feat(objectql): enforce per-option visibleWhen server-side (objectui#2284)#2637
Merged
Merged
Conversation
…2284) A select/multiselect/radio option may gate itself with a `visibleWhen` CEL predicate. Client-side hiding is UX, not a security boundary, so on write the engine now re-evaluates the picked value's predicate against the merged record + `current_user` and rejects a clean FALSE (`invalid_option`). Enforces both role/context gating (`'admin' in current_user.roles`) and cascade integrity (`record.country == 'cn'`) that a caller could bypass by submitting a hidden value directly. - rule-validator: `evaluateOptionVisibility` checks only WRITTEN choice fields (multi-select element-wise); fail-open on an unevaluable predicate (missing field / unbound current_user) so cascade predicates never brick a write. `needsPriorRecord` now accounts for option visibleWhen so a cascade predicate can read an unchanged sibling from the prior record on update. - engine: bind `current_user` (ADR-0068 EvalUser) from the execution context at the insert/update validation call sites. - 15 new unit tests (cascade insert/update, role gating, fail-open, multiselect). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_019aYFm77ddLp6tzuJjt9hK2
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
github-actions
Bot
added
documentation
Contributor
📓 Docs Drift CheckThis PR changes 1 package(s): 13 hand-written doc(s) reference the affected code and may need an implementation-accuracy re-verification:
|
os-zhuang
marked this pull request as ready for review
July 5, 2026 14:13
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Follow-up to the spec + renderer work for cascading/role-gated select options (objectstack-ai/objectui#2284, spec #2635, renderer objectui#2289). This closes the security leg: server-side enforcement of per-option
visibleWhen.Why
SelectOption.visibleWhenhides an option in the UI, but hiding is not a security boundary — a caller can submit a hidden value directly (curl, script, replayed request). For a role-gated option ('admin' in current_user.roles) that is an authorization bypass; for a cascade (record.country == 'cn') it is a data-integrity hole (the "China + California" pair). The write path must re-check.What
rule-validator—evaluateOptionVisibility: for each writtenselect/multiselect/radiofield, find the picked option(s) and re-evaluate theirvisibleWhenagainst the merged record +current_user. A clean FALSE →invalid_optionvalidation error (sameValidationErrorenvelope →400 VALIDATION_FAILED). Multi-select is checked element-wise. Unchanged persisted values are not re-checked (only what the patch writes).current_useron a system write) — consistent with every other field rule here, so a broken cascade predicate never bricks a write. Authorization gating therefore depends oncurrent_userbeing bound.engine: bindscurrent_user(ADR-0068EvalUser—{id, roles, organizationId}) from the execution context at the insert/update validation call sites (buildEvalUser).needsPriorRecordnow accounts for optionvisibleWhen, so on update a cascade predicate referencing an unchanged sibling reads it from the prior record.Semantics
FALSEinvalid_option)TRUEcurrent_user)This single pass enforces both authorization gating and cascade integrity without needing to distinguish the two intents — reject-on-clean-false is correct for both, provided
current_useris bound (which the engine now does).Tests
rule-validator.option-visibility.test.ts): cascade insert, cascade update via prior record, "only written fields checked", role gating (admin vs non-admin), fail-open whencurrent_userunbound, multi-select element-wise,needsPriorRecord.@objectstack/objectqlbuilds (tsc/DTS) clean.🤖 Generated with Claude Code
https://claude.ai/code/session_019aYFm77ddLp6tzuJjt9hK2
Generated by Claude Code