Skip to content

A business requester and a legal counsel get "You don't have permission" on the contract's Discussion tab and a blank Approvals tab — sys_activity / sys_comment / sys_attachment / sys_approval_request answer 403 #88

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
zhuangjianguo merged 1 commit into from
Oct 10, 2026
Merged

A business requester and a legal counsel get "You don't have permission" on the contract's Discussion tab and a blank Approvals tab — sys_activity / sys_comment / sys_attachment / sys_approval_request answer 403 #88

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
29 changes: 29 additions & 0 deletions src/profiles/requester.profile.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -78,6 +78,35 @@ export const RequesterSet = definePermissionSet({
clm_contract_type: { allowCreate: false, allowRead: true, allowEdit: false, allowDelete: false },
clm_clause: { allowCreate: false, allowRead: true, allowEdit: false, allowDelete: false },
clm_approval_rule: { allowCreate: false, allowRead: true, allowEdit: false, allowDelete: false },
// The contract page's Discussion tab (DESIGN.md §05, 讨论 — the platform
// discussion panel) reads these three platform objects and posts to
// `sys_comment`. The platform baseline every member resolves
// (`member_default`) names none of them — it has been explicit-allow since
// the wildcard retired, "everything else is the application's to declare"
// — so without these lines every audience got `403 PERMISSION_DENIED` on
// all three and the tab read "You don't have permission…" (issue #86).
// They sit in this set because every audience holds it (see the header).
//
// An object-level read here does NOT open rows beyond §04, because the
// platform scopes each of these reads by the record the row is about, with
// the caller's own read of that record: a comment by the record its
// `thread_id` names, an activity row by `object_name` + `record_id`, an
// attachment by `parent_object` + `parent_id`. Posting a comment likewise
// requires reading the record it is posted on. MEASURED on 17.7.0 with two
// requesters, each owning a contract the other cannot open: each listed
// only their own contract's comment and attachment, the other's comment
// answered `404` by id, posting on the other's contract answered `403`,
// and all 640 activity rows served to one of them were about records that
// requester can read.
//
// Deliberately absent: `sys_approval_request` (the Approvals tab). Its data
// door has no such parent scoping — a read granted here serves every
// approval request in the organization, payload snapshot included, to
// every holder — so whether and how requesters see approval history is a
// maintainer decision (#86), not a line in this set.
sys_comment: { allowCreate: true, allowRead: true, allowEdit: false, allowDelete: false },
sys_activity: { allowCreate: false, allowRead: true, allowEdit: false, allowDelete: false },
sys_attachment: { allowCreate: false, allowRead: true, allowEdit: false, allowDelete: false },
},
fields: {
...readOnly(Contract, CONTRACT_STAMPED_FIELDS),
Expand Down
Loading