Approvals inbox detail drawer unconditionally renders a "Raw data (JSON)" panel — exposes `hidden: true` fields, internal ids and audit columns to business approvers

[os-zhuang]

Moved from objectstack-ai/objectstack#10734 (filed there in Chinese by @baozhoutao, MEMBER, from a real EHR deployment on @objectstack/* 17.1.0; transfer unavailable in this tooling, rebuilt per file-at-destination — the renderer ships from this repo, @objectstack/console dist is a generated artifact of it). Original card retains the full report and repro; summary below.

Defect

In the Approvals center (/_console/apps/<app>/system/approvals, also the setup inbox route), opening any approval request shows a collapsible panel 「原始数据(JSON)」/ "Raw data (JSON)" (with a copy button) between the activity feed and the action buttons. Expanded, it renders the submitted record's complete raw row JSON, including:

• internal columns: id, created_by, updated_by, owner_id, organization_id, bare lookup ids;
• fields the object's metadata explicitly declares hidden: true — the app author's visibility declaration is silently bypassed on the approver's path.

Appears for all request states (pending / approved). Render condition is only payload != null — no role check, no debug/feature flag (reporter grepped showRaw* / rawPayload / hideRawData / showPayload / approvals.* settings keys: zero hits). Data source: sys_approval_request.payload_json, written unconditionally by @objectstack/plugin-approvals. The app author has no legitimate config to remove it (field hidden, view columns, nav, permission sets, env vars all ineffective) — only dist patching or CSS injection.

Locator from the report: chunk ApprovalsInboxPage-*.js, i18n key rawData.

Expected

A business approver sees only decision-relevant business information (key fields, approval chain, activity, actions). The raw row JSON is an implementation detail and must not bypass declared field visibility.

Triage scope guidance

Minimal fix direction (reporter's own priority order): default to not rendering the panel for business approvers (dev-mode / platform-admin / explicit debug gating is acceptable), or at minimum trim the payload rendering by object metadata (drop hidden: true fields + internal audit/pk columns). ⛔ Adding a new system/app-level config key (e.g. approvals.showRawPayload) is new public surface — propose it in the report if you believe it is needed, do not implement without a ruling.

Server-side residual (the payload itself still reaches the client unfiltered regardless of this panel) is tracked separately in the objectstack repo — this card is the UI half only.

Screenshots exist in the source project (private); see the original card for contact.

[os-sales]

Claim: PM loop round 1
Session: session_012u2pRjcqAYtoEjgr3wwhnK
Branch: claude/issue-5553-approvals-raw-payload-panel
Worktree: objectui-issue-5553
Domain: domain:ui
File surface: apps/console/src/pages/system/ApprovalsInboxPage.tsx (+ its tests, + a changeset) (stop on breach; explain in the report)
Container & model: M, mode:subagent, model: opus — tier from this round's node scripts/pm/dispatch-gates.mjs --tier apps/console/src/pages/system/ApprovalsInboxPage.tsx, which reports no path-derived mandate ("floor sonnet · default opus · ceiling fable"), so this is the per-card judgment call: the fix requires deciding what a business approver may see, which is not a mechanical edit.
Clause-②: no — the card's own scope guidance forbids minting a new config key (approvals.showRawPayload) without a ruling, and gating or trimming an existing panel neither changes contract accept/reject behaviour nor widens the public surface. If the implementation cannot proceed without a new authorable key, that flips this declaration — stop and report rather than implementing it.
Serial constraints cleared: apps/console/src/pages/system/ApprovalsInboxPage.tsx — predecessor PR #5509 merged today (9b9af8d, "stop the Approvals Inbox remounting every row cell on every render"), so re-verify against current origin/main before editing. #5554 (approvals step progress bar) touches the same drawer and is serialised behind this card — fold-or-serial answered serial: different defect shape, different fix, so gate ① of the family-dispatch test fails. No other in-flight card in this lane touches apps/console; #5521, #5544, #5557, #5368 are queued behind it.

Premise re-verified on origin/main this round rather than relayed: the panel is still live at ApprovalsInboxPage.tsx:2083 ({tr('rawData', 'Raw data (JSON)')}).

