Repository navigation
feat(app-shell): Studio retires the two delegated-admin switches the spec retired (objectui#12406) - #12659
Merged
objectstack-fleet[bot] merged 1 commit intoOct 16, 2026
Conversation
…spec retired The permission-set editor's Delegated Admin Scope facet no longer draws the "Manage bindings" and "Author env sets" switches. `@objectstack/spec` 18 retired `adminScope.manageBindings` and `adminScope.authorEnvironmentSets` as tombstones that refuse any value, so flipping either made the set unsaveable. Their four i18n strings go, the help text stops offering to manage bindings, and the remaining manage-assignments switch writes its key by name, without the cast that let a tombstoned key compile. The anchor pin now covers the one remaining manage switch, and three new cases pin that the facet draws neither retired switch and that flipping every switch it draws writes a scope the spec accepts. Claude-Session: https://claude.ai/code/session_011K9g23W67dy2zwnyzaoB6o Co-authored-by: Claude <noreply@anthropic.com>
Contributor
✅ Console Performance Budget
The eager closure is every chunk the entry reaches through static imports — what the browser fetches and parses before the app renders. The entry chunk on its own is a small fraction of it. 📦 Bundle Size Report
Size Limits
|
This was referenced Oct 16, 2026
Contributor
Author
席位核对 · ACCEPT ·
|
This was referenced Oct 16, 2026
objectstack-fleet
Bot
deleted the
claude/issue-12406-retire-admin-switches
branch
October 16, 2026 12:56
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes #12406
Clause-②: no
What changes
Studio's permission-set editor stops offering the two delegated-admin switches that
@objectstack/spec18 retired. This is item 4 of the maintainer's letter A on objectstack-ai/objectstack#23488 (comment 6181988435): "objectui: Studio's two switches, the help strings, the i18n keys and the pin test retire".PermissionAdvancedFacets.tsx. The "Manage bindings" and "Author env sets" switch rows are gone. "Manage assignments" stays as the control and now writes its key by name,setScopeDetail({ manageAssignments: !!v }), instead of through the tuple list's cast to the partialAdminScopetype. The header docblock names the four live keys. TheAdminScopedocblock now says why the editor strips neither retired key from a loaded scope (the H3 decision below). Two docblock counts ("the six keys", "the other five carry defaults") are corrected, because two of those keys are now tombstones.i18n.ts. The four strings go:perm.admin.manageBindingsandperm.admin.authorEnvironmentSets, in English and Chinese.perm.admin.helpno longer offers to "manage bindings", in either language. I read the ruling's "help strings" as this text, the only Studio help string that names a retired right.PermissionAdvancedFacets.adminScopeAnchor.test.tsx. The inert-switch case now covers the one remaining manage switch. A new describe block pins the retirement (see Tests)..changeset/12406-retire-admin-switches.md.@object-ui/app-shellpatch, with the Clause-② reading in words.Clause-②: no.
PermissionAdvancedFacetsand the metadata-admin dictionary are not on@object-ui/app-shell's published entry (exportshas.and./styles.css;src/index.tsexports neither). The change removes two controls that wrote keys the spec already refuses. No published type, prop or export changes.Measurements
18.0.0-next.2).AdminScopeSchemarefuses each retired key withinvalid_typeat its own path, for bothtrueandfalse. CONTROL: a scope with the four live keys parses.manageAssignmentsstays.CHANGELOG.md, the workspace has these four strings only ini18n.tsand the anchor pin's caption list. The controlmanageAssignmentsis found in the same files. No other locale pack or reader exists.AdminScopetype, typed as the retired mark: an object whose one key is'[REMOVED] Key retired: run os validate for its migration.'with typenever. The old tuple-list write compiled only because of its cast. The new by-name write lets that type do the refusing. Reverse check:setScopeDetail({ manageBindings: !!v })was written at the switch, andtsc --noEmitturned red withTS2322: Type 'boolean' is not assignable to typethat retired mark. The file was then restored byablation-replace.mjs, and its blob equals HEAD.