Repository navigation
Commit 150da61
Clause-②: no
Part of #15204 (C3 stage 8, the test half: S8-T). The code half (S8) is
built ahead on `claude/issue-15204-s8-catalog-objects` and lands right
after this PR. #15204 remains open.
## What this changes
Test files only. Every edit keeps the suite green on `main` **and** on
`main` + S8, where the four security-catalog row objects
(`sys_position`, `sys_permission_set`, `sys_position_permission_set`,
`sys_capability`) are no longer registered (ADR-0131 D3).
- **A testkit for the retired tables.**
`plugin-security/src/__tests__/legacy-catalog-objects.testkit.ts` holds
the four tables' shapes (fields, indexes, validations only), for suites
that model an existing database whose rows outlive the object
declarations until the organization-ownership migration (ADR-0131 D10).
The suites that registered the object declarations import the shapes
from it; `withLegacyCatalogTables()` adds the shapes a plugin no longer
declares. plugin-auth's two grant-reader suites register the
`sys_permission_set` shape the same way
(`plugin-auth/src/__tests__/legacy-catalog-objects.testkit.ts`, a
test-only copy: the plugin-security file is no export, and a relative
import would make a test read another package's source) before seeding
the platform-bucket rows.
- **Deleted, because they pin what S8 removes:** the object-declaration
pins (`sys-*.organization-unique`, `sys-capability-deactivation-claim`,
`clone-carryover`, the junction/position cases of `rbac-objects`,
`reserved-identity-names`, `managed-by-system-data`,
`sys-security-assignment-display-title`, `rbac-objects-bulk-exposure`),
`position-write-through.test.ts` (S8 unwires that middleware; 7b deletes
the module), `bootstrap-platform-admin-refused-existence-read.test.ts`
(the legacy-row read S8 removes), `row-active.test.ts` (S8 deletes
`isRowActive`), pin 6 of `packaged-permission-set-lock.test.ts`, and the
dogfood files for the data-door write-throughs, the projection, the row
lock and the junction gates: `two-doors-permission`,
`declared-position-provenance`, `permission-set-lock-row-provenance`,
`permission-set-write-through-package-binding`,
`showcase-permission-projection`, `position-environment-write-through`,
`position-held-name-setup-create`. `ensureLegacyPermissionSetRow` leaves
the dogfood catalog helper with its last callers.
`walled-catalog-data-door.test.ts` (#22895) stays with `main`'s bytes:
S8 deletes it together with the walled data-door refusal it pins.
- **Fixtures moved off the rows:** dogfood suites that authored a
permission set through `POST /api/v1/data/sys_permission_set` use `PUT
/api/v1/meta/permission/:name` (or `protocol.saveMetaItem`); checks that
a set "was seeded" read the security catalog (`catalogPermissionSet`) or
the registry; vestigial `sys_position` row inserts are gone.
`mail-message-pool-read-gate` reads its fixture sets from the catalog
(split out and landed on `main` as #23159, `b8f226c440`, the same blob).
- **Pins made to span the change:**
- censuses of a retired table run only where the object is registered
(`showcase-permission-seeding`, the runtime seeder-copy suite,
`permission-set-clone-door`, `showcase-d7-default-profile`);
- `wall-catalog-refusal`'s data-door case answers `403
PERMISSION_DENIED` while the row objects are registered and `404
OBJECT_NOT_FOUND` once they are retired, with no definition either way;
- `builtin-positions.boot`'s walled golden keeps `control: create a
position row` (`403 PERMISSION_DENIED`, the walled data-door refusal of
`walled-catalog-data-door.ts`) wherever the plugin declares
`sys_position`, and leaves it out only once the object is retired; every
other key is unchanged;
- `cleanup-package-permissions.test.ts` hands the sweep D's
`UninstallDeclared` shape (`{ permission: [...] }`) and asserts what
holds both ways; D's two named-grant pins are restated over this
fixture;
- the clone-route refusal prose is pinned around the route; the
uninstall-cleanup runner request may carry `declared`; page/registry
floors drop by the retired page and the four names (the record-page
label-map floor is 38, with B2's two maps gone); the tenancy-inventory
and dangling-reference fixtures use surviving security tables.
