Merge remote-tracking branch 'origin/main' into claude/issue-24648-etag-describe

Author: claude

.changeset/24501-list-object-column.md

@@ -0,0 +1,20 @@
+---
+'@objectstack/plugin-approvals': patch
+'@objectstack/plugin-audit': patch
+'@objectstack/plugin-sharing': patch
+---
+
+fix(plugin-approvals, plugin-audit, plugin-sharing): list views no longer show the target object's API name as an Object column
+
+Clause-②: no
+
+- **The Object column leaves these lists.** These list views showed `object_name`, the target object's API name (such as `showcase_announcement`), as plain text beside the `record_id` record pointer. They no longer list it:
+  - `sys_approval_request`: `all_requests`, `my_pending`, `submitted_by_me` and `completed`;
+  - `sys_approval_action`: `recent` and `all_actions`;
+  - `sys_audit_log`: `recent`, `writes_only`, `record_views` and `all_events`;
+  - `sys_record_share`: all six views;
+  - `sys_share_link`: all four views.
+- **The Record column names the target record.** `record_id` is the id half of the `record_id` / `object_name` pointer pair. The console draws it as the target record, with its object's icon and the record's name, and fetches `object_name` for that cell without a column. This relies on a console that fetches a pointer's type half for its cell, as the console bundled with this release does; an older console draws the raw record id in that column.
+- **Unchanged:** `object_name` stays a declared field on all five objects, and the pointer pair, its indexes and every query on it are untouched. `sys_audit_log`'s `config_changes` view keeps its Object column, because its rows carry no `record_id`.
+
+A patch: entries removed from list view `columns` on shipped platform objects. No export, type, accepted value, served key or stored column changes.

.changeset/24614-system-run-user-grants.md

@@ -0,0 +1,22 @@
+---
+'@objectstack/service-automation': minor
+---
+
+fix(service-automation)!: a `runAs: 'user'` hook fired by a user-triggered `runAs: 'system'` flow's write runs on that user's own grants
+
+Clause-②: no (narrowing) — a `runAs: 'user'` hook fired by a write of a `runAs: 'system'` flow that names a user now runs on that user's own grants instead of the member baseline, so for a user whose own grants admit less than the baseline its reads narrow; the published `RunIdentityContext` / `RunDataContext` types make `positions` and `permissions` optional, and no published schema or export moves.
+
+<!-- adr-0087: not-required (no-migration-prescription) A runtime semantics change of the data context a runAs 'system' flow run hands ObjectQL when it names a user, not a metadata shape change. No spec key, enum value, export, option, config field, response field or stored shape is removed, renamed or re-shaped, so there is no tombstone and nothing for `objectstack migrate meta` to rewrite. What narrows is whose grants a runAs 'user' hook fired by such a run's write carries: the named user's own, resolved in the run's organization, instead of the member baseline, so for a user whose own grants admit less than the baseline that hook reads less. The run's own operations keep full system privileges. The other categories are closed on facts: the package publishes (not unpublished); no ADR-0087 id covers this behaviour and this diff adds none (not registered / already-registered); and the change is a behaviour change, not only an interface or type change (not runtime-interface-only / type-surface-only). -->
+
+**BREAKING** (an accept-set narrowing), shipped as `minor` under the launch-window convention for breaking changes.
+
+A `runAs: 'system'` flow run that names a user (a manual run, a record change fired by a user's write, and every post-decision node of a `runAs: 'system'` approval flow, where the user is the decider) handed ObjectQL `{ isSystem: true, userId, tenantId, positions: [], permissions: [] }`. Its own operations never read the two arrays: elevation short-circuits every gate before they are read. But a `runAs: 'user'` hook fired by one of its writes de-elevates to that context, and the engine keeps the arrays a context carries, resolving the user's grants only when none are carried. So that hook ran on the member baseline, whoever the user was.
+
+- **Now:** a `runAs: 'system'` run that names a user carries no `positions` or `permissions` in its data context. A `runAs: 'user'` hook its writes fire resolves the named user's own positions, permission sets and organization peers in the run's organization, exactly as that user's own request resolves them. After an approval decision that user is the decider, so the hooks the post-decision writes fire run on the decider's grants.
+- **Wider:** for a user granted more than the baseline, such a hook now reads and writes what the user may, where it was refused on objects the baseline does not grant.
+- **Narrower:** for a user whose own grants admit less than the baseline, such a hook now reads only what that user's own request reads.
+- **Unchanged:** the run's own elevation, `isSystem`, its `actor` label, its `userId` and its `tenantId`; a user-less `runAs: 'system'` run (a schedule), which keeps `positions: []` and `permissions: []`, and a `runAs: 'user'` hook it fires is still refused for want of a user; hooks declaring `runAs: 'system'` or `'inherit'`; and `runAs: 'user'` flows.
+
+The published `RunIdentityContext` and `RunDataContext` types of `@objectstack/service-automation` declare `positions` and `permissions` optional, because a `runAs: 'system'` envelope that names a user no longer carries them. Code that reads either member from `resolveRunDataContext`'s answer must allow for its absence.
+
+What changes for you: a `runAs: 'user'` hook that a user-triggered `runAs: 'system'` flow fires now sees exactly what that user sees. If such a hook must read or write something the user may not, declare it `runAs: 'system'`.

