objectstack-ai
diff --git a/‎.changeset/18990-viewall-only-permissions-seed.md‎
Lines changed: 14 additions & 0 deletions b/‎.changeset/18990-viewall-only-permissions-seed.md‎
Lines changed: 14 additions & 0 deletions
diff --git a/‎packages/plugins/plugin-hono-server/src/current-user-endpoints.ts‎
Lines changed: 39 additions & 12 deletions b/‎packages/plugins/plugin-hono-server/src/current-user-endpoints.ts‎
Lines changed: 39 additions & 12 deletions
diff --git a/‎packages/plugins/plugin-hono-server/src/effective-api-operations.test.ts‎
Lines changed: 57 additions & 6 deletions b/‎packages/plugins/plugin-hono-server/src/effective-api-operations.test.ts‎
Lines changed: 57 additions & 6 deletions
@@ -0,0 +1,14 @@
+---
+'@objectstack/plugin-hono-server': patch
+---
+
+`/auth/me/permissions` now answers a wildcard-only `viewAllRecords` principal instead of staying silent about every object it can reach.
+
+`seedSuperUserRestrictedObjects` was guarded to `modifyAllRecords` super-users alone. A principal that reaches an object only through a wildcard `viewAllRecords` grant therefore got **no entry at all**: the client fell back to its default-allow path and rendered write and Export affordances the server answers `403 EXPORT_NOT_PERMITTED`. Same silence, same consequence, different principal class from the one framework#18931 closed.
+
+- **One predicate admits both classes.** The seed now asks the wildcard READ bypass — `viewAllRecords || modifyAllRecords` — which is the same question `foldWildcardSuperUser` already asks to decide whose `allowRead` it pulls true, and the same one `PermissionEvaluator` applies server-side. It is now a single module-local reading both call sites share, so the seed can never materialise an entry for a principal the fold leaves entirely false.
+- **A plain wildcard grant carrying neither bypass bit is still not seeded.** That is what makes the admission the read bypass rather than "any wildcard": the fold pulls nothing true for it, so a seeded entry would be an all-false claim with no server behaviour behind it.
+- **The seeded entry is the truth, not an overreach.** It starts `{allow*: false}`, the fold pulls `allowRead` true, and the write bits stay false. The seed only ever touches objects with **no explicit entry**, and on those a viewAll-only principal really can only read — so "explicit false" for edit is what is true about it, where the silence it replaces was not.
+- **`apiOperations` is attached through the predicate already shared with the modify-all class** — an unrestricted object whose export stays allowed is still skipped, because for it the client's default-allow path is already right.
+
+⚠️ **This is a deliberate behaviour change on an existing published channel, ruled rather than inferred.** For a viewAll-only principal a client that reads "no entry" as default-allow now reads an explicit `allowEdit: false` instead. Two pins asserting the old silence (`toBeUndefined` for the viewAll-only principal, one of them added by the framework#18931 PR that pinned this boundary while saying the pin was not a ruling that the silence was correct) are inverted on purpose under that ruling. Payload growth is the same one-entry-per-object framework#18931 accepted, now also for viewAll principals.
@@ -237,6 +237,23 @@ function allPathsMounted(rawApp: any, paths: readonly string[]): boolean {
     );
 }
 
+/**
+ * Does the `'*'` entry carry the super-user READ bypass?
+ *
+ * ONE reading of that question for this whole file — {@link foldWildcardSuperUser}
+ * asks it to decide whose `allowRead` it pulls true, and
+ * {@link seedSuperUserRestrictedObjects} asks it to decide whom it seeds for, so
+ * the seed can never materialise an entry for a principal the fold leaves false.
+ * It is the same bypass the server itself applies: `PermissionEvaluator`'s
+ * `wildcardSuperUser()` treats `viewAllRecords` and `modifyAllRecords` alike for
+ * read (`allowRead` short-circuits on either), and only the modify bit reaches
+ * the write axis.
+ */
+function wildcardGrantsSuperRead(objects: Record<string, any>): boolean {
+    const wild = objects?.['*'];
+    return wild?.viewAllRecords === true || wild?.modifyAllRecords === true;
+}
+
 /**
  * Fold the `'*'` wildcard super-user grant into every per-object entry of a
  * `/me/permissions` `objects` map, mutating it in place.
@@ -263,7 +280,7 @@ function allPathsMounted(rawApp: any, paths: readonly string[]): boolean {
 export function foldWildcardSuperUser(objects: Record<string, any>): void {
     const wild = objects?.['*'];
     if (!wild) return;
-    const superRead = wild.viewAllRecords === true || wild.modifyAllRecords === true;
+    const superRead = wildcardGrantsSuperRead(objects);
     const superWrite = wild.modifyAllRecords === true;
     if (!superRead && !superWrite) return;
     for (const [obj, acc] of Object.entries(objects) as Array<[string, any]>) {
@@ -443,7 +460,7 @@ export interface ApiExposureSchemaLike {
 }
 