- **New pins:**
- `bootstrap-platform-admin-fresh-boot.golden.test.ts`: a fresh
`single`-posture engine holding only the plugin's own objects promotes
its first human (E6's first pin). E6's second pin is the existing
`grant-readers-unnamed-grant` suite.
- `permission-metadata-door-reaches-catalog.dogfood.test.ts`: a create,
an edit and a delete through `/api/v1/meta/permission` each reach the
security catalog the resolver reads (the premise E1 → A rested on).
## Merge of `main` after D, and the re-check against D
Merge commit `a805619472` takes `main` at `f931e765b7` (D #22900 is
`c8a9783eca`). No rebase, no force-push; generated files went through
`scripts/pm/os-regen-merge.sh` (this branch touches none; the rerun's
step 2 took nothing). Conflicts, all hand-written test files:
- modify/delete, S8-T's deletion taken over `main`'s edit:
`bootstrap-platform-admin-refused-existence-read` (D),
`position-write-through` (#22895), and the dogfood
`permission-set-lock-row-provenance`,
`permission-set-write-through-package-binding`,
`showcase-permission-projection`, `two-doors-permission` (T2, and
#22874's rename);
- `rbac-objects`: S8-T's removal of the retired declaration pins (`main`
had only dropped one case inside them);
- `activity-text-predicate`, `approval-snapshot-masked-field`,
`sharing-rule-org-less-caller`, `showcase-crud-persona-matrix`: `main`'s
`catalogPermissionSet` reads kept, S8-T's `sys_position` insert removals
kept;
- `showcase-permission-zoo`: S8-T's side;
`showcase-fls-read-mask-strip`: S8-T's metadata-door authoring plus
`main`'s catalog read;
- `bootstrap-platform-admin-authenticable-target`,
`-promotion-selection`, `per-organization-catalog`: `main`'s
`seedLegacyPlatformBucket` import (and T1's removal of
`bootstrapDeclaredPermissions`) with the testkit imports;
- `standalone-stack-seeder-declaration-copy`: `main`'s "no row" pin kept
beside S8-T's registered-object guard;
- `platform-page-i18n-parity`: the label-map floor restated for B2 and
the retired page.
D changed after `fcaedfdaa1`, the base S8-T was first built against.
Every case the stage-8 report pinned against D was re-checked on this
merge:
| case | result |
|:---|:---|
| S8-T's deletions over D's edits | taken; the deleted suites'
assertions are what S8 removes |
| `catalogPermissionSet` reads in the four dogfood files | kept; green
on both trees |
| `showcase-fls-read-mask-strip`, `showcase-permission-zoo` | S8-T's
side (FLS also keeps `main`'s catalog read); green on both trees |
| `ensureLegacyPermissionSetRow` | deleted from the dogfood helper; no
caller left (`git grep`) |
| `showcase-permission-seeding` census | guarded by
`getObject('sys_permission_set')`; green on both trees |
| plugin-security imports | `seedLegacyPlatformBucket` plus the testkit;
green on both trees |
| D's uninstall cleanup by catalog set name | D landed
`UninstallDeclared` (`{ permission }`), not the bare array S8-T was
written against: `cleanup-package-permissions.test.ts` now passes that
shape, D's two named-grant pins restated; green on both trees |
| E6 fresh-boot golden | green on both trees; ablation below |
| E6 second pin (`grant-readers-unnamed-grant`, plugin-security and
plugin-auth) | green on both trees; plugin-auth's copy registers the
legacy table before seeding |
| E1 premise (`permission-metadata-door-reaches-catalog`) | green on
both trees |
| uninstall-cleanup runner `declared` | green on both trees |
Suites `main` brought in or changed after S8-T's base that read the four
objects, made to hold on both trees here: `wall-catalog-refusal`,
`mail-message-pool-read-gate`, plugin-auth's two grant-reader suites
(legacy table registered before the T2 bucket seed, seat ruling),
`builtin-positions.boot` (walled create judged while `sys_position` is
declared, seat ruling). `walled-catalog-data-door.test.ts` is kept with
`main`'s bytes: green on `main` + S8-T, red on `main` + S8-T + S8 by
design, and S8 deletes it with the door.
## Verification
Two trees, built locally through `scripts/pm/os-verify-lock.sh`:
- **`main` + S8-T**: this branch.
