feat(identity): open standard Edit affordance on sys_user for profile fields (ADR-0092 D4)

sys_user gains userActions:{edit:true} (create/import/delete stay off).
name/image are editable; email, email_verified, two_factor_enabled, role,
banned/ban_reason/ban_expires, ai_access, manager_id,
primary_business_unit_id and every system-managed stamp are marked
readonly so the standard edit form renders them non-editable.

Safe because the server boundary is the identity write guard (ADR-0092
D2, #2828): a user-context sys_user update may only touch {name, image}
regardless of what a form submits. The readonly flags are UX only.

Verified in the running Console: the object metadata sent to the client
carries userActions.edit=true and the correct per-field readonly flags;
the row 'Edit' action appears; the edit form surfaces only name/image;
and — the risk this issue flagged — the create_user/invite_user dialogs
keep email/role editable (action params do not inherit field readonly).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01YGAN5VvvBi4YRGwpNT6e21

Author: claude

.changeset/sys-user-edit-affordance.md

@@ -0,0 +1,26 @@
+---
+"@objectstack/platform-objects": minor
+---
+
+feat(identity): open the standard Edit affordance on sys_user for profile fields (ADR-0092 D4)
+
+`sys_user` now sets `userActions: { edit: true }`, so the generic row-edit
+form is available (create / import / delete stay off). The two profile fields
+(`name`, `image`) are editable; every other column — `email`, `role`, ban
+state, phone, and all system-managed stamps — is marked `readonly` so the
+standard edit form renders it non-editable.
+
+This is safe because the server boundary is the identity write guard shipped
+in the previous change (ADR-0092 D2): a user-context update to `sys_user` may
+only touch `{name, image}` regardless of what any form submits; everything
+else is stripped or rejected. The `readonly` flags here are UX only.
+
+The dedicated action dialogs are unaffected — `create_user` / `invite_user` /
+`set_user_role` reference `email` and `role` as action **params** (their own
+inputs), which do not inherit the field-level `readonly` and stay editable
+(verified in the running Console).
+
+Note: the Console's record-form renderer must honor `userActions.edit` +
+per-field `readonly` on `managedBy:'better-auth'` objects for the edit form to
+be functional; that is an objectui-side change vendored via `objectui:refresh`
+and tracked separately.

packages/platform-objects/src/identity/sys-user.object.ts

@@ -20,6 +20,15 @@ export const SysUser = ObjectSchema.create({
   icon: 'user',
   isSystem: true,
   managedBy: 'better-auth',
+  // ADR-0092 D4 — the ONE generic affordance opened on an identity table:
+  // standard row editing. Safe because the plugin-auth identity write guard
+  // (ADR-0092 D2) enforces the profile whitelist server-side — a user-context
+  // update may only touch SYS_USER_PROFILE_EDIT_FIELDS ({name, image});
+  // everything else is stripped/rejected regardless of what a form submits.
+  // The permission layer still decides WHO may edit (platform admins only by
+  // default; member/org-admin sets keep allowEdit: false). create / import /
+  // delete stay bucket-default (off).
+  userActions: { edit: true },
   // ADR-0010 §3.7 — identity table is managed by better-auth; schema must not drift.
   protection: {
     lock: 'full',
@@ -462,22 +471,29 @@ export const SysUser = ObjectSchema.create({
       group: 'Identity',
     }),
 
+    // ADR-0092 D4 — with the generic edit affordance open, every non-profile
+    // field is readonly so the standard edit form renders it non-editable.
+    // This is UX only; the server boundary is the plugin-auth identity write
+    // guard (ADR-0092 D2), which strips/rejects these regardless.
     email: Field.email({
       label: 'Email',
       required: true,
+      readonly: true, // login identity — change flows through better-auth change-email verification
       searchable: true,
       group: 'Identity',
     }),
 
     email_verified: Field.boolean({
       label: 'Email Verified',
       defaultValue: false,
+      readonly: true,
       group: 'Identity',
     }),
 
     two_factor_enabled: Field.boolean({
       label: 'Two-Factor Enabled',
       defaultValue: false,
+      readonly: true,
       group: 'Identity',
       description: 'Whether two-factor authentication is enabled for this user. Maintained by the better-auth `twoFactor` plugin.',
     }),
@@ -486,6 +502,7 @@ export const SysUser = ObjectSchema.create({
     role: Field.text({
       label: 'Platform Role',
       required: false,
+      readonly: true, // ADR-0092 — set via the Set Platform Role action, never the edit form
       maxLength: 64,
       group: 'Admin',
       description: 'Platform-level role (admin, user, …). Set via the Set Platform Role action.',
@@ -494,20 +511,23 @@ export const SysUser = ObjectSchema.create({
     banned: Field.boolean({
       label: 'Banned',
       defaultValue: false,
+      readonly: true, // ADR-0092 — toggled via Ban/Unban actions (session side effects)
       group: 'Admin',
       description: 'When true, the user cannot sign in. Toggle via Ban User / Unban User actions.',
     }),
 
     ban_reason: Field.text({
       label: 'Ban Reason',
       required: false,
+      readonly: true, // ADR-0092 — written by the Ban User action
       maxLength: 255,
       group: 'Admin',
     }),
 
     ban_expires: Field.datetime({
       label: 'Ban Expires',
       required: false,
+      readonly: true, // ADR-0092 — written by the Ban User action
       group: 'Admin',
       description: 'When set, the ban auto-clears at this time.',
     }),
@@ -618,6 +638,7 @@ export const SysUser = ObjectSchema.create({
     ai_access: Field.boolean({
       label: 'AI Access',
       defaultValue: false,
+      readonly: true, // ADR-0092 — a licensed-seat grant; flows through the AiSeatPlugin enforcement path
       group: 'Admin',
       description:
         'Whether this user holds an AI seat — grants access to the in-UI AI ' +
@@ -639,13 +660,15 @@ export const SysUser = ObjectSchema.create({
     manager_id: Field.lookup('sys_user', {
       label: 'Manager',
       required: false,
+      readonly: true, // ADR-0092 — drives own_and_reports RLS scope; org-structure maintenance is its own surface
       group: 'Organization',
       description: "This user's direct manager. Forms the reporting chain the `own_and_reports` hierarchy scope walks (ADR-0057 / @objectstack/security-enterprise).",
     }),
 
     primary_business_unit_id: Field.lookup('sys_business_unit', {
       label: 'Primary Business Unit',
       required: false,
+      readonly: true, // ADR-0092 — denormalised projection maintained by plugin-sharing; never hand-edited
       group: 'Organization',
       description: "The user's primary business unit — a denormalised projection of sys_business_unit_member.is_primary, maintained by plugin-sharing (ADR-0057 addendum D12). Lets a user-lookup filter candidates by business unit without traversing the membership junction. Do not edit directly; set it via business-unit membership.",
     }),