---

Generated by Claude Code

[os-sales]

{
 "issue": 5553,
 "status": "done",
 "branch": "claude/issue-5553-approvals-raw-payload-panel",
 "pr": "https://github.com/objectstack-ai/objectui/pull/5563",
 "premise_still_valid": true,
 "final_sha": "d96c3727f",
 "files_changed": [
 "apps/console/src/pages/system/ApprovalsInboxPage.tsx (modified: 2 imports, gate predicate, 1 render condition)",
 "apps/console/src/pages/system/ApprovalsInboxPage.rawPayloadGate.test.tsx (new, 4 cases)",
 ".changeset/approvals-raw-payload-gate-5553.md (new, '@object-ui/console': patch)"
 ],
 "summary": "The drawer's Raw data (JSON) panel is now gated on holdsStudioAccess, reused verbatim from apps/console/src/components/studioEntry.ts. No new authorable key was needed or added; no new i18n copy; the file fence was not breached. The gate reads the RAW systemPermissions from usePermissions() and fails CLOSED (no provider / field absent / reported empty all deny), inverted from hasCapabilities, which fails open by design and is the wrong posture for a surface whose defect IS a non-holder seeing it.",
 "pm_assumption_1": "CONFIRMED. ApprovalsInboxPage renders under AppContent, which wraps DefaultAppContent (and its systemRoutes, incl. system/approvals) in MePermissionsProvider — so systemPermissions[] from /api/v1/auth/me/permissions is reachable via usePermissions() with no new fetch. studio.access is platform-scope and platform-admin-only (framework PLATFORM_ADMIN_ONLY_CAPABILITIES = manage_metadata, manage_platform_settings, studio.access, manage_users). Chose the single narrow capability over mirroring that 4-cap list into the renderer: mirroring would be a second de-facto contract (AGENTS.md #0.1), and manage_users holders have no business reading raw clinical payloads.",
 "pm_assumption_2": "FALSIFIED AS STATED. Object metadata carrying hidden:true is NOT reachable at this point. ApprovalsInboxPage holds no field-level metadata (all 10 'hidden' hits in the file are Tailwind classes, aria-hidden, or prose), and the only object-fields hook, useObjectFields, lives under packages/app-shell/src/views/metadata-admin/previews/ and is NOT exported from packages/app-shell/src/index.ts (grep exit 1). Trimming would have required a new metadata read; the ruling's route did not need one. Filed as #5565.",
 "tests": "All at final commit d96c3727f. (1) pnpm exec vitest run apps/console/ -> 'Test Files 63 passed (63)' / 'Tests 704 passed (704)'. (2) pnpm exec vitest run apps/console/src/pages/system/ -> 'Test Files 10 passed (10)' / 'Tests 64 passed (64)'. (3) pnpm --filter @object-ui/console type-check -> exit 0, script echoed 'tsc --noEmit && tsc -b tsconfig.node.json --force' (not a zero-match silent pass). (4) pnpm --filter @object-ui/console lint -> its own line: '201 problems (0 errors, 201 warnings)'; --format json reports 165 files linted, 0 errors; new test file 0/0; ApprovalsInboxPage.tsx 19 warnings all on pre-existing lines (lowest 522, the pre-existing buildApproverIdentities(user as any) line; added block starts 524). ABLATION (pure source; root vitest aliases @object-ui specifiers at package src, no build artifact between edit and run; no dist involved so no rebuild leg applies): fix committed first at 35fd9497b, then perl -0pi restored the bare condition. Mutation CONFIRMED ON DISK before measuring, not from the editor's exit code — anchored greps on both texts: gated form 'maySeeRawPayload && selected.payload != null' 1 -> 0, bare form 'selected.payload != null && (' 0 -> 1, git diff --stat '1 file changed, 1 insertion(+), 1 deletion(-)'. Predicted direction: three denial cases red, holder case green. Observed exactly that: 'Tests 3 failed | 1 passed (4)', each failure on the Raw data (JSON) assertion naming the found summary element. Script carried trap '<restore>' EXIT INT TERM; restore verified byte-identical (git status --short and git diff --stat both empty).",
 "gates_run": {
 "note": "Dispatch gate list was objectstack-side and ABSENT in objectui (PM confirmed mid-task). Re-derived from objectui's own package.json + .github/workflows against my actual changed paths. Verdicts read from each gate's own output line; exit codes captured before any pipe.",
 "check-changeset-fixed": "exit 0",
 "check-changeset-no-major": "exit 0",
