Lock down better-auth managed identity tables; fix RLS null tenant + 403 mapping

hotlong · Copilot · hotlong · commit 6d32cc6be0a3 · 2026-05-07T23:47:47.000+08:00
Phase-1 RBAC follow-up to address the dashboard sys_user page showing nothing
and the request to gate write access to better-auth-owned identity tables.

spec
- Add Object.managedBy?: 'better-auth' | 'system' | 'platform' (Zod-first).
  Forward-compatible marker for downstream UI to suppress the generic CRUD
  form for tables whose lifecycle is owned by an external service.

platform-objects
- Annotate 17 better-auth-managed identity objects with managedBy:
  'better-auth' (sys_user/account/session/organization/member/invitation/
  team/team_member/api_key/two_factor/verification/jwks/device_code/
  oauth_application/oauth_access_token/oauth_refresh_token/oauth_consent).
- default-permission-sets.ts: add BETTER_AUTH_MANAGED_OBJECTS const +
  helper denyWritesOnManagedObjects() and spread into member_default +
  viewer_readonly. Server now returns HTTP 403 on direct writes to
  identity tables; reads remain scoped by sys_user_self / sys_organization_self.

plugin-security
- RLSCompiler.compileExpression: treat null as "skip this policy" (was
  only checking undefined). A logged-in user with no active organization
  caused the wildcard tenant_isolation rule to compile to organization_id
  = null which (a) returned zero rows from sys_user (no organization_id
  column) and (b) silently exposed un-tenanted rows on application
  tables. The compiler now defers to per-object rules. Same fix for the
  IN(current_user.array) form on empty/missing arrays.
- Two regression tests added.

rest
- mapDataError: short-circuit on PERMISSION_DENIED before the unknown-object
  heuristic — previously a security message containing the object name and
  the substring "not" was misclassified as 404. Now returns HTTP 403 with
  code: 'PERMISSION_DENIED'.
- CRUD route catches stop logging 403s as "[REST] Unhandled error:".

Tests: plugin-security 32/32, runtime 200/200, rest 53/53, objectql 209/209,
spec 6840/6840, platform-objects 100/100.

Verified end-to-end against pnpm dev:crm:
  GET sys_user as authenticated user -&gt; 1 row (own self)
  GET sys_user/&lt;another-user-id&gt;     -&gt; HTTP 404 (RLS hides)
  POST sys_user (create)             -&gt; HTTP 403 PERMISSION_DENIED
  PATCH sys_user/&lt;self&gt; (update)     -&gt; HTTP 403
  DELETE sys_user/&lt;self&gt; (delete)    -&gt; HTTP 403

Known limitation (unchanged): the dashboard's @object-ui/app-shell is a
3rd-party library and its New/Edit/Delete buttons do not yet respect the
new managedBy flag — server-side deny is the source-of-truth gate today.
UI hide-buttons land when upstream adopts the flag.