- **`main` + S8-T + S8**: a local, never-pushed scratch tree, S8's own
commit `dbae752f6e` replayed onto this branch, its conflicts with D's
final form resolved the way the S8 build-ahead resolved them (D's
`captureUninstallDeclared` / `UninstallDeclared` kept; the walled
data-door refusal unregistered with the write-throughs).
| suite | `main` + S8-T | `main` + S8-T + S8 |
|:---|:---|:---|
| plugin-security, full | 186 files, 3,831 passed, 45 skipped (at
`9d55c0589a`, `walled-catalog-data-door.test.ts` included) | 185 files,
3,815 passed, 45 skipped, 4 failed in `builtin-positions.boot` (at S8-T
`008ca32a75`), fixed below |
| `builtin-positions.boot` | 52 passed (at `9d9bdd96b2`; the walled
create key judged, `403 PERMISSION_DENIED`) | 52 passed (the key left
out) |
| `walled-catalog-data-door` (`main`'s bytes) | 12 passed (at
`9d9bdd96b2`) | red by design (`Cannot find module
'./objects/sys-position.object.js'`); S8 deletes it with the door |
| `cleanup-package-permissions` | 10 passed | 10 passed |
| plugin-auth `grant-readers-by-name.golden`,
`grant-readers-unnamed-grant` | 9 passed (at `e40fe491c1`) | 9 failed at
`008ca32a75` ("Object 'sys_permission_set' not found"); 9 passed at
`e40fe491c1` |
| cli unit (`organization-ownership-inventory`,
`platform-page-i18n-parity`) | 35 passed | 1 failed at `008ca32a75` (38
label maps under a floor of 39); 35 passed with the floor at 38 |
| metadata-protocol (3 files) | 89 passed | 89 passed |
| objectql (2 files) | 58 passed | 58 passed |
| platform-objects (1 file) | 20 passed | 15 passed |
| lint, rest, runtime, spec (1 file each) | 15, 11, 13, 11 passed | 15,
11, 13, 11 passed |
| core `src/security` | 37 files, 867 passed | 37 files, 867 passed |
| typecheck | 12 touched packages, 77 turbo tasks green (at
`d426f922ed`); plugin-auth again at `e40fe491c1` | plugin-security,
plugin-auth, dogfood: 67 tasks green; plugin-auth again at the final
head |
Every file changed after a full run was re-run on both trees at the
final head. E6 ablation on the `main` + S8-T + S8 tree: with `main`'s
(D's) `bootstrap-platform-admin.ts` put back (blob `edf2a164d9`, on disk
by hash), the fresh-boot golden goes red, 2 of 2 (`adminPromoted:
false`); restored (blob `56166db769`, `git diff HEAD` empty), green, 2
of 2.
## Dogfood
PR and queue CI do not run the dogfood shards (#22998), so this is their
first record before `main`'s full battery. The 24 files S8-T touches or
that read the four objects, on the showcase boot:
| tree | result |
|:---|:---|
| `main` + S8-T | 23 of 24 files at `9d55c0589a`, the red one
`mail-message-pool-read-gate` (`main`'s own red since D; this branch
carries the hunk #23159 landed on `main`); at `c0dc292ae8` that file and
`wall-catalog-refusal` green, `activity-text-predicate` timed out once
(5000 ms, contended box) and passed alone (22 of 22) at `d426f922ed` |
| `main` + S8-T + S8 | 24 of 24 files, 280 tests passed |
No dogfood file changed after `008ca32a75`.
## Gates
`node scripts/pm/dispatch-gates.mjs --commands --repo
objectstack-ai/objectstack` derives 89 commands for this diff at
`9d9bdd96b2` (the same 89 as the dispatch's list at `0d43004100`). All
89 ran after the final commit and exit 0 (`check:dual-build-cjs-loads`
first answered PREREQUISITE NOT MET, exit 3, and exit 0 once every
package was built); `--ran` with each exit code recorded: "89 derived,
89 run, 0 NOT-MEASURED, 0 UNRUN". `check:entry-nameability` keeps its
existing note that `@objectstack/spec/api-assembled` and `/qa` have no
callable export to measure; `packages/spec` is untouched.