{"businessUnit":"east","manageAssignments":true,"manageBindings":true,"authorEnvironmentSets":false}. After one "Include subtree" flip it reads{…, "manageBindings":true, "authorEnvironmentSets":false, "includeSubtree":true}.setScopespreads the stored object, and the host's whole-record Save sendsdraft.adminScopewhether or not the facet was touched.0af559e: the metadata protocol's layered read (the overlay row) and its draft read both pass the stored row throughconvertStoredItem, thenapplyConversionsToStoredItem(retired entries included), whose conversionpermission-admin-scope-binding-authoring-removeddrops both keys. The spec half was measured here with the installed spec:applyConversionsToStoredItem('permission', …)turns that same stored scope into{"businessUnit":"east","manageAssignments":true}and emits two notices from that conversion. The raw stored set failsPermissionSetSchema; the rehydrated one passes. The save door validates strictly and replays no conversion, so a body that still carried either key would be answered422 INVALID_METADATAat the key.H3 decision: Studio does not strip the two keys
Two options. A: mirror this file's RLS
priorityprecedent and strip both keys in the facet's write path. B: strip nothing, and leave the server's stored-row conversion as the one place they are dropped. Chosen: B. Reasons, axis by axis:registered). A strip in the facet would also only cover facet edits: the host's whole-record Save sends the scope untouched, so A could not deliver "saves without them" from inside this file.os validate. A would silently drop it on the client, which is the consumer-side tolerance the frame ranks below a strict contract.A's case rests on this file's RLS
prioritystrip. That strip was written when Studio's own Add button seeded the retired key into new policies, so this editor was the producer. Here the producer was the switches, and they are gone.Tests
The new describe is
PermissionAdvancedFacets · the retired delegated-admin keys (objectui#12406), mounted as the Access pillar mounts the facet (only="admin"). Switches are found by role, not by caption:falseincluded.safeParsesuccess, and the exact written object.Ablation (wrap mode,
ablation-replace.mjsfrom objectstack). The two retired rows were put back exactly as they were onmain(tuple list, cast included). The run readTests 2 failed | 10 passed (12): the two new pins went red (expected [ 'perm.admin.includeSubtree', …(3) ]andexpected [ 'manageBindings', …(1) ] to deeply equal []). Restore was proven: blob after restore equals blob at HEAD, andgit diff HEADis empty. The test imports the component from source, so no build sits between the mutation and the run.All of the following ran on head
165e820, the final commit. Every exit code was captured before any pipe.pnpm exec vitest run packages/app-shell/src/views/metadata-admin/: exit 0,Test Files 509 passed (509),Tests 5742 passed | 1 skipped (5743). It held the shared verify lock for 940s on a shared 4-core box.pnpm exec turbo run build --filter='@object-ui/app-shell^...' --concurrency=2: exit 0,Tasks: 28 successful, 28 total.pnpm --filter @object-ui/app-shell type-check: exit 0. The output echoestsc --noEmit && tsc -p tsconfig.test.json. The test project includessrc/**/*.test.tsx, so the new cases are type-checked.pnpm check:changeset-claims0 ·pnpm changeset:check0 ·pnpm check:test-path-roots0 ·pnpm check:spec-symbols0 ·node scripts/check-changeset-presence.mjs0 ·pnpm check:new-line-citations0 ·node scripts/check-governed-queue-guard.mjs --testover the 4 paths: 0,NOT GOVERNED.setDraftprop'sany, and asetErrorMapcall inside an effect).packages/app-shell/suite and the repo-wide lint. Both are left to CI, as the dispatch said.Acceptance notes
docs/adr/0056-permission-editing-studio.mdstill namesmanageBindingsandauthorEnvironmentSetsin theAdminScopeSchemabullet ("the exact target shape for the admin_scope editor"). It is governed text, so it is not edited here (Tier S/H). Carrier: none in objectui. The ruling's item 5 Tier H docs PR covers ADR-0090 and ADR-0086 in objectstack, not this ADR.packages/app-shell/src/__tests__/spec-symbol-parity.test.tshas a comment, "…and the other five are defaulted". Two of those five are now tombstones. It is a comment, not an assertion, and the assertions still hold. It is outside this card's file surface and is noted only.PermissionMatrixEditor) sendsdraft.adminScopeas loaded. That is safe only because the server's reads drop the two keys (H3). It is recorded here as the boundary of the H3 decision, not as a defect.The session is
https://claude.ai/code/session_011K9g23W67dy2zwnyzaoB6o.Generated by Claude Code