fix(plugin-security,spec)!: a non-system caller that carries a principal and resolves no permission set gets the deny baseline at object admission and at the row scope by objectstack-fleet[bot] · Pull Request #21217 · objectstack-ai/objectstack

fix(plugin-security)!: an empty permission-set list is the deny baseline at object admission and row scope

claude

committed

93eaf72

test(plugin-security): pin the deny baseline per caller class and re-pin the zero-set field suites

claude

committed

a62c37f

refactor(plugin-security): keep the delegator change to the load-bearing grant arms

claude

committed

2461557

test(dogfood): re-pin the anonymous endpoint and the zero-set doors to the deny baseline

claude

committed

a12139a

chore(changeset): the deny baseline for an empty permission-set list, BREAKING, with the ruling's migration text

claude

committed

a036618

Merge remote-tracking branch 'origin/main' into claude/issue-21079-zero-set-deny-baseline

claude

committed

5f95189

test(plugin-security): the deny-baseline suite's fake engine opens findOne with the engine's own predicate check

claude

committed

3e49b1a

Merge remote-tracking branch 'origin/main' into claude/issue-21079-zero-set-deny-baseline

claude

committed

2e1564f

test(rest,dogfood): re-pin the public picker on a deployment without the guest set to the deny baseline

claude

committed

4d2b191

test(rest): the masked-only picker pin proves the engine's refusal is object admission, not the field guard

claude

committed

335cae7

docs(forms): the public picker's search is authorized by the guest set, and answers 403 PERMISSION_DENIED without one

claude

committed

03ae860

Navigation Menu

Repository navigation

fix(plugin-security,spec)!: a non-system caller that carries a principal and resolves no permission set gets the deny baseline at object admission and at the row scope - #21217

fix(plugin-security,spec)!: a non-system caller that carries a principal and resolves no permission set gets the deny baseline at object admission and at the row scope#21217
objectstack-fleet[bot] merged 11 commits into
mainfrom
claude/issue-21079-zero-set-deny-baseline

Commits on Oct 1, 2026

fix(plugin-security)!: an empty permission-set list is the deny baseline at object admission and row scope

test(plugin-security): pin the deny baseline per caller class and re-pin the zero-set field suites

refactor(plugin-security): keep the delegator change to the load-bearing grant arms

test(dogfood): re-pin the anonymous endpoint and the zero-set doors to the deny baseline

chore(changeset): the deny baseline for an empty permission-set list, BREAKING, with the ruling's migration text

Merge remote-tracking branch 'origin/main' into claude/issue-21079-zero-set-deny-baseline

test(plugin-security): the deny-baseline suite's fake engine opens findOne with the engine's own predicate check

Merge remote-tracking branch 'origin/main' into claude/issue-21079-zero-set-deny-baseline

test(rest,dogfood): re-pin the public picker on a deployment without the guest set to the deny baseline

test(rest): the masked-only picker pin proves the engine's refusal is object admission, not the field guard

docs(forms): the public picker's search is authorized by the guest set, and answers 403 PERMISSION_DENIED without one