Uh oh!
There was an error while loading. Please reload this page.
fix(spec,runtime)!: AnalyticsQueryRequest 即裸 AnalyticsQuery；/analytics 入口 Zod 校验，畸形请求 400（#3878 建议 1） - #4010
Merged
Conversation
… validate /analytics bodies at the entry (#3878) The spec's AnalyticsQueryRequestSchema described a {cube, query, format} ENVELOPE — the dialect of the retired degraded shim (#3891) that the real engine never understood: an envelope body inferred a column-less cube and died as a driver SQL syntax error (SELECT FROM ...) instead of a shape error, and a non-contract `filters` key was silently ignored. That mismatch sent #3867's first investigation to a wrong conclusion. Spec: - AnalyticsQueryRequestSchema = bare AnalyticsQuery + required top-level `cube`, `.strict()`. `query` and `format` are retiredKey-tombstoned (tsc `never` + parse-time prescription); `format` was never implemented (declared != enforced). - Registered as two step-17 semantic migrations (an HTTP-wire change with no stored metadata to rewrite); spec-changes.json, upgrade guide, authorable-surface, JSON schemas, OpenAPI, reference docs regenerated. Runtime: - POST /analytics/query and /analytics/sql validate the body at the entry and raise the duck-typed VALIDATION_FAILED shape both dispatcher error exits already map to 400 + fields[] (#3918) — the envelope answers with the tombstone's migration text, `filters` gets a bespoke hint at `where`. The domain throws through, matching its existing error contract; the wire-level 400 is pinned in dispatcher-validation-error.real.test.ts. - A valid body is forwarded byte-identical (validation only): parsing would inject the schema's timezone 'UTC' default and override org-timezone resolution (#1982/#2018). - Service-absent still answers 404 before body inspection (#3891). Tests: 5 new entry-validation cases + wire-level 400/200 pins; 9 legacy fixtures updated to contract-valid bodies. Refs #3878, #3891, #3867, #3918. Part 1 of the #3878 follow-through; route-mount conditionality is the next PR. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017WZBR9XyhXoqKCU6qQVyjx
The latest updates on your projects. Learn more about Vercel for GitHub. 1 Skipped Deployment
|
Contributor
📓 Docs Drift CheckThis PR changes 2 package(s): 112 hand-written doc(s) reference the affected code and may need an implementation-accuracy re-verification:
|
os-zhuang
marked this pull request as ready for review
July 30, 2026 02:56
Uh oh!
There was an error while loading. Please reload this page.
os-zhuang added a commit
that referenced
this pull request
Jul 30, 2026
#3891 follow-through, ADR-0076 D11) (#4019) * feat(runtime): mount /analytics routes only when the capability exists (#3891 follow-through, ADR-0076 D11) The dispatcher plugin mounted POST /analytics/query, GET /analytics/meta and POST /analytics/sql unconditionally, so a deployment without @objectstack/service-analytics kept the routes in its table: PUT answered 405 + Allow: POST, advertising a method on an API that isn't there (the POST itself has answered 404 since #3989 emptied the slot). Mounting is now capability-conditional. Plugin start() runs after the kernel's Phase-1 init, so service presence is authoritative: - single-kernel, `analytics` absent: routes NOT mounted — every method answers the adapter's shared not-found contract, and a boot log names the fix (install @objectstack/service-analytics); - single-kernel, `analytics` registered: unchanged; - multi-tenant host (kernel-resolver wired): mounted unconditionally — mounts are host-global while the service lives per-project kernel, so presence is a per-request question answered by the analytics domain's existing handled:false → 404. New public HttpDispatcher.isMultiTenantHost() exposes the mode. Tests: three conditional-mount cases in dispatcher-plugin.routes.test.ts (absent / registered / multi-tenant); conformance boots gain an analytics stub so the 405 + parity contracts keep their subject, plus a capability-absent boot pinning "no mounts, shared 404 for every method, sibling routes unaffected". Route-ledger row annotated (a row is an SDK-expressibility claim, not a mount guarantee). Completes the #3891 arc: #3989 emptied the slot, #4010 made the body contract strict at the entry, this removes the last wire-level residue of the uninstalled API. The hono standalone static discovery that still hardcodes the full routes table is tracked as #4018. Refs #3891, #3989, #4010, #4018. