From 602e4b9cd99a635abbbb88adb0585be626fca288 Mon Sep 17 00:00:00 2001 From: "objectstack-fleet[bot]" <332303061+objectstack-fleet[bot]@users.noreply.github.com> Date: Thu, 8 Oct 2026 20:21:21 +0000 Subject: [PATCH] fix(plugin-list): re-land aa67386a5 (objectui#11999), reverted by 902fbe190 for first-load bytes only (objectui#11984) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit fix(plugin-list): the hide-fields, Group and Row color lists and the user-filter chips ask the field read (objectui#11984) (#11999) Fixes #11984 Clause-②: no The list toolbar's hide-fields popover, Group editor and Row color select no longer offer a field the caller may not read, and neither do its user-filter chips. Each now asks `canReadField`, the predicate objectui#11962 gave the Filter panel and the Sort picker, behind the same `isLoaded` gate. This is the family's third card, after objectui#11925 (filter) and objectui#11943 (sort), and it carries the enumeration pin triage asked for (`6063905126`). ## What changes All in `packages/plugin-list/src/ListView.tsx`: - **`allFields` asks the read.** It is the one list the hide-fields popover, the Group editor and the Row color select offer, and the compact toolbar's View settings popover hands it to the same three sections. A column the caller may not read is offered by none of them. Before the permission answer loads, nothing is withheld, as the column gate defers. - **The user-filter chips ask it too** (`filterElements`, now a memo declared below `perms`). A dropdown or toggle chip on an unreadable field is dropped, whether the author named the field or `resolvedUserFilters` derived it from the definition: a value chosen on it is a filter the server refuses, and the list blanks. One exception, shaped like the Sort picker's: a chip whose field a held selection names (the applied user filter, or a host-restored `userFilterSelections`) stays, so that filter can be cleared. Preset tabs pass through. - **Stored configuration on an unreadable field is kept as stored:** - a grouping level stays visible and removable. `GroupingEditor` already mounts a value its options lack as its own entry, labelled with the field name, so the level reads `secret_note` (the raw name), its remove button works, and no other level and no "Add group field" offers it. Nothing fires `onGroupingChange` until the user edits. - a hidden-field entry is withheld from both hide-fields lists: not listed, not counted in the badge, not cleared by "Show all", and every write puts it back. Without this, "Show all" would rewrite the view for its other viewers through an entry this caller was never shown. - a row-color rule is withheld from both Row color selects: they show None with no Clear, and the trigger is not marked. The rule stays in `rowColorConfig`; `ListView` has no row-color callback, so nothing writes it back to a host. It colors nothing for this caller anyway: the server masks the field out of their rows. - **Comments.** The `canReadField` docblock and the `effectiveFields` comment now name every list that asks the read, and point at the enumeration pin for which lists exist instead of asserting a list. **Named in-place fix: the user-filter chips.** The card names three lists; the chips are a fourth. Triage's ruling asks every field list `ListView` and its toolbar offer to pass the predicate, the probe found the derived chips offering an unreadable select field (below), and the change is the same defect class, the same predicate, in the file this claim holds, under the same gates. The seat may want to add the `resolvedUserFilters` / `filterElements` region to the claim's file surface. ## The dispatch's hypotheses - **H0, read first (objectstack `51290bca`, read only): the server refuses a grouping on an unreadable field; it does not reveal it.** The grid's header query rides `POST /data/:object/query`, and `findData` routes a body carrying `groupBy` to `engine.aggregate`. plugin-security refuses it twice over: step 2.9's `assertReadableQueryFields` walks `groupBy` (with `where`, `orderBy`, `having` and `aggregations`) and throws `PermissionDeniedError` (`code` `PERMISSION_DENIED`, `status` 403, reason `field_predicate_denied`); step 2.5b refuses any `groupBy` or aggregation field the query-guard map marks unreadable on an `aggregate`. The same step-2.9 guard answers a user-filter `where` on such a field with 403. Read from source; not measured against a running server. - **H1 holds.