Co-authored-by: Copilot &lt;223556219+Copilot@users.noreply.github.com&gt;
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -9,6 +9,13 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Fixed
 - **`@objectstack/driver-sql` tests failing in CI** — Added `vitest.config.ts` with resolve aliases for `@objectstack/spec/*` subpath exports (`/data`, `/contracts`, `/system`). Without these aliases, vitest could not resolve the source paths at test time, causing all 81 tests to fail with `ERR_MODULE_NOT_FOUND`.
+- **RLS over-filter when user has no active organization** (`@objectstack/plugin-security`) — `RLSCompiler.compileExpression` now treats a `null` user-context value the same as `undefined` and skips the policy. Before this fix, a logged-in user without an active organization (e.g. immediately after sign-up, before joining or creating one) caused the wildcard `tenant_isolation` policy to compile down to `organization_id = null`, which (a) returned zero rows from system tables that lack an `organization_id` column at all (e.g. `sys_user`) and (b) silently exposed any un-tenanted rows on application tables. The compiler now emits no filter for the `null` case, deferring to the more specific per-object rules (`sys_user_self`, `sys_organization_self`, …) and the field-existence safety net in `SecurityPlugin`. Two regression tests added in `packages/plugins/plugin-security/src/security-plugin.test.ts`. **Symptom this resolves:** the `_dashboard/apps/setup/sys_user` page now displays the signed-in user's own row instead of an empty list. Same fix applied to the `IN (current_user.array_property)` form for empty/missing arrays.
+- **`PermissionDeniedError` returned as HTTP 404 instead of 403** (`@objectstack/rest`) — `mapDataError` previously fell through to the unknown-object heuristic for any error message containing the object name and the substring `"not"`, which matched the security message `"… on object 'sys_user' is not permitted …"`. The mapper now short-circuits on `error.code === 'PERMISSION_DENIED'` / `error.name === 'PermissionDeniedError'` / message-prefix match before the heuristic and returns HTTP 403 with `code: 'PERMISSION_DENIED'`. The CRUD route catches in `RestServer` also stop logging 403s as `[REST] Unhandled error:` (4 sites updated).
+
+### Added
+- **`managedBy` flag on `ObjectSchema`** (`@objectstack/spec`) — `Object.managedBy?: 'better-auth' | 'system' | 'platform'` is a Zod-first marker that downstream UI (Studio / Dashboard / app shell) and CLI tooling should honour to suppress the generic CRUD form for tables whose lifecycle is owned by an external service. Documented in `packages/spec/src/data/object.zod.ts` with the rationale that better-auth-managed identity tables (`sys_user`, `sys_session`, `sys_organization`, …) require side-effects (password hashing, email-verification flows, invitation tokens, refresh-token rotation, JWKS rotation) that the generic record editor cannot reproduce, so writes must go through better-auth's typed SDK methods instead.
+- **17 better-auth identity objects annotated with `managedBy: 'better-auth'`** (`@objectstack/platform-objects`) — `sys_user`, `sys_account`, `sys_session`, `sys_organization`, `sys_member`, `sys_invitation`, `sys_team`, `sys_team_member`, `sys_api_key`, `sys_two_factor`, `sys_verification`, `sys_jwks`, `sys_device_code`, `sys_oauth_application`, `sys_oauth_access_token`, `sys_oauth_refresh_token`, `sys_oauth_consent`. (`sys_user_preference` is excluded — it is user-managed.)
+- **Server-side write deny for managed identity tables** (`@objectstack/platform-objects`) — `default-permission-sets.ts` now exports `BETTER_AUTH_MANAGED_OBJECTS` + `denyWritesOnManagedObjects()` and spreads it into both `member_default.objects` and `viewer_readonly.objects`, producing per-table `{ allowRead: true, allowCreate: false, allowEdit: false, allowDelete: false }` overrides on top of the wildcard. The admin profile (`admin_full_access`) keeps a `'*': { allowCreate: true, modifyAllRecords: true, … }` wildcard so platform admins are unaffected. End-to-end probe verified: an authenticated non-admin user receives HTTP 403 + `code: 'PERMISSION_DENIED'` on `POST /api/v1/data/sys_user`, `POST /api/v1/data/sys_member`, `POST /api/v1/data/sys_organization`, `PATCH /api/v1/data/sys_user/<self>`, and `DELETE /api/v1/data/sys_user/<self>`. Reads remain allowed and are still scoped by RLS (`sys_user_self`, `sys_organization_self`).
 
