Repository navigation
fix(plugin-list): the hide-fields, Group and Row color lists and the user-filter chips ask the field read (objectui#11984) - #11999
Merged
objectstack-fleet[bot] merged 7 commits intoOct 8, 2026
Conversation
…user-filter chips ask the field read (objectui#11984) The list the hide-fields popover, the Group editor and the Row color select share (`allFields`, which the compact toolbar's View settings popover reads too) now passes through `canReadField`, the predicate the Filter panel's and the Sort picker's lists use, behind the same `isLoaded` gate. So do the user-filter chips, with the in-use exception the Sort picker makes: a chip whose field a held selection names stays, so that filter can be cleared. A stored hidden-field entry or row-color rule on a field the caller may not read is withheld from the editors (not listed, counted or cleared) and kept as stored. Claude-Session: https://claude.ai/code/session_01MgfduSkFrfM3eorB3UGfAU Co-authored-by: Claude <noreply@anthropic.com>
…list (objectui#11984) A sweep opens every toolbar popover and combobox and reads what each offers: the popovers that offer a field must be the enumerated ones, and for a restricted caller none may offer a field they cannot read (control: with full read every enumerated list offers it). One pin per position, before-isLoaded, and the stored-configuration cases. Claude-Session: https://claude.ai/code/session_01MgfduSkFrfM3eorB3UGfAU Co-authored-by: Claude <noreply@anthropic.com>
… check (objectui#11984) Claude-Session: https://claude.ai/code/session_01MgfduSkFrfM3eorB3UGfAU Co-authored-by: Claude <noreply@anthropic.com>
Contributor
✅ Console Performance Budget
The eager closure is every chunk the entry reaches through static imports — what the browser fetches and parses before the app renders. The entry chunk on its own is a small fraction of it. 📦 Bundle Size Report
Size Limits
|
Sync with main 054fd84 for the eager-closure re-measure (objectui#11984). Claude-Session: https://claude.ai/code/session_01MgfduSkFrfM3eorB3UGfAU Co-authored-by: Claude <noreply@anthropic.com>
Contributor
❌ Console Performance Budget
The eager closure is every chunk the entry reaches through static imports — what the browser fetches and parses before the app renders. The entry chunk on its own is a small fraction of it. Which half objected:
📦 Bundle Size Report
Size Limits
|
… drops its identity-preserving return (objectui#11984) The seat's ruling A on the eager-closure overrun: 43 B gzip off the closure, measured on the merged tree. The memo still recomputes only when its inputs change, and every family pin holds. Claude-Session: https://claude.ai/code/session_01MgfduSkFrfM3eorB3UGfAU Co-authored-by: Claude <noreply@anthropic.com>
…, so its config type-checks (objectui#11984) The previous commit's guard read only `fields?.length`, which does not narrow `resolvedUserFilters`, so the spread typed `element` as optional and the UserFilters `config` prop refused it (TS2719). The guard now reads through `resolvedUserFilters` itself. Claude-Session: https://claude.ai/code/session_01MgfduSkFrfM3eorB3UGfAU Co-authored-by: Claude <noreply@anthropic.com>
Sync with main b1f0dcc before the eager-closure re-measure (objectui#11984). Claude-Session: https://claude.ai/code/session_01MgfduSkFrfM3eorB3UGfAU Co-authored-by: Claude <noreply@anthropic.com>
Contributor
✅ Console Performance Budget
The eager closure is every chunk the entry reaches through static imports — what the browser fetches and parses before the app renders. The entry chunk on its own is a small fraction of it. 📦 Bundle Size Report
Size Limits
|
objectstack-fleet
Bot
deleted the
claude/issue-11984-toolbar-field-lists
branch
October 8, 2026 20:38
os-bill
pushed a commit
that referenced
this pull request
Oct 8, 2026
…and the user-filter chips ask the field read (objectui#11984) (#11999)" This reverts commit aa67386. The eager closure crossed its ceiling when this commit merged behind aaba865 in one merge-queue run. aaba865 fits alone and stays; this commit is rolled back alone, with no ceiling raise. Claude-Session: https://claude.ai/code/session_01MgfduSkFrfM3eorB3UGfAU Co-authored-by: Claude <noreply@anthropic.com>
os-bill
pushed a commit
that referenced
this pull request
Oct 9, 2026
