fix(security): /me/permissions folds wildcard super-user into per-object FLS + bump objectui to sys_user edit-form fix (ADR-0092 D4)

Completes ADR-0092 D4 end-to-end (#2817). Three parts brought the standard
sys_user edit form to life for platform admins, verified in a running
Console (edit name → persisted; email/role stay read-only):

1. foldWildcardSuperUser in /me/permissions (hono-plugin): the per-object
   FLS map now folds the '*' modifyAll/viewAll super-user grant into every
   object entry, so the client mirrors the server's actual enforcement
   (checkObjectPermission is most-permissive, no deny-wins). Fixes the
   false-negative where a platform admin who also holds organization_admin
   (denies identity writes) saw sys_user.allowEdit:false and a disabled
   form, though the server accepts the write (PATCH → 200). ADR-0057 D10.
2. .objectui-sha bump to 5da9905 — pulls in objectui#2395 (ObjectForm
   honors userActions.edit instead of blanket-disabling managed objects).
3. sys_user userActions.edit + field readonly governance (earlier commit).

The identity write guard (#2828) still restricts the actual write to
{name, image}; these changes only correct which affordances the UI shows.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01YGAN5VvvBi4YRGwpNT6e21

Author: claude

.changeset/console-5da9905b30fc.md

@@ -0,0 +1,9 @@
+---
+"@objectstack/console": patch
+---
+
+Console (objectui) refreshed to `5da9905b30fc`. Frontend changes in this range:
+
+- fix(plugin-form): honor userActions.edit on managed objects, don't blanket-disable fields (ADR-0092 D4) (#2395)
+
+objectui range: `6fa8e6aeb67c...5da9905b30fc`

.changeset/me-permissions-wildcard-fold.md

@@ -0,0 +1,26 @@
+---
+"@objectstack/plugin-hono-server": patch
+---
+
+fix(security): `/me/permissions` folds the `'*'` wildcard super-user grant into per-object FLS, matching server enforcement (ADR-0057 D10)
+
+The `/api/v1/auth/me/permissions` per-object map merged each permission set's
+explicit `objects` entries most-permissively per key, but treated `'*'` and
+named objects as independent keys — so a wildcard "Modify/View All Data" grant
+was never propagated into a per-object entry another set explicitly denied.
+That made the client's field-level security STRICTER than the server's actual
+enforcement (`PermissionEvaluator.checkObjectPermission` allows as soon as any
+set grants, including via the `'*'` modifyAll/viewAll super-user bypass, with
+no deny-wins).
+
+Concretely: a platform admin (`admin_full_access` → `'*': {modifyAllRecords}`)
+who also holds `organization_admin` (which denies writes on identity tables)
+resolved to `sys_user.allowEdit:false` in this payload, so the Console disabled
+the standard edit form — even though the server accepts the write (`PATCH
+/data/sys_user {name}` → 200). The new `foldWildcardSuperUser` post-pass lifts
+each per-object entry's read/write bits when the merged wildcard is a
+super-user grant, so the client mirrors the server (never broader — the
+super-user grant already covers private/managed objects server-side). This
+unblocks the ADR-0092 D4 `sys_user` profile-edit affordance for platform
+admins; the identity write guard still restricts the actual write to
+`{name, image}`.

.objectui-sha

@@ -1 +1 @@
-6fa8e6aeb67c53169b7c9c4bbc1ef7cf897d0cbf
+5da9905b30fc06fa2d262fbcbccbcf881f9da360

