feat(sharing): criteria_json is declaratively required — ADR-0113 P2, the first consumer (P1 browser-verified) - #4044
Merged
Conversation
… the first consumer The field the ADR was written for: flips required: true (write contract — legacy null rows rest, an admin can still active:false an over-broad legacy rule, no NOT NULL migration; deliberately NO storage.notNull, those nulls are the case the split exists for). The Setup form gets its required marker from this declaration (P1 verifies the Console side). The #3929 guards consolidate by layer instead of vanishing: the record validator now owns the missing/null/explicit-clear cases declaratively; the beforeInsert/beforeUpdate hook narrows to the NON-null match-all shapes required cannot express ('{}', vacuous $and/$or, unparsable, scalars), where isMatchAllCriteria judges and the message names the shape (hooks fire before validation, so the better message still wins on the direct path); defineRule keeps the API seam; the evaluator fail-closed stays (ADR-0049). Empty-state registry entry updated with the declarative pointer. plugin-sharing 198/198; the bound sharing-rule-criteria-required proof 5/5 against a booted stack; check:empty-state + check:liveness green. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01QuViRSR1j6GJjf9qGbnqFX
|
The latest updates on your projects. Learn more about Vercel for GitHub. 1 Skipped Deployment
|
Contributor
📓 Docs Drift CheckThis PR changes 3 package(s): 106 hand-written doc(s) reference the affected code and may need an implementation-accuracy re-verification:
|
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01QuViRSR1j6GJjf9qGbnqFX
github-actions
Bot
added
the
documentation
The 'already IN the table' case needs a row from before the gate existed. Pre-P2 it could fake one by unbinding the hook and inserting through the engine; the declarative required: true closed that path too — the record validator now rejects it with the hook unbound, which is exactly the defense-in-depth the flip bought (and what CI correctly caught; the local 5/5 was a stale plugin-sharing dist, the same trap for the fourth time). A true legacy row predates every gate, so it is now written at the DRIVER seam — the level a pre-gate deployment's storage actually holds it — and the unused guard-package unbind ceremony is gone with it. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01QuViRSR1j6GJjf9qGbnqFX
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The field ADR-0113 was written for, cashing in the split #4031 landed. One commit.
P2 — the declaration
sys_sharing_rule.criteria_jsonflips torequired: true— the exact posture that was un-declarable before the split: write contract only (an insert must provide it, an update may not null it out, rows predating the gate rest — an admin can stillactive: falsean over-broad legacy rule), deliberately nostorage.notNullbecause every deployed tenant's legacy null rows are the case the split exists for.The #3929 guards consolidate by layer instead of vanishing:
required: true(declarative)bindRuleCriteriaGuard(hook, narrowed)requiredcannot express:'{}', vacuous$and/$or, unparsable JSON, bare scalars —isMatchAllCriteriajudges, the message names the offending shape (hooks fire before validation, so the better message still wins on the direct path)defineRuleEmpty-state registry's
closedentry gains the declarative pointer as evidence.P1 — browser-verified, zero Console changes
The Console's form bridge already derives the marker from field metadata (
form-view.ts:99in objectui), so the declaration is the whole feature. Verified end-to-end with the objectui HMR console against a booted showcase built from this branch:GET /api/v1/meta/objects/sys_sharing_ruleservescriteria_json.required: true,storage: undefined(column stays nullable); sibling controls sane (object_name.required: true,description.required: false).Criteria*(<span aria-label="required">*</span>) — positive controlObject*has the same marker, negative controlDescriptionhas none. Screenshot attached to the session.The dogfood boot along the way also tripped the
rls.prioritytombstone on two stale build artifacts (plugin-security dist, the showcase's compiledobjectstack.json) — both rebuilt; the tombstone rejecting stale artifacts loudly is it doing its job.Verification
sharing-rule-criteria-requiredproof 5/5 against a booted stack (message assertions intact — hook fires before validation).check:empty-state+check:livenessgreen; re-verified after rebasing over feat(spec,objectql,driver-sql)!: ADR-0113 accepted — required is a write contract, storage.notNull is the column constraint #4031/fix(spec,drivers): the view filter vocabulary and the AST vocabulary now agree (#3948) #4039.sys_sharing_rulemetadata + hook comments in@objectstack/plugin-sharing— wait, that package publishes; the flip is behavior-affecting. Changeset intentionally omitted only if CI's gate exempts metadata-only changes — if Check Changeset fails, a patch changeset follows.Generated by Claude Code