feat(identity): sys_user 放开档案字段标准编辑 affordance（ADR-0092 D4，closes #2817）#2832
Merged
Conversation
… fields (ADR-0092 D4)
sys_user gains userActions:{edit:true} (create/import/delete stay off).
name/image are editable; email, email_verified, two_factor_enabled, role,
banned/ban_reason/ban_expires, ai_access, manager_id,
primary_business_unit_id and every system-managed stamp are marked
readonly so the standard edit form renders them non-editable.
Safe because the server boundary is the identity write guard (ADR-0092
D2, #2828): a user-context sys_user update may only touch {name, image}
regardless of what a form submits. The readonly flags are UX only.
Verified in the running Console: the object metadata sent to the client
carries userActions.edit=true and the correct per-field readonly flags;
the row 'Edit' action appears; the edit form surfaces only name/image;
and — the risk this issue flagged — the create_user/invite_user dialogs
keep email/role editable (action params do not inherit field readonly).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01YGAN5VvvBi4YRGwpNT6e21
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
github-actions
Bot
added
documentation
Contributor
📓 Docs Drift CheckThis PR changes 2 package(s): 5 hand-written doc(s) reference the affected code and may need an implementation-accuracy re-verification:
|
…ect FLS + bump objectui to sys_user edit-form fix (ADR-0092 D4) Completes ADR-0092 D4 end-to-end (#2817). Three parts brought the standard sys_user edit form to life for platform admins, verified in a running Console (edit name → persisted; email/role stay read-only): 1. foldWildcardSuperUser in /me/permissions (hono-plugin): the per-object FLS map now folds the '*' modifyAll/viewAll super-user grant into every object entry, so the client mirrors the server's actual enforcement (checkObjectPermission is most-permissive, no deny-wins). Fixes the false-negative where a platform admin who also holds organization_admin (denies identity writes) saw sys_user.allowEdit:false and a disabled form, though the server accepts the write (PATCH → 200). ADR-0057 D10. 2. .objectui-sha bump to 5da9905 — pulls in objectui#2395 (ObjectForm honors userActions.edit instead of blanket-disabling managed objects). 3. sys_user userActions.edit + field readonly governance (earlier commit). The identity write guard (#2828) still restricts the actual write to {name, image}; these changes only correct which affordances the UI shows. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01YGAN5VvvBi4YRGwpNT6e21
…ission ∩ guard (ADR-0092 complete fix) Completes the /me/permissions consistency fix. foldWildcardSuperUser alone fixed the false-NEGATIVE (admin couldn't see sys_user editable) but introduced a false-POSITIVE: it reported allowEdit:true for every better-auth identity table, including ones the identity write guard (#2828) actually blocks (sys_member, sys_account, sys_session, …). clampManagedObjectWrites re-applies the guard's user-context policy: a managedBy:'better-auth' object is writable only where it opted in via userActions.{edit,create,delete} (sys_user → edit; the field readonly flags then narrow it to {name,image}). Only better-auth objects are clamped — system/config/append-only have no such guard, so their permission-set result stands (admin CAN write them; must not under-report). Net: the Console's per-object FLS now equals real server enforcement (permission-set ∩ guard). Verified against a running stack: sys_user allowEdit:true + form editable; sys_member/session/account allowEdit:false (read preserved). +4 unit tests (8 total). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01YGAN5VvvBi4YRGwpNT6e21
os-zhuang
marked this pull request as ready for review
July 11, 2026 12:20
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
概要
ADR-0092 D4（#2817）——
sys_user档案字段经标准编辑表单可编辑,运行中的 Console 端到端验证通过(编辑 name → 落库;email/role 只读)。守卫 #2828 仍确保用户上下文只能改{name, image}。三块协同改动:
platform-objects）—userActions:{edit:true};name/image可编辑,其余标readonly。/me/permissions提示 = 权限 ∩ 守卫（plugin-hono-server,新增foldWildcardSuperUser+clampManagedObjectWrites+ 8 单测)。.objectui-sha→ 5da9905 — 拉入 objectui feat(auth): per-org MFA + dispatcher/MCP gate (ADR-0069 D3) #2395（ObjectForm按userActions.edit逐字段渲染)。根因与完整修复（浏览器验证中发现,逐层查明)
放开 affordance 后表单仍全禁用,原因是两个独立门:
/me/permissions客户端 FLS 与服务端强制不一致。服务端对身份表有两层强制:权限集(
checkObjectPermission,最宽松合成、无 deny-wins,admin 的modifyAllRecords通配符放行)∩ 身份写守卫 #2828(全managedBy:'better-auth'表默认拒用户上下文写,仅sys_user开edit)。/me/permissions原来两层都没反映,于是:foldWildcardSuperUser折入通配符超级用户位 → 修假阴性(admin 看不到 sys_user 可编辑,但PATCH /data/sys_user{name}→200 证明服务端放行)。clampManagedObjectWrites按守卫策略夹回 → 修 fold 引入的假阳性:sys_member/sys_account/sys_session等无白名单托管表夹回allowEdit:false(read 保留),与守卫一致。仅夹better-auth对象(守卫只管它们);system/config/append-only 无此守卫,权限集结果照旧(admin 可经 data API 写,提示不得漏报)。结果:客户端 per-object FLS = 真实服务端强制(权限 ∩ 守卫),双向不一致均消除。此前担心的"admin 在所有 system 表看到编辑按钮"的影响面已由 clamp 消除。
验证
foldWildcardSuperUser+clampManagedObjectWrites(8 例)、objectuiObjectForm.managedEdit(3 例,随 feat(auth): per-org MFA + dispatcher/MCP gate (ADR-0069 D3) #2395)、身份守卫(随 feat(auth): 身份表写守卫 — managedBy:'better-auth' 引擎级强制（ADR-0092 D2/D3/D6，closes #2816） #2828)。plugin-hono-server 全套 64、platform-objects 76 通过。/data/sys_user落库;email/role 不可编辑;Create/Invite 弹窗不受影响。/me/permissions实测:sys_user.allowEdittrue(可编辑)、sys_member/session/account.allowEditfalse(read 保留)—— 与守卫逐表一致。相关
ADR-0092 D4/D5 · closes #2817 · 修复 #2836（权限合成 finding）· 依赖已合并 #2828、objectui #2395 · 关联 #2833
🤖 Generated with Claude Code
https://claude.ai/code/session_01YGAN5VvvBi4YRGwpNT6e21