… for first-load bytes only (objectui#11984) fix(plugin-list): the hide-fields, Group and Row color lists and the user-filter chips ask the field read (objectui#11984) (#11999) Fixes #11984 Clause-②: no The list toolbar's hide-fields popover, Group editor and Row color select no longer offer a field the caller may not read, and neither do its user-filter chips. Each now asks `canReadField`, the predicate objectui#11962 gave the Filter panel and the Sort picker, behind the same `isLoaded` gate. This is the family's third card, after objectui#11925 (filter) and objectui#11943 (sort), and it carries the enumeration pin triage asked for (`6063905126`). ## What changes All in `packages/plugin-list/src/ListView.tsx`: - **`allFields` asks the read.** It is the one list the hide-fields popover, the Group editor and the Row color select offer, and the compact toolbar's View settings popover hands it to the same three sections. A column the caller may not read is offered by none of them. Before the permission answer loads, nothing is withheld, as the column gate defers. - **The user-filter chips ask it too** (`filterElements`, now a memo declared below `perms`). A dropdown or toggle chip on an unreadable field is dropped, whether the author named the field or `resolvedUserFilters` derived it from the definition: a value chosen on it is a filter the server refuses, and the list blanks. One exception, shaped like the Sort picker's: a chip whose field a held selection names (the applied user filter, or a host-restored `userFilterSelections`) stays, so that filter can be cleared. Preset tabs pass through. - **Stored configuration on an unreadable field is kept as stored:** - a grouping level stays visible and removable. `GroupingEditor` already mounts a value its options lack as its own entry, labelled with the field name, so the level reads `secret_note` (the raw name), its remove button works, and no other level and no "Add group field" offers it. Nothing fires `onGroupingChange` until the user edits. - a hidden-field entry is withheld from both hide-fields lists: not listed, not counted in the badge, not cleared by "Show all", and every write puts it back. Without this, "Show all" would rewrite the view for its other viewers through an entry this caller was never shown. - a row-color rule is withheld from both Row color selects: they show None with no Clear, and the trigger is not marked. The rule stays in `rowColorConfig`; `ListView` has no row-color callback, so nothing writes it back to a host. It colors nothing for this caller anyway: the server masks the field out of their rows. - **Comments.** The `canReadField` docblock and the `effectiveFields` comment now name every list that asks the read, and point at the enumeration pin for which lists exist instead of asserting a list. **Named in-place fix: the user-filter chips.** The card names three lists; the chips are a fourth. Triage's ruling asks every field list `ListView` and its toolbar offer to pass the predicate, the probe found the derived chips offering an unreadable select field (below), and the change is the same defect class, the same predicate, in the file this claim holds, under the same gates. The seat may want to add the `resolvedUserFilters` / `filterElements` region to the claim's file surface. ## The dispatch's hypotheses - **H0, read first (objectstack `51290bca`, read only): the server refuses a grouping on an unreadable field; it does not reveal it.** The grid's header query rides `POST /data/:object/query`, and `findData` routes a body carrying `groupBy` to `engine.aggregate`. plugin-security refuses it twice over: step 2.9's `assertReadableQueryFields` walks `groupBy` (with `where`, `orderBy`, `having` and `aggregations`) and throws `PermissionDeniedError` (`code` `PERMISSION_DENIED`, `status` 403, reason `field_predicate_denied`); step 2.5b refuses any `groupBy` or aggregation field the query-guard map marks unreadable on an `aggregate`. The same step-2.9 guard answers a user-filter `where` on such a field with 403. Read from source; not measured against a running server. - **H1 holds.