fix(examples): declare runAs:'system' on showcase webhook + approval-outcome flows (#1888)#2316
Merged
Merged
Conversation
…outcome flows (#1888) Audit follow-up to #1888 (flow `runAs` enforcement). Two showcase flows relied on implicit elevation and would teach the wrong pattern as AI-authoring reference templates now that `runAs` is enforced: - `showcase_inbound_task_webhook` — an HMAC webhook (no authenticated user) that creates records. It only worked via the "no identity → security-skipped" fall-through. Now declares `runAs:'system'` — the correct, explicit pattern for external ingest (and robust once the target object carries RLS). - `showcase_invoice_signoff` — the revert-on-reject write is an approval-process outcome, not an act of the submitter. `runAs:'system'` so it lands regardless of whether the submitter still has edit rights on a "sent" invoice. No behavioral regression in the showcase itself (broad member perms — the full dogfood gate was already green); this hardens the templates so they stay correct under stricter RLS and as patterns AI copies. The rest of the example flows were audited and are correct as-is: `system` where they cross owners (lead qualification, renewal/stale sweeps, todo escalation/recurrence) and `user` where they act on the trigger user's own accessible record (lead convert, task reassign, resilient-sync self-update). Verified: `pnpm --filter @objectstack/example-showcase typecheck` + full dogfood gate (173 tests) green. Refs #1888 Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Regression-audit follow-up to #2302 (flow
runAsenforcement, #1888). Now thatrunAsis enforced, I audited every example-app flow for ones that would be silently under-privileged or that teach the wrong pattern as AI-authoring reference templates.Audit result
No example flow regresses under the enforcement (consistent with the green dogfood gate). They split cleanly:
system(correct) — cross-owner / no-user work: CRMlead_qualification_conversion,renewal_reminder_flow,stale_opportunity_sweep; todo escalation + recurring-task flows.user(correct) — acts only on the trigger user's own accessible record: CRMcrm_convert_lead_wizard(get/update the user's own lead), showcaseshowcase_reassign_wizard(edit a task the user launched the action on),showcase_resilient_sync(updates the same task the trigger user just completed).Fixes (2 showcase flows)
Two flows relied on implicit elevation and would teach the wrong pattern as templates:
showcase_inbound_task_webhook— an HMAC webhook (type: 'api', no authenticated user) that creates a task. It only worked via the "no identity → security-skipped" fall-through. Now declaresrunAs: 'system'— the correct, explicit pattern for external ingest, and robust once the target object carries RLS.showcase_invoice_signoff— the revert-on-rejectupdate_recordis an approval-process outcome, not an act of the submitter.runAs: 'system'so it lands regardless of whether the submitter still has edit rights on a "sent" invoice (mirrors how Salesforce approval field updates run as the process).No behavioral change in the showcase itself (broad member perms — the gate was already green); this hardens the reference templates so they stay correct under stricter RLS and as patterns AI copies.
Verification
pnpm --filter @objectstack/example-showcase typecheck✓flow-runasproof).Example-only change to a private package → no changeset needed.
Refs #1888
🤖 Generated with Claude Code