 "check-changeset-presence": "exit 0",
 "check-control-bytes": "exit 0 (plus manual self-scan of all 3 changed files: no control bytes)",
 "check:i18n-keys": "exit 0",
 "check:i18n-drift": "exit 0",
 "check:i18n-dead-keys": "exit 0",
 "check:eager-closure": "GREEN: 'Console eager closure is 3784.8 KB gzipped across 52 of 508 chunks (budget: 3867.2 KB, headroom: 82.4 KB)'. First read was exit 2 = BROKEN GAUGE ('No eager-closure report ... the console was not built'), the state of any fresh worktree, not a finding about this diff; resolved by actually building the console, not by argument.",
 "check:phantom-deps": "exit 0",
 "check:self-import": "exit 0",
 "check:esm-specifiers": "exit 0",
 "check-lint-coverage": "exit 0",
 "check-type-check-coverage": "exit 0"
 },
 "i18n_decision": "The rawData locale key STAYS, deliberately. The fix gates the panel rather than removing it, so tr('rawData', 'Raw data (JSON)') remains a live call site and the label still renders for a holder. check:i18n-dead-keys measured green; NO locale table touched. Removing the key would have meant editing ~10 locale files outside this card's file fence to delete copy that is still reachable.",
 "deviations": [
 "DECLARED NARROWING: repo-wide 'pnpm lint' (turbo, all packages) and 'pnpm type-check' were left to CI; ran the apps/console slice instead. Evidence the narrowing is a measurement, not a skip: population came from ESLint's own config resolution (165 files, count read from --format json), 0 errors; and type-aware linting is NOT enabled in the root eslint.config.js (no projectService, no parserOptions.project), so this diff cannot move the verdict of any untouched file.",
 "Repo guard rejected 'pnpm --filter <pkg> test -- <path>' (objectui#3288: args after -- are silently dropped by vitest, and cwd was not the repo root). Used the form the guard named: 'pnpm exec vitest run <path>' from the repo root.",
 "Built the console dependency closure and then the console app itself. Both were required and neither is a source change: a fresh worktree has no dist, so type-check could not resolve any @object-ui specifier and the eager-closure gauge did not exist.",
 "All heavy commands ran through scripts/pm/os-verify-lock.sh. Longest single wait 3m34s at position 2/2; no stall, all work done in-turn."
 ],
 "open_questions": [
 {
 "question": "The gate reuses holdsStudioAccess, so the approvals raw panel now tracks whatever studio.access means for Studio ENTRY. Correct coupling, or should this surface get its own signal?",
 "options": [
 "A - keep holdsStudioAccess (shipped): one definition of 'platform operator vs business user' in this app, so the two surfaces cannot drift into two spellings of one fact; cost is that re-scoping studio.access silently moves this gate too",
 "B - mirror the framework's PLATFORM_ADMIN_ONLY_CAPABILITIES (manage_metadata, manage_platform_settings, studio.access, manage_users) into the renderer: matches the server's own platform-admin probe exactly, but copies a cross-repo list that can go stale, and widens the audience to user admins",
 "C - mint a dedicated capability for debug/raw surfaces: cleanest semantics, but it is new public surface and needs a maintainer ruling this card does not have"
 ],
 "recommendation": "A, shipped. It is the narrowest defensible gate, adds zero public surface, and reuses a predicate this repo already documented and tested for an inverted-stake, fail-closed entry decision. B trades a real drift hazard for semantics that are not better here — manage_users holders reading raw clinical payloads is the outcome this card exists to prevent. C is out of bounds without a ruling. Flagging A's coupling explicitly so it is a recorded decision rather than an accident."
 }
 ],
 "out_of_scope_findings": [
 "filed as #5565: the drawer's SUMMARY CARD (payloadSummary) has no field-visibility filter, so a field the object declares hidden:true can render there — same invariant as this card, narrower surface, different render path and different prerequisite (needs a metadata read that is not reachable today). Filed unassigned, no labels, with a recommendation to fix at the producer (server-side projection) rather than as a client-side trim, per AGENTS.md #0.1. Searched first: no duplicate."
 ]
}