** Measured first on `main` through the real `ListView` with a probe (deleted, never committed): with a `/me/permissions` answer marking two fields unreadable, the Sort picker withheld them, so the answer was loaded and denying, while the hide-fields popover, the Group editor, the Row color select, all three View settings sections and the derived user-filter chips offered them. Now each omits them, behind `isLoaded`, with a readable control in each. - **H2 holds**: the enumeration pin below, with two scratch ablations that add an unfiltered list. - **H3**: as described above, and pinned. - **H4**: the budget bot's reading comes after CI. Local estimate only: the minified `ListView` module grows by 628 B, 214 B gzipped on its own (esbuild, gzip -9, `b13ea3c67` against `d9a6f718b`); the latest PR readings were 3311.2 KB against the 3312.0 KB ceiling. ## Pins `packages/plugin-list/src/__tests__/ListView.fieldListRead-11984.test.tsx`, 20 tests: 1. **The enumeration pin**, per toolbar layout (wide and compact). A sweep opens every popover the toolbar renders (anything carrying `aria-haspopup`), opens every combobox inside it, and reads every option and checkbox. The popovers that offer a field of the view must equal `FIELD_LIST_TRIGGERS` (wide: Color, Filter, Group, Hide fields, Sort; compact: Filter, Sort, View settings), so a new field list fails until it is listed. For a restricted caller nothing it reads, nor the toolbar's own text (the chips), may name an unreadable field. Control: with full read every enumerated list offers it. Its bound is written in the file: a list behind a further click, such as a collapsed section, needs a row in `POSITIONS`. 2. **One pin per position** (`POSITIONS`, 10 rows: the Filter panel, the Sort picker, the hide-fields popover, the Group editor, the Row color select, the user-filter chips derived and authored, and the three View settings sections). With no permission answer and with full read the list is identical and includes the unreadable fields; restricted, it is that list minus them. Plus **before `isLoaded`**: a provider refetching with the restricted answer still held offers every field in the hide-fields list, the chips and the Group editor. 3. **Stored configuration**: the grouping level, the hidden-field entry (with a full-read control), the row-color rule (with a full-read control), and a chip kept by a restored selection that leaves once the selection is cleared. ## Reverse check On the committed tree `d9a6f718b`, each mutation landed and was restored through objectstack's `scripts/ablation-replace.mjs` (anchor 1 to 0, blob changed; restore blob equal to `HEAD`, `git diff HEAD` empty), running the new file plus the three family files (`ListView.filterFieldRead-11925`, `ListView.sortFieldRead-11943`, `ListView.sortRemovableOnly-11943`), 37 tests. Every observation matched its prediction: | Mutation | Observed | |---|---| | M1: `allFields` drops the read | 11 failed / 26 passed: both restricted sweeps, the six `allFields` positions, before-isLoaded, the stored grouping and hidden-field cases | | M2: the chips drop the read | 6 / 31: both restricted sweeps, both chip positions, before-isLoaded, the restored-selection chip | | M3: the chips drop the in-use exception | 1 / 36: the restored-selection chip | | M4: nothing is withheld from `hiddenFields` | 1 / 36: the stored hidden-field case | | M5: the row-color rule is not withheld | 1 / 36: the stored row-color case | | M6, scratch: an unfiltered native select added inside the Group popover | 1 / 36: the wide restricted sweep; the Group editor's own pin stays green | | M7, scratch: a new toolbar popover listing every column | 4 / 33: all four sweeps (an unlisted field list; restricted, also an unreadable field) | | M8: the Filter panel drops the read | 8 / 29: both restricted sweeps, the Filter position, five objectui#11925 pins | | M9: the Sort picker drops the read | 10 / 27: both restricted sweeps, the Sort position, three objectui#11943 read pins, four removable-only pins | M3, M5 and M6 were first sent with a replacement that contained its own anchor. `ablation-replace` refused each before any test ran, with the restore proven, so those first attempts measured nothing; they were re-anchored and re-run, and the rows above are the re-runs. ## Gates On `HEAD` `d9a6f718b`, heavy runs through the container's verify lock: - `pnpm --workspace-concurrency=2 --filter '@object-ui/plugin-list^...' build`: `VERDICT command-exit 0`, scope 13 of 47 workspace projects. - `pnpm --filter @object-ui/plugin-list type-check` (`tsc --noEmit && tsc -p tsconfig.test.json`): `VERDICT command-exit 0`; `--listFilesOnly` lists the new test file. - `pnpm exec vitest run --maxWorkers=2` over every `plugin-list` test file naming `ListView`, `canReadField`, `hiddenFields`, `rowColor` or `GroupingEditor` (101 files by `git grep -l`, the new one included), plus `packages/core/src/utils/__tests__/column-identity.ratchet.test.ts` and `scripts/__tests__/one-authority-per-exported-name-6273.test.ts`: `Test Files 103 passed (103)`, `Tests 1137 passed (1137)`, `VERDICT command-exit 0`. - `node scripts/check-changeset-presence.mjs` exit 0 ("2 source file(s) of 1 released package(s) changed, and this change declares 1 changeset(s)"); `node scripts/check-changeset-no-major.mjs` exit 0. - `pnpm check:new-line-citations` exit 0, `VERDICT new-cross-file-line-citations: 0 new citation(s)`; `pnpm check:control-bytes` exit 0. - Also exit 0: `check:changeset-claims`, `check:pending-changeset-literals`, `check:test-path-roots`, `check:vi-mock-specifiers`, `check:vi-mock-inherit`, `check:vi-mock-override-shape`, `check:i18n-keys`, `check:shell-escape-residue`, `check:unreferenced-sources`, `check:phantom-deps`. - **Lint, narrowed and measured.** `pnpm exec eslint --format json` over the two touched TS files (the config's `**/*.{ts,tsx}` population): 2 files, 0 errors. `ListView.tsx` carries 187 warnings, equal to its base blob linted over stdin; the new test carries 0. `eslint.config.js` enables no type-aware linting, so the diff cannot move an untouched file's verdict. Repo-wide lint is CI's. ## Acceptance notes - **Docs.** The package README and `content/docs` say nothing about which toolbar lists ask the field read, so nothing there became false. They are outside the claim's file surface and are not edited. - **Out of scope, measured, reported for the seat, not fixed here:** a host-restored user-filter selection (`userFilterSelections`) on a chip derived from the definition (`userFilters` with `element: 'dropdown'` and no `fields`) is dropped when the definition loads after mount. With full read and no permission provider, the chip showed no selection and the fetch carried no `$filter`; with the same field named by the author, the fetch carried `["status","=","open"]`. The chip state is initialised once, from the fields present at mount, and a derived list has none until the definition loads. Producers: app-shell's `ObjectView`, `ObjectDataPage` and `InterfaceListPage` pass URL-restored `userFilterSelections`. - Observation, not filed: the `allFields` lists label a column by its declared `label` or the i18n resolver, falling back to the raw name, so with unlabelled columns they read `title` where the Sort picker reads `Title`. Unchanged here. - Changeset: `.changeset/11984-toolbar-field-lists-read.md`, a patch for `@object-ui/plugin-list`. Session: `https://claude.ai/code/session_01MgfduSkFrfM3eorB3UGfAU` --- _Generated by [Claude Code](https://claude.ai/code/session_01MgfduSkFrfM3eorB3UGfAU)_ --------- Claude-Session: https://claude.ai/code/session_01MgfduSkFrfM3eorB3UGfAU Co-authored-by: Claude <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes #11984
Clause-②: no
The list toolbar's hide-fields popover, Group editor and Row color select no longer offer a field the caller may not read, and neither do its user-filter chips. Each now asks
canReadField, the predicate objectui#11962 gave the Filter panel and the Sort picker, behind the sameisLoadedgate. This is the family's third card, after objectui#11925 (filter) and objectui#11943 (sort), and it carries the enumeration pin triage asked for (6063905126).What changes
All in
packages/plugin-list/src/ListView.tsx:allFieldsasks the read. It is the one list the hide-fields popover, the Group editor and the Row color select offer, and the compact toolbar's View settings popover hands it to the same three sections. A column the caller may not read is offered by none of them. Before the permission answer loads, nothing is withheld, as the column gate defers.filterElements, now a memo declared belowperms). A dropdown or toggle chip on an unreadable field is dropped, whether the author named the field orresolvedUserFiltersderived it from the definition: a value chosen on it is a filter the server refuses, and the list blanks. One exception, shaped like the Sort