fix(fields): lookup candidate queries expand the reference columns they display (objectui#10223)

.changeset/10223-lookup-candidates-expand.md

@@ -0,0 +1,40 @@
+---
+'@object-ui/fields': patch
+---
+
+fix(fields): a lookup's candidate queries expand the reference columns they display
+
+Opening a lookup field's dropdown sent the candidate query without `$expand`.
+Every reference column the dropdown previews under each candidate (by default
+the referenced object's leading `highlightFields`) therefore arrived as a bare
+foreign key, and the lookup cell renderer fetched each related record on its
+own: one extra request per candidate per such column, on every open. The
+browse-all picker (`RecordPickerDialog`) did the same once per table row.
+
+Both queries now ask for `$expand` on the reference columns they display,
+chosen by `buildExpandFields` from `@object-ui/core` (the rule the list views
+apply to their visible columns): the dropdown's previewed columns, and the
+picker's columns other than its id column. The dropdown's recently-used rail
+asks for the same expansion. Related records in the expanded columns now
+render with no request per row.
+
+Field-level security gates that list the way it gates the other
+`buildExpandFields` call sites: once the permission policy has loaded, a
+reference column the user may not read on the referenced object is left out of
+`$expand`; before the policy loads, nothing is filtered. `@object-ui/fields`
+now depends on `@object-ui/permissions` for that check. A column left out of
+`$expand`, like any column from a backend that ignores the parameter, still
+arrives as a bare id and is resolved one by one as before.
+
+`buildExpandFields` covers `user` columns as well as `lookup`,
+`master_detail` and `tree`. A previewed `user` column therefore now shows the
+person, as the picker table and the list views do, where it used to show the
+raw id marked as unresolved.
+
+What the dropdown and the picker hand onward is built from each row with its
+expanded relations collapsed back to ids, through `toPredicateRecord` from
+`@object-ui/core`. That covers option labels, `titleFormat` titles, the
+committed value, and the records passed to `onSelectRecord` and
+`onSelectRecords`, so none of them carries an expanded object. One difference
+remains: `toPredicateRecord` returns ids as strings, so a numeric foreign key
+in an expanded column reaches those callbacks in its string form.

.changeset/lookup-dropdown-cell-renderer-5492.md

@@ -27,11 +27,14 @@ there is a single renderer left to drift from. The dropdown's extra columns are
 rendered into the option row itself; the row's `title` keeps the full option
 label, which is what a truncated label needs, instead of a raw-value dump.
 
-No query changed and no contract widened. `lookupColumns` entries stay bare
-field names — no dot paths, no populate/expand semantics — because neither
-surface's request carries populate to begin with: the picker resolves a
+This change touched no query and widened no contract. `lookupColumns` entries
+stay bare field names — no dot paths, no populate/expand semantics — because
+at the time neither surface's request carried populate: the picker resolved a
 foreign-key id to a name client-side, in the lookup cell renderer, and the
-dropdown now inherits exactly that. An unresolved reference therefore renders
+dropdown inherited exactly that. A later change (objectui#10223) has both
+requests ask for `$expand` on the reference columns they display, minus any
+the loaded permission policy denies; a value that still arrives as a bare id
+is resolved by that same cell renderer. An unresolved reference therefore renders
 what the picker renders for it, and keeps its column: a slot is dropped only
 when the record holds no value for the field, decided on the raw value and
 never on what the renderer makes of it, so an unresolved id can never degrade

packages/fields/package.json

@@ -33,6 +33,7 @@
     "@object-ui/components": "workspace:*",
     "@object-ui/core": "workspace:*",
     "@object-ui/i18n": "workspace:*",
+    "@object-ui/permissions": "workspace:*",
     "@object-ui/providers": "workspace:*",
     "@object-ui/react": "workspace:*",
     "@object-ui/types": "workspace:*",