refactor(metadata-core): 回收 sys_view_definition 的等价全开白名单 + 派生契约端到端实测 (#3026) - #3772
Merged
os-zhuang merged 1 commit intoJul 28, 2026
Merged
Conversation
…s whitelist (#3026) #3745 completed this object's boilerplate CRUD-five whitelist to all six primitives so its batch routes stopped 405-ing. A whitelist naming all six is equivalent to no whitelist — except it stops tracking primitives the enum grows later — so the #3543 audit rule ("delete the equivalent-to-open boilerplate") applies and the declaration goes. No behaviour change: `undefined` resolves to `unrestricted`, whose effective operation set is identical to `restricted` holding all six primitives. Removing it is safe HERE specifically because the object has no `managedBy`: `reconcileManagedApiMethods` (ADR-0103 D3) early-returns on a non-array `apiMethods`, so for a managed object an absent whitelist would take the managed-write backstop with it. That is why the RBAC objects reclaimed by #3745 keep their explicit arrays and this one does not — the two treatments are not inconsistent, they follow the presence of a backstop. The object's test is rewritten to guard the new shape in both directions (whitelist must stay absent; the resolver must report `unrestricted`) and to pin the derived verbs the contract grants it. Verified end-to-end against a real running server (showcase, seeded admin), not only by unit test: 14/14 checks over the live REST surface, including this object's deleteMany reaching the engine rather than the API gate, derived import/export on a whitelist-free object, a tightened object still answering 405, and apiEnabled:false still answering 404 ahead of the method gate. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01CkdX2VCuKfcsFBbvtATe7V
|
The latest updates on your projects. Learn more about Vercel for GitHub. 1 Skipped Deployment
|
github-actions
Bot
added
documentation
Contributor
📓 Docs Drift CheckThis PR changes 1 package(s): 2 hand-written doc(s) reference the affected code and may need an implementation-accuracy re-verification:
|
os-zhuang
marked this pull request as ready for review
July 28, 2026 04:17
This was referenced Jul 28, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
改动
sys_view_definition删除apiMethods声明(#3745 把它补成六原语后,已与"无白名单"等价),并重写其测试。零行为变化:
undefined解析为unrestricted,其有效操作集与"restricted且持有全部六原语"完全相同(resolveEffectiveApiMethods对两者走同一张computeOperations,未映射的自定义 action 两种模式下也都放行)。为什么这个对象删、#3745 的七个不删
不是双标,是有没有兜底可保:
reconcileManagedApiMethods(ADR-0103 D3)在apiMethods非数组时早退——所以对
managedBy对象,删掉白名单会连带关掉 managed-write 兜底(#3745 那七个都是managedBy,故保留显式数组)。sys_view_definition没有managedBy→ D3 本就不适用 → 没有任何东西argues for保留声明 → 按 #3543 审计惯例(等价全开的样板直接删)回收。测试改为双向守卫:白名单必须保持缺席(重新加回"全六个"是无操作且不再跟踪未来原语,加回更窄的则会静默关掉今天开着的路由),且 resolver 必须报
unrestricted;另加一条钉住它派生得到的数据可携带性动词。派生契约端到端实测(本 PR 的另一半)
之前 #3745 / #3755 的结论都来自单测。这次按仓内
dogfood-verification流程起真实服务(showcase +--fresh --seed-admin,独占端口 38977),以种子管理员登录后打真实 REST 面,14/14 通过:/me/permissions下发 per-objectapiOperationssys_user → [get,list,update,bulk,aggregate,history,search,import,export]*按设计跳过)sys_permission_seteffective 含bulksys_business_unitexport(白名单里从未声明过 export)sys_business_unitimport(从未声明过 import)sys_permission_set/sys_position/sys_user_position/sys_view_definition的deleteManysys_api_key(白名单[get,list])exportsys_api_keycreate / import / deleteManysys_oauth_consent(apiEnabled:false)未覆盖:按钮显隐那一半在 objectui 仓,
packages/console/dist需要从该仓构建;本会话没有 objectui 接入,所以前端渲染未做浏览器验证,上表全部是服务端权威行为。验证
@objectstack/metadata-core8 files / 103 tests 全过changeset:
@objectstack/metadata-corepatch。关联
#3026、#3745(补
bulk的那批对象)、#3755(防复发棘轮)、#3543(P2 审计惯例)、ADR-0103 D3Generated by Claude Code