Uh oh!
There was an error while loading. Please reload this page.
fix(fls): wire real per-caller FLS into import targets and grid columns, drop dead field.permissions shape - #2866
Merged
Conversation
…ns, drop dead field.permissions shape (objectstack#3661)
The `permissions?: { read?, write?, edit? }` key on field definitions was
declared-but-never-enforced: no producer ever populated it, so all three
guards reading it permanently short-circuited to "allow". Per ADR-0049
enforce-or-remove:
- ImportWizard target fields (ObjectView): filter by the server-resolved
/auth/me/permissions editable bit via usePermissions().checkField, so
the mapping step and the downloadable CSV template stop offering
columns the FLS write gate rejects with 403.
- ObjectGrid auto-derived columns: drop columns the caller cannot read
(same checkField gate ListView already applies).
- ObjectForm: delete the redundant dead guard in field generation — the
existing applyFieldPerms gate is the real enforcement point.
- @object-ui/types: remove the never-populated `permissions` field shape
(BREAKING) so future guards against it fail at compile time.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01AEb4XCVb7iLEBVe9HghjTtThe latest updates on your projects. Learn more about Vercel for GitHub. |
Contributor
✅ Console Performance Budget
📦 Bundle Size Report
Size Limits
|
os-zhuang
marked this pull request as ready for review
July 27, 2026 14:15
10 tasks
Uh oh!
There was an error while loading. Please reload this page.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Implements steps ① and ② of objectstack-ai/objectstack#3661 (metadata-plane FLS: dead
field.permissionsguards).What changed
① Wire the real per-caller FLS channel (
/auth/me/permissionsviausePermissions().checkField) into the two surfaces that had none:app-shell/ObjectView.tsx): the importable field set — and therefore the downloadable CSV template's columns — now drops fields the caller cannot edit (checkField(object, field, 'write')), instead of offering columns the server-side FLS write gate rejects with an explicit 403 (security-plugin.tsstep 2.5). Permissive when no permission provider is mounted (!perms?.isLoaded), matching the ListView precedent.plugin-grid/ObjectGrid.tsx): columns the caller cannot read are dropped viacheckField(object, field, 'read')— the same gate ListView already applies to its auto-derived columns (ListView.tsx:961).plugin-form/ObjectForm.tsx): the dead guard in field generation is deleted outright — its output already flows through the realapplyFieldPermsgate (checkFieldread/write), so the dead check was redundant there rather than a gap.② Remove the never-populated
permissions?: { read?, write?, edit? }shape from@object-ui/types(BREAKING):The shape was Phase 3.2.6 legacy: it exists in no
@objectstack/specschema, has zero producers in either repo, and every guard reading it permanently short-circuited to "allow" — declared ≠ enforced (ADR-0049 enforce-or-remove). Deleting the key makes any future guard written against it a compile error. Rides the major release currently being prepared (amajorchangeset for the fixed group is already pending).What this is NOT
/metaobject schemas) is intentionally not included: per the maintainer, target deployments have no untrusted authenticated callers, so the metadata plane stays unmasked with/auth/me/permissionsas the authoritative per-caller channel (to be recorded in an ADR).Verification
turbo run buildfor the 4 touched packages + dependents: 29/29 green.vitest --project unit: 429 + 1010 tests green;--project dom --project dom-heavyfor plugin-form / plugin-grid / app-shell / permissions: 1103 tests green.changeset:checkandturbo run lintfor touched packages: green.Closes nothing by itself — tracked by objectstack-ai/objectstack#3661 (steps ①②).
🤖 Generated with Claude Code
https://claude.ai/code/session_01AEb4XCVb7iLEBVe9HghjTt
Generated by Claude Code