Repository navigation
feat(plugin-list): page list-view honours requiredPermissions - #13087
Merged
objectstack-fleet[bot] merged 3 commits intoOct 19, 2026
Merged
Conversation
…Record (objectui#13074) A page `list-view` node gates on `requiredPermissions` the way the record blocks do (hasCapabilities, the insufficient-permissions notice, no query), and its Add button opens the page's create path (RelatedRecordActionsValue.resolve(...).onCreate), withheld when the host offers none. Both keys are published; their by-measurement rows in the console parity gate are struck. `sharing` stays unpublished. Co-authored-by: Claude <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01XVp19E1MYUTFM3dnkwz8gB
Contributor
✅ Console Performance Budget
The eager closure is every chunk the entry reaches through static imports — what the browser fetches and parses before the app renders. The entry chunk on its own is a small fraction of it. 📦 Bundle Size Report
Size Limits
|
…ge list-view node (objectui#13074) The package README and the plugin-list docs page describe the two keys a page list-view node now honours: the capability gate (the record blocks' notice, no query) and the Add button (the page's create path, withheld without a create grant or a host). `sharing` is stated to do nothing yet. Co-authored-by: Claude <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01XVp19E1MYUTFM3dnkwz8gB
github-actions
Bot
added
the
documentation
Contributor
✅ Console Performance Budget
The eager closure is every chunk the entry reaches through static imports — what the browser fetches and parses before the app renders. The entry chunk on its own is a small fraction of it. 📦 Bundle Size Report
Size Limits
|
This was referenced Oct 19, 2026
…ves onCreate (objectui#13074) The console page host answers a parent-less list with no handlers, so a page list-view node's Add button is withheld there. addRecord leaves the registration inputs, its parity exemption returns citing objectui#13089, and its member pin is dropped. The block-level routing and its pins stay, retitled to a provider that serves onCreate; a restored row measures no Add button on a page node under no onCreate host. Docs and changeset keep requiredPermissions and drop every console create-form sentence. The schema handed to ListView is a named document-derived local again, so check-handler-key-read-sites follows the hop into ListView: the alias census is back to 11 rows from 7. Co-Authored-By: Claude <noreply@anthropic.com>
Contributor
✅ Console Performance Budget
The eager closure is every chunk the entry reaches through static imports — what the browser fetches and parses before the app renders. The entry chunk on its own is a small fraction of it. 📦 Bundle Size Report
Size Limits
|
objectstack-fleet
Bot
changed the title
objectstack-fleet
Bot
deleted the
claude/issue-13074-list-view-inert-keys
branch
October 19, 2026 21:40
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes #13074
Clause-②: yes
What changed
A page
list-viewnode now honours the spec'srequiredPermissions, and thelist-viewandlistregistrations publish it. Clause-② keys published:requiredPermissionsonly.addRecordandsharingstay unpublished.This PR first published
addRecordas well. The contract review (6277254453on #13074) found that the console page host serves noonCreate:pageRelatedHandlersanswers a list with no parent with no handlers. So that half was wrong on this base. The seat ruled (6277259990) to landrequiredPermissionsalone and filed the page host's create path as objectui#13089.requiredPermissions(ListViewBlock): the audience gate, read the way the record blocks read it, throughusePermissions().hasCapabilities(required)from@object-ui/permissions.role="status", "Insufficient permissions to view list.") in place of the list.ElementDataSourceGate, so no saved view is resolved and nofindis sent.systemPermissionsfails open, ashasCapabilitiesdoes everywhere else.addRecord, unpublished. The block sends the Add button to theonCreatethat aRelatedRecordActionsContextprovider serves for the listed object, and withholds the button where none is served. That is every console page today. So a node withaddRecord.enableddraws no button where it used to draw a dead one. A hostonAddRecordprop handed to the block still wins. TheUNPUBLISHED_EXEMPTIONSrow forlist-view.addRecordis reworded to this fact and cites objectui#13089, which publishes the key once the page host servesonCreate.index.tsxpublishesrequiredPermissions(array,of: 'string') onLIST_VIEW_INPUTS.registry-inputs-spec-parity.test.ts:list-view.requiredPermissionsis struck, and its member pin points at the new pin file;list-view.addRecordrow stays, reworded.packages/plugin-list/README.mdandcontent/docs/plugins/plugin-list.mdxgain an "On a page —requiredPermissions" section: the viewer must hold ALL listed capabilities, otherwise the notice shows and no query is sent; an empty or absent key is no gate; an unreported provider shows the list. Both sayaddRecordandsharingare not published inputs.ListViewBlockhandsListViewa named local taken from the document (const listSchema = add.schema), socheck-handler-key-read-siteskeeps following the step intoListView. Theview:listalias census is 11 (as onmain), and the test's floor is unchanged. The first head passedadd.schemainline, which the scanner does not follow, and dropped the census to 7..changeset/13074-list-view-inert-keys.md:@object-ui/plugin-listminor.Pins
packages/plugin-list/src/__tests__/ListViewBlock.inertKeys-13074.test.tsx. Every node is authored in apropertiesbag that the spec's ownlist-viewrow parses. It renders through the realSchemaRendererand this package's registration, under a real stockMePermissionsProvider.requiredPermissions:findand no grid;systemPermissionsfails open.onCreate:onCreate, andresolvewas asked for{ objectName: 'crm_task' };position: 'both'dispatches from each button;onCreate, withcreateDisabled, and with no provider.addRecord, no button is drawn andresolveis never called;sharing's Share button changes nothing;requiredPermissionsand notaddRecordorsharing.ListViewBlock.specInputs-13047.test.tsxhas one restored row: a page node draws no Add button with no provider, or under a provider whoseresolveanswers the console host's frozen empty set. In that caseresolvewas asked and no create is sent.Ablations (each restore proven by blob hash)
ListViewBlock.tsxfalse &&ac5989279f, restore blobeba5fd8e3b56onAddRecord: handlers.onCreatereplaced byundefinedac5989279f, restore blobeba5fd8e3b56ac5989279f, restore blobeba5fd8e3b56{ schema: bound, onAddRecord: undefined }7156ba0657, restore blob3eff70d41efeLocal gates
At
7156ba0657:registry-inputs-spec-parity,scripts/__tests__/check-handler-key-read-sites.test.ts): 373 passed.pnpm --filter @object-ui/plugin-list type-checkexited 0, tests included.check:handler-key-reads("11 read(s) under 8 namespaced-only alias(es)"),check:new-line-citations,check:changeset-claims,check:pending-changeset-literalsandcheck:registry-bare-names.At
ac5989279f:Declared to CI and not run locally: the full
packages/plugin-list/andapps/console/directories, and the@object-ui/consoletype-check.Acceptance notes
sharingstays unpublished with its recorded reason: the spec declares no action for the Share button.addRecordstays unpublished. The page host's create path, the objectui#12870 CONTROL row's re-examination, a pin through the realPageView, and publishing the key all go to objectui#13089.openChildFormignoreseditMode: 'page'): source reading. Carrier: objectui#13089.renderListViewpassesaddRecordwithoutonAddRecord): source reading, not measured. Carrier: objectui#13089.Generated by Claude Code