fix(example-crm): grant crm_opportunity_line_item in crm_sales_user, matching its master crm_opportunity (#8164)

[os-zhuang]

Fixes#8164

What

crm_opportunity_line_item is a master-detail child of crm_opportunity
(sharingModel: 'controlled_by_parent', inlineEdit: 'grid' on the
Opportunity form) but was not granted object-level CRUD in any app-crm
permission set. Record-level access always follows the master (ADR-0055),
but object-level CRUD is a separate gate the platform never derives —
so every role-bound (non-admin) user, including the three positions this
app ships to demonstrate selling, got a silent 403 the moment they tried
to add/edit a product line on an Opportunity they otherwise fully own. The
platform's own build-time lint (security-master-detail-ungranted)
already flagged this independently.

Added crm_opportunity_line_item to crm_sales_user's objects map in
examples/app-crm/src/security/sales-positions.ts, with the same grant
shape as its master crm_opportunity:
{ allowRead: true, allowCreate: true, allowEdit: true, allowDelete: false }.

Why this shape

The lint rule's own name (security-master-detail-ungranted) and the
runtime's ADR-0055 derivation both say the line item's access is meant to
follow its master. Matching the parent's grant exactly (not inventing an
independent CRUD policy) keeps that relationship visible in the metadata:
the same users who can already create/read/edit an Opportunity can now
also create/read/edit its line items, with delete withheld on both (line
items are removed by editing the Opportunity's grid, not by a standalone
delete permission — consistent with the master).

Also regenerated examples/app-crm/access-matrix.json (the ADR-0090 D6
capability snapshot objectstack build checks on every compile) via
objectstack build --update-access-matrix — never hand-edited. The build
fails on undocumented capability drift, and granting the line item is
exactly such a drift; the new entry records the object's own
sharingModel (controlled_by_parent), not the master's
public_read_write.

Tests

• New coverage: examples/app-crm/test/smoke.test.ts gained one new,
  purely-additive test —
  grants crm_opportunity_line_item in crm_sales_user, matching its master crm_opportunity (#8164) — asserting the child's grant exists and equals
  the master's. No existing test was touched or re-spelled; there was zero
  prior coverage of crm_sales_user's grant contents before this PR.
  Confirmed the test discriminates: red on the ablated (pre-fix) code
  (expected undefined to be defined), green on the fix.
• objectstack verify --app examples/app-crm/objectstack.config.ts --rls:
  every position persona's probeBlocked count dropped from 1 (the line
  item — the sole gap [finding] The CRM example binds none of its 3 declared positions to crm_sales_user, so a user holding one is 403 on every CRM object #8060 deliberately left open) to 0
  (memberVisible: 6, not proven — expected, since the object is
  effectively controlled_by_parent on a public_read_write master, so
  the object gate opening makes it visible by design), with zero RLS
  holes. Aggregate across the 3 position personas: probeBlocked 3 → 0,
  memberVisible 15 → 18, holes 0 → 0. Full before/after readout in the
  dev report.
• Build-time lint: security-master-detail-ungranted no longer fires for
  crm_opportunity_line_item (confirmed present on the ablated build,
  absent on the fix).
• Ablation: committed the fix first, then reverted both
  sales-positions.ts and access-matrix.json together (reverting only
  the grant would itself trigger an access-matrix drift failure),
  re-ran verify --rls and the build lint, confirmed both returned
  exactly to the pre-fix baseline, then restored from the committed
  branch (no git stash).

Not in scope

packages/plugins/plugin-security/** — this PR stays entirely inside
examples/app-crm/**, per the card's scope.

---

Generated by Claude Code

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
objectstack	Ignored		Aug 12, 2026 9:29pm