 /**
- * [#3391] Seed false-initialized per-object entries for a MODIFY-ALL super-user,
+ * [#3391] Seed false-initialized per-object entries for a wildcard SUPER-USER,
  * for every registered object whose `apiMethods` whitelist tightens exposure.
  *
  * A super-user's grant is usually the `'*'` wildcard, not explicit per-object
@@ -453,11 +470,20 @@ export interface ApiExposureSchemaLike {
  * everything) and lets {@link annotateEffectiveApiOperations} attach the effective
  * set. Runs BEFORE fold.
  *
- * Guarded to `modifyAllRecords` super-users ONLY: for a viewAll-only caller,
- * materializing a `false` entry would flip the client's `check('edit')` from
- * "undefined → default-allow" to "explicit false → deny" — a scope-exceeding
- * behavior change. A modify-all caller is folded to `true` anyway, so seeding is
- * harmless there.
+ * [#18990] Admitted by {@link wildcardGrantsSuperRead} — the READ bypass, so
+ * BOTH super-user classes are seeded, and a plain wildcard grant carrying
+ * neither bypass bit still is not. This pass used to be guarded to
+ * `modifyAllRecords` alone, on the reading that materializing a `false` entry
+ * for a viewAll-only caller would flip the client's `check('edit')` from
+ * "undefined → default-allow" to "explicit false → deny". It does flip it, and
+ * that flip is the POINT: the seed only ever touches objects with no explicit
+ * entry (`objects[name]` below), and on those a viewAll-only principal really
+ * can only read — so "explicit false" for edit is what is TRUE about it, while
+ * the silence it replaces left the client rendering write and Export
+ * affordances the server answers `403`. `allowRead` is pulled true by the same
+ * fold for the same reason: `viewAllRecords` is a read bypass server-side too
+ * (`PermissionEvaluator.checkObjectPermission`), so the entry is exactly as
+ * broad as real enforcement, never broader.
  *
  * [#18931] A schema is skipped only when it needs NO annotation, which is the
  * predicate {@link annotateEffectiveApiOperations} itself applies: unrestricted
@@ -473,7 +499,7 @@ export function seedSuperUserRestrictedObjects(
     objects: Record<string, any>,
     allSchemas: readonly ApiExposureSchemaLike[],
 ): void {
-    if (objects?.['*']?.modifyAllRecords !== true) return;
+    if (!wildcardGrantsSuperRead(objects)) return;
     // [#18931] The export slot annotate will read for an entry seeded here. A
     // seeded entry carries no `allowExport` of its own and `foldWildcardSuperUser`
     // does not add one, so annotate's `acc.allowExport ?? wildExport` resolves to
@@ -1075,10 +1101,11 @@ export function registerCurrentUserEndpoints(
             // (sys_user → edit). Together these remove both the false-negative
             // (admin sees sys_user editable) and the false-positive (admin does
             // NOT see sys_member editable, matching the guard).
-            // [#3391] For a modify-all super-user, seed restricting objects
-            // absent from the merged map so fold pulls them true and annotate
-            // can attach their effective apiOperations. Guarded — a failure
-            // here must never drop the whole response.
+            // [#3391] For a wildcard super-user — [#18990] either bypass bit,
+            // not modify-all alone — seed restricting objects absent from the
+            // merged map so fold pulls what it pulls and annotate can attach
+            // their effective apiOperations. Guarded — a failure here must
+            // never drop the whole response.
             try {
                 // The contract's registry view returns `unknown[]` (schema
                 // shape is engine-local); narrow to the slice this seeding
 
@@ -3,6 +3,7 @@
 import { describe, it, expect } from 'vitest';
 import {
   annotateEffectiveApiOperations,
+  foldWildcardSuperUser,
   seedSuperUserRestrictedObjects,
   type ApiExposureSchemaLike,
 } from './current-user-endpoints.js';
@@ -189,10 +190,30 @@ describe('seedSuperUserRestrictedObjects (#3391)', () => {
     expect(objects.open_obj).toBeUndefined();
   });
 