packages/plugins/plugin-approvals/src/approval-list-display-labels.integration.test.ts

@@ -288,7 +288,10 @@ describe('#23889 — the approval lists read engine-written display columns', ()
       for (const col of view.columns) expect(act.fields[col], `${name}.${col}`).toBeDefined();
     }
     for (const name of ['recent', 'all_actions']) {
-      expect(act.listViews[name].columns, name).toEqual(expect.arrayContaining(['object_name', 'record_id', 'acted_as_label']));
+      // The pointer shows as its id half; the type half is fetched for that
+      // cell, never shown as a column (`sys-approval-request-pointer-pair.test.ts`).
+      expect(act.listViews[name].columns, name).toEqual(expect.arrayContaining(['record_id', 'acted_as_label']));
+      expect(act.listViews[name].columns, name).not.toContain('object_name');
       expect(act.listViews[name].columns, name).not.toContain('acted_as');
     }
     expect(act.fields.record_id.referenceVia).toBe('object_name');

packages/plugins/plugin-approvals/src/restored-approval-continuation.test.ts

@@ -981,7 +981,7 @@ describe('ruling A — a decision resumes the run as the person who decided', ()
     } as never);
     expect(seen.before, 'the nodes before the decision run as the submitter').toEqual(flow === 'who_flow'
       ? { userId: 'submitter', permissions: ['deal_rep'] }
-      : { userId: 'submitter', permissions: [], isSystem: true });
+      : { userId: 'submitter', isSystem: true });
     return (await data.find('sys_approval_request', { where: { status: 'pending' } }))[0];
   }
 
@@ -998,7 +998,7 @@ describe('ruling A — a decision resumes the run as the person who decided', ()
     const req = await parked(automation, 'who_flow_sys');
     const out = await service.decide(req.id, { decision, actorId: 'u1', comment: decision }, DECIDER_CTX);
     expect(out.resumed, JSON.stringify(out)).toBe(true);
-    expect(seen[`after_${decision}`]).toEqual({ userId: 'u1', permissions: [], isSystem: true });
+    expect(seen[`after_${decision}`]).toEqual({ userId: 'u1', isSystem: true });
   });
 
   it('CONTROL: an SLA auto-decision names no decider, so the run keeps the identity it had', async () => {

packages/plugins/plugin-approvals/src/sys-approval-action.object.ts

@@ -47,14 +47,17 @@ export const SysApprovalAction = ObjectSchema.create({
   // (`object_name` + `record_id`) are written by `ApprovalService` with the row,
   // copied from the request it belongs to (`actionRow`). The row is
   // append-only, so each is the engine's fact at the moment of the action; a
-  // list shows them as stored and never re-derives them.
+  // list shows them as stored and never re-derives them. The pointer shows as
+  // its id half, `record_id`, which the console draws as the target record and
+  // resolves through `object_name` without a column (objectui#13036); no list
+  // view shows the type half (`sys-approval-request-pointer-pair.test.ts`).
   listViews: {
     recent: {
       type: 'grid',
       name: 'recent',
       label: 'Recent',
       data: { provider: 'object', object: 'sys_approval_action' },
-      columns: ['created_at', 'object_name', 'record_id', 'request_id', 'step_label', 'action', 'actor_id', 'acted_as_label', 'via_override', 'comment'],
+      columns: ['created_at', 'record_id', 'request_id', 'step_label', 'action', 'actor_id', 'acted_as_label', 'via_override', 'comment'],
       sort: [{ field: 'created_at', order: 'desc' }],
       pagination: { pageSize: 50 },
       emptyState: { title: 'No approval actions yet', message: 'Actions are logged automatically when approvals progress.' },
@@ -74,7 +77,7 @@ export const SysApprovalAction = ObjectSchema.create({
       name: 'all_actions',
       label: 'All',
       data: { provider: 'object', object: 'sys_approval_action' },
-      columns: ['created_at', 'object_name', 'record_id', 'request_id', 'step_label', 'action', 'actor_id', 'acted_as_label', 'via_override', 'comment'],
+      columns: ['created_at', 'record_id', 'request_id', 'step_label', 'action', 'actor_id', 'acted_as_label', 'via_override', 'comment'],
       sort: [{ field: 'created_at', order: 'desc' }],
       pagination: { pageSize: 100 },
     },

packages/plugins/plugin-approvals/src/sys-approval-request-pointer-pair.test.ts

@@ -2,6 +2,7 @@
 
 import { describe, it, expect } from 'vitest';
 import { ObjectSchema } from '@objectstack/spec/data';
+import { ApprovalsServicePlugin } from './approvals-plugin.js';
 import { SysApprovalRequest } from './sys-approval-request.object.js';
 
