fix(rest): route batch creates through the create ingress so readonly is enforced (#3835)

`POST /batch` called `ql.insert` directly, and the engine's INSERT path is
static-`readonly`-exempt by design (#3413) — the strip that stops a non-system
caller from seeding a read-only column lives at the protocol's create ingress
(#3043). So the same forged value was dropped on `POST /data/:object` and
written through on `/batch`: one rule, two answers.

Create ops now go through `p.createData`, the ingress itself, rather than a
second copy of the strip at the REST layer. One ingress means a future change to
its policy covers the batch for free, and the carve-outs it already encodes stay
intact — the platform-object exemption (a `sys_`/`managedBy` object's own guard
must REJECT a forged value, not silently swallow it) and the `isSystem`
exemption. `trxCtx` is passed as the context, so the insert still joins the batch
transaction and `$ref` resolution is unaffected; the ingress's `droppedFields`
fold into the batch's per-op list.

Update ops are untouched — the engine enforces both strips on its update path.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Author: baozhoutao

.changeset/batch-create-readonly-ingress.md

@@ -0,0 +1,39 @@
+---
+"@objectstack/rest": minor
+---
+
+fix(rest): a batch create goes through the same create ingress as a single create (#3835)
+
+`readonly` meant two different things depending on which create endpoint you
+used. `POST /data/:object` runs the #3043 ingress strip, so a non-system caller
+cannot seed a read-only column — the field is dropped and reported. The
+cross-object transactional batch (`POST /batch`) called `ql.insert` directly and
+skipped that ingress entirely, and the engine's INSERT path is
+static-`readonly`-exempt **by design** (#3413, the strip lives one layer up), so
+nothing enforced it: the same forged `readonly` value that was rejected on one
+route was written through on the other.
+
+Measured on the showcase (`showcase_contact.lead_score`, `readonly: true`, same
+signed-in non-system user):
+
+| | before | after |
+|---|---|---|
+| `POST /data/showcase_contact` | `lead_score = null`, reported | unchanged |
+| `POST /batch` create | **`lead_score = 999` written, silent** | `null`, reported |
+
+The fix routes the batch's create ops through the protocol's `createData` rather
+than re-implementing the strip at the REST layer. That keeps **one** create
+ingress: a future change to its policy covers the batch for free, and the
+carve-outs already encoded there stay intact — notably the platform-object
+exemption (a `sys_`/`managedBy` object's own guard must *reject* a forged value
+with 403, not have it silently swallowed) and the `isSystem` exemption. The
+context passed through is the transaction context, so the insert still joins the
+batch transaction and rolls back with it, and `{ $ref: <opIndex> }` resolution is
+unaffected.
+
+`createData`'s `droppedFields` are folded into the batch response's per-op
+`droppedFields` list (#3794), so a batch create now reports its strips the same
+way an update does.
+
+Update ops are untouched: the engine enforces `readonly` and `readonlyWhen` on
+its own update path.

packages/rest/src/rest-batch-endpoint.test.ts

@@ -42,13 +42,42 @@ function makeQl(overrides: Partial<Record<'insert' | 'update' | 'delete', any>>
   return ql;
 }
 
+/**
+ * A fake `createData` standing in for the protocol's create ingress (#3835):
+ * the batch's create ops go through it rather than calling `ql.insert`, so the
+ * #3043 static-`readonly` strip applies to a batch create exactly as it does to
+ * `POST /data/:object`. Delegates to the same `ql.insert` the other ops use, so
+ * assertions about what reached the engine still read off `ql.insert`.
+ */
+function makeCreateData(ql: any, opts: { readonlyFields?: string[] } = {}) {
+  const readonlyFields = opts.readonlyFields ?? [];
+  return vi.fn(async (request: any) => {
+    const supplied = request?.data ?? {};
+    const stripped: string[] = readonlyFields.filter((f) => f in supplied);
+    const data = { ...supplied };
+    for (const f of stripped) delete data[f];
+    const record = await ql.insert(request.object, data, { context: request.context });
+    return {
+      object: request.object,
+      id: record?.id,
+      record,
+      ...(stripped.length > 0
+        ? { droppedFields: [{ object: request.object, fields: stripped, reason: 'readonly' }] }
+        : {}),
+    };
+  });
+}
+
 /** Build a RestServer with an optional ObjectQL provider and object metadata. */
-function buildServer(opts: { ql?: any; objects?: any[] } = {}) {
+function buildServer(opts: { ql?: any; objects?: any[]; readonlyFields?: string[] } = {}) {
   const server = mockServer();
   const protocol: any = {
     getDiscovery: vi.fn().mockResolvedValue({ version: 'v0', endpoints: {} }),
     getMetaTypes: vi.fn().mockResolvedValue([]),
     getMetaItems: vi.fn().mockResolvedValue(opts.objects ?? []),
+    createData: opts.ql
+      ? makeCreateData(opts.ql, { readonlyFields: opts.readonlyFields ?? [] })
+      : vi.fn(),
   };
   const objectQLProvider = opts.ql ? async () => opts.ql : undefined;
   const rest = new RestServer(
@@ -258,6 +287,64 @@ describe('POST {basePath}/batch — cross-object transactional batch', () => {
     expect(res.body).not.toHaveProperty('droppedFields');
   });
 
+  // ── create ingress parity (#3835) ─────────────────────────────────────────
+  //
+  // The engine's INSERT path is static-`readonly`-exempt by design (#3413), so
+  // the #3043 strip that stops a non-system caller from seeding a read-only
+  // column lives at the protocol's create ingress. This route used to call
+  // `ql.insert` directly and skip it, so `readonly` meant two different things
+  // depending on which create endpoint you used.
+
+  it('routes create ops through the protocol create ingress, not ql.insert', async () => {
+    const ql = makeQl();
+    const { route, protocol } = buildServer({ ql });
+    const res = await post(route, {
+      operations: [{ object: 'account', action: 'create', data: { name: 'Acme' } }],
+    });
+    expect(res.statusCode).toBe(200);
+    expect(protocol.createData).toHaveBeenCalledTimes(1);
+    const request = protocol.createData.mock.calls[0][0];
+    expect(request).toMatchObject({ object: 'account', data: { name: 'Acme' } });
+    // The ingress must run INSIDE this transaction — same context the other ops
+    // bind, or the create would commit independently of the rollback.
+    expect(request.context).toMatchObject({ __trx: true });
+  });
+
+  it('strips a caller-forged readonly column on a batch create and reports it', async () => {
+    const ql = makeQl();
+    const { route } = buildServer({ ql, readonlyFields: ['approval_status'] });
+    const res = await post(route, {
+      operations: [
+        { object: 'account', action: 'create', data: { name: 'Acme', approval_status: 'approved' } },
+      ],
+    });
+    expect(res.statusCode).toBe(200);
+    // Never reached the engine…
+    expect(ql.insert).toHaveBeenCalledWith('account', { name: 'Acme' }, expect.anything());
+    // …and the caller is told, tagged with the op that dropped it.
+    expect(res.body.droppedFields).toEqual([
+      { object: 'account', fields: ['approval_status'], reason: 'readonly', index: 0 },
+    ]);
+  });
+
+  it('keeps $ref resolution working through the ingress', async () => {
+    // `results` now holds the ingress's echoed record rather than the raw
+    // engine return — a later op must still resolve `{ $ref: 0 }` to its id.
+    const ql = makeQl();
+    const { route } = buildServer({ ql });
+    const res = await post(route, {
+      operations: [
+        { object: 'project', action: 'create', data: { name: 'Apollo' } },
+        { object: 'task', action: 'create', data: { title: 'Kickoff', project: { $ref: 0 } } },
+      ],
+    });
+    expect(res.statusCode).toBe(200);
+    expect(res.body.results[0].id).toBe('id_1');
+    expect(ql.insert).toHaveBeenLastCalledWith(
+      'task', { title: 'Kickoff', project: 'id_1' }, expect.anything(),
+    );
+  });
+
   // ── request validation ────────────────────────────────────────────────────
 
   it('rejects a non-atomic request (this endpoint is always atomic)', async () => {

packages/rest/src/rest-server.ts

@@ -6609,10 +6609,36 @@ export class RestServer {
                         const out: any[] = [];
                         for (const [index, op] of ops.entries()) {
                             const data = resolveRefs(op.data, out);
-                            const onFieldsDropped = (e: DroppedFieldsEvent) => { dropped.push({ ...e, index }); };
                             if (op.action === 'create') {
-                                out.push(await ql.insert(op.object, data, { context: trxCtx, onFieldsDropped }));
+                                // [#3835] Go through the protocol's create ingress —
+                                // the SAME one `POST /data/:object` uses — rather than
+                                // calling `ql.insert` directly. The engine's INSERT path
+                                // is static-`readonly`-exempt by design (#3413), so the
+                                // #3043 strip that stops a non-system caller from seeding
+                                // a read-only column lives at that ingress. Bypassing it
+                                // here made `readonly` mean two different things on two
+                                // create paths: rejected on the single route, written
+                                // through the batch. `createData` also owns the platform-
+                                // object carve-out (a `sys_`/`managedBy` object's own
+                                // guard must REJECT a forged value, not silently swallow
+                                // it), which is why this routes to the ingress instead of
+                                // re-implementing the strip here — one create ingress,
+                                // and a future change to its policy covers the batch for
+                                // free. `trxCtx` carries the caller's context (including
+                                // `isSystem`) plus the open transaction, so the strip
+                                // decides exactly as it does on the single route and the
+                                // insert still joins this transaction.
+                                const created: any = await p.createData({ object: op.object, data, context: trxCtx } as any);
+                                for (const e of (created?.droppedFields ?? []) as DroppedFieldsEvent[]) {
+                                    dropped.push({ ...e, index });
+                                }
+                                out.push(created?.record);
                             } else if (op.action === 'update') {
+                                // Update needs no ingress detour: the engine enforces
+                                // both static `readonly` (#2948) and `readonlyWhen`
+                                // (#3042) on its own update path, and reports them
+                                // through this listener.
+                                const onFieldsDropped = (e: DroppedFieldsEvent) => { dropped.push({ ...e, index }); };
                                 const id = op.id ?? data?.id;
                                 out.push(await ql.update(op.object, { ...data, id }, { context: trxCtx, onFieldsDropped }));
                             } else { // 'delete'