName`? The user-scoped twin of
+   * {@link expandPositionUsers}: the same two sources, the same organization
+   * scope and the same ADR-0091 D2 validity filter, each narrowed to one user,
+   * so the answer is `expandPositionUsers(positionName, organizationId)
+   * .includes(userId)` — pinned in `position-graph.test.ts` — read in two
+   * indexed lookups instead of the position's whole holder list.
+   *
+   * Exists for the recipient-membership recompute
+   * (`recipient-membership-recompute.ts`), which re-evaluates a position rule
+   * for the ONE user whose assignment was written. That runs on the write path,
+   * once per written row, so a full expansion there would make a bulk
+   * assignment import quadratic in the position's holder count.
+   *
+   * Uncached on purpose: the answer is wanted right after a write that may
+   * have changed it. A failed assignment read falls through to the transition
+   * source, as the expansion's does.
+   */
+  async holdsPosition(userId: string, positionName: string, organizationId?: string): Promise<boolean> {
+    if (!userId || !positionName) return false;
+    const scopeOrg = organizationId ?? this.organizationId;
+    try {
+      const rows = await this.engine.find('sys_user_position', {
+        filter: { ...positionAssignmentPredicate(positionName, scopeOrg), user_id: userId },
+        fields: ASSIGNMENT_FIELDS,
+        limit: 1000,
+        context: SYSTEM_CTX,
+      });
+      const nowMs = Date.now();
+      for (const r of (rows ?? []) as any[]) {
+        if (String(r.user_id ?? '') === userId && isGrantActive(r, nowMs)) return true;
+      }
+    } catch {
+      /* table may not exist on minimal stacks — the transition source below still applies */
+    }
+    return holdsRole(this.engine, positionName, userId, scopeOrg);
+  }
 }