** Measured first on `main` through the real `ListView` with a probe (deleted, never committed): with a `/me/permissions` answer marking two fields unreadable, the Sort picker withheld them, so the answer was loaded and denying, while the hide-fields popover, the Group editor, the Row color select, all three View settings sections and the derived user-filter chips offered them. Now each omits them, behind `isLoaded`, with a readable control in each. - **H2 holds**: the enumeration pin below, with two scratch ablations that add an unfiltered list. - **H3**: as described above, and pinned. - **H4**: the budget bot's reading comes after CI. Local estimate only: the minified `ListView` module grows by 628 B, 214 B gzipped on its own (esbuild, gzip -9, `b13ea3c67` against `d9a6f718b`); the latest PR readings were 3311.2 KB against the 3312.0 KB ceiling. ## Pins `packages/plugin-list/src/__tests__/ListView.fieldListRead-11984.test.tsx`, 20 tests: 1. **The enumeration pin**, per toolbar layout (wide and compact). A sweep opens every popover the toolbar renders (anything carrying `aria-haspopup`), opens every combobox inside it, and reads every option and checkbox. The popovers that offer a field of the view must equal `FIELD_LIST_TRIGGERS` (wide: Color, Filter, Group, Hide fields, Sort; compact: Filter, Sort, View settings), so a new field list fails until it is listed. For a restricted caller nothing it reads, nor the toolbar's own text (the chips), may name an unreadable field. Control: with full read every enumerated list offers it. Its bound is written in the file: a list behind a further click, such as a collapsed section, needs a row in `POSITIONS`. 2. **One pin per position** (`POSITIONS`, 10 rows: the Filter panel, the Sort picker, the hide-fields popover, the Group editor, the Row color select, the user-filter chips derived and authored, and the three View settings sections). With no permission answer and with full read the list is identical and includes the unreadable fields; restricted, it is that list minus them. Plus **before `isLoaded`**: a provider refetching with the restricted answer still held offers every field in the hide-fields list, the chips and the Group editor. 3. **Stored configuration**: the grouping level, the hidden-field entry (with a full-read control), the row-color rule (with a full-read control), and a chip kept by a restored selection that leaves once the selection is cleared. ## Reverse check On the committed tree `d9a6f718b`, each mutation landed and was restored through objectstack's `scripts/ablation-replace.mjs` (anchor 1 to 0, blob changed; restore blob equal to `HEAD`, `git diff HEAD` empty), running the new file plus the three family files (`ListView.filterFieldRead-11925`, `ListView.sortFieldRead-11943`, `ListView.sortRemovableOnly-11943`), 37 tests. Every observation matched its prediction: | Mutation | Observed | |---|---| | M1: `allFields` drops the read | 11 failed / 26 passed: both restricted sweeps, the six `allFields` positions, before-isLoaded, the stored grouping and hidden-field cases | | M2: the chips drop the read | 6 / 31: both restricted sweeps, both chip positions, before-isLoaded, the restored-selection chip | | M3: the chips drop the in-use exception | 1 / 36: the restored-selection chip | | M4: nothing is withheld from `hiddenFields` | 1 / 36: the stored hidden-field case | | M5: the row-color rule is not withheld | 1 / 36: the stored row-color case | | M6, scratch: an unfiltered native select added inside the Group popover | 1 / 36: the wide restricted sweep; the Group editor's own pin stays green | | M7, scratch: a new toolbar popover listing every column | 4 / 33: all four sweeps (an unlisted field list; restricted, also an unreadable field) | | M8: the Filter panel drops the read | 8 / 29: both restricted sweeps, the Filter position, five objectui#11925 pins | | M9: the Sort picker drops the read | 10 / 27: both restricted sweeps, the Sort position, three objectui#11943 read pins, four removable-only pins | M3, M5 and M6 were first sent with a replacement that contained its own anchor. `ablation-replace` refused each before any test ran, with the restore proven, so those first attempts measured nothing; they were re-anchored and re-run, and the rows above are the re-runs. ## Gates On `HEAD` `d9a6f718b`, heavy runs through the container's verify lock: - `pnpm --workspace-concurrency=2 --filter '@object-ui/plugin-list^...' build`: `VERDICT command-exit 0`, scope 13 of 47 workspace projects. - `pnpm --filter @object-ui/plugin-list type-check` (`tsc --noEmit && tsc -p tsconfig.test.json`): `VERDICT command-exit 0`; `--listFilesOnly` lists the new test file. - `pnpm exec vitest run --maxWorkers=2` over every `plugin-list` test file naming `ListView`, `canReadField`, `hiddenFields`, `rowColor` or `GroupingEditor` (101 files by `git grep -l`, the new one included), plus `packages/core/src/utils/__tests__/column-identity.ratchet.test.ts` and `scripts/__tests__/one-authority-per-exported-name-6273.test.ts`: `Test Files 103 passed (103)`, `Tests 1137 passed (1137)`, `VERDICT command-exit 0`. - `node scripts/check-changeset-presence.mjs` exit 0 ("2 source file(s) of 1 released package(s) changed, and this change declares 1 changeset(s)"); `node scripts/check-changeset-no-major.mjs` exit 0. - `pnpm check:new-line-citations` exit 0, `VERDICT new-cross-file-line-citations: 0 new citation(s)`; `pnpm check:control-bytes` exit 0. - Also exit 0: `check:changeset-claims`, `check:pending-changeset-literals`, `check:test-path-roots`, `check:vi-mock-specifiers`, `check:vi-mock-inherit`, `check:vi-mock-override-shape`, `check:i18n-keys`, `check:shell-escape-residue`, `check:unreferenced-sources`, `check:phantom-deps`. - **Lint, narrowed and measured.