 ### Added
 - **Account portal: full better-auth SDK migration** — All user-settings pages (`/account/*`) and the first-run `/setup` wizard now use typed SDK methods from `@objectstack/client` instead of raw `fetch()` calls against `/api/v1/auth/…`. This fixes several silent bugs (wrong parameter names, invented endpoints) and adds missing features:
diff --git a/packages/platform-objects/src/identity/sys-account.object.ts b/packages/platform-objects/src/identity/sys-account.object.ts
@@ -16,6 +16,7 @@ export const SysAccount = ObjectSchema.create({
   pluralLabel: 'Accounts',
   icon: 'link',
   isSystem: true,
+  managedBy: 'better-auth',
   description: 'OAuth and authentication provider accounts',
   titleFormat: '{provider_id} - {account_id}',
   compactLayout: ['provider_id', 'user_id', 'account_id'],
diff --git a/packages/platform-objects/src/identity/sys-api-key.object.ts b/packages/platform-objects/src/identity/sys-api-key.object.ts
@@ -19,6 +19,7 @@ export const SysApiKey = ObjectSchema.create({
   pluralLabel: 'API Keys',
   icon: 'key-round',
   isSystem: true,
+  managedBy: 'better-auth',
   description: 'API keys for programmatic access',
   displayNameField: 'name',
   titleFormat: '{name}',
diff --git a/packages/platform-objects/src/identity/sys-device-code.object.ts b/packages/platform-objects/src/identity/sys-device-code.object.ts
@@ -25,6 +25,7 @@ export const SysDeviceCode = ObjectSchema.create({
   pluralLabel: 'Device Codes',
   icon: 'key-round',
   isSystem: true,
+  managedBy: 'better-auth',
   description: 'OAuth 2.0 Device Authorization Grant (RFC 8628) pending requests',
   titleFormat: '{user_code}',
   compactLayout: ['user_code', 'status', 'client_id', 'expires_at'],
diff --git a/packages/platform-objects/src/identity/sys-invitation.object.ts b/packages/platform-objects/src/identity/sys-invitation.object.ts
@@ -16,6 +16,7 @@ export const SysInvitation = ObjectSchema.create({
   pluralLabel: 'Invitations',
   icon: 'mail',
   isSystem: true,
+  managedBy: 'better-auth',
   description: 'Organization invitations for user onboarding',
   titleFormat: 'Invitation to {organization_id}',
   compactLayout: ['email', 'organization_id', 'status'],
diff --git a/packages/platform-objects/src/identity/sys-jwks.object.ts b/packages/platform-objects/src/identity/sys-jwks.object.ts
@@ -20,6 +20,7 @@ export const SysJwks = ObjectSchema.create({
   pluralLabel: 'JWKS Keys',
   icon: 'key',
   isSystem: true,
+  managedBy: 'better-auth',
   description: 'Asymmetric key pairs used to sign and verify issued JWTs',
   compactLayout: ['id', 'created_at', 'expires_at'],
 
diff --git a/packages/platform-objects/src/identity/sys-member.object.ts b/packages/platform-objects/src/identity/sys-member.object.ts
@@ -16,6 +16,7 @@ export const SysMember = ObjectSchema.create({
   pluralLabel: 'Members',
   icon: 'user-check',
   isSystem: true,
+  managedBy: 'better-auth',
   description: 'Organization membership records',
   titleFormat: '{user_id} in {organization_id}',
   compactLayout: ['user_id', 'organization_id', 'role'],
diff --git a/packages/platform-objects/src/identity/sys-oauth-access-token.object.ts b/packages/platform-objects/src/identity/sys-oauth-access-token.object.ts
@@ -21,6 +21,7 @@ export const SysOauthAccessToken = ObjectSchema.create({
   pluralLabel: 'OAuth Access Tokens',
   icon: 'ticket',
   isSystem: true,
+  managedBy: 'better-auth',
   description: 'Opaque OAuth access tokens issued to client applications',
   compactLayout: ['client_id', 'user_id', 'expires_at'],
 
diff --git a/packages/platform-objects/src/identity/sys-oauth-application.object.ts b/packages/platform-objects/src/identity/sys-oauth-application.object.ts
@@ -23,6 +23,7 @@ export const SysOauthApplication = ObjectSchema.create({
   pluralLabel: 'OAuth Applications',
   icon: 'key-round',
   isSystem: true,
+  managedBy: 'better-auth',
   description: 'Registered OAuth/OIDC client applications',
   displayNameField: 'name',
   titleFormat: '{name}',
diff --git a/packages/platform-objects/src/identity/sys-oauth-consent.object.ts b/packages/platform-objects/src/identity/sys-oauth-consent.object.ts
@@ -22,6 +22,7 @@ export const SysOauthConsent = ObjectSchema.create({
   pluralLabel: 'OAuth Consents',
   icon: 'shield-check',
   isSystem: true,
+  managedBy: 'better-auth',
   description: 'User consent records for OAuth client applications',
   compactLayout: ['client_id', 'user_id', 'scopes'],
 
diff --git a/packages/platform-objects/src/identity/sys-oauth-refresh-token.object.ts b/packages/platform-objects/src/identity/sys-oauth-refresh-token.object.ts
@@ -20,6 +20,7 @@ export const SysOauthRefreshToken = ObjectSchema.create({
   pluralLabel: 'OAuth Refresh Tokens',
   icon: 'refresh-cw',
   isSystem: true,
+  managedBy: 'better-auth',
   description: 'Opaque OAuth refresh tokens (linked to a session)',
   compactLayout: ['client_id', 'user_id', 'expires_at'],
 
