feat(spec,security,lint): ADR-0066 authoring surface — per-operation requiredPermissions (⑤) + capability-reference lint (⑨)#2690
Merged
Conversation
…66 ⑤)
Object `requiredPermissions` may now be either a `string[]` (gates all CRUD,
the original shape) or a `{ read, create, update, delete }` map that gates each
operation class independently — enabling read-open / write-gated objects
(Salesforce & Dataverse separate capability by operation).
- spec: `ObjectRequiredPermissionsSchema` union + `PerOperationRequiredPermissions`
(`.strict()` so a mistyped key fails at author time).
- plugin-security: normalize into per-CRUD buckets and enforce the caps for the
request's operation as the same D3 AND-gate (fail-closed, checked before the
CRUD grant). `transfer`/`restore` fold into `update`, `purge` into `delete`
via `crudBucketForOperation`, derived from the CRUD permission bits.
- Backward-compatible: the array form is normalized into an `all` bucket that
unions with the per-op bucket, preserving gate-every-operation semantics.
- Tests: per-operation middleware cases (read-open / create-gated / array-form
backward compat) + `crudBucketForOperation` unit tests. Docs + ADR-0066 ⑤
marked landed; api-surface snapshot regenerated.
Refs #2561
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0187GeNqezxV6g5jiLiggfbt
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
github-actions
Bot
added
size/m
documentation
Contributor
📓 Docs Drift CheckThis PR changes 4 package(s): 100 hand-written doc(s) reference the affected code and may need an implementation-accuracy re-verification:
|
`requiredPermissions` is a free string, so a typo (`mange_users`) is schema-valid and fails closed at runtime — safe but undiscoverable. The new `validateCapabilityReferences` rule (@objectstack/lint) warns at author time (`os validate` / `os lint`) when a `requiredPermissions` on an object, field, app, or action names a capability registered nowhere. Author-time "known" set = built-in platform capabilities ∪ capabilities the stack grants via a permission set's `systemPermissions` ∪ `sys_capability` seed rows. Warning (not error): a package can't see other installed packages' capabilities, and the reference fails closed anyway. `systemPermissions` (the declaration side) is never flagged. Understands the per-operation `requiredPermissions` map form (⑤) and points at the exact operation slice. - spec: canonical `PLATFORM_CAPABILITIES` / `PLATFORM_CAPABILITY_NAMES` (security/capabilities.ts) as the single source of truth. - plugin-security: `bootstrapSystemCapabilities` now seeds from that list (KNOWN_CAPABILITIES re-exports it — no drift between seeder and lint). - cli: wired into `os validate` and `os lint`. - Tests: 8 rule cases; end-to-end verified via `os validate`. Docs + ADR-0066 ⑨ marked landed; api-surface snapshot regenerated. Refs #2561 Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0187GeNqezxV6g5jiLiggfbt
os-zhuang
changed the title
This was referenced Jul 8, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What & why
Closes two P2 model-completeness items on the authorization gap map (umbrella #2561), both on the ADR-0066 authoring surface. They ship together because ⑨'s lint understands ⑤'s per-operation shape.
⑤ Per-operation object
requiredPermissionsToday an object's
requiredPermissionsgates all of CRUD on one capability set; ERP routinely needs "read-open / write-gated" (Salesforce & Dataverse separate capability by operation).Object.requiredPermissionsnow accepts eitherstring[](all operations, original shape) or{ read?, create?, update?, delete? }(gates each operation class independently).data/object.zod.ts):ObjectRequiredPermissionsSchemaunion +PerOperationRequiredPermissionsSchema(.strict(), so a mistyped key is rejected at author time).crudBucketForOperation(derived fromOPERATION_TO_PERMISSION) foldstransfer/restore→update,purge→delete.string[]form normalizes into anallbucket that unions with every operation, preserving gate-every-operation semantics.⑨ Author-time capability-reference lint
requiredPermissionsis a free string, so a typo (mange_users) is schema-valid and fails closed at runtime — safe but undiscoverable. NewvalidateCapabilityReferences(@objectstack/lint) warns at author time when arequiredPermissions(object / field / app / action) names a capability registered nowhere.systemPermissions∪sys_capabilityseed rows.systemPermissions(the declaration side) is never flagged. Understands the ⑤ per-operation map and points at the exact operation slice.PLATFORM_CAPABILITIES/PLATFORM_CAPABILITY_NAMES(security/capabilities.ts) as the single source of truth;plugin-security'sbootstrapSystemCapabilitiesseeds from that same list (no drift between seeder and lint).os validateandos lint.Tests / verification
plugin-security: 192 passed (⑤ middleware cases +crudBucketForOperationunit tests).lint: 139 passed (8 new ⑨ rule cases).spec: 6715 passed; API-surface snapshot regenerated (0 breaking, 7 added exports); liveness ✓.turbo buildgreen (no downstream typecheck breakage).os validateruns the new step clean on a real example app, and emits the expected warning on a seeded capability typo (validation still passes — non-blocking).content/docs/permissions/authorization.mdx) + ADR-0066 ⑤/⑨ updated to "landed".Refs #2561
🤖 Generated with Claude Code
https://claude.ai/code/session_0187GeNqezxV6g5jiLiggfbt