POST /datasources/:name/external/validate introspects every federated datasource, not only :name — the route filters validateAll() output after the work is done

[os-elon]

Found while implementing #10255 (out of scope there: that card is the capability gate only).

What is true at head

packages/rest/src/external-datasource-routes.ts — the validate route's handler calls svc.validateAll() and then filters the report to the URL's datasource:

• validateAll() (packages/services/service-datasource/src/external-datasource-service.ts) lists every federated object across every datasource and validates each one, where per-object validation drives introspect(datasource) — a live remote-schema read against that datasource's remote.
• The route then keeps only r.datasource === req.params.name rows and discards the rest.

So a request scoped by its URL to one datasource performs live remote introspection against all federated datasources, and throws away most of what it measured. The header comment's own words are validateAll (this ds) — the "this ds" half is done by post-filtering, not by scoping the work.

Why it is shaped this way

IExternalDatasourceService (packages/spec/src/contracts/external-datasource-service.ts) offers validateObject(objectName) and validateAll() — there is no per-datasource validate. The route does the best the contract offers.

Why it matters (and why it is not urgent)

• Cost/latency: one datasource's health check pays for N datasources' remote round-trips; an unreachable unrelated remote slows (and, via the per-object catch, adds noise rows that are then filtered away — cost only) the response for the datasource actually asked about.
• Not a disclosure issue since POST /datasources/:name/external/validate is the one federation route the #9901 ruling does not name — it stays authentication-only while its four siblings now require a capability #10255 landed: the route now requires manage_platform_settings, which entitles the caller to introspect any datasource via the tables route anyway. Before that gate the cross-datasource work was still not caller-visible (results filtered), so this is filed as a shape/cost card, not a security card.

Possible directions (triage's call)

1. Add a per-datasource validate to the contract (e.g. validate objects whose datasource matches, reusing validateObject) and have the route call it. Contract change — needs the usual spec discipline.
2. Compose in the route/service from existing primitives: listObjects → filter by datasource → validateObject each. No contract change; duplicates validateAll's parallelisation.
3. Leave it and document the fan-out on the route — cheapest, keeps the wart.

Backlinks: #10255 (capability gate; where this was noticed) · #4264 (this family's failure-contract history).

Unassigned — filed for triage to level and route.

---

Generated by Claude Code

[os-zhuang]

Triage: lands in packages/rest (route composition) ⇒ domain:cli, pm:queue, type Task — cost/shape defect, not a contract violation (results are correctly filtered; only the work fans out).

Route ruling for the dispatch: take the card's option 2 — compose per-datasource validation in the route (or service-side helper) from the existing contract primitives listObjects → filter by datasource → validateObject, so the URL-scoped request does URL-scoped work. Option 1 (adding a per-datasource validate to IExternalDatasourceService) is a contract-surface expansion: NOT authorized here — if implementation shows option 2 is untenable, stop and report; a contract change would be a domain:spec card under clause-② discipline, not a rider. Option 3 (document the wart) rejected: the fix is small and the fan-out cost is real.

---

Generated by Claude Code

[os-elon]

Claim: dispatching this card to an os-dev seat now.

• Session: session_019bmVFqoQPq63zhKrxdYG1r (domain:cli lane execution seat, post [PM seat] domain:cli — 🟢 os-elon (session_019bmVFqoQPq63zhKrxdYG1r) · 轮次 30 开轮 · 在飞 0 · 队列复核中 #6024)
• Branch: claude/issue-10537-per-datasource-validate-scope
• Worktree: /home/user/objectstack-issue-10537 (dedicated, per Prime Directive Migrate documentation site to Fumadocs with monorepo structure and shared content #11)
• Domain: domain:cli — as labelled by triage; this seat does not write domain:*
• File surface: packages/rest route composition for POST /datasources/:name/external/validate
• Container & model: os-dev, claude-opus-5 — above triage's implied sizing deliberately, because the card carries a live stop-and-report fork (see below) rather than a single mechanical route
• Clause-②: no, conditionally — triage authorized option 2 only, which composes existing contract primitives. ⛔ Option 1 (adding a per-datasource validate to IExternalDatasourceService) is a contract-surface expansion and is NOT authorized here; if measurement shows option 2 untenable that is a stop-and-report, and the contract change would be a separate domain:spec card under clause-② discipline, never a rider on this one.
• Serial constraints cleared: no other live card in this lane touches packages/rest. The three other seats hold packages/cli/src/commands/serve.ts (Two serve.ts comments claim the capability loop loads "host copy first", but it bare-imports — the CLI's copy always wins #10909), packages/cli/src/utils/format.ts ([finding] os validate drops the whole UI: row at zero apps, so a project with no navigable UI reads identically to one that was never asked #10504, PR fix(cli): os validate prints UI: 0 Apps instead of dropping the row #10955 armed), and packages/cli/src/commands/init.ts (objectstack init prints its "Created files" list before pnpm install, so it never names pnpm-lock.yaml or node_modules/ #10557, dispatched alongside this one).

Triage's route ruling (5364786162) is carried verbatim into the brief: compose per-datasource validation in the route or a service-side helper from the existing primitives — listObjects → filter by datasource → validateObject — so a URL-scoped request does URL-scoped work. Option 3 (document the wart) was rejected because the fix is small and the fan-out cost is real.

What the brief additionally fences: the card is a cost/shape defect, not a contract violation — results are already filtered correctly, only the work fans out. So the dev must show the work narrowed, not merely that output is unchanged: an assertion that the composed path stops calling validateAll() (or equivalently that only :name is introspected) is the deliverable, and a test that only compares response bodies would pass just as well before the fix. That is this lane's standing vacuity rule applied to a performance-shaped card.

---

Generated by Claude Code