feat: upgrade ObjectStack to 17.0.0-rc.1 - #579
Merged
Merged
Conversation
|
The latest updates on your projects. Learn more about Vercel for GitHub. |
github-actions
Bot
added
documentation
15 tasks
The version bump leaves three 17.0 contracts half-migrated. The first is a silent outage. allowExport became an opt-in bit. Before 17.0 an unset value inherited read, so "can list => can export" and the bit only ever hid a button; 17.0 inverted the default, and `resolveUserExportAllowed` now demands an explicit `allowExport: true` with neither `viewAllRecords` nor `modifyAllRecords` standing in for it. No profile carried the bit, so every CSV/XLSX list export and every report export would have 403'd for every user, system_admin included — while `os validate`, `os build` and the whole suite stayed green, because the grant is well-formed, it just isn't there. Grant it on the five objects with a real export surface (a list view declaring `exportOptions`, or a report whose dataset is built on them), for each profile that already reads them. `guest_portal` gets none: ADR-0090 D9 classes `allowExport` as high-privilege, so a set carrying it stops binding to the `guest` anchor entirely. New guards in authorization-coverage fail in both directions — an export surface nobody can reach, and a grant with no surface behind it — so the next `exportOptions` cannot ship without its grant. Approval nodes drop the hand-rolled `org_membership_level: 'owner'` approver for the native `onEmptyApprovers: 'admin_rescue'`. That entry existed only to avoid the empty-position dead-end, and with `behavior: 'first_response'` it overshot: it made an org owner a routine approver on every deal over $100K rather than a rescue when the bench is empty. Media fields declare `accept` / `maxSize`, which 17.0 enforces server-side against the stored sys_file (ADR-0104 D3 wave 2). Previously the upload widget read them while FieldSchema dropped them at parse, so the constraint never reached a caller talking to the API directly. Also drop the `edit`/`delete`/`view` builtin whitelist from the rowActions guard. 17.0's `action-name-undefined` rule refuses a rowActions string naming no defined action, so the whitelist was letting metadata past CI that the platform then rejects. MAINTENANCE.md §3.2 documents the `os migrate` data gates and the `OS_ALLOW_LAX_*` escape hatches: `pnpm verify` and `demo:reset` start from an empty database, so neither can catch what an in-place upgrade needs. Claude-Session: https://claude.ai/code/session_01YHzpTPCxNfskro88FRuBwH Co-authored-by: Claude <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
@objectstack/*dependency and protocol manifest to17.0.0-rc.1.Validation
pnpm validatepnpm typecheckpnpm buildpnpm test