## Size
93 files, +1,255 / −3,950 = 5,205 changed lines against the merge base
`f931e765b7`, almost all deletion: over the 3,000-line line, so this
lands by the maintainer's approval. `mail-message-pool-read-gate` leaves
the diff at the next `main` merge (`main` carries the same blob).
`skip-changeset`: only test files, a test-only testkit under
`src/__tests__` (no entry imports it; `files` ships `dist` only) and the
private dogfood package change.
## 维护者速读(草稿)
**改了什么**
C3 第 8 阶段的"测试半边"(S8-T),只改测试文件:93 个文件,+1,255 / −3,950
行,绝大部分是删除。四个已退役的安全目录行对象(`sys_position`、`sys_permission_set`、`sys_position_permission_set`、`sys_capability`)将在
S8 中取消注册;本 PR 先让测试不再依赖它们:删除只钉住"S8
要拆掉的行为"的测试,夹具改为走元数据门(`/api/v1/meta`)或读安全目录,少数断言改成无论对象是否注册都成立。本轮还把 D 落地后的
`main` 合进来,并修了 `main` 新带进来、依赖这四个对象的 5 个测试文件。
**为什么改**
ADR-0131 D3 规定权限集、岗位、能力只有一个归宿:安全目录(注册表)。S8 取消注册这四个行对象;测试若不先迁走,S8
一落地就会大面积变红。测试半边单独先落,S8 本身的代码改动才能保持可审。
**风险与代价(含回滚)**
- 只动测试,产品行为零变化;回滚即 revert 本 PR 的合并提交。
- S8 落地前的短窗口里,`main`
上少了几条钉"即将被拆掉的行为"的单元测试(如数据门写穿);走廊下数据门的创建拒绝(`walled-catalog-data-door.ts`)仍由原样保留的
`walled-catalog-data-door.test.ts` 和 `builtin-positions.boot` 钉着,S8
连同该门一起删除它们。S8 紧随其后落地。
- 超过 3000 行,按规则需要您的批准;其中约 76% 是删除。
- PR 与队列 CI 不跑 dogfood(#22998);两棵树都已在本地跑过,`main` 的完整测试组是它们在 CI 上的首次记录。
**席位意见**
**你要做的**
批准本 PR(授权批准或亲自合并);之后席位接着落 S8。
---
_Generated by [Claude
Code](https://claude.ai/code/session_01ADzJtzYTLUfgrRZHxkagkX)_
---------
Co-authored-by: Claude <noreply@anthropic.com>
1 parent 107853c commit 150da61
92 files changed
Lines changed: 1250 additions & 3948 deletions
File tree
- packages
- cli
- src/utils
- test
- core/src/security
- lint/src
- metadata-protocol/src
- objectql/src
- integrity
- platform-objects/src/pages
- plugins
- plugin-auth/src
- __tests__
- plugin-security/src
- __tests__
- objects
- translations
- qa/dogfood
- test
- rest/src
- runtime/src
- spec/src/system/constants
Some content is hidden
Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
86 | 86 | | |
87 | 87 | | |
88 | 88 | | |
89 | | - | |
| 89 | + | |
| 90 | + | |
90 | 91 | | |
91 | 92 | | |
92 | 93 | | |
| |||
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
788 | 788 | | |
789 | 789 | | |
790 | 790 | | |
791 | | - | |
| 791 | + | |
| 792 | + | |
792 | 793 | | |
793 | | - | |
| 794 | + | |
794 | 795 | | |
795 | 796 | | |
796 | 797 | | |
| |||
838 | 839 | | |
839 | 840 | | |
840 | 841 | | |
841 | | - | |
842 | | - | |
843 | | - | |
| 842 | + | |
| 843 | + | |
| 844 | + | |
| 845 | + | |
844 | 846 | | |
845 | 847 | | |
846 | 848 | | |
| |||
1041 | 1043 | | |
1042 | 1044 | | |
1043 | 1045 | | |
1044 | | - | |
| 1046 | + | |
| 1047 | + | |
1045 | 1048 | | |
1046 | 1049 | | |
1047 | 1050 | | |
1048 | 1051 | | |
1049 | 1052 | | |
1050 | 1053 | | |
1051 | | - | |
1052 | 1054 | | |
1053 | 1055 | | |
1054 | 1056 | | |
| |||
1063 | 1065 | | |
1064 | 1066 | | |
1065 | 1067 | | |
1066 | | - | |
| 1068 | + | |
1067 | 1069 | | |
1068 | 1070 | | |
1069 | 1071 | | |
| |||
1202 | 1204 | | |
1203 | 1205 | | |
1204 | 1206 | | |
1205 | | - | |
| 1207 | + | |
| 1208 | + | |
1206 | 1209 | | |
1207 | 1210 | | |
1208 | | - | |
| 1211 | + | |
1209 | 1212 | | |
1210 | 1213 | | |
1211 | 1214 | | |
| |||
This file was deleted.
