Repository navigation
docs(spec): state what the action requiredPermissions server gate does NOT cover (#3923) - #3943
Merged
Merged
Conversation
|
The latest updates on your projects. Learn more about Vercel for GitHub. 1 Skipped Deployment
|
Contributor
📓 Docs Drift CheckThis PR changes 1 package(s): 105 hand-written doc(s) reference the affected code and may need an implementation-accuracy re-verification:
|
…s NOT cover (#3923) `ActionSchema.requiredPermissions` documented itself as a dual-surface gate whose server half is "the source of truth". An app author reasonably reads that as "any action I declare this on is enforced somewhere", and it isn't. Server enforcement lives on the platform action route — POST /api/v1/actions/<object>/<action> and the MCP/AI path — which is where `type: 'script' | 'flow' | 'modal'` actions execute. A `type: 'api'` action pointed at a self-authored endpoint is fetched by the browser directly; that request never reaches the platform, so nothing checks the declaration server-side and the endpoint must re-check the capability itself. The doc comment, the `describe()` string (what surfaces in generated schema docs and editor tooltips) and ADR-0066 D4 now say so. Behaviour is unchanged. The UI half's gaps were separate and are fixed in objectui. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
…() (#3923) `content/docs/references/*` is generated from the spec's `describe()` strings, so the previous commit's rewording left it out of sync and the `check:docs` gate failed. Regenerated via `gen:schema && gen:docs`. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes the documentation half of #3923. Behaviour is unchanged.
The problem
ActionSchema.requiredPermissionsdocumented itself as a dual-surface gate whose server half is "the source of truth":An app author reasonably reads that as "any action I declare this on is enforced somewhere". It isn't.
Server enforcement (
actionPermissionError) sits on the platform action route —POST /api/v1/actions/<object>/<action>and the MCP/AI path — which is wheretype: 'script' | 'flow' | 'modal'actions execute. Atype: 'api'action whosetargetis a self-authored endpoint is fetched by the browser directly: that request never reaches the platform, so nothing checks the declaration server-side, and the endpoint has to re-check the capability itself.The change
The doc comment, the
describe()string (which is what surfaces in generated schema docs and editor tooltips), and ADR-0066 D4 now say exactly that. ADR-0066 D4 also records the UI half's real scope — every action surface, not just the engine — which is fixed in objectui#2965.packages/spectests (262 files / 6823 cases) andtsc --noEmitgreen.🤖 Generated with Claude Code