 /**
@@ -77,3 +78,64 @@ describe('sys_approval_request — record_id tombstone predicate', () => {
     expect(parsed.success, parsed.success ? '' : JSON.stringify(parsed.error.issues)).toBe(true);
   });
 });
+
+/**
+ * [#24501] A list names a pointer's target with the id half alone. The console
+ * draws a `referenceVia` column as the target record (its object's icon and
+ * name) and fetches the type half for that cell without a column
+ * (objectui#13036); a type-half column draws the stored API name as text.
+ * Enumerated over every object the plugin registers, so a view added later is
+ * judged without anyone listing it here.
+ */
+describe('approvals list views — a pointer shows as its id half, never its type half (#24501)', () => {
+  type PointerObject = {
+    name: string;
+    fields: Record<string, { referenceVia?: unknown } | undefined>;
+    listViews?: Record<string, { columns?: ReadonlyArray<string | { field: string }> }>;
+  };
+
+  async function registeredObjects(): Promise<PointerObject[]> {
+    const registered: Array<{ objects: PointerObject[] }> = [];
+    const ctx: any = {
+      getService: (name: string) =>
+        name === 'manifest' ? { register: (m: { objects: PointerObject[] }) => registered.push(m) } : undefined,
+      logger: { info: () => {}, warn: () => {} },
+    };
+    await new ApprovalsServicePlugin({ disableService: true }).init(ctx);
+    expect(registered).toHaveLength(1);
+    return registered[0].objects;
+  }
+
+  /** `object.view: column` for each shown id half, and for each type half shown beside one. */
+  function pointerColumns(objects: readonly PointerObject[]): { idHalves: string[]; typeHalves: string[] } {
+    const idHalves: string[] = [];
+    const typeHalves: string[] = [];
+    for (const object of objects) {
+      for (const [view, def] of Object.entries(object.listViews ?? {})) {
+        const shown = new Set((def.columns ?? []).map((c) => (typeof c === 'string' ? c : c.field)));
+        for (const column of shown) {
+          const via = object.fields[column]?.referenceVia;
+          if (typeof via !== 'string') continue;
+          idHalves.push(`${object.name}.${view}: ${column}`);
+          if (shown.has(via)) typeHalves.push(`${object.name}.${view}: ${via}`);
+        }
+      }
+    }
+    return { idHalves, typeHalves };
+  }
+
+  it('no list view shows a referenceVia sibling beside its id half', async () => {
+    expect(pointerColumns(await registeredObjects()).typeHalves).toEqual([]);
+  });
+
+  it('the request and action lists still show the id half, so the Record column names the target', async () => {
+    expect(pointerColumns(await registeredObjects()).idHalves).toEqual(expect.arrayContaining([
+      'sys_approval_request.all_requests: record_id',
+      'sys_approval_request.my_pending: record_id',
+      'sys_approval_request.submitted_by_me: record_id',
+      'sys_approval_request.completed: record_id',
+      'sys_approval_action.recent: record_id',
+      'sys_approval_action.all_actions: record_id',
+    ]));
+  });
+});

