feat(platform-objects): lock studio & account apps with ADR-0010 full protection#1774
Merged
Conversation
… protection
Studio and Account shipped without a protection block, so tenant
overlay writes to PUT /api/v1/meta/app/{studio,account} succeeded —
the NavigationSyncEffect bug in objectui demonstrated the hazard by
writing auto-navigation into these system apps. Both are core platform
UI in the same class as Setup (which already carries lock: 'full'):
- studio: the metadata workbench — a broken overlay locks implementers
out of the very surface used to repair metadata
- account: every authenticated user's only self-service security
surface (sessions / API keys / linked accounts)
The loader translates protection into the _lock envelope; objectui's
isNavigationSyncableApp already filters on _lock ∈ {full, no-overlay},
so client behavior is automatically correct. Setup-style navigation
contributions are unaffected (registration-time in-memory merge, not
overlay writes).
Adds a regression test pinning lock: 'full' on all three platform apps.
Verified end-to-end on a rebuilt showcase stack: GET /api/v1/meta/app
now serves _lock: "full" for setup, studio, and account.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
…1771 #1771 moved both marketplace entries out to cloud-connection's plugins but left the now-empty contribution behind, tripping the SETUP_NAV_CONTRIBUTIONS test ('items.length > 0') and turning main CI red. The group_apps shell anchor stays in setup.app.ts and is filled entirely by capability plugins. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
setupalready shipsprotection: { lock: 'full' }(ADR-0010 §3.7), butstudioandaccounthad no protection block, so tenant overlay writes viaPUT /api/v1/meta/app/{studio,account}succeeded. The objectui NavigationSyncEffect bug demonstrated the hazard by writing auto-navigation pages into these writable system apps.Both are core platform UI in the same class as Setup:
Changes
protection: { lock: 'full', reason, docsUrl }tostudio.app.tsandaccount.app.ts, mirroringsetup.app.tslock: 'full'on all three platform apps (and AppSchema parse)Notes
isNavigationSyncableAppalready filters on_lock ∈ {full, no-overlay}, so client behavior is automatically correct once the server serves the lockenvironmentIdset); standalone/control-plane stacks skip it by design (protocol.tsassertLockAllowsWrite)Test plan
vitest run src/platform-objects.test.ts— new protection tests pass (the one failing SETUP_NAV_CONTRIBUTIONS test also fails on clean main, pre-existing)tsc --noEmitcleanGET /api/v1/meta/appserves_lock: "full"+ reason for setup/studio/account🤖 Generated with Claude Code