** `pnpm exec eslint --format json` over the two touched TS files (the config's `**/*.{ts,tsx}` population): 2 files, 0 errors. `ListView.tsx` carries 187 warnings, equal to its base blob linted over stdin; the new test carries 0. `eslint.config.js` enables no type-aware linting, so the diff cannot move an untouched file's verdict. Repo-wide lint is CI's. ## Acceptance notes - **Docs.** The package README and `content/docs` say nothing about which toolbar lists ask the field read, so nothing there became false. They are outside the claim's file surface and are not edited. - **Out of scope, measured, reported for the seat, not fixed here:** a host-restored user-filter selection (`userFilterSelections`) on a chip derived from the definition (`userFilters` with `element: 'dropdown'` and no `fields`) is dropped when the definition loads after mount. With full read and no permission provider, the chip showed no selection and the fetch carried no `$filter`; with the same field named by the author, the fetch carried `["status","=","open"]`. The chip state is initialised once, from the fields present at mount, and a derived list has none until the definition loads. Producers: app-shell's `ObjectView`, `ObjectDataPage` and `InterfaceListPage` pass URL-restored `userFilterSelections`. - Observation, not filed: the `allFields` lists label a column by its declared `label` or the i18n resolver, falling back to the raw name, so with unlabelled columns they read `title` where the Sort picker reads `Title`. Unchanged here. - Changeset: `.changeset/11984-toolbar-field-lists-read.md`, a patch for `@object-ui/plugin-list`. Session: `https://claude.ai/code/session_01MgfduSkFrfM3eorB3UGfAU` --- _Generated by [Claude Code](https://claude.ai/code/session_01MgfduSkFrfM3eorB3UGfAU)_ --------- Claude-Session: https://claude.ai/code/session_01MgfduSkFrfM3eorB3UGfAU Co-authored-by: Claude --- .changeset/11984-toolbar-field-lists-read.md | 11 + packages/plugin-list/src/ListView.tsx | 132 +++-- .../ListView.fieldListRead-11984.test.tsx | 520 ++++++++++++++++++ 3 files changed, 632 insertions(+), 31 deletions(-) create mode 100644 .changeset/11984-toolbar-field-lists-read.md create mode 100644 packages/plugin-list/src/__tests__/ListView.fieldListRead-11984.test.tsx diff --git a/.changeset/11984-toolbar-field-lists-read.md b/.changeset/11984-toolbar-field-lists-read.md new file mode 100644 index 0000000000..02933d29a0 --- /dev/null +++ b/.changeset/11984-toolbar-field-lists-read.md @@ -0,0 +1,11 @@ +--- +'@object-ui/plugin-list': patch +--- + +The list toolbar's hide-fields popover, Group editor and Row color select, and its user-filter chips, no longer offer a field the user may not read (objectui#11984). They now ask the same field-level read check as the list's columns, its Filter panel and its Sort picker. The compact toolbar's View settings popover offers the same three lists and asks it too. + +- **User-filter chips.** A chip on a field the user may not read is not shown, whether the author named the field or it was derived from the object definition: a value chosen on it is a filter the server refuses, and the list went blank. A chip whose field a selection already holds (the applied filter, or a selection the host restored) stays, so that filter can be cleared. +- **Stored settings are kept.** A grouping level on such a field still shows, under the field's name, so it can be removed, and nothing offers that field as a new choice. A hidden-field entry or a row-color rule on such a field is not shown, counted or cleared in the editors, and stays as stored: "Show all" and every other edit keep it. +- **Nothing else changes.