diff --git a/‎.changeset/21124-datasource-meta-write-capability.md‎
Lines changed: 14 additions & 0 deletions b/‎.changeset/21124-datasource-meta-write-capability.md‎
Lines changed: 14 additions & 0 deletions
diff --git a/‎packages/rest/src/index.ts‎
Lines changed: 8 additions & 0 deletions b/‎packages/rest/src/index.ts‎
Lines changed: 8 additions & 0 deletions
diff --git a/‎packages/rest/src/meta-item-read-gate.ts‎
Lines changed: 107 additions & 1 deletion b/‎packages/rest/src/meta-item-read-gate.ts‎
Lines changed: 107 additions & 1 deletion
@@ -0,0 +1,14 @@
+---
+'@objectstack/rest': patch
+'@objectstack/runtime': patch
+---
+
+fix(rest,runtime): writing `datasource` metadata through `/api/v1/meta` requires `manage_platform_settings`, the capability the datasource admin door already requires (#21124)
+
+Clause-②: no
+
+- A write of a `datasource` definition through `/api/v1/meta` (and its plural spelling) is now admitted only for a caller who holds `manage_platform_settings`. That is the capability the datasource admin door (`POST /api/v1/datasources`, `PATCH` and `DELETE /api/v1/datasources/:name`) already requires for the same create, update and remove. Every write verb is judged alike: the save (`PUT /meta/datasource/:name`, a draft save included), the reset (`DELETE`), `/publish` and `/rollback`.
+- A caller without the capability gets `403` with `error.code` `PERMISSION_DENIED`, and a message that names the capability. Nothing is written. The answer is the same whether or not the named item exists.
+- The write doors' own authoring admission is unchanged and still applies, so a datasource write needs `manage_platform_settings` and `manage_metadata` both. Platform administrators hold both through `admin_full_access`. Every other metadata type, and every read route, is unchanged. `external_catalog` writes are unchanged: that type's own write door requires `manage_metadata`.
+- Both transports answer the same way: `RestServer`, and the runtime dispatcher's `/meta` domain that a host mounting only the `/api/v1/*` catch-all is served by.
+- If you write datasource definitions through `/api/v1/meta` with a caller that holds only an authoring capability (`manage_metadata`, `studio.access` or `setup.access`), grant `manage_platform_settings` to that caller, or write through the datasource admin door with a caller that already holds it.
@@ -118,6 +118,11 @@ export { refuseRepeatedQueryParams, repeatedQueryParamMessage } from './query-mu
 // `/meta` entry, before any store read (`metaTypeReadRefusal` over
 // `META_TYPE_READ_CAPABILITIES`): a datasource-family type is read under the
 // capability its own door requires.
+//
+// [#21124] …and its write-side twin (`metaTypeWriteRefusal` over
+// `META_TYPE_WRITE_CAPABILITIES`), asked at the same two entries before any
+// store write: a datasource definition is written under the capability the
+// datasource admin door requires.
 export {
     createMetaBookTreeAnswer,
     createMetaItemAnswer,
@@ -127,11 +132,13 @@ export {
     createMetaListAnswer,
     isPublicAudienceRead,
     META_TYPE_READ_CAPABILITIES,
+    META_TYPE_WRITE_CAPABILITIES,
     metaCallerOrganizationId,
     metaItemLayersDeprecationHeaders,
     metaReadOrganizationId,
     metaRequestLocale,
     metaTypeReadRefusal,
+    metaTypeWriteRefusal,
     projectMetaObjectSchema,
     refuseUnknownMetaListType,
     STORED_VERSION_DOOR_POLICY,
@@ -159,4 +166,5 @@ export type {
     MetaReadGatePolicy,
     MetaRequestHttp,
     MetaTypeReadRefusal,
+    MetaTypeWriteRefusal,
 } from './meta-item-read-gate.js';
@@ -1684,7 +1684,9 @@ export function isPublicAudienceRead(
  * Uniform, for the reason the datasource admin door gives for gating even its
  * static driver catalog: a family whose floor has one hole has to be read
  * route by route. Writes are not judged here — the save door keeps its own
- * admission (`metaWriteCapabilityVerdict`).
+ * admission (`metaWriteCapabilityVerdict`), and a write of a type whose own
+ * write door requires more is judged by the twin below
+ * ({@link metaTypeWriteRefusal}, #21124).
  *
  * Both transports ask {@link metaTypeReadRefusal} at their single `/meta`
  * entry, right after the anonymous deny: `RestServer`'s guarded registrar
@@ -1761,6 +1763,110 @@ export function metaTypeReadRefusal(
     };
 }
 
+// ── The type-level write capability ───────────────────────────────────────────
+
+/**
+ * [#21124] The metadata types whose `/meta` WRITES require a platform
+ * capability beyond the authoring admission every write door already asks
+ * (`metaWriteCapabilityVerdict`) — the write-side twin of
+ * {@link META_TYPE_READ_CAPABILITIES}, judged the same way: per TYPE, once, at
+ * each transport's `/meta` entry, before any handler resolves the protocol or
+ * writes the store; never per document.