picker's: a chip whose field a held selection names (the applied user filter, or a host-restoreduserFilterSelections) stays, so that filter can be cleared. Preset tabs pass through.GroupingEditoralready mounts a value its options lack as its own entry, labelled with the field name, so the level readssecret_note(the raw name), its remove button works, and no other level and no "Add group field" offers it. Nothing firesonGroupingChangeuntil the user edits.rowColorConfig;ListViewhas no row-color callback, so nothing writes it back to a host. It colors nothing for this caller anyway: the server masks the field out of their rows.canReadFielddocblock and theeffectiveFieldscomment now name every list that asks the read, and point at the enumeration pin for which lists exist instead of asserting a list.Named in-place fix: the user-filter chips. The card names three lists; the chips are a fourth. Triage's ruling asks every field list
ListViewand its toolbar offer to pass the predicate, the probe found the derived chips offering an unreadable select field (below), and the change is the same defect class, the same predicate, in the file this claim holds, under the same gates. The seat may want to add theresolvedUserFilters/filterElementsregion to the claim's file surface.The dispatch's hypotheses
51290bca, read only): the server refuses a grouping on an unreadable field; it does not reveal it. The grid's header query ridesPOST /data/:object/query, andfindDataroutes a body carryinggroupBytoengine.aggregate. plugin-security refuses it twice over: step 2.9'sassertReadableQueryFieldswalksgroupBy(withwhere,orderBy,havingandaggregations) and throwsPermissionDeniedError(codePERMISSION_DENIED,status403, reasonfield_predicate_denied); step 2.5b refuses anygroupByor aggregation field the query-guard map marks unreadable on anaggregate. The same step-2.9 guard answers a user-filterwhereon such a field with 403. Read from source; not measured against a running server.mainthrough the realListViewwith a probe (deleted, never committed): with a/me/permissionsanswer marking two fields unreadable, the Sort picker withheld them, so the answer was loaded and denying, while the hide-fields popover, the Group editor, the Row color select, all three View settings sections and the derived user-filter chips offered them. Now each omits them, behindisLoaded, with a readable control in each.ListViewmodule grows by 628 B, 214 B gzipped on its own (esbuild, gzip -9,b13ea3c67againstd9a6f718b); the latest PR readings were 3311.2 KB against the 3312.0 KB ceiling.Pins
packages/plugin-list/src/__tests__/ListView.fieldListRead-11984.test.tsx, 20 tests:aria-haspopup), opens every combobox inside it, and reads every option and checkbox. The popovers that offer a field of the view must equalFIELD_LIST_TRIGGERS(wide: Color, Filter, Group, Hide fields, Sort; compact: Filter, Sort, View settings), so a new field list fails until it is listed. For a restricted caller nothing it reads, nor the toolbar's own text (the chips), may name an unreadable field. Control: with full read every enumerated list offers it. Its bound is written in the file: a list behind a further click, such as a collapsed section, needs a row inPOSITIONS.POSITIONS, 10 rows: the Filter panel, the Sort picker, the hide-fields popover, the Group editor, the Row color select, the user-filter chips derived and authored, and the three View settings sections). With no permission answer and with full read the list is identical and includes the unreadable fields; restricted, it is that list minus them. Plus beforeisLoaded: a provider refetching with the restricted answer still held offers every field in the hide-fields list, the chips and the Group editor.Reverse check
On the committed tree
d9a6f718b, each mutation landed and was restored through objectstack'sscripts/ablation-replace.mjs(anchor 1 to 0, blob changed; restore blob equal toHEAD,git diff HEADempty), running the new file plus the three family files (ListView.filterFieldRead-11925,ListView.sortFieldRead-11943,ListView.sortRemovableOnly-11943), 37 tests. Every observation matched its prediction:allFieldsdrops the readallFieldspositions, before-isLoaded, the stored grouping and hidden-field caseshiddenFieldsM3, M5 and M6 were first sent with a replacement that contained its own anchor.