** While the permission answer has not loaded, every list is as before, the same way the column check defers. A user who may read every field sees the same lists, in the same order. + +**Clause-②: no**: no export, prop, type member or accepted input changes. diff --git a/packages/plugin-list/src/ListView.tsx b/packages/plugin-list/src/ListView.tsx index 95728f40b9..565dae2c04 100644 --- a/packages/plugin-list/src/ListView.tsx +++ b/packages/plugin-list/src/ListView.tsx @@ -1121,10 +1121,15 @@ function describeRefusedPageSize( /** * Field-level READ for the field lists the toolbar offers: the Filter panel's - * (`filterFields`, objectui#11925) and the Sort picker's (`sortFields`, - * objectui#11943). The two lists used to disagree: objectui#11925 wrote this - * predicate inside the filter memo, so the sort picker never asked it. It now - * lives once, here, and both lists call it. + * (`filterFields`, objectui#11925), the Sort picker's (`sortFields`, + * objectui#11943), and since objectui#11984 the list the hide-fields popover, + * the Group editor and the Row color select share (`allFields`, which the + * compact toolbar's View settings popover reads too) and the user-filter + * chips (`filterElements`). The first two lists used to disagree: + * objectui#11925 wrote this predicate inside the filter memo, so the sort + * picker never asked it. It now lives once, here, and every list calls it. + * Which lists exist is re-derived by the enumeration pin in + * `ListView.fieldListRead-11984.test.tsx`, not by this comment. * * It is the same call the column gate (`effectiveFields`) makes, * `perms.checkField(objectName, field, 'read')`, behind the same gate: until @@ -1132,8 +1137,8 @@ function describeRefusedPageSize( * true. An unanswered policy filters nothing, exactly as the columns defer. * * A plain function of the permission value and the object name rather than a - * hook. Both memos already depend on those two, so neither memo depends on a - * function's identity (AGENTS.md #10). + * hook. Every memo that calls it already depends on those two, so none depends + * on a function's identity (AGENTS.md #10). */ function canReadField( perms: ReturnType, @@ -1678,9 +1683,8 @@ export const ListView = React.forwardRef(({ return { ...configured, fields: derivedFields }; }, [schema.userFilters, objectDef, tFieldLabel]); - - // ADR-0053: userFilters (dropdown | tabs) is the sole page filter control. - const filterElements = resolvedUserFilters; + // The chips the toolbar renders are `filterElements`, which asks the field + // read; it is declared below `perms` (objectui#11984). // Hidden Fields State (initialized from schema) const [hiddenFields, setHiddenFields] = React.useState>( @@ -3218,11 +3222,14 @@ export const ListView = React.forwardRef(({ // The other field lists are not built from it, and each asks the same read // itself. The `$select` projection in the data-fetch effect filters the // declared columns with the same call; `perms` is read before that effect so - // it can. The Filter panel's list and the Sort picker's list ask through - // `canReadField` (objectui#11925, objectui#11943). One exception: the Sort - // picker keeps a field the current sort already names, so its row can be - // removed. It lists that field disabled, so no other row and no "Add sort" - // can choose it. + // it can. The Filter panel's list, the Sort picker's list, the list the + // hide-fields popover, the Group editor and the Row color select share + // (`allFields`), and the user-filter chips (`filterElements`) ask through + // `canReadField` (objectui#11925, objectui#11943, objectui#11984). Two + // exceptions keep a field the current state already names: the Sort picker + // lists it disabled, so its row can be removed but no other row and no "Add + // sort" can choose it; a user-filter chip whose field a held selection names + // stays, so that selection can be cleared. const effectiveFields = React.useMemo(() => { // Defensive: `columns` is `string[] | ListColumn[]`, but metadata is // user-authored — anything non-array degrades to "no declared columns". @@ -4487,9 +4494,20 @@ export const ListView = React.forwardRef(({ }, [data, effectiveFields, resolvedExportOptions, schema.objectName, authoredFilter, schema.searchableFields, exportPermitted, dataSource, appliedFilters, appliedUserFilterConditions, currentSort, searchTerm, objectDef, resolveObjectLabel]); // All available fields for hide/show (with i18n) + // + // objectui#11984 — this one list is what the hide-fields popover, the Group + // editor and the Row color select offer, in the toolbar and in the compact + // toolbar's View settings popover alike, so the field read is asked here, + // once, through `canReadField`: a column the caller may not read is offered + // by none of them. Until the permission answer loads, nothing is withheld, + // as the column gate defers. A grouping level that already names a withheld + // field still shows: `GroupingEditor` mounts a value its options do not + // carry as its own entry, labelled with the field name, so the level can be + // removed, and no other level or "Add group field" offers it. const allFields = React.useMemo(() => { return (Array.isArray(schema.columns) ? (schema.columns