-  it('does not seed for a viewAll-only wildcard (avoids flipping check() to explicit deny)', () => {
+  // [#18990] INVERTED on purpose. This used to read "does not seed for a
+  // viewAll-only wildcard (avoids flipping check() to explicit deny)". The
+  // ruling on #18990 (batch #159 item 1, letter A) settles that the flip is the
+  // truth for this class, not an overreach: the seed only touches objects with
+  // no explicit entry, and there a viewAll-only principal really can only read.
+  it('seeds for a viewAll-only wildcard too — the read bypass is what admits a principal', () => {
     const objects: Record<string, any> = { '*': { viewAllRecords: true } }; // no modifyAllRecords
     seedSuperUserRestrictedObjects(objects, schemas);
+    expect(objects.widget).toEqual({ allowCreate: false, allowRead: false, allowEdit: false, allowDelete: false });
+    expect(objects.locked).toBeDefined();
+    // the export axis withholds `export` here (no `allowExport` on the
+    // wildcard), which is its own reason to seed the unrestricted object
+    expect(objects.open_obj).toBeDefined();
+  });
+
+  // The other half of that predicate, and the reason it is the READ BYPASS
+  // rather than "any wildcard": a plain wildcard grant carries no bypass bit,
+  // `foldWildcardSuperUser` pulls nothing true for it, and a seeded entry would
+  // therefore be an all-false claim with no server behaviour behind it.
+  it('does not seed for a wildcard carrying neither bypass bit', () => {
+    const objects: Record<string, any> = { '*': { allowRead: true, allowEdit: true } };
+    seedSuperUserRestrictedObjects(objects, schemas);
     expect(objects.widget).toBeUndefined();
+    expect(objects.locked).toBeUndefined();
   });
 
   it('does not clobber an object already present in the map', () => {
@@ -277,12 +298,42 @@ describe('seedSuperUserRestrictedObjects (#3391)', () => {
       expect(objects.crm_lead).toBeUndefined();
     });
 
-    it('does not reach a viewAll-only principal (the seed guard is unchanged)', () => {
-      // Materialising a `false` entry for a caller the fold does NOT pull true
-      // would flip the client's `check()` from default-allow to explicit deny.
-      // #18931 widens WHICH schemas are considered, never WHICH principals.
-      const objects: Record<string, any> = { '*': { viewAllRecords: true } };
+    // [#18990] INVERTED on purpose, under the ruling on #18990 (batch #159
+    // item 1, letter A). This case read "does not reach a viewAll-only
+    // principal (the seed guard is unchanged)" and asserted `toBeUndefined`;
+    // #18931 deliberately widened WHICH schemas are considered and left WHICH
+    // principals alone, pinning that boundary while saying in the same breath
+    // that the pin was not a ruling that the silence was correct. It is that
+    // ruling that now says otherwise, so the pin moves with it.
+    it('reaches a viewAll-only principal: read folded true, writes explicitly false', () => {
+      const objects: Record<string, any> = { '*': { viewAllRecords: true } }; // no modifyAllRecords
+      seedSuperUserRestrictedObjects(objects, unrestricted);
+      foldWildcardSuperUser(objects);
+      annotateEffectiveApiOperations(objects, (name) => unrestricted.find((s) => s.name === name));
+
+      // The four affordances, each pinned — the entry's VALUE is the whole
+      // point of materialising it, so "an entry exists" is not the assertion.
+      expect(objects.crm_lead).toBeDefined();
+      expect(objects.crm_lead.allowRead).toBe(true);   // the wildcard read bypass, folded
+      expect(objects.crm_lead.allowEdit).toBe(false);  // …and the write bits the fold leaves alone
+      expect(objects.crm_lead.allowCreate).toBe(false);
+      expect(objects.crm_lead.allowDelete).toBe(false);
+      // The export axis withholds `export` for this principal exactly as it
+      // does for the modify-all class above — one predicate, both classes.
+      expect(objects.crm_lead.apiOperations).not.toContain('export');
+      expect(objects.crm_lead.apiOperations).toEqual(
+        ['get', 'list', 'create', 'update', 'delete', 'upsert', 'bulk', 'aggregate', 'search', 'import'],
+      );
+    });
+
+    it('stays silent for a viewAll-only principal once it really may export', () => {
+      // The ruling's own carve-out — "skip only an unrestricted object whose
+      // export stays allowed" — is the SAME skip the modify-all control above
+      // pins, reached through the same predicate and not a second one.
+      const objects: Record<string, any> = { '*': { viewAllRecords: true, allowExport: true } };
       seedSuperUserRestrictedObjects(objects, unrestricted);
+      foldWildcardSuperUser(objects);
+      annotateEffectiveApiOperations(objects, (name) => unrestricted.find((s) => s.name === name));
       expect(objects.crm_lead).toBeUndefined();
     });
   });