From 04b2b7c9239af4eebc12e58b4d35002d4d072b0d Mon Sep 17 00:00:00 2001 From: os-zhuang Date: Wed, 24 Jun 2026 12:44:00 +0800 Subject: [PATCH] fix(setup): drop Advanced nav entries for non-listable objects MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Browser-dogfooding every Setup menu found two Advanced entries that always render "failed to load": Verifications (sys_verification) and Device Codes (sys_device_code). Both objects intentionally omit `list` from `apiMethods` (sensitive ephemeral secrets), so the generic list-view menu 405s every time. Removed both nav entries + their orphaned zh labels; objects stay reachable by id. (Re-adding a browse menu needs `list` enabled — a security decision.) Co-Authored-By: Claude Opus 4.8 --- .changeset/setup-advanced-nav-unlistable.md | 14 ++++++++++++++ .../src/apps/setup-nav.contributions.ts | 8 ++++++-- .../src/apps/translations/zh-CN.ts | 2 -- 3 files changed, 20 insertions(+), 4 deletions(-) create mode 100644 .changeset/setup-advanced-nav-unlistable.md diff --git a/.changeset/setup-advanced-nav-unlistable.md b/.changeset/setup-advanced-nav-unlistable.md new file mode 100644 index 0000000000..49473e117f --- /dev/null +++ b/.changeset/setup-advanced-nav-unlistable.md @@ -0,0 +1,14 @@ +--- +"@objectstack/platform-objects": patch +--- + +fix(setup): drop Advanced nav entries for non-listable objects (sys_verification, sys_device_code) + +Dogfooding every Setup menu surfaced two Advanced entries that always render +"无法加载记录 / failed to load": **Verifications** (`sys_verification`) and +**Device Codes** (`sys_device_code`). Both objects deliberately omit `list` +from `apiMethods` (sensitive, ephemeral secrets — verification tokens and OAuth +device-grant codes are not meant to be browsed), so the generic object/list-view +menu can only ever 405. Removed both nav entries (and their orphaned zh labels); +the objects remain reachable by id. Re-adding a browse menu would require +enabling `list` on the object — a security decision, not a nav fix. diff --git a/packages/platform-objects/src/apps/setup-nav.contributions.ts b/packages/platform-objects/src/apps/setup-nav.contributions.ts index e7c930d2ab..31685aaa56 100644 --- a/packages/platform-objects/src/apps/setup-nav.contributions.ts +++ b/packages/platform-objects/src/apps/setup-nav.contributions.ts @@ -113,8 +113,12 @@ export const SETUP_NAV_CONTRIBUTIONS: NavigationContribution[] = [ items: [ { id: 'nav_oauth_apps', type: 'object', label: 'OAuth Applications', objectName: 'sys_oauth_application', icon: 'app-window' }, { id: 'nav_jwks', type: 'object', label: 'Signing Keys (JWKS)', objectName: 'sys_jwks', icon: 'key-round' }, - { id: 'nav_verifications', type: 'object', label: 'Verifications', objectName: 'sys_verification', icon: 'mail-check' }, - { id: 'nav_device_codes', type: 'object', label: 'Device Codes', objectName: 'sys_device_code', icon: 'qr-code' }, + // `sys_verification` (email/phone tokens) and `sys_device_code` (OAuth + // device-grant codes) deliberately omit `list` from their `apiMethods` + // (sensitive, ephemeral secrets — not browsable), so an object/list-view + // nav entry for them can only ever render "failed to load". They're + // reachable by id (get) when needed; no browse menu. (Re-adding requires + // enabling `list` on the object — a security decision.) { id: 'nav_accounts', type: 'object', label: 'Identity Links', objectName: 'sys_account', icon: 'link-2' }, { id: 'nav_user_preferences', type: 'object', label: 'User Preferences', objectName: 'sys_user_preference', icon: 'sliders' }, ], diff --git a/packages/platform-objects/src/apps/translations/zh-CN.ts b/packages/platform-objects/src/apps/translations/zh-CN.ts index 440811eeb3..9c6b0af25b 100644 --- a/packages/platform-objects/src/apps/translations/zh-CN.ts +++ b/packages/platform-objects/src/apps/translations/zh-CN.ts @@ -84,8 +84,6 @@ export const zhCN: TranslationData = { nav_oauth_apps: { label: 'OAuth 应用' }, nav_jwks: { label: '签名密钥 (JWKS)' }, - nav_verifications: { label: '验证记录' }, - nav_device_codes: { label: '设备代码' }, nav_accounts: { label: '身份链接' }, nav_user_preferences: { label: '用户偏好' }, nav_metadata: { label: '全部元数据' },