fix(app-shell): Studio Access refuses a new permission set over a taken identifier and can discard a set's draft - #26916

Requested by Steedos · project thread

Fixes #26836

Clause-②: no
Metadata-protocol: none

维护者速读

• 改了什么:Studio「访问」页新建权限集前,先查已发布和草稿中的同名权限集(跨所有软件包);标识已被占用就拒绝、不写入,提示里点名那个权限集,属于本软件包时给出「打开它」。另外,打开的权限集若有待发布草稿,标题栏多一个「放弃草稿」。
• 为什么改:原来的首写保护(If-None-Match: * + 草稿模式)只拦已有草稿,不拦已发布的同名权限集,于是新建会在线上权限集上叠一份空白草稿,发布软件包就会清空它的全部授权;Studio 里也没有办法放弃这份草稿。
• 风险与回滚:低。只改 AccessPillar 一处的新建与放弃路径,沿用现有接口(列表、草稿列表、DELETE ?state=draft&package=);服务端、spec 不动。回滚即还原本 PR。
• 先看:ui/packages/app-shell/src/views/studio-design/StudioDesignSurface.tsx 的 AccessPillar(doCreate 新增的占用检查、discardDraft、对话框 extra 里的拒绝提示);StudioDesignSurface.accessCreateTaken-26836.test.tsx。
• 两分钟验证:pnpm --dir ui exec vitest run packages/app-shell/src/views/studio-design/StudioDesignSurface.accessCreateTaken-26836.test.tsx,预期 9 个测试全绿。
• 需要你做的:无,席位落地。

What changes

• Create over a taken identifier is refused before anything is written. AccessPillar's doCreate now reads the published permission sets and the draft headers across every package (client.list('permission'), client.listDrafts({ type: 'permission' }), the same unscoped pair the Interfaces pillar's create reads). A name either holds is refused in the dialog with a sentence naming the set (its label and identifier). When the set is this package's (on the rail), the dialog offers "Open “LABEL”", which closes the dialog and opens it; a set another package holds gets no open path, and the sentence says it is outside this package.
• A fresh name is created as before: the draft save with mode: 'draft', packageId, ifNoneMatch: '*', surface: 'studio', the toast, and the new set opened.
• Discard draft. An open set with a pending draft shows "Discard draft" in its header (beside Explain access), hidden on a read-only package. It confirms (one sentence for a published set, another for a set never published), then calls client.reset('permission', NAME, { state: 'draft', packageId }), the DELETE ?state=draft&package= door the metadata editor's discard uses. A published set goes back to its live body (the matrix re-reads it, as after a publish); a set never published leaves the rail. A refused discard is a toast with the door's message.
• Six new studio namespace rows in @object-ui/i18n, en and zh. One root changeset: @object-ui/app-shell patch and @object-ui/i18n patch.
• No packages/spec/**, no server change.

Tests

StudioDesignSurface.accessCreateTaken-26836.test.tsx, nine cases on the real AccessPillar and PermissionMatrixEditPage, over a client double that keeps published and draft rows per package and refuses a first-write pin over a draft row the way the door does:

• create over a published id of this package: refused, save never called, no draft row, the sentence names the set, and "Open" opens it (its header and grant count);
• create over a published id another package holds: refused, nothing written, no "Open";
• create over a draft id: refused before the save;
• a draft that lands between the check and the save: the save still carries ifNoneMatch: '*' and the door's 409 is shown, the other draft untouched (objectui#11773);
• a fresh id: saved with the four options above, toast, rail row and header;
• discard on a published set: reset called with { state: 'draft', packageId }, the matrix goes from 0 to 1 object granted (the live set), the set stays on the rail, the control goes away;
• discard on a set never published: it leaves the rail and the remaining set opens;
• a declined confirm discards nothing;
• no discard control without a pending draft, nor on a read-only package.

Acceptance notes

• The door half is not a server defect, so there is no domain:server child. The metadata door does what the spec declares: SaveMetaItemRequestSchema.parentVersion says a present null "asserts 'no current row of this lifecycle'" (on the REST door, If-None-Match: *), and the @objectstack/metadata-protocol changelog entry that opened the header says If-None-Match: * "with ?mode=draft for a draft … saves only where no row of that lifecycle exists". A draft-mode pin over a published row is therefore admitted by contract (it is how a client says "start a draft only if nobody has one"). Making the door judge every lifecycle would be a semantic change to that declared pin, beyond this card.
• Race window of the client-side check: a set published (or created in another package) between the pillar's two reads and its save is not refused by the pin; the save then writes a blank draft over it, as before this change. A draft that lands in that window is still refused by the door (tested above).
• The "Open" path exists only for a set on this package's rail; a set another package holds cannot be opened from this pillar, so the refusal there names it and asks for another identifier.

Verification

All at head 4dd29301, in a worktree off origin/main c4a4aefc.

Dogfood battery: not run, no ! in the title and no (narrowing) arm.

Generated by Claude Code