diff --git a/packages/platform-objects/src/identity/sys-organization.object.ts b/packages/platform-objects/src/identity/sys-organization.object.ts
@@ -16,6 +16,7 @@ export const SysOrganization = ObjectSchema.create({
   pluralLabel: 'Organizations',
   icon: 'building-2',
   isSystem: true,
+  managedBy: 'better-auth',
   description: 'Organizations for multi-tenant grouping',
   displayNameField: 'name',
   titleFormat: '{name}',
diff --git a/packages/platform-objects/src/identity/sys-session.object.ts b/packages/platform-objects/src/identity/sys-session.object.ts
@@ -20,6 +20,7 @@ export const SysSession = ObjectSchema.create({
   pluralLabel: 'Sessions',
   icon: 'key',
   isSystem: true,
+  managedBy: 'better-auth',
   description: 'Active user sessions',
   displayNameField: 'user_id',
   titleFormat: 'Session — {user_id}',
diff --git a/packages/platform-objects/src/identity/sys-team-member.object.ts b/packages/platform-objects/src/identity/sys-team-member.object.ts
@@ -16,6 +16,7 @@ export const SysTeamMember = ObjectSchema.create({
   pluralLabel: 'Team Members',
   icon: 'user-plus',
   isSystem: true,
+  managedBy: 'better-auth',
   description: 'Team membership records linking users to teams',
   titleFormat: '{user_id} in {team_id}',
   compactLayout: ['user_id', 'team_id', 'created_at'],
diff --git a/packages/platform-objects/src/identity/sys-team.object.ts b/packages/platform-objects/src/identity/sys-team.object.ts
@@ -16,6 +16,7 @@ export const SysTeam = ObjectSchema.create({
   pluralLabel: 'Teams',
   icon: 'users',
   isSystem: true,
+  managedBy: 'better-auth',
   description: 'Teams within organizations for fine-grained grouping',
   displayNameField: 'name',
   titleFormat: '{name}',
diff --git a/packages/platform-objects/src/identity/sys-two-factor.object.ts b/packages/platform-objects/src/identity/sys-two-factor.object.ts
@@ -16,6 +16,7 @@ export const SysTwoFactor = ObjectSchema.create({
   pluralLabel: 'Two Factor Credentials',
   icon: 'smartphone',
   isSystem: true,
+  managedBy: 'better-auth',
   description: 'Two-factor authentication credentials',
   titleFormat: 'Two-factor for {user_id}',
   compactLayout: ['user_id', 'created_at'],
diff --git a/packages/platform-objects/src/identity/sys-user.object.ts b/packages/platform-objects/src/identity/sys-user.object.ts
@@ -19,6 +19,7 @@ export const SysUser = ObjectSchema.create({
   pluralLabel: 'Users',
   icon: 'user',
   isSystem: true,
+  managedBy: 'better-auth',
   description: 'User accounts for authentication',
   displayNameField: 'name',
   titleFormat: '{name}',
diff --git a/packages/platform-objects/src/identity/sys-verification.object.ts b/packages/platform-objects/src/identity/sys-verification.object.ts
@@ -16,6 +16,7 @@ export const SysVerification = ObjectSchema.create({
   pluralLabel: 'Verifications',
   icon: 'shield-check',
   isSystem: true,
+  managedBy: 'better-auth',
   description: 'Email and phone verification tokens',
   titleFormat: 'Verification for {identifier}',
   compactLayout: ['identifier', 'expires_at', 'created_at'],
diff --git a/packages/platform-objects/src/security/default-permission-sets.ts b/packages/platform-objects/src/security/default-permission-sets.ts
@@ -2,6 +2,56 @@
 
 import { PermissionSetSchema, type PermissionSet } from '@objectstack/spec/security';
 
