feat(spring-data): add Spring Data JPA query plan adapter

.github/workflows/spring-data.yaml

@@ -0,0 +1,36 @@
+name: Spring Data Test
+
+on:
+  pull_request:
+    paths:
+      - "spring-data/**"
+      - "policies/**"
+      - ".github/workflows/spring-data.yaml"
+  push:
+    tags:
+      - spring-data/v*
+
+defaults:
+  run:
+    working-directory: spring-data
+
+jobs:
+  test:
+    strategy:
+      matrix:
+        java-version: ["17", "21"]
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+
+      - name: Setup JDK
+        uses: actions/setup-java@ad2b38190b15e4d6bdf0c97fb4fca8412226d287 # v5.3.0
+        with:
+          distribution: temurin
+          java-version: ${{ matrix.java-version }}
+
+      - name: Setup Gradle
+        uses: gradle/actions/setup-gradle@3f131e8634966bd73d06cc69884922b02e6faf92 # v6.2.0
+
+      - name: Build and test
+        run: gradle build --no-daemon

CLAUDE.md

@@ -13,6 +13,7 @@ Multi-language ORM adapters that translate Cerbos query plan responses into data
 | langchain-chromadb | TypeScript | `@cerbos/langchain-chromadb` | ChromaDB |
 | sqlalchemy | Python | `cerbos-sqlalchemy` | SQLAlchemy |
 | elasticsearch-java | Java | `cerbos-elasticsearch` | Elasticsearch |
+| spring-data | Java | `cerbos-spring-data` | Spring Data JPA |
 