+ *
+ * ## The row, and why the capability
+ *
+ *  - `datasource` → `manage_platform_settings`. The datasource family's own
+ *    write doors — `POST /api/v1/datasources`, `PATCH` and `DELETE
+ *    /api/v1/datasources/:name` (`admin-routes.ts` in
+ *    `@objectstack/service-datasource`, `DATASOURCE_ADMIN_CAPABILITY`) —
+ *    create, update and remove the same stored definition a `/meta` write of
+ *    this type persists, and admit only this capability. One operation reached
+ *    through two mounted doors cannot admit two different sets of callers.
+ *
+ * ## Why `external_catalog` has no row here
+ *
+ * Its READ row exists because its read door requires
+ * `manage_platform_settings`. Its WRITE door — `POST
+ * /datasources/:name/external/refresh-catalog` — requires
+ * `FEDERATION_WRITE_CAPABILITY` (`manage_metadata`, in
+ * `./external-datasource-routes.ts`), which every `/meta` write door already
+ * demands. ⛔ A row here names the capability the type's own WRITE door
+ * requires — matched, never minted; a type whose write door asks nothing beyond
+ * the authoring admission has no row.
+ *
+ * ## Which requests
+ *
+ * Every write verb — `PUT`, `POST`, `PATCH`, `DELETE` — whose `:type` segment
+ * folds to a listed type, on every route shape: the item save in each of its
+ * modes (a draft included), the reset, `/publish` and `/rollback`, and any
+ * write verb a transport answers on a read route. A route with no `:type`
+ * segment (`POST /meta/_migrate-stored`) is not judged here. The authoring
+ * admission still runs after this one: a holder of the capability is also
+ * asked for `manage_metadata` by the door itself, as before.
+ */
+export const META_TYPE_WRITE_CAPABILITIES: Readonly<Record<string, string>> = Object.freeze({
+    datasource: 'manage_platform_settings',
+});
+
+/** The verbs {@link metaTypeWriteRefusal} judges. */
+const META_WRITE_VERBS: ReadonlySet<string> = new Set(['PUT', 'POST', 'PATCH', 'DELETE']);
+
+/**
+ * [#21124] Why a `/meta` write of a {@link META_TYPE_WRITE_CAPABILITIES} type is
+ * not taken — the same two arms, envelope and codes as
+ * {@link MetaTypeReadRefusal}.
+ */
+export type MetaTypeWriteRefusal = MetaTypeReadRefusal;
+
+/**
+ * [#21124] THE type-level write admission of the `/meta` surface — see
+ * {@link META_TYPE_WRITE_CAPABILITIES} for the row and the reason.
+ *
+ * Same inputs and same folding as {@link metaTypeReadRefusal}: `method` the
+ * request's verb, `type` the RAW `:type` segment (folded here through
+ * `canonicalMetaUrlType` and `pluralToSingular`, so `/meta/datasources`
+ * cannot fall outside the row `/meta/datasource` is in), `caller` the
+ * request's resolved execution context.
+ *
+ * Answers `undefined` — go on, nothing sent — for a read verb, for an unlisted
+ * type, and for a caller whose resolved `systemPermissions` hold the row's
+ * capability. Otherwise the refusal, decided before the door resolves the
+ * protocol, so nothing is written and the answer is the same whether or not
+ * the named item exists. The message names the capability and nothing else.
+ *
+ * ⛔ No `isSystem` arm, for the reason {@link metaTypeReadRefusal} gives:
+ * inbound HTTP never carries `isSystem`, and the datasource admin door reads
+ * the held set alone.
+ */
+export function metaTypeWriteRefusal(
+    method: unknown,
+    type: unknown,
+    caller: unknown,
+): MetaTypeWriteRefusal | undefined {
+    const verb = String(method ?? '').toUpperCase();
+    if (!META_WRITE_VERBS.has(verb)) return undefined;
+    if (typeof type !== 'string' || type.length === 0) return undefined;
+    const canonical = canonicalMetaUrlType(type);
+    const folded = Object.prototype.hasOwnProperty.call(META_TYPE_WRITE_CAPABILITIES, canonical)
+        ? canonical
+        : pluralToSingular(type);
+    if (!Object.prototype.hasOwnProperty.call(META_TYPE_WRITE_CAPABILITIES, folded)) return undefined;
+    const capability = META_TYPE_WRITE_CAPABILITIES[folded];
+    const ctx = caller && typeof caller === 'object'
+        ? caller as { userId?: unknown; systemPermissions?: unknown }
+        : undefined;
+    if (!ctx?.userId) {
+        return { status: ANONYMOUS_DENY_STATUS, code: ANONYMOUS_DENY_CODE, message: ANONYMOUS_DENY_MESSAGE };
+    }
+    const held = Array.isArray(ctx.systemPermissions) ? ctx.systemPermissions : [];
+    if (held.includes(capability)) return undefined;
+    return {
+        status: 403,
+        code: 'PERMISSION_DENIED',
+        message: `Writing ${folded} metadata requires the \`${capability}\` capability.`,
+    };
+}
+
 // ── The list route's unknown-type refusal ─────────────────────────────────────
 
 /**