+/**
+ * Identity tables managed by the better-auth plugin (see
+ * `packages/platform-objects/src/identity/`). Mutations to these tables
+ * MUST flow through the better-auth API endpoints (sign-up, password
+ * reset, organization invite/remove-member, api-key/create, …) rather
+ * than the generic CRUD pipeline so that password hashing, token
+ * signing, email verification, invitation flows and scope hashing all
+ * fire correctly.
+ *
+ * The default member/viewer permission sets therefore explicitly DENY
+ * `allowCreate / allowEdit / allowDelete` on these objects while still
+ * permitting reads (subject to the rest of the RLS chain). Admin
+ * permission sets keep their `*` wildcard so they can rescue data
+ * directly when needed.
+ *
+ * Each entry mirrors the `managedBy: 'better-auth'` flag declared on
+ * the corresponding object schema in `packages/platform-objects/src/identity/`.
+ */
+const BETTER_AUTH_MANAGED_OBJECTS = [
+  'sys_user',
+  'sys_account',
+  'sys_session',
+  'sys_organization',
+  'sys_member',
+  'sys_invitation',
+  'sys_team',
+  'sys_team_member',
+  'sys_api_key',
+  'sys_two_factor',
+  'sys_verification',
+  'sys_jwks',
+  'sys_device_code',
+  'sys_oauth_application',
+  'sys_oauth_access_token',
+  'sys_oauth_refresh_token',
+  'sys_oauth_consent',
+] as const;
+
+const denyWritesOnManagedObjects = (): Record<string, {
+  allowRead: boolean;
+  allowCreate: boolean;
+  allowEdit: boolean;
+  allowDelete: boolean;
+}> => Object.fromEntries(
+  BETTER_AUTH_MANAGED_OBJECTS.map((name) => [
+    name,
+    { allowRead: true, allowCreate: false, allowEdit: false, allowDelete: false },
+  ]),
+);
+
 /**
  * Default permission sets seeded by the platform.
  *
@@ -18,6 +68,8 @@ import { PermissionSetSchema, type PermissionSet } from '@objectstack/spec/secur
  *
  * `objects: { '*': … }` uses the wildcard sentinel honoured by
  * `PermissionEvaluator` — admins do not need an explicit row per object.
+ * Per-object entries fully override the wildcard for that object (see
+ * `PermissionEvaluator.checkObjectPermission` — lookup, not merge).
  *
  * RLS policies use the canonical `current_user.*` placeholders compiled
  * by `RLSCompiler`. The active organization is exposed under
@@ -54,6 +106,8 @@ export const defaultPermissionSets: PermissionSet[] = [
         allowEdit: true,
         allowDelete: true,
       },
+      // Identity tables are managed by better-auth — no direct writes.
+      ...denyWritesOnManagedObjects(),
     },
     rowLevelSecurity: [
       {
@@ -101,6 +155,10 @@ export const defaultPermissionSets: PermissionSet[] = [
         allowEdit: false,
         allowDelete: false,
       },
+      // Belt-and-suspenders: explicit deny on managed objects even though
+      // the wildcard already denies — keeps the policy readable when
+      // future relaxations might widen the wildcard.
+      ...denyWritesOnManagedObjects(),
     },
     rowLevelSecurity: [
       {
diff --git a/packages/plugins/plugin-security/src/rls-compiler.ts b/packages/plugins/plugin-security/src/rls-compiler.ts
@@ -80,7 +80,14 @@ export class RLSCompiler {
     if (eqMatch) {
       const [, field, prop] = eqMatch;
       const value = userCtx[prop];
-      if (value === undefined) return null;
+      // Skip when the user-context value is missing (undefined or null).
+      // A `null` `organization_id` means "no active organization" — applying
+      // the filter as `organization_id IS NULL` would silently expose every
+      // un-tenanted row across tenants and break system tables that lack the
+      // column entirely. Treating null as "skip this policy" makes the
+      // tenant_isolation rule safely opt-out for users without an active org
+      // while still applying when one is set.
+      if (value === undefined || value === null) return null;
       return { [field]: value };
     }
 
@@ -96,7 +103,7 @@ export class RLSCompiler {
     if (inMatch) {
       const [, field, prop] = inMatch;
       const value = userCtx[prop];
-      if (!Array.isArray(value)) return null;
+      if (!Array.isArray(value) || value.length === 0) return null;
       return { [field]: { $in: value } };
     }
 
diff --git a/packages/plugins/plugin-security/src/security-plugin.test.ts b/packages/plugins/plugin-security/src/security-plugin.test.ts
@@ -317,6 +317,31 @@ describe('RLSCompiler', () => {
     expect(filter).toBeNull();
   });
 
