Uh oh!
There was an error while loading. Please reload this page.
fix(studio): scope Access rail server-side by package (ADR-0086 P1 follow-up) - #2229
Merged
Merged
Conversation
The Access pillar's permission-set rail filtered client-side on a `package_id`
read from `client.list('permission')` rows. But the metadata list endpoint does
not echo the record-level provenance columns — every row returns with
`package_id` unset — so the guard "is any set tagged?" never fired and the rail
showed ALL sets, including environment-owned platform defaults
(`admin_full_access`, `member_default`, …), inside a package's Access panel.
Scope the rail server-side via `client.list('permission', { packageId })`: the
metadata API filters `permission` by the `package_id` provenance seeded in
framework ADR-0086 P1, returning only the sets this package owns. The
draft-merge (published ∪ package-scoped drafts) is unchanged; the now-unused
`scopePermissionSetList` client helper is removed.
Verified against a live showcase backend (objectstack dev --fresh): the panel
lists exactly showcase_contributor + showcase_member_default and excludes the
four platform defaults; objects scope 84 → 20 the same way (P0, unchanged).
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QWcZRYnJXN3YXFTbm3PLg5The latest updates on your projects. Learn more about Vercel for GitHub. |
Contributor
✅ Console Performance Budget
📦 Bundle Size Report
Size Limits
|
…packageid-scope-pbndje
…x main) #2228 changed CreateWorkspaceDialog to pass the workspace name through as the production env `displayName`, but left this test asserting only `{ organizationId }` — so it fails on main for every branch that includes the change. Align the assertion with the shipped behavior. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01QWcZRYnJXN3YXFTbm3PLg5
Contributor
✅ Console Performance Budget
📦 Bundle Size Report
Size Limits
|
os-zhuang
marked this pull request as ready for review
July 4, 2026 15:17
Uh oh!
There was an error while loading. Please reload this page.
3 tasks
8 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Follow-up to #2222 (P0) / #2225 (P2), addressing #2223 item 1. Found by live end-to-end verification against a real backend now that framework ADR-0086 P1 (framework#2566) is merged.
The bug (silent, security-relevant)
The Access pillar's permission-set rail filtered client-side on a
package_idread fromclient.list('permission')rows, hiding environment-owned platform defaults from a package's panel. But the metadata list endpoint does not echo the record-level provenance columns — every row comes back withpackage_idunset. So the "is any set tagged?" guard never fired and the rail fell back to showing all sets, includingadmin_full_access/member_default, inside a package's Access panel. This defeated acceptance item 3 of the #2221 coordination note ("platform defaults must not appear in a package's Access panel").Fix
Scope the rail server-side:
client.list('permission', { packageId }). The metadata API filterspermissionby thepackage_idprovenance seeded in framework ADR-0086 P1, returning only the sets this package owns — the same mechanism the Data/Interfaces pillars already use for objects (list('object', { packageId })). The published ∪ package-scoped-drafts merge (P2) is unchanged; the now-unusedscopePermissionSetListclient helper is removed.Live verification (objectstack dev --fresh showcase backend on :4010)
Ran the real framework showcase backend (with P1 + P2 merged) and the objectui console dev proxying to it, and checked the exact calls the UI makes:
meta/permission(unscoped)meta/permission?package=com.example.showcaseshowcase_contributor,showcase_member_default)meta/object(unscoped)meta/object?package=com.example.showcaseshowcase_*)Provenance confirmed on the data rows (
sys_permission_set):showcase_*→managed_by=package, package_id=com.example.showcase; the four platform defaults → null (environment-owned). The 84→20 object scoping is the P0 behavior from #2222, re-confirmed live.Tests
permission-slice.test.ts— updated (drops the removed helper's cases);scopePermissionSet/mergePermissionSlicestill pinned.PermissionMatrixEditor.scope.test.tsx— unchanged, still green (object scope + slice-merge + P2 draft-save mode).type-check0 errors.Follow-ups (tracked in #2223)
🤖 Generated with Claude Code
https://claude.ai/code/session_01QWcZRYnJXN3YXFTbm3PLg5
Generated by Claude Code