packages/plugins/plugin-approvals/src/sys-approval-request.object.ts

@@ -91,13 +91,20 @@ export const SysApprovalRequest = ObjectSchema.create({
   // reads them as stored and never re-derives a label from flow metadata or
   // resolves an approver address itself; `process_name`, `current_step` and
   // `pending_approvers` keep the machine values every query and decision reads.
+  //
+  // The target is the `record_id` column alone. It is the pointer's id half,
+  // so the console draws the target record (its object's icon and name) and
+  // fetches the type half `object_name` for that cell without a column
+  // (objectui#13036). An `object_name` column drew the stored API name as
+  // text; no list view shows a pointer's type half
+  // (`sys-approval-request-pointer-pair.test.ts`).
   listViews: {
     all_requests: {
       type: 'grid',
       name: 'all_requests',
       label: 'All',
       data: { provider: 'object', object: 'sys_approval_request' },
-      columns: ['process_label', 'object_name', 'record_id', 'status', 'current_step_label', 'pending_approver_labels', 'submitter_id', 'updated_at'],
+      columns: ['process_label', 'record_id', 'status', 'current_step_label', 'pending_approver_labels', 'submitter_id', 'updated_at'],
       sort: [{ field: 'updated_at', order: 'desc' }],
       pagination: { pageSize: 50 },
     },
@@ -106,7 +113,7 @@ export const SysApprovalRequest = ObjectSchema.create({
       name: 'my_pending',
       label: 'My Pending',
       data: { provider: 'object', object: 'sys_approval_request' },
-      columns: ['process_label', 'object_name', 'record_id', 'current_step_label', 'pending_approver_labels', 'submitter_id', 'updated_at'],
+      columns: ['process_label', 'record_id', 'current_step_label', 'pending_approver_labels', 'submitter_id', 'updated_at'],
       filter: [
         { field: 'status', operator: 'equals', value: 'pending' },
         { field: 'pending_approvers', operator: 'contains', value: '{current_user_id}' },
@@ -120,7 +127,7 @@ export const SysApprovalRequest = ObjectSchema.create({
       name: 'submitted_by_me',
       label: 'I Submitted',
       data: { provider: 'object', object: 'sys_approval_request' },
-      columns: ['process_label', 'object_name', 'record_id', 'status', 'current_step_label', 'updated_at'],
+      columns: ['process_label', 'record_id', 'status', 'current_step_label', 'updated_at'],
       filter: [{ field: 'submitter_id', operator: 'equals', value: '{current_user_id}' }],
       sort: [{ field: 'updated_at', order: 'desc' }],
       pagination: { pageSize: 25 },
@@ -130,7 +137,7 @@ export const SysApprovalRequest = ObjectSchema.create({
       name: 'completed',
       label: 'Completed',
       data: { provider: 'object', object: 'sys_approval_request' },
-      columns: ['process_label', 'object_name', 'record_id', 'status', 'submitter_id', 'completed_at'],
+      columns: ['process_label', 'record_id', 'status', 'submitter_id', 'completed_at'],
       // Every terminal state, `cancelled` included (#13568) — a platform-voided
       // request is kept as audit evidence, and a terminal state absent from the
       // only curated terminal view is evidence nobody can find.

packages/plugins/plugin-audit/src/objects/sys-audit-log.object.ts

@@ -44,13 +44,20 @@ export const SysAuditLog = ObjectSchema.create({
   titleFormat: '{action} · {object_name}',
   highlightFields: ['created_at', 'action', 'object_name', 'record_id', 'user_id'],
 
+  // A list names the target with the pointer's id half, `record_id`: the
+  // console draws it as the target record and fetches the type half
+  // `object_name` for that cell without a column (objectui#13036). A list
+  // view never shows the type half beside it, which would draw the stored API
+  // name as text (`sys-audit-log-pointer-pair.test.ts`). `config_changes`
+  // keeps `object_name`: its rows carry no `record_id`, so no pointer names
+  // their target.
   listViews: {
     recent: {
       type: 'grid',
       name: 'recent',
       label: 'Recent',
       data: { provider: 'object', object: 'sys_audit_log' },
-      columns: ['created_at', 'action', 'object_name', 'record_id', 'user_id'],
+      columns: ['created_at', 'action', 'record_id', 'user_id'],
       sort: [{ field: 'created_at', order: 'desc' }],
       pagination: { pageSize: 50 },
       emptyState: { title: 'No audit events', message: 'Activity will appear here as users interact with the platform.' },
@@ -60,7 +67,7 @@ export const SysAuditLog = ObjectSchema.create({
       name: 'writes_only',
       label: 'Writes',
       data: { provider: 'object', object: 'sys_audit_log' },
-      columns: ['created_at', 'action', 'object_name', 'record_id', 'user_id'],
+      columns: ['created_at', 'action', 'record_id', 'user_id'],
       // `restore` removed (#8315): the value is retired from the enum, so the
       // filter would have matched nothing for the rest of time. The three that
       // remain are exactly what `actionFor()` in `audit-writers.ts` can emit.
@@ -105,7 +112,7 @@ export const SysAuditLog = ObjectSchema.create({
       name: 'record_views',
       label: 'Record Views',
       data: { provider: 'object', object: 'sys_audit_log' },
-      columns: ['created_at', 'user_id', 'object_name', 'record_id', 'actor'],
+      columns: ['created_at', 'user_id', 'record_id', 'actor'],
       filter: [{ field: 'action', operator: 'in', value: ['read'] }],
       sort: [{ field: 'created_at', order: 'desc' }],
       pagination: { pageSize: 50 },
@@ -137,7 +144,7 @@ export const SysAuditLog = ObjectSchema.create({
       name: 'all_events',
       label: 'All',
       data: { provider: 'object', object: 'sys_audit_log' },
-      columns: ['created_at', 'action', 'object_name', 'record_id', 'user_id'],
+      columns: ['created_at', 'action', 'record_id', 'user_id'],
       sort: [{ field: 'created_at', order: 'desc' }],
       pagination: { pageSize: 100 },
     },