+  it('should skip equality policy when user-context value is null', () => {
+    // Repro: a logged-in user without an active organization. The
+    // tenant_isolation rule would otherwise emit `organization_id = null`,
+    // which silently exposes un-tenanted rows or breaks queries on system
+    // tables that lack the column. Treating null as "skip" is safe because
+    // the field-existence check + most-permissive permission-set merge
+    // remain in force.
+    const compiler = new RLSCompiler();
+    const policy: any = { object: '*', operation: 'all', using: 'organization_id = current_user.organization_id' };
+    const ctx: any = { userId: 'u1', tenantId: null, roles: [] };
+    const filter = compiler.compileFilter([policy], ctx);
+    expect(filter).toBeNull();
+  });
+
+  it('should still apply policy when only one of multiple has a usable value', () => {
+    // Same scenario as above but combined with a self-row rule. The
+    // organization_id rule should drop out, leaving only `id = current_user.id`.
+    const compiler = new RLSCompiler();
+    const tenantPolicy: any = { object: '*', operation: 'all', using: 'organization_id = current_user.organization_id' };
+    const selfPolicy: any = { object: 'sys_user', operation: 'select', using: 'id = current_user.id' };
+    const ctx: any = { userId: 'u1', tenantId: null, roles: [] };
+    const filter = compiler.compileFilter([tenantPolicy, selfPolicy], ctx);
+    expect(filter).toEqual({ id: 'u1' });
+  });
+
   it('should get applicable policies for object and operation', () => {
     const compiler = new RLSCompiler();
     const policies: any[] = [
diff --git a/packages/rest/src/rest-server.ts b/packages/rest/src/rest-server.ts
@@ -15,8 +15,30 @@ const logError = (...args: unknown[]) => (globalThis as any).console?.error(...a
  * so clients can distinguish "object isn't registered" from real server
  * faults. Anything else becomes a 400 (bad request) preserving prior
  * behavior. Genuine 500s are still logged.
+ *
+ * `PermissionDeniedError` (thrown by `SecurityPlugin`) MUST be caught
+ * before the unknown-object heuristic, otherwise its message —
+ * "[Security] Access denied: operation 'insert' on object 'sys_user' is
+ * not permitted …" — trips the `'<obj>' … not` substring check and
+ * returns a misleading 404.
  */
 function mapDataError(error: any, object?: string): { status: number; body: Record<string, unknown> } {
+    // Short-circuit: explicit security denial → 403. Match by `code` /
+    // `name` to avoid pulling a runtime dependency on plugin-security.
+    if (
+        error?.code === 'PERMISSION_DENIED' ||
+        error?.name === 'PermissionDeniedError' ||
+        (typeof error?.message === 'string' && error.message.startsWith('[Security] Access denied'))
+    ) {
+        return {
+            status: 403,
+            body: {
+                error: error?.message ?? 'Permission denied',
+                code: 'PERMISSION_DENIED',
+                ...(object ? { object } : {}),
+            },
+        };
+    }
     const raw = String(error?.message ?? error ?? '');
     const lower = raw.toLowerCase();
     const looksLikeUnknownObject =
@@ -954,7 +976,7 @@ export class RestServer {
                         res.json(result);
                     } catch (error: any) {
                         const mapped = mapDataError(error, req.params?.object);
-                        if (mapped.status !== 404) logError("[REST] Unhandled error:", error);
+                        if (mapped.status !== 404 && mapped.status !== 403) logError("[REST] Unhandled error:", error);
                         res.status(mapped.status === 400 ? 404 : mapped.status).json(mapped.body);
                     }
                 },
@@ -984,7 +1006,7 @@ export class RestServer {
                         res.status(201).json(result);
                     } catch (error: any) {
                         const mapped = mapDataError(error, req.params?.object);
-                        if (mapped.status !== 404) logError("[REST] Unhandled error:", error);
+                        if (mapped.status !== 404 && mapped.status !== 403) logError("[REST] Unhandled error:", error);
                         res.status(mapped.status).json(mapped.body);
                     }
                 },
@@ -1015,7 +1037,7 @@ export class RestServer {
                         res.json(result);
                     } catch (error: any) {
                         const mapped = mapDataError(error, req.params?.object);
-                        if (mapped.status !== 404) logError("[REST] Unhandled error:", error);
+                        if (mapped.status !== 404 && mapped.status !== 403) logError("[REST] Unhandled error:", error);
                         res.status(mapped.status).json(mapped.body);
                     }
                 },
@@ -1045,7 +1067,7 @@ export class RestServer {
                         res.json(result);
                     } catch (error: any) {
                         const mapped = mapDataError(error, req.params?.object);
-                        if (mapped.status !== 404) logError("[REST] Unhandled error:", error);
+                        if (mapped.status !== 404 && mapped.status !== 403) logError("[REST] Unhandled error:", error);
                         res.status(mapped.status).json(mapped.body);
                     }
                 },
diff --git a/packages/spec/src/data/object.zod.ts b/packages/spec/src/data/object.zod.ts