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017WZBR9XyhXoqKCU6qQVyjx * docs(api): discovery sample reflects the capability-conditional analytics surface The /api/v1 discovery example still showed the pre-#3989 picture: analytics hardcoded in `routes` and reported available with provider objectql on a minimal install. Show the honest minimal-install shape instead — analytics unavailable with the install hint and omitted from routes — which also makes the sample demonstrate the omitted-when-uninstalled rule the paragraph below it explains. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017WZBR9XyhXoqKCU6qQVyjx --------- Co-authored-by: Claude <noreply@anthropic.com>
os-zhuang added a commit
that referenced
this pull request
Jul 30, 2026
…l inert-key removal, ADR-0113 (Proposed) (#3998) Three parts, closing the #3896 security-audit line for the v17 window. 1. v17 release notes carry the whole security-hardening arc: a Highlights bullet (empty-criteria sharing + disabled RLS both fail closed now), two breaking-change sections with migration guidance, dead-cluster rows for DynamicLoadingConfig and rls.priority, Spec/kernel bullets for the 44-entry security-subset re-verification and the check:empty-state gate, and three upgrade-checklist items. implementation-status updated to match. 2. The four inert tool authoring keys are removed (major): category/permissions/active/builtIn parsed and did nothing — permissions promised an invocation gate nothing enforced, and active:false read as "withdrawn" while the tool kept reaching the LLM set and /execute kept running it (the rls.enabled shape). Full retirement kit per #3715: strict-rejection prescriptions (TOOL_RETIRED_KEY_GUIDANCE, 6 new tests), D2 conversion + D3 chain step (tool-inert-authoring-keys-removed), ToolCategorySchema removed with the key it typed, Studio tool form drops the retired inputs, the published AI skill's Tool section rewritten (it was teaching the removed keys, os:check'd), ledger entries deleted, api-surface + authorable-surface + json-schema.manifest + form-translation bundles updated deliberately, and the CLI authorWarn expectation retired with its ledger entry. 3. ADR-0113 merges as PROPOSED (not implemented): required as a write-time contract vs the column constraint as its own explicitly-authored axis — the tri-binding cited at its exact sites (record-validator; sql-driver.ts:4901; schema-drift.ts:249), criteria_json as first consumer. Q1 (spelling) / Q2 (new-field default) / Q3 (requiredWhen) remain open for adjudication. spec: 6895 tests green; all gates green; 198 prose examples type-check; dogfood green. Union-merged over #4010's step-17 rationale (chain-replay gate verified the composition).
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
#3878 建议 1 的落地（#3891/#3989 退役 shim 后，信封方言已无服务端消费者，规范形状之争消失）。PR A of 2 —— PR B（路由挂载与服务安装绑定）随后。
Spec：
AnalyticsQueryRequestSchema信封 → 裸形状原 schema 描述的是
{ cube, query: {...}, format }信封——已退役降级 shim 的方言，真引擎从不认识：信封 body 推断出无列 cube，死在驱动层 SQL 语法错误（SELECT FROM …），而不是形状错误（#3867 第一次实证被它带偏）。现在：AnalyticsQuery（顶层cube+measures必填，dimensions/where/timeDimensions/order/limit/offset/timezone并列），.strict()；query/format用retiredKey墓碑（tscnever+ 解析期即迁移指引）；format从未实现（declared ≠ enforced，响应永远是 JSON 包络）；gen:schema守卫通过。Runtime：入口校验
POST /analytics/query与/analytics/sql在入口用该 schema 校验：VALIDATION_FAILED形状（[17.0.0-rc.0] Runtime dispatcher error paths drop ValidationError.fields[] and downgrade status to 500 (rest-server maps it correctly) #3918 的通道），wire 层 400 +details.fields[]——信封请求得到墓碑的迁移文本；filters（非契约键，strict 只会给通用报错）得到指向where的定制提示；timezone:'UTC'默认值，静默覆盖组织时区解析（ADR-0053 Phase 2 · Slice 5: timezone-aware analytics date bucketing #1982/fix(analytics): make organization timezone drive date-dimension bucketing (#1982) #2018）——测试钉住了toBe(body)同引用；测试
pnpm test：132/132 绿。影响面
发对形状的调用方（objectui dashboard、client SDK 透传）零影响。发信封或
filters的调用方从"500 SQL 语法错误 / 数字静默变大"变为 400 + 指出改法。@objectstack/specmajor（schema 形状变更），@objectstack/runtimeminor。关联：#3878、#3891、#3989、#3867、#3918。
🤖 Generated with Claude Code
https://claude.ai/code/session_017WZBR9XyhXoqKCU6qQVyjx
Generated by Claude Code