as any[]) : []).flatMap((f: any) => { if (typeof f === 'string') { + if (!canReadField(perms, schema.objectName, f)) return []; return [{ name: f, label: tFieldLabel(f, f) }]; } // `name` here is this popover's OWN key (it drives `hiddenFields`), which @@ -4498,10 +4516,62 @@ export const ListView = React.forwardRef(({ const name = columnIdentity(f); // No resolvable identity → nothing to hide or show; it used to render a // checkbox keyed `undefined` that could never match a column. - if (!name) return []; + if (!name || !canReadField(perms, schema.objectName, name)) return []; return [{ name, label: tFieldLabel(name, f.label || name) }]; }); - }, [schema.columns, tFieldLabel]); + }, [schema.columns, tFieldLabel, perms, schema.objectName]); + + // objectui#11984 — what the two hide-fields lists (the toolbar popover and + // the View settings section) are handed of `hiddenFields`. An entry naming a + // field the caller may not read is WITHHELD from them: not listed, not + // counted in their badges, not cleared by their "Show all", and put back by + // every write they make, so the stored list keeps it. Hiding such a column + // changes nothing for this caller, since the column gate already drops it, + // and a "Show all" that cleared it would rewrite the view for its other + // viewers through an entry this caller was never shown. With nothing + // withheld (full read, or no answer loaded yet) both are exactly + // `hiddenFields` and `updateHiddenFields`. Plain per-render values, not + // memos (AGENTS.md #10). + const withheldHiddenFields = [...hiddenFields].filter((name) => !canReadField(perms, schema.objectName, name)); + const offeredHiddenFields = withheldHiddenFields.length === 0 + ? hiddenFields + : new Set([...hiddenFields].filter((name) => !withheldHiddenFields.includes(name))); + const updateOfferedHiddenFields = (next: Set) => + updateHiddenFields(withheldHiddenFields.length === 0 ? next : new Set([...next, ...withheldHiddenFields])); + + // objectui#11984 — a row-color rule on a field the caller may not read is + // withheld from both Row color selects the same way: they show "None" with + // no Clear, and the trigger is not marked active. The rule itself stays in + // `rowColorConfig`, which only a pick in those selects ever replaces. It + // colors nothing for this caller: their fetch does not ask for a field they + // may not read and the server masks it out of their rows, so the rows carry + // no value to color by. + const offeredRowColorConfig = + rowColorConfig && canReadField(perms, schema.objectName, rowColorConfig.field) ? rowColorConfig : undefined; + + /** + * The user-filter chips the toolbar renders (ADR-0053: `userFilters`, dropdown + * or tabs, is the sole page filter control). + * + * objectui#11984 — the dropdown and toggle chips are a field list too, whether + * the author named the fields or `resolvedUserFilters` derived them from the + * object definition, so each asks `canReadField`. A chip on a field the caller + * may not read is dropped: a value chosen on it is a filter the server refuses + * with 403, and the list blanks. The exception is a chip whose field a held + * selection already names, the applied user filter or a selection the host + * restored (`userFilterSelections`): it stays, so the filter it holds can be + * cleared, as the Sort picker keeps a field its current sort names. The + * preset tabs carry filters, not a field list, and pass through unchanged. + */ + const filterElements = React.useMemo(() => { + if (!resolvedUserFilters?.fields?.length) return resolvedUserFilters; + const held = new Set(Object.keys(userFilterSelections ?? {}).filter((field) => userFilterSelections?.[field]?.length)); + for (const condition of userFilterConditions) if (Array.isArray(condition)) held.add(condition[0]); + return { + ...resolvedUserFilters, + fields: resolvedUserFilters.fields.filter((f) => held.has(f.field) || canReadField(perms, schema.objectName, f.field)), + }; + }, [resolvedUserFilters, userFilterConditions, userFilterSelections, perms, schema.objectName]); /** * The list region's ARIA attributes, read through the ONE reader of the @@ -4663,14 +4733,14 @@ export const ListView = React.forwardRef(({ size="sm" className={cn( "hidden sm:inline-flex h-7 px-2 text-muted-foreground hover:text-primary text-xs transition-colors duration-150", - hiddenFields.size > 0 && "text-primary" + offeredHiddenFields.size > 0 && "text-primary" )} > {t('list.hideFields')} - {hiddenFields.size > 0 && ( + {offeredHiddenFields.size > 0 && ( - {hiddenFields.size} + {offeredHiddenFields.size} )} @@ -4679,8 +4749,8 @@ export const ListView = React.forwardRef(({

{t('list.hideFieldsTitle')}

- {hiddenFields.size > 0 && ( - )} @@ -4690,15 +4760,15 @@ export const ListView = React.forwardRef(({