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
44 | 44 | | |
45 | 45 | | |
46 | 46 | | |
47 | | - | |
48 | | - | |
49 | | - | |
50 | | - | |
51 | | - | |
52 | | - | |
53 | | - | |
54 | | - | |
55 | 47 | | |
56 | 48 | | |
57 | 49 | | |
| |||
193 | 185 | | |
194 | 186 | | |
195 | 187 | | |
196 | | - | |
197 | | - | |
198 | | - | |
199 | | - | |
| 188 | + | |
| 189 | + | |
| 190 | + | |
| 191 | + | |
| 192 | + | |
200 | 193 | | |
201 | 194 | | |
202 | 195 | | |
| |||
218 | 211 | | |
219 | 212 | | |
220 | 213 | | |
221 | | - | |
| 214 | + | |
222 | 215 | | |
223 | 216 | | |
224 | | - | |
| 217 | + | |
225 | 218 | | |
226 | 219 | | |
227 | 220 | | |
228 | 221 | | |
229 | 222 | | |
230 | 223 | | |
231 | 224 | | |
232 | | - | |
233 | 225 | | |
234 | 226 | | |
235 | 227 | | |
| |||
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
369 | 369 | | |
370 | 370 | | |
371 | 371 | | |
372 | | - | |
373 | | - | |
374 | | - | |
375 | | - | |
| 372 | + | |
| 373 | + | |
| 374 | + | |
| 375 | + | |
376 | 376 | | |
377 | 377 | | |
378 | 378 | | |
| |||
411 | 411 | | |
412 | 412 | | |
413 | 413 | | |
414 | | - | |
| 414 | + | |
415 | 415 | | |
416 | 416 | | |
417 | 417 | | |
| |||
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
99 | 99 | | |
100 | 100 | | |
101 | 101 | | |
102 | | - | |
| 102 | + | |
| 103 | + | |
| 104 | + | |
103 | 105 | | |
104 | 106 | | |
105 | 107 | | |
| |||
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
574 | 574 | | |
575 | 575 | | |
576 | 576 | | |
577 | | - | |
578 | | - | |
579 | | - | |
580 | | - | |
| 577 | + | |
| 578 | + | |
| 579 | + | |
| 580 | + | |
| 581 | + | |
581 | 582 | | |
582 | 583 | | |
583 | 584 | | |
| |||
1253 | 1254 | | |
1254 | 1255 | | |
1255 | 1256 | | |
| 1257 | + | |
| 1258 | + | |
1256 | 1259 | | |
1257 | | - | |
| 1260 | + | |
| 1261 | + | |
| 1262 | + | |
| 1263 | + | |
| 1264 | + | |
| 1265 | + | |
| 1266 | + | |
| 1267 | + | |
1258 | 1268 | | |
1259 | 1269 | | |
1260 | 1270 | | |
| |||
1286 | 1296 | | |
1287 | 1297 | | |
1288 | 1298 | | |
1289 | | - | |
1290 | | - | |
1291 | | - | |
1292 | | - | |
| 1299 | + | |
| 1300 | + | |
| 1301 | + | |
1293 | 1302 | | |
1294 | 1303 | | |
1295 | 1304 | | |
| |||
1359 | 1368 | | |
1360 | 1369 | | |
1361 | 1370 | | |
1362 | | - | |
1363 | | - | |
1364 | | - | |
1365 | | - | |
| 1371 | + | |
| 1372 | + | |
| 1373 | + | |
1366 | 1374 | | |
1367 | 1375 | | |
1368 | 1376 | | |
| |||
0 commit comments