---

Generated by Claude Code

[os-sales]

os-dev-report

Supersedes the previous comment: GitHub's sanitizer stripped the HTML-comment marker there (verified by read-back — that body now begins with the code fence), so it is invisible to a marker scan. It also ate three short angle-bracket fragments inside the JSON. This copy uses the literal-text marker and no angle brackets.

{
 "issue": 5553,
 "status": "done",
 "branch": "claude/issue-5553-approvals-raw-payload-panel",
 "pr": "https://github.com/objectstack-ai/objectui/pull/5563",
 "premise_still_valid": true,
 "final_sha": "d96c3727f",
 "files_changed": [
 "apps/console/src/pages/system/ApprovalsInboxPage.tsx (modified: 2 imports, gate predicate, 1 render condition)",
 "apps/console/src/pages/system/ApprovalsInboxPage.rawPayloadGate.test.tsx (new, 4 cases)",
 ".changeset/approvals-raw-payload-gate-5553.md (new, '@object-ui/console': patch)"
 ],
 "summary": "The drawer's Raw data (JSON) panel is now gated on holdsStudioAccess, reused verbatim from apps/console/src/components/studioEntry.ts. No new authorable key was needed or added; no new i18n copy; the file fence was not breached. The gate reads the RAW systemPermissions from usePermissions() and fails CLOSED (no provider / field absent / reported empty all deny), inverted from hasCapabilities, which fails open by design and is the wrong posture for a surface whose defect IS a non-holder seeing it.",
 "pm_assumption_1": "CONFIRMED. ApprovalsInboxPage renders under AppContent, which wraps DefaultAppContent (and its systemRoutes, incl. system/approvals) in MePermissionsProvider — so systemPermissions from /api/v1/auth/me/permissions is reachable via usePermissions() with no new fetch. studio.access is platform-scope and platform-admin-only (framework PLATFORM_ADMIN_ONLY_CAPABILITIES = manage_metadata, manage_platform_settings, studio.access, manage_users). Chose the single narrow capability over mirroring that 4-cap list into the renderer: mirroring would be a second de-facto contract (AGENTS.md #0.1), and manage_users holders have no business reading raw clinical payloads.",
 "pm_assumption_2": "FALSIFIED AS STATED. Object metadata carrying hidden:true is NOT reachable at this point. ApprovalsInboxPage holds no field-level metadata (all 10 'hidden' hits in the file are Tailwind classes, aria-hidden, or prose), and the only object-fields hook, useObjectFields, lives under packages/app-shell/src/views/metadata-admin/previews/ and is NOT exported from packages/app-shell/src/index.ts (grep exit 1). Trimming would have required a new metadata read; the ruling's route did not need one. Filed as #5565.",
 "tests": "All at final commit d96c3727f. (1) pnpm exec vitest run apps/console/ gives 'Test Files 63 passed (63)' / 'Tests 704 passed (704)'. (2) pnpm exec vitest run apps/console/src/pages/system/ gives 'Test Files 10 passed (10)' / 'Tests 64 passed (64)'. (3) pnpm --filter @object-ui/console type-check exit 0, script echoed 'tsc --noEmit && tsc -b tsconfig.node.json --force' (not a zero-match silent pass). (4) pnpm --filter @object-ui/console lint, its own line: '201 problems (0 errors, 201 warnings)'; --format json reports 165 files linted, 0 errors; new test file 0/0; ApprovalsInboxPage.tsx 19 warnings all on pre-existing lines (lowest 522, the pre-existing buildApproverIdentities(user as any) line; added block starts 524). ABLATION (pure source; root vitest aliases every @object-ui specifier at that package's src, so no build artifact sits between edit and run; no dist involved, so no rebuild leg applies): fix committed FIRST at 35fd9497b, then perl -0pi restored the bare condition. Mutation CONFIRMED ON DISK before measuring, not inferred from the editor's exit code — anchored greps on both texts: gated form 'maySeeRawPayload && selected.payload != null' went 1 to 0, bare form 'selected.payload != null && (' went 0 to 1, git diff --stat '1 file changed, 1 insertion(+), 1 deletion(-)'. Predicted direction stated before running: three denial cases red, holder case green. Observed exactly that: 'Tests 3 failed | 1 passed (4)', each failure on the Raw data (JSON) assertion, naming the summary element it found in the DOM. The mutation script carried a trap on EXIT INT TERM to restore; restore verified byte-identical (git status --short and git diff --stat both empty).",
 "gates_run": {
 "note": "Dispatch gate list was objectstack-side and ABSENT in objectui (independently measured here, then PM confirmed mid-task). Re-derived from objectui's own package.json + .github/workflows against my actual changed paths. Verdicts read from each gate's own output line; exit codes captured before any pipe.",
