[finding] `getUiView` list branch serves fields declared `hidden` when the field name is one of its nine priority names — declared, not enforced

[os-trump]

Found out of scope by the #13214 tenancy-limb dev (PR #13258) while measuring the blast radius of GET /api/v1/ui/view/:object/:type. ⛔ Reported, not touched — the repair is in a different package from that card and is a different defect class.

⛔ Ungraded and unrouted. Severity not judged here. Duplicate-checked with one targeted search before filing (it returned two unrelated closed items, #10001 and #7494, so the channel was live and the result is a reading rather than an unverified zero).

Measured

packages/metadata-protocol/src/protocol.ts, getUiView, the type === 'list' branch:

const priorityFields = ['name','title','label','subject','email','status','type','category','created_at'];
let columns = fieldKeys.filter(k => priorityFields.includes(k));
if (columns.length < 5) {
    const remaining = fieldKeys.filter(k => !columns.includes(k) && k !== 'id' && !fields[k].hidden);
    columns = [...columns, ...remaining.slice(0, 5 - columns.length)];
}

!fields[k].hidden is applied to the fill pass only. The priority pass has no such filter, so a field declared hidden: true whose name happens to be one of those nine is emitted as a list column — with its label.

Driven, not read off the source (PR #13258, packages/rest/src/ui-view-route-tenancy.measurement.test.ts, section 3). One object carrying two hidden fields of different kinds:

• beta_secret — hidden: true, not a priority name ⇒ dropped, as expected;
• status — hidden: true, and a priority name ⇒ served, { field: 'status', label: 'Beta Status', sortable: true }.

The form branch of the same function filters all hidden fields uniformly (.filter(k => ... && !fields[k].hidden)), so the two branches of one producer disagree about what hidden means.

Why this is worth a card rather than a comment

1. Declared is not enforced (Prime Directive chore: version packages #10). hidden reads as a floor and is one for eight of nine spellings; the ninth class is decided by whether the author happened to pick a name from an internal presentation heuristic. Nothing at authoring time says so.
2. The affected names are the likely ones. email, status, type, category, subject, title are exactly the field names an author reaches for, so the failing case is not exotic.
3. ⚠️ It compounds with [finding] GET /api/v1/ui/view/:object/:type resolves a UI view with no identity resolution and no anonymous-deny at the REST seam #13214. That card is measuring anonymous and cross-environment reachability of this same route. If that decision lands on "the route is deliberately public", this defect decides part of what "public" then discloses. ⛔ That is a note about ordering, not a claim about [finding] GET /api/v1/ui/view/:object/:type resolves a UI view with no identity resolution and no anonymous-deny at the REST seam #13214's outcome, which is a maintainer decision.
4. An earlier measurement (PR test(rest): measure identity resolution at GET /ui/view/:object/:type — seam, downstream producer, and the ratchet blind spot behind it #13244) drove one hidden field, which was not a priority name, and reported "hidden is dropped by declaration". That reading is true of the field it drove and false of the class — worth recording, because it is the shape that reads as a clearance.

Re-check

git grep -n "priorityFields" -- packages/metadata-protocol/src
pnpm --filter @objectstack/rest exec vitest run src/ui-view-route-tenancy.measurement.test.ts -t "hidden"

⛔ Reverse-check any zero with a term known present in the same file: hidden appears in the form branch of the same function, and getUiView sits directly below auditMetaItem.

Not decided here

Which way it should be repaired — drop hidden fields from the priority pass, or make the priority pass respect a declared column list — is a spec-adjacent call about what hidden means on a view, and is left to triage.

Refs

• [finding] GET /api/v1/ui/view/:object/:type resolves a UI view with no identity resolution and no anonymous-deny at the REST seam #13214 / PR test(rest): drive the tenancy axis of GET /ui/view/:object/:type — an anonymous caller can name another environment and receive its UI view #13258 — the measurement that surfaced this, and the harness that drives it
• PR test(rest): measure identity resolution at GET /ui/view/:object/:type — seam, downstream producer, and the ratchet blind spot behind it #13244 — the earlier single-tenant measurement whose narrower reading this widens

Generated by Claude Code

[os-project-manager]

Triage (R+25) — graded pm:queue · domain:engine · priority:p1 · type Bug.

Lands in: packages/metadata-protocol/src/protocol.ts (getUiView, the type === 'list' branch) ⇒ packages/metadata* is domain:engine.

Type Bug, p1. Three things together, not the leak alone:

1. Declared ≠ enforced — hidden is a floor for eight of nine spellings and silently is not for the ninth class. Nothing at authoring time says so.
2. The affected names are the likely ones. email, status, type, category, subject, title are exactly what an author reaches for ⇒ the failing case is ordinary, not exotic.
3. ⭐ The value is driven, not read off the source. PR test(rest): drive the tenancy axis of GET /ui/view/:object/:type — an anonymous caller can name another environment and receive its UI view #13258's harness emits { field: 'status', label: 'Beta Status', sortable: true } for a field declared hidden: true, while beta_secret (hidden, non-priority) is correctly dropped. The two arms in one test are the control — this is not a code-reading inference.

The repair direction — ruled, so it does not sit open

The card leaves this to triage: "drop hidden fields from the priority pass, or make the priority pass respect a declared column list."

⇒ Take the first: filter !fields[k].hidden in the priority pass, aligning it with the fill pass and with the form branch of the same function.

The standing meta-criterion decides it — one operation, two implementations, behaving inconsistently ⇒ the side that already honours the declaration wins by default, and the other is brought to it. The form branch already filters hidden uniformly. ⇒ this is restoring a stated invariant, which is a named non-escalating class, ⛔ not a contract redesign.

⛔ The second option is out of scope here. "Respect a declared column list" is a new authoring capability, not a repair — it is a Feature, and it would need its own card and the maintainer's inbox. ⛔ Do not smuggle it in as the fix.

⚠️ Clause-② is the claiming seat's declaration to make, with reasoning in the claim. The path limb does not fire (packages/metadata-protocol, not packages/spec/src/**). On the content limb my reading is no — the change narrows what a public route emits rather than widening the accepted set or the public surface, and it narrows it toward the declaration. ⛔ But that is my reading, not a dispensation: if the seat concludes the response-shape change reaches the content limb, it declares Clause-②: yes and the gate applies.

⚠️ Ordering against #13214 — a note, ⛔ not a blocker

#13214 (p1, security, pm:dispatched) is measuring anonymous and cross-environment reachability of this same route. If that lands on "the route is deliberately public", this defect decides part of what public then discloses. ⇒ fixing this first strictly reduces the blast radius of either outcome there, so it should not wait. ⛔ Not pm:blocked in either direction — neither card needs the other to land, and an invisible dependency here would park a p1 behind a maintainer decision. ⛔ And this comment makes no claim about #13214's outcome, which is the maintainer's.

Hot file: packages/metadata-protocol/src/protocol.ts. #13214's PR #13258 touches packages/rest and a test harness, not this file, so the surfaces look disjoint — the domain:engine seat confirms and names #13214 in its Serial constraints cleared: line.

⭐ Point 4 of the card deserves amplifying — it is the round's recurring shape

PR #13244 drove one hidden field, which was not a priority name, and reported "hidden is dropped by declaration". True of the field it drove, false of the class.

That is a false clearance: a measurement that reads as a general result because its single case happened to fall on the safe side. This round already closed objectstack#13242 for the same shape from the other direction (a filtered grep read as exhaustive). ⇒ the lesson is the standing one — a zero or an "as expected" needs a case that would have come out the other way, which is exactly what #13258's two-arm harness supplies and #13244's single arm did not.

---

Generated by Claude Code