packages/plugins/plugin-hono-server/src/fold-wildcard-superuser.test.ts

@@ -0,0 +1,50 @@
+// Copyright (c) 2026 ObjectStack. Licensed under the Apache-2.0 license.
+
+import { describe, it, expect } from 'vitest';
+import { foldWildcardSuperUser } from './hono-plugin.js';
+
+/**
+ * ADR-0057 D10 / ADR-0092 D5 — the `/me/permissions` per-object FLS map must
+ * mirror the server's actual enforcement, which grants writes via a `'*'`
+ * modifyAll super-user bypass regardless of another set's explicit per-object
+ * deny (most-permissive merge, no deny-wins).
+ */
+describe('foldWildcardSuperUser', () => {
+  it('lifts an explicit per-object deny when the wildcard is a modifyAll super-user grant', () => {
+    const objects: Record<string, any> = {
+      '*': { allowRead: true, allowEdit: true, viewAllRecords: true, modifyAllRecords: true },
+      // As produced when admin_full_access ('*') composes with organization_admin
+      // (explicit sys_user deny) — the naive merge leaves allowEdit:false.
+      sys_user: { allowRead: true, allowEdit: false, allowCreate: false, allowDelete: false },
+    };
+    foldWildcardSuperUser(objects);
+    expect(objects.sys_user).toMatchObject({ allowRead: true, allowEdit: true, allowCreate: true, allowDelete: true });
+    // The wildcard entry itself is untouched.
+    expect(objects['*'].modifyAllRecords).toBe(true);
+  });
+
+  it('viewAll-only wildcard lifts read but NOT write', () => {
+    const objects: Record<string, any> = {
+      '*': { allowRead: true, viewAllRecords: true },
+      sys_session: { allowRead: false, allowEdit: false },
+    };
+    foldWildcardSuperUser(objects);
+    expect(objects.sys_session.allowRead).toBe(true);
+    expect(objects.sys_session.allowEdit).toBe(false);
+  });
+
+  it('no-ops when the wildcard is not a super-user grant', () => {
+    const objects: Record<string, any> = {
+      '*': { allowRead: true, allowEdit: true }, // plain allow, no view/modifyAll
+      sys_user: { allowRead: true, allowEdit: false },
+    };
+    foldWildcardSuperUser(objects);
+    expect(objects.sys_user.allowEdit).toBe(false); // untouched — no super-user bypass
+  });
+
+  it('no-ops when there is no wildcard entry', () => {
+    const objects: Record<string, any> = { sys_user: { allowEdit: false } };
+    foldWildcardSuperUser(objects);
+    expect(objects.sys_user.allowEdit).toBe(false);
+  });
+});

packages/plugins/plugin-hono-server/src/hono-plugin.ts

@@ -81,6 +81,45 @@ export interface HonoPluginOptions {
  * - `@objectstack/rest` → CRUD, metadata, discovery, UI, batch
  * - `createDispatcherPlugin()` → auth, graphql, analytics, packages, etc.
  */
+
+/**
+ * Fold the `'*'` wildcard super-user grant into every per-object entry of a
+ * `/me/permissions` `objects` map, mutating it in place.
+ *
+ * The endpoint merges each resolved permission set's explicit `objects` entries
+ * most-permissively per key, but treats `'*'` and named objects as independent
+ * keys — so a wildcard "Modify/View All Data" grant is never propagated into a
+ * per-object entry another set explicitly denied. That makes the client's
+ * per-object FLS STRICTER than the server's actual enforcement
+ * (`PermissionEvaluator.checkObjectPermission`, which returns allow as soon as
+ * ANY set grants — including via the `'*'` modifyAll/viewAll super-user bypass,
+ * with no deny-wins). The mismatch surfaces for a platform admin
+ * (`admin_full_access` `'*': {modifyAllRecords}`) who ALSO holds
+ * `organization_admin` (which denies writes on identity tables): the client
+ * would see `sys_user.allowEdit:false` and disable a form the server accepts
+ * (verified: `PATCH /data/sys_user {name}` → 200). ADR-0057 D10 makes the
+ * server the authoritative gate; the client must mirror it, never diverge.
+ *
+ * The super-user grant covers private/managed objects on the server, so folding
+ * it here is exactly as broad as real enforcement — never broader.
+ */
+export function foldWildcardSuperUser(objects: Record<string, any>): void {
+    const wild = objects?.['*'];
+    if (!wild) return;
+    const superRead = wild.viewAllRecords === true || wild.modifyAllRecords === true;
+    const superWrite = wild.modifyAllRecords === true;
+    if (!superRead && !superWrite) return;
+    for (const [obj, acc] of Object.entries(objects) as Array<[string, any]>) {
+        if (obj === '*' || !acc) continue;
+        if (superRead) acc.allowRead = true;
+        if (superWrite) {
+            acc.allowEdit = true;
+            acc.allowCreate = true;
+            acc.allowDelete = true;
+        }
+    }
+}
+
 export class HonoServerPlugin implements Plugin {
     name = 'com.objectstack.server.hono';
     type = 'server';
@@ -796,6 +835,10 @@ export class HonoServerPlugin implements Plugin {
                         }
                     }
                 }
+                // Fold the `'*'` wildcard super-user grant into every per-object
+                // entry (see foldWildcardSuperUser) so the client's per-object FLS
+                // matches the server's actual enforcement (ADR-0057 D10).
+                foldWildcardSuperUser(objects);
                 return c.json({
                     authenticated: true,
                     userId: execCtx.userId,