 "check-changeset-fixed": "exit 0",
 "check-changeset-no-major": "exit 0",
 "check-changeset-presence": "exit 0",
 "check-control-bytes": "exit 0 (plus manual self-scan of all 3 changed files: no control bytes)",
 "check:i18n-keys": "exit 0",
 "check:i18n-drift": "exit 0",
 "check:i18n-dead-keys": "exit 0",
 "check:eager-closure": "GREEN: 'Console eager closure is 3784.8 KB gzipped across 52 of 508 chunks (budget: 3867.2 KB, headroom: 82.4 KB)'. First read was exit 2 = BROKEN GAUGE ('No eager-closure report ... the console was not built'), which is the state of any fresh worktree and not a finding about this diff; resolved by actually building the console rather than by argument.",
 "check:phantom-deps": "exit 0",
 "check:self-import": "exit 0",
 "check:esm-specifiers": "exit 0",
 "check-lint-coverage": "exit 0",
 "check-type-check-coverage": "exit 0"
 },
 "i18n_decision": "The rawData locale key STAYS, deliberately. The fix gates the panel rather than removing it, so tr('rawData', 'Raw data (JSON)') remains a live call site and the label still renders for a holder. check:i18n-dead-keys measured green; NO locale table touched. Removing the key would have meant editing ~10 locale files outside this card's file fence, to delete copy that is still reachable.",
 "deviations": [
 "DECLARED NARROWING: repo-wide 'pnpm lint' (turbo, all packages) and 'pnpm type-check' were left to CI; ran the apps/console slice instead. Evidence this is a measurement rather than a skip: population came from ESLint's own config resolution (165 files, count read from --format json), 0 errors; and type-aware linting is NOT enabled in the root eslint.config.js (no projectService, no parserOptions.project), so this diff cannot move the verdict of any untouched file.",
 "Repo guard rejected the 'pnpm --filter PKG test -- PATH' form (objectui#3288: args after the double dash are silently dropped by vitest, and cwd was not the repo root). Used the form the guard itself named: 'pnpm exec vitest run PATH' from the repo root.",
 "Built the console dependency closure and then the console app itself. Both were required and neither is a source change: a fresh worktree has no dist, so type-check could not resolve any @object-ui specifier and the eager-closure gauge did not exist.",
 "All heavy commands ran through scripts/pm/os-verify-lock.sh. Longest single wait 3m34s at position 2/2; no stall, all work completed in-turn.",
 "Report posted twice: the first comment's HTML-comment marker was stripped by the sanitizer (confirmed by read-back). This comment carries the literal-text marker."
 ],
 "open_questions": [
 {
 "question": "The gate reuses holdsStudioAccess, so the approvals raw panel now tracks whatever studio.access means for Studio ENTRY. Correct coupling, or should this surface get its own signal?",
 "options": [
 "A - keep holdsStudioAccess (shipped): one definition of 'platform operator vs business user' in this app, so the two surfaces cannot drift into two spellings of one fact; cost is that re-scoping studio.access silently moves this gate too",
 "B - mirror the framework's PLATFORM_ADMIN_ONLY_CAPABILITIES (manage_metadata, manage_platform_settings, studio.access, manage_users) into the renderer: matches the server's own platform-admin probe exactly, but copies a cross-repo list that can go stale, and widens the audience to user admins",
 "C - mint a dedicated capability for debug/raw surfaces: cleanest semantics, but it is new public surface and needs a maintainer ruling this card does not have"
 ],
 "recommendation": "A, shipped. It is the narrowest defensible gate, adds zero public surface, and reuses a predicate this repo already documented and tested for an inverted-stake, fail-closed entry decision. B trades a real drift hazard for semantics that are not better here — manage_users holders reading raw clinical payloads is the outcome this card exists to prevent. C is out of bounds without a ruling. Flagging A's coupling explicitly so it is a recorded decision rather than an accident."
 }
 ],
 "out_of_scope_findings": [
 "filed as #5565: the drawer's SUMMARY CARD (payloadSummary) has no field-visibility filter, so a field the object declares hidden:true can render there — same invariant as this card, narrower surface, different render path, and a different prerequisite (needs a metadata read that is not reachable today). Filed unassigned, no labels, recommending a fix at the producer (server-side projection) rather than a client-side trim, per AGENTS.md #0.1. Searched twice first: no duplicate."
 ]
}

---

Generated by Claude Code