ablation-replacerefused each before any test ran, with the restore proven, so those first attempts measured nothing; they were re-anchored and re-run, and the rows above are the re-runs.Gates
On
HEADd9a6f718b, heavy runs through the container's verify lock:pnpm --workspace-concurrency=2 --filter '@object-ui/plugin-list^...' build:VERDICT command-exit 0, scope 13 of 47 workspace projects.pnpm --filter @object-ui/plugin-list type-check(tsc --noEmit && tsc -p tsconfig.test.json):VERDICT command-exit 0;--listFilesOnlylists the new test file.pnpm exec vitest run --maxWorkers=2over everyplugin-listtest file namingListView,canReadField,hiddenFields,rowColororGroupingEditor(101 files bygit grep -l, the new one included), pluspackages/core/src/utils/__tests__/column-identity.ratchet.test.tsandscripts/__tests__/one-authority-per-exported-name-6273.test.ts:Test Files 103 passed (103),Tests 1137 passed (1137),VERDICT command-exit 0.node scripts/check-changeset-presence.mjsexit 0 ("2 source file(s) of 1 released package(s) changed, and this change declares 1 changeset(s)");node scripts/check-changeset-no-major.mjsexit 0.pnpm check:new-line-citationsexit 0,VERDICT new-cross-file-line-citations: 0 new citation(s);pnpm check:control-bytesexit 0.check:changeset-claims,check:pending-changeset-literals,check:test-path-roots,check:vi-mock-specifiers,check:vi-mock-inherit,check:vi-mock-override-shape,check:i18n-keys,check:shell-escape-residue,check:unreferenced-sources,check:phantom-deps.pnpm exec eslint --format jsonover the two touched TS files (the config's**/*.{ts,tsx}population): 2 files, 0 errors.ListView.tsxcarries 187 warnings, equal to its base blob linted over stdin; the new test carries 0.eslint.config.jsenables no type-aware linting, so the diff cannot move an untouched file's verdict. Repo-wide lint is CI's.Acceptance notes
content/docssay nothing about which toolbar lists ask the field read, so nothing there became false. They are outside the claim's file surface and are not edited.userFilterSelections) on a chip derived from the definition (userFilterswithelement: 'dropdown'and nofields) is dropped when the definition loads after mount. With full read and no permission provider, the chip showed no selection and the fetch carried no$filter; with the same field named by the author, the fetch carried["status","=","open"]. The chip state is initialised once, from the fields present at mount, and a derived list has none until the definition loads. Producers: app-shell'sObjectView,ObjectDataPageandInterfaceListPagepass URL-restoreduserFilterSelections.allFieldslists label a column by its declaredlabelor the i18n resolver, falling back to the raw name, so with unlabelled columns they readtitlewhere the Sort picker readsTitle. Unchanged here..changeset/11984-toolbar-field-lists-read.md, a patch for@object-ui/plugin-list.Session:
https://claude.ai/code/session_01MgfduSkFrfM3eorB3UGfAUGenerated by Claude Code