 ## Commands
 
@@ -34,9 +35,12 @@ pdm run test     # pytest
 pdm run format   # isort + black
 ```
 
-### Java (Elasticsearch)
+### Java (Elasticsearch, Spring Data)
 ```bash
-docker run --rm -v "$(pwd)":/app -w /app gradle:8.12-jdk17 gradle build --no-daemon
+# For tests that use testcontainers (cerbos PDP + DBs), mount the docker socket:
+docker run --rm -v "$(pwd)":/app -v /var/run/docker.sock:/var/run/docker.sock \
+  -e TESTCONTAINERS_RYUK_DISABLED=true --network host \
+  -w /app gradle:8.12-jdk17 gradle build --no-daemon
 ```
 
 ## Testing
@@ -68,7 +72,7 @@ Conventional Commits: `feat(prisma):`, `fix(mongoose):`, `chore(deps):`. Scope i
 
 Each adapter has its own GitHub Actions workflow triggered by changes in its directory or `/policies/`. Matrix tests across Node versions (20, 22, 24, 25) and relevant service versions.
 
-Tag-based publishing: `prisma/v*` -> npm, `sqla/v*` -> PyPI, `elasticsearch-java/v*` -> Maven Central.
+Tag-based publishing: `prisma/v*` -> npm, `sqla/v*` -> PyPI, `elasticsearch-java/v*` and `spring-data/v*` -> Maven Central.
 
 ## Working with Adapters
 

policies/resource.yaml

@@ -855,6 +855,24 @@ resourcePolicy:
         match:
           expr: request.resource.attr.aString == request.resource.attr.id
 
+    - actions:
+        - "not-equal-field-to-field"
+      effect: EFFECT_ALLOW
+      roles:
+        - USER
+      condition:
+        match:
+          expr: request.resource.attr.aString != request.resource.attr.id
+
+    - actions:
+        - "size-count-threshold"
+      effect: EFFECT_ALLOW
+      roles:
+        - USER
+      condition:
+        match:
+          expr: size(request.resource.attr.ownedBy) >= 2
+
     - actions:
         - "equal-bool-false"
       effect: EFFECT_ALLOW
@@ -942,4 +960,45 @@ resourcePolicy:
           expr: >
             hierarchy(R.attr.scope).descendentOf(hierarchy(P.attr.scope))
 
+    # Operand-order conformance: the planner preserves policy source order, so these
+    # value-first shapes reach adapters with the constant as the FIRST operand. Directional
+    # operators must be mirrored by adapters or results are silently inverted.
+    - actions:
+        - "value-first-lt"
+      effect: EFFECT_ALLOW
+      roles:
+        - USER
+      condition:
+        match:
+          expr: 1 < R.attr.aNumber
+
+    - actions:
+        - "value-first-size"
+      effect: EFFECT_ALLOW
+      roles:
+        - USER
+      condition:
+        match:
+          expr: 0 < size(R.attr.ownedBy)
+
+    - actions:
+        - "value-first-intersect"
+      effect: EFFECT_ALLOW
+      roles:
+        - USER
+      condition:
+        match:
+          expr: hasIntersection(["user1", "userX"], R.attr.ownedBy)
+
+    # A residual resource attribute INSIDE a collection lambda body — adapters must resolve
+    # it against the outer entity, not the collection element.
+    - actions:
+        - "outer-attr-in-lambda"
+      effect: EFFECT_ALLOW
+      roles:
+        - USER
+      condition:
+        match:
+          expr: R.attr.tags.exists(tag, tag.name == "public" && R.attr.aBool)
+
 

spring-data/.gitignore

@@ -0,0 +1,5 @@
+.gradle/
+build/
+bin/
+.idea/
+*.iml

spring-data/CONTEXT.md

@@ -0,0 +1,38 @@
+# Domain glossary — spring-data adapter
+
+Terms used by this adapter's code, tests, and reviews. Architecture vocabulary
+(module / interface / seam / depth) follows the codebase-design convention.
+
+- **Error→deny contract** — the adapter's semantic target: the filtered row set
+  equals what per-resource `check()` calls would allow. CEL evaluation errors
+  (null/missing attribute without a null overload) deny, so their SQL
+  translation must evaluate UNKNOWN — never FALSE — under every polarity.
+- **TriPredicate** — the tri-state predicate algebra module enforcing that
+  contract structurally: it owns the UNKNOWN constant, the junction-barriered
+  negation (Hibernate 6 collapses `cb.not(cb.not(p))`), and the macro truth
+  tables. Inputs consumed in more than one polarity are `Supplier`s, so
+  "translate fresh per occurrence" cannot be violated by callers. `cb.not` has
+  exactly one call site: inside this module.
+- **ComparisonTranslator / Resolved** — the single comparison-translation seam.
+  Every binary leaf comparison resolves each operand to a typed `Resolved` case
+  (`Constant`, `Field`, `ConstantAdd`, `FieldPlusConstant`, `Arithmetic`,
+  `Opaque`) and dispatches on the pair. New operand types (e.g. `timestamp()`)
+  are one resolver case + dispatch pairings — see the extension recipe in the
+  module Javadoc. Classification is structural; conversion is lazy, because
+  which error fires is part of the pinned interface.
+- **NormalizedBinary** — planner operands arrive in policy source order
+  (`1 < R.attr.x` is value-first); this normalizes field-first and mirrors
+  directional operators (`lt`↔`gt`). Receiver-sensitive operators
+  (`contains`/`startsWith`/`endsWith`) are exempt — the receiver's position is
+  meaning, not noise. Overrides observe the mirrored operator name.
+- **ChainSubquery** — the one correlated-subquery skeleton. It anchors
+  correlation at the scope that owns the relation and joins through every hop
+  of a multi-hop chain; all collection operators compose over it.
+- **Differential oracle** — the adversarial conformance suite: hostile policy
+  shapes planned against a real PDP, translated, executed on H2, and the id set
+  compared row-by-row against `check()` with attributes mirroring the DB rows
+  exactly. DB NULL is a *missing* attribute on the check side. No
+  hand-computed expectations; a degeneracy guard prevents vacuous passes.
+- **Double space** — all numeric work happens in IEEE doubles, because Cerbos
+  attribute numbers are CEL doubles and the wire plan erases `1` vs `1.0`.
+  Constants fold in Java; columns get a real `CAST(... AS DOUBLE)`.

spring-data/Dockerfile

@@ -0,0 +1,8 @@
+FROM gradle:8.12-jdk17 AS build
+WORKDIR /app
+COPY build.gradle.kts settings.gradle.kts ./
+COPY src ./src
+# Tests need a Docker daemon (Testcontainers spawns a Cerbos PDP) and the shared /policies
+# directory, neither of which exists inside `docker build`. Build artifacts only; run the
+# test suite via CI or `docker run` with the docker socket mounted (see CLAUDE.md).
+RUN gradle build -x test --no-daemon