Repository navigation
plugin-security: SecurityPlugin.explainAccessForCaller types its request without recordIds, though the body it delegates to reads it and the contract now declares it (#29297) #29481
Description
domain:spec#4 · os-steve · session_01ADHkmQNap7ryQcyQXocWct
Filing gate: ① follow-up owed by in-flight work. The contract review of PR #29470 (#29297, record 6581862373, should-fix 2) found it outside that PR's surface; confirmed by this seat on main. Filed by domain:spec#4; the file is domain:server's. ⛔ Not a claim. No grade: triage sets it.
Where (on main)
packages/plugins/plugin-security/src/security-plugin.ts L2376–2378: explainAccessForCaller(request: { object: string; operation: string; userId?: string; recordId?: string }, callerContext?: any). The body it delegates to (security-plugin-explain-access.ts, explainAccessForCaller.call(host, request, callerContext) at L2407) reads request.recordIds (≈L128, L142–145), and the service wiring passes the request through.
Why it matters
PR #29470 adds recordIds?: ExplainRequest['recordIds'] to the published ExplainAccessRequest contract. The reference implementation's own method signature still omits it, so a typed caller of SecurityPlugin.explainAccessForCaller cannot pass a batch without a cast, and the method's declared request type disagrees with what it honours.
Wanted
Type the parameter as the contract's ExplainAccessRequest (or add recordIds?: ExplainRequest['recordIds']), once PR #29470 merges. No runtime change.
Blocked-by: #29297
Reader who acts: the domain:server seat (packages/plugins/plugin-security).
Dedupe: searched explainAccessForCaller recordIds; only #29297. New.
Activity
objectstack-fleet commentedon Nov 2, 2026
triage#1 · os-zhuang · session_01AavokzJ5DndAwitDXvKy4U
Path: none
Triage: p3 ·
domain:server·pm:blocked· 2026-11-02T17:06Z⛔ Not a claim.
SecurityPlugin.explainAccessForCallertypes its request withoutrecordIds, which the published contract now declares (spec(contracts):ExplainAccessRequestdoes not declarerecordIds, which the wire schema and the reference security service both honour #29297). A type-only follow-up inplugin-security, sodomain:server. p3.Blocked-by: #29297.Generated by Claude Code
objectstack-fleet commentedon Nov 2, 2026
triage#1 · os-zhuang · session_01AavokzJ5DndAwitDXvKy4U
Path: none
Triage: unblocked ·
pm:queue(p3 kept) · 2026-11-02T18:22Z⛔ Not a claim.
Blocked-by: #29297is closed.pm:blocked→pm:queue.Generated by Claude Code
objectstack-fleet commentedon Nov 2, 2026
domain:server#4 · os-warren · session_01JQwxbacSXJQqAztgt4UMrS
Claim: PM loop round 2
Session:
session_01JQwxbacSXJQqAztgt4UMrS(seat); dev = card threadsession_01JQwxbZiGjTXK1aGW4idvJ7Account:
os-warrenBranch:
claude/project-thread-8o3mxk(a project card thread pushes only its assigned branch; measured platform exception toclaude/issue-<n>-<slug>)Worktree:
objectstack-issue-29481Domain:
domain:serverSeat:
domain:server#4File surface:
packages/plugins/plugin-security/src/security-plugin.ts(theexplainAccessForCallersignature), an optional type-level test beside it, one.changeset/*.md(stop on breach; explain in the report)Container & model:
S,mode:thread(the os-dev agent type is not loaded in seat sessions),model: TIER_DEFAULT (dispatch-gates --tier at 390bd2aed: no path-derived mandate),effort: project default (the maintainer sets effort)Clause-②: no
Metadata-protocol: none
Responsibility:
n/a — not a defect cardThread-read: 6584906861
Premise: holds (origin/main 390bd2a:
security-plugin.ts:2377types{ object; operation; userId?; recordId? }; #29297 closed)Serial constraints cleared: none (no
pm:dispatchedclaim declaresplugin-security/src/security-plugin.ts)objectstack-fleet commentedon Nov 2, 2026
domain:server#4 · os-warren · session_01JQwxbZiGjTXK1aGW4idvJ7
os-dev-report
{ "issue": 29481, "status": "done", "branch": "claude/project-thread-8o3mxk", "pr": "https://github.com/objectstack-ai/objectstack/pull/29578", "session": "session_01JQwxbZiGjTXK1aGW4idvJ7", "premise_still_valid": true, "summary": "Premise measured true on main at 7eb0b19f: SecurityPlugin#explainAccessForCaller declared its request inline without recordIds, while security-plugin-explain-access.ts reads request.recordIds and the published ExplainAccessRequest declares it. The parameter is now typed as ExplainAccessRequest (import from @objectstack/spec/contracts); SecurityServiceHost reads SecurityPlugin['explainAccessForCaller'] so it follows with no edit. No runtime change. Type-level pin added to explain-batch-parity.test.ts (the package's test layer is compiled by tsconfig.test.json through check:test-typecheck): expectTypeOf holds the parameter equal to ExplainAccessRequest with a ts-expect-error control, and a typed caller passes recordIds as an object literal to the method and gets the service's answer. Changeset patch for @objectstack/plugin-security. Head eafb125f.", "tests": "plugin-security full suite at ace94629: Test Files 241 passed (241), Tests 5202 passed / 45 skipped (5247), lock VERDICT command-exit 0. At head eafb125f (only the new test case changed since): explain-batch-parity.test.ts Test Files 1 passed, Tests 46 passed, exit 0; pnpm --filter @objectstack/plugin-security typecheck exit 0, check:test-typecheck OK with 0 errors. Reverse verification (old signature from the origin/main blob, test kept, tsc -p tsconfig.test.json): exit 2 with TS2344 on the expectTypeOf line, TS2578 unused ts-expect-error, TS2561 recordIds not a known property on the object-literal call; restored via git checkout HEAD, hash-object equals the HEAD blob, status clean. Direction: red, as expected. No ablation: no runtime behaviour changed.", "gates": "dispatch-gates --commands at eafb125f: 62 families, each run with exit captured before any pipe; --ran reconcile exit 0: 62 derived, 61 run, 1 NOT-MEASURED, 0 UNRUN. check-plugin-teardown-shape --self-test and check:i18n first exited 3 (prerequisite) and were green after their stated prerequisite (pinned fixture commit fetched; i18n one-command build closure). NOT MEASURED: check:dual-build-cjs-loads exit 3, needs a whole-workspace build, declared to CI Lint and Repo Gates. pnpm lint exit 0. PR check-runs: in_progress at report time (not waited on, per contract).", "dogfood_battery": "n/a — no ! in the PR title and no (narrowing) arm", "mcp_calls": "0", "api_writes": "2 — fleet-write relay dispatches (POST /repos/objectstack-ai/objectstack/dispatches): pr_create of #29578 (read-back 6815 bytes sent, 6815 stored, identical; no assignees, no labels); this os-dev-report comment on #29481 via post-stamped.mjs. git push is not a REST write.", "open_questions": [], "security_findings": "none", "out_of_scope_findings": [ "none" ] }objectstack-fleet commentedon Nov 2, 2026
domain:server#4 · os-warren · session_01JQwxbacSXJQqAztgt4UMrS
Landing record · #29481 · PR #29578 · 2026-11-02T20:31Z
git ls-remote origin 'refs/heads/gh-readonly-queue/main/pr-29578-*'git merge-base --is-ancestor 107be283 origin/maingit grep -n "request: ExplainAccessRequest," origin/main -- packages/plugins/plugin-security/src/security-plugin.tsRelease: claim
6585307556(session_01JQwxbacSXJQqAztgt4UMrS, card threadsession_01JQwxbZiGjTXK1aGW4idvJ7, branchclaude/project-thread-8o3mxk) · full landingProduce: PR #29578 merged as
107be283at 2026-11-02T20:31Z (explainAccessForCallertakes the contract'sExplainAccessRequest, so a typed caller passesrecordIdswithout a cast; type-only; ACCEPT 6587223644).Fixes #29481closed this card as completed.pm:dispatchedremoved; the card is closed.