feat(metadata-admin): support allowRuntimeCreate for db-only items

os-zhuang · os-zhuang · commit 694385437d09 · 2026-05-29T05:27:27.000+08:00
diff --git a/packages/app-shell/src/views/metadata-admin/DirectoryPage.tsx b/packages/app-shell/src/views/metadata-admin/DirectoryPage.tsx
@@ -89,11 +89,13 @@ export function MetadataDirectoryPage() {
     return c;
   }, [entries]);
 
-  const writableCount = entries.filter((e) => !HIDDEN_TYPES.has(e.type) && e.allowOrgOverride).length;
+  const writableCount = entries.filter(
+    (e) => !HIDDEN_TYPES.has(e.type) && (e.allowOrgOverride || e.allowRuntimeCreate),
+  ).length;
 
   const filtered = entries.filter((e) => {
     if (HIDDEN_TYPES.has(e.type)) return false;
-    if (writableOnly && !e.allowOrgOverride) return false;
+    if (writableOnly && !(e.allowOrgOverride || e.allowRuntimeCreate)) return false;
     if (domainFilter !== 'all' && (e.domain ?? 'other') !== domainFilter) return false;
     if (query) {
       const q = query.toLowerCase();
@@ -282,6 +284,13 @@ function TypeTile({ entry, locale }: { entry: RichMetadataTypeEntry; locale?: st
           >
             {t('engine.badge.writable', locale)}
           </Badge>
+        ) : entry.allowRuntimeCreate ? (
+          <Badge
+            className="text-[10px] shrink-0 bg-sky-100 text-sky-800 hover:bg-sky-100"
+            title="Code-shipped items are locked; new items can be created at runtime"
+          >
+            {t('engine.badge.createOnly', locale)}
+          </Badge>
         ) : (
           <Badge variant="outline" className="text-[10px] shrink-0 text-muted-foreground">
             {t('engine.badge.readOnly', locale)}
diff --git a/packages/app-shell/src/views/metadata-admin/EmbeddedItemEditor.tsx b/packages/app-shell/src/views/metadata-admin/EmbeddedItemEditor.tsx
@@ -73,7 +73,7 @@ export function EmbeddedItemEditor({
   }, [initialRaw, itemName, parentType, parentName]);
 
   const readOnly =
-    subEntry != null && !subEntry.allowOrgOverride;
+    subEntry != null && !subEntry.allowOrgOverride && !subEntry.allowRuntimeCreate;
 
   async function doSave() {
     if (!embeddedPath) {
diff --git a/packages/app-shell/src/views/metadata-admin/PageShell.tsx b/packages/app-shell/src/views/metadata-admin/PageShell.tsx
@@ -112,6 +112,13 @@ export function PageShell({
                 >
                   {t('engine.badge.writable', locale)}
                 </Badge>
+              ) : entry?.allowRuntimeCreate ? (
+                <Badge
+                  className="text-[10px] bg-sky-100 text-sky-800 hover:bg-sky-100"
+                  title="Code-shipped items are locked; new items can be created at runtime"
+                >
+                  {t('engine.badge.createOnly', locale)}
+                </Badge>
               ) : (
                 <Badge variant="outline" className="text-[10px] text-muted-foreground">
                   {t('engine.badge.readOnly', locale)}
diff --git a/packages/app-shell/src/views/metadata-admin/ResourceEditPage.tsx b/packages/app-shell/src/views/metadata-admin/ResourceEditPage.tsx
@@ -434,7 +434,23 @@ export function MetadataResourceEditPage({
   const schema =
     (entry?.schema as Record<string, unknown> | undefined) ??
     (config.defaultSchema as Record<string, unknown> | undefined);
-  const readOnly = !entry?.allowOrgOverride && !createMode;
+
+  // Two-tier authorization (PR-10d.7):
+  //   - artifact-backed items (layered.code != null) need allowOrgOverride
+  //   - DB-only items (no artifact) need allowOrgOverride OR allowRuntimeCreate
+  //   - createMode is always writable (the server will gate on intent)
+  const isArtifactItem = !createMode && layered?.code != null;
+  const canWrite = createMode
+    ? !!(entry?.allowOrgOverride || entry?.allowRuntimeCreate)
+    : isArtifactItem
+      ? !!entry?.allowOrgOverride
+      : !!(entry?.allowOrgOverride || entry?.allowRuntimeCreate);
+  const readOnly = !canWrite && !createMode;
+  // Banner variant: when type ships with allowRuntimeCreate but this
+  // specific item is locked because it comes from a code package, we
+  // show a different message inviting the user to create their own.
+  const showArtifactLockedBanner =
+    readOnly && isArtifactItem && !!entry?.allowRuntimeCreate;
 
   // Preview tab — opt-in via