Repository navigation
fix(runtime): honor app-declared default profile on the artifact-serve path (ADR-0056 D7) - #2132
Closed
xuyushun441-sys wants to merge 3 commits into
Closed
xuyushun441-sys wants to merge 3 commits into
xuyushun441-sys wants to merge 3 commits into
Conversation
…e path (ADR-0056 D7) `createStandaloneStack` (the boot path used by `objectstack dev`/`serve`/`start` when serving a compiled `dist/objectstack.json` with no host `objectstack.config.ts`) surfaced `objects`/`requires`/`manifest` from the artifact bundle but dropped `permissions[]` and `roles[]`. So the CLI's `appDefaultProfileName(config.permissions)` saw `undefined` and SecurityPlugin fell back to the built-in owner-only `member_default` — an app `isDefault` profile carrying e.g. `readScope: 'unit_and_below'` was silently ignored. The config-load path was unaffected (the app's `permissions` survived via the original stack object). Surface `permissions[]` and `roles[]` from the artifact bundle, mirroring the existing `objects`/`requires`/`manifest` handling, so the artifact-serve path applies the app default profile exactly like the config-load path. Tests: - packages/runtime/src/standalone-stack.test.ts — the artifact-serve path now surfaces permissions/roles (incl. readScope) and drives appDefaultProfileName. - packages/dogfood/test/showcase-scope-depth-fallback.dogfood.test.ts — a profile resolved by name as fallbackPermissionSet widens the visibility matrix (unit_and_below) with the reference hierarchy resolver, and fails closed without it. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
Contributor
📓 Docs Drift CheckThis PR changes 2 package(s): 17 hand-written doc(s) reference the affected code and may need an implementation-accuracy re-verification:
|
The first createStandaloneStack call cold-loads heavy deps (objectql/metadata/ driver-memory) via dynamic import, which on a cold CI worker (Node 20) exceeded vitest's default 5s test timeout — failing only the first case. Move the one-time boot into a beforeAll with a 60s timeout and have the assertion cases read the shared result (also removes 4 redundant boots). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This was referenced Jun 21, 2026
Closed
Closed
Collaborator
Author
This branch was successfully deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
问题
objectstack dev/serve/start从编译产物(dist/objectstack.json,无 hostobjectstack.config.ts)启动时,不会应用 app 声明的默认权限集 profile(isProfile: true, isDefault: true),而带 config 启动时会。表现:一个默认 profile 携带readScope(如 ADR-0057unit_and_below)的 app,在 artifact 启动路径下被忽略,所有用户回退到内置仅 owner 的member_default,层级 scope fail-closed。根因
dev没有独立启动路径,它把serve --dev当子进程拉起;无 config 时走 artifact 启动路径。产物本身保留了permissions/isDefault,但createStandaloneStack(packages/runtime)只把objects/requires/manifest浮到顶层,漏掉了permissions[]和roles[]。于是serve.ts的appDefaultProfileName(config.permissions)拿到undefined,SecurityPlugin回退到member_default。config 加载路径未受影响,仅因originalConfig.permissions在展开时幸存。修复
在
createStandaloneStack中把产物 bundle 的permissions[]和roles[]一并浮到顶层,与现有objects/requires/manifest处理方式一致。这样 artifact 启动路径对 app 默认 profile 的处理与 config 路径完全相同(也修复了 artifact 模式下 app org roles 未注册到 Better-Auth 的同类缺口)。验证
packages/runtime/src/standalone-stack.test.ts(5/5):artifact 路径现在浮出 permissions/roles(含readScope),并驱动appDefaultProfileName。packages/dogfood/test/showcase-scope-depth-fallback.dogfood.test.ts(4/4):profile 按名字作为fallbackPermissionSet解析(正是修复所喂入的 CLI 接线),可见性矩阵按unit_and_below放宽(配合参考层级 resolver),无 resolver 时 fail-closed 退回 owner-only。对齐参考用例showcase-scope-depth.dogfood.test.ts的矩阵。🤖 Generated with Claude Code