Skip to content

docs: clone endpoint, required-FK delete, Field.time, owner-scoped writes - #2012

Merged
os-zhuang merged 1 commit into
mainfrom
docs/clone-deletebehavior-time-security
Jun 17, 2026
Merged

docs: clone endpoint, required-FK delete, Field.time, owner-scoped writes#2012
os-zhuang merged 1 commit into
mainfrom
docs/clone-deletebehavior-time-security

Conversation

@os-zhuang

Copy link
Copy Markdown
Contributor

Targeted hand-written-doc updates so the docs match the runtime behavior shipped this cycle (clone, delete-cascade, time validation, owner-scoped member writes).

DocUpdate
guides/api-reference.mdx + concepts/implementation-status.mdxDocument POST /data/:object/:id/clone — gated by enable.clone (403 CLONE_DISABLED when off), optional { overrides }, 201 { object, id, sourceId, record }. (enable.clone was already listed as a capability but had no runtime/endpoint until #1961.)
protocol/objectql/types.mdxdeleteBehavior: a required lookup FK escalates a defaultedset_null to restrict409 DELETE_RESTRICTED (with dependentObject/dependentCount), instead of a misleading "<field> is required" error (#1984). Field.time accepts HH:MM/HH:MM:SS and is validated as a time-of-day, not a date (#2004).
guides/security.mdxmember_default writes are owner-scoped (created_by) and now actually enforced on by-id update/delete via a pre-image authorization check — a member can't modify another user's record (403); modifyAllRecords/admin bypass; audit-opt-out objects fail closed (#1994).

Docs-only; no package version impact.

🤖 Generated with Claude Code

…ites
Reflect runtime behavior shipped this cycle in the hand-written docs:
- api-reference + implementation-status: POST /data/:object/:id/clone (gated by
enable.clone; overrides; 201 {object,id,sourceId,record}).
- protocol/objectql/types: a required lookup FK escalates a defaulted set_null to
restrict → 409 DELETE_RESTRICTED; Field.time accepts HH:MM/HH:MM:SS.
- guides/security: member_default writes are owner-scoped (created_by) and now
enforced on by-id update/delete via a pre-image authorization check; admins /
modifyAllRecords bypass; audit-opt-out objects fail closed.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
@vercel

vercelBot commented Jun 17, 2026

Copy link
Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.

ProjectDeploymentActionsUpdated (UTC)
specReadyReadyPreview, CommentJun 17, 2026 7:15am

Request Review

@github-actionsgithub-actionsBot added documentation Improvements or additions to documentation tooling size/s labels Jun 17, 2026
@os-zhuang
os-zhuang merged commit a3442f9 into mainJun 17, 2026
13 checks passed
@os-zhuang
os-zhuang deleted the docs/clone-deletebehavior-time-security branch June 17, 2026 07:20
Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Labels

documentationImprovements or additions to documentationsize/stooling

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant

@os-zhuang