fix(platform-objects): allow import/export on sys_business_unit (#3025)#3392
Merged
Conversation
The Business Units list surfaces Import/Export buttons, but sys_business_unit declared a restrictive `enable.apiMethods` whitelist of only the five CRUD verbs. The REST data plane gates import/export on that whitelist (ADR-0049), so both buttons returned 405 OBJECT_API_METHOD_NOT_ALLOWED. This was an unintentional gap, not a deliberate restriction: the object's fields (external_ref, effective_from/to) are designed for HRIS batch sync and the org tree is expected to support bulk import. Add 'import'/'export' to the whitelist; import reuses the create/update affordances already granted, and the managed-object reconciliation backstop leaves import/export untouched. Adds a regression test asserting the whitelist includes import/export. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
github-actions
Bot
added
documentation
Contributor
📓 Docs Drift CheckThis PR changes 1 package(s): 2 hand-written doc(s) reference the affected code and may need an implementation-accuracy re-verification:
|
xuyushun441-sys
pushed a commit
that referenced
this pull request
Jul 21, 2026
#3025 / #3391 P0) Completes the #3025 point-fix. #3392 added import/export to sys_business_unit but left the sibling membership table on a CRUD-only whitelist, so the HRIS org-tree sync scenario (units + memberships imported together) still 405'd on the membership import/export path. #3391's P0 checklist pairs both tables; this is the half #3392 missed. - sys_business_unit_member enable.apiMethods gains 'import','export'. - Reconcile-safe: import/export are not in MANAGED_WRITE_VERB_AFFORDANCE, so reconcileManagedApiMethods (managedBy:'platform') never strips them — the declared whitelist reaches apiAccessDenialFromEnable intact. - Regression test locks import/export + CRUD, proven red-before-green. Transitional per #3391 P2 (derived import/export mapping reclaims both objects). Refs #3025, #3391. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
os-zhuang
added a commit
that referenced
this pull request
Jul 21, 2026
#3025 / #3391 P0) (#3394) Completes the #3025 point-fix. #3392 added import/export to sys_business_unit but left the sibling membership table on a CRUD-only whitelist, so the HRIS org-tree sync scenario (units + memberships imported together) still 405'd on the membership import/export path. #3391's P0 checklist pairs both tables; this is the half #3392 missed. - sys_business_unit_member enable.apiMethods gains 'import','export'. - Reconcile-safe: import/export are not in MANAGED_WRITE_VERB_AFFORDANCE, so reconcileManagedApiMethods (managedBy:'platform') never strips them — the declared whitelist reaches apiAccessDenialFromEnable intact. - Regression test locks import/export + CRUD, proven red-before-green. Transitional per #3391 P2 (derived import/export mapping reclaims both objects). Refs #3025, #3391. Co-authored-by: Jack Zhuang <277994282+os-zhuang@users.noreply.github.com> Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
问题
业务单元列表(Setup → Business Units)点「导入」/「导出」按钮报 405:
根因
REST 数据面按 ADR-0049 用对象上的
enable.apiMethods白名单门控。缺省语义是无apiMethods= 全放行——支持导入的对象都是干脆不声明白名单。而sys_business_unit显式声明了限制性白名单,只有 CRUD 五件套,漏了import/export:排查确认这是无意的缺口而非刻意收紧:ADR-0057 与提交注释均未提及;真正刻意收紧的对象(如
sys_oauth_application)都有注释 + 测试锁死。且该对象字段(external_ref、effective_from/to)明确为 HRIS 批量同步设计,组织树本就该支持批量导入。405 的门控落点在
packages/rest/src/rest-server.ts(apiAccessDenialFromEnable),import/export 路由(/data/:object/import、/data/:object/export)在执行前enforceApiAccess(..., 'import'|'export'),故受此白名单门控。修复
白名单补上
'import'、'export'。create/updateaffordance。sys_business_unit是managedBy:'platform',reconcileManagedApiMethods只剥写动词(create/update/upsert/delete/purge),不动import/export。测试
sys_business_unit白名单必须含import/export(且保留 CRUD 五件套)。已验证防假绿:临时回退修复后该测试如实变红(expected [...] to include 'import')。@objectstack/platform-objects套件 214 条全过;tsc --noEmit通过。备注(不在本 PR 范围)
同类缺口:
sys_user(['get','list','update'])、sys_import_job(['get','list'])等显式白名单对象同样不含 import/export。本 PR 按 #3025 单点修复sys_business_unit;UI 按钮与白名单前后端一致性的通用设计问题按 issue 说明另开 issue 跟进。Closes #3025
🤖 Generated with Claude Code