Skip to content

fix(setup): drop Advanced nav entries for non-listable objects (verifications, device codes) #2266

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
os-zhuang merged 1 commit into from
Jun 24, 2026
Merged

fix(setup): drop Advanced nav entries for non-listable objects (verifications, device codes) #2266

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
14 changes: 14 additions & 0 deletions .changeset/setup-advanced-nav-unlistable.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,14 @@
---
"@objectstack/platform-objects": patch
---

fix(setup): drop Advanced nav entries for non-listable objects (sys_verification, sys_device_code)

Dogfooding every Setup menu surfaced two Advanced entries that always render
"无法加载记录 / failed to load": **Verifications** (`sys_verification`) and
**Device Codes** (`sys_device_code`). Both objects deliberately omit `list`
from `apiMethods` (sensitive, ephemeral secrets — verification tokens and OAuth
device-grant codes are not meant to be browsed), so the generic object/list-view
menu can only ever 405. Removed both nav entries (and their orphaned zh labels);
the objects remain reachable by id. Re-adding a browse menu would require
enabling `list` on the object — a security decision, not a nav fix.
8 changes: 6 additions & 2 deletions packages/platform-objects/src/apps/setup-nav.contributions.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -113,8 +113,12 @@ export const SETUP_NAV_CONTRIBUTIONS: NavigationContribution[] = [
items: [
{ id: 'nav_oauth_apps', type: 'object', label: 'OAuth Applications', objectName: 'sys_oauth_application', icon: 'app-window' },
{ id: 'nav_jwks', type: 'object', label: 'Signing Keys (JWKS)', objectName: 'sys_jwks', icon: 'key-round' },
{ id: 'nav_verifications', type: 'object', label: 'Verifications', objectName: 'sys_verification', icon: 'mail-check' },
{ id: 'nav_device_codes', type: 'object', label: 'Device Codes', objectName: 'sys_device_code', icon: 'qr-code' },
// `sys_verification` (email/phone tokens) and `sys_device_code` (OAuth
// device-grant codes) deliberately omit `list` from their `apiMethods`
// (sensitive, ephemeral secrets — not browsable), so an object/list-view
// nav entry for them can only ever render "failed to load". They're
// reachable by id (get) when needed; no browse menu. (Re-adding requires
// enabling `list` on the object — a security decision.)
{ id: 'nav_accounts', type: 'object', label: 'Identity Links', objectName: 'sys_account', icon: 'link-2' },
{ id: 'nav_user_preferences', type: 'object', label: 'User Preferences', objectName: 'sys_user_preference', icon: 'sliders' },
],
Expand Down
2 changes: 0 additions & 2 deletions packages/platform-objects/src/apps/translations/zh-CN.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -84,8 +84,6 @@ export const zhCN: TranslationData = {

nav_oauth_apps: { label: 'OAuth 应用' },
nav_jwks: { label: '签名密钥 (JWKS)' },
nav_verifications: { label: '验证记录' },
nav_device_codes: { label: '设备代码' },
nav_accounts: { label: '身份链接' },
nav_user_preferences: { label: '用户偏好' },
nav_metadata: { label: '全部元数据' },
Expand Down
Loading