fix(setup): drop Advanced nav entries for non-listable objects (#2266)

Browser-dogfooding every Setup menu found two Advanced entries that always
render "failed to load": Verifications (sys_verification) and Device Codes
(sys_device_code). Both objects intentionally omit `list` from `apiMethods`
(sensitive ephemeral secrets), so the generic list-view menu 405s every time.
Removed both nav entries + their orphaned zh labels; objects stay reachable by
id. (Re-adding a browse menu needs `list` enabled — a security decision.)

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>

Author: os-zhuang

.changeset/setup-advanced-nav-unlistable.md

@@ -0,0 +1,14 @@
+---
+"@objectstack/platform-objects": patch
+---
+
+fix(setup): drop Advanced nav entries for non-listable objects (sys_verification, sys_device_code)
+
+Dogfooding every Setup menu surfaced two Advanced entries that always render
+"无法加载记录 / failed to load": **Verifications** (`sys_verification`) and
+**Device Codes** (`sys_device_code`). Both objects deliberately omit `list`
+from `apiMethods` (sensitive, ephemeral secrets — verification tokens and OAuth
+device-grant codes are not meant to be browsed), so the generic object/list-view
+menu can only ever 405. Removed both nav entries (and their orphaned zh labels);
+the objects remain reachable by id. Re-adding a browse menu would require
+enabling `list` on the object — a security decision, not a nav fix.

packages/platform-objects/src/apps/setup-nav.contributions.ts

@@ -113,8 +113,12 @@ export const SETUP_NAV_CONTRIBUTIONS: NavigationContribution[] = [
     items: [
       { id: 'nav_oauth_apps', type: 'object', label: 'OAuth Applications', objectName: 'sys_oauth_application', icon: 'app-window' },
       { id: 'nav_jwks', type: 'object', label: 'Signing Keys (JWKS)', objectName: 'sys_jwks', icon: 'key-round' },
-      { id: 'nav_verifications', type: 'object', label: 'Verifications', objectName: 'sys_verification', icon: 'mail-check' },
-      { id: 'nav_device_codes', type: 'object', label: 'Device Codes', objectName: 'sys_device_code', icon: 'qr-code' },
+      // `sys_verification` (email/phone tokens) and `sys_device_code` (OAuth
+      // device-grant codes) deliberately omit `list` from their `apiMethods`
+      // (sensitive, ephemeral secrets — not browsable), so an object/list-view
+      // nav entry for them can only ever render "failed to load". They're
+      // reachable by id (get) when needed; no browse menu. (Re-adding requires
+      // enabling `list` on the object — a security decision.)
       { id: 'nav_accounts', type: 'object', label: 'Identity Links', objectName: 'sys_account', icon: 'link-2' },
       { id: 'nav_user_preferences', type: 'object', label: 'User Preferences', objectName: 'sys_user_preference', icon: 'sliders' },
     ],

packages/platform-objects/src/apps/translations/zh-CN.ts

@@ -84,8 +84,6 @@ export const zhCN: TranslationData = {
 
         nav_oauth_apps: { label: 'OAuth 应用' },
         nav_jwks: { label: '签名密钥 (JWKS)' },
-        nav_verifications: { label: '验证记录' },
-        nav_device_codes: { label: '设备代码' },
         nav_accounts: { label: '身份链接' },
         nav_user_preferences: { label: '用户偏好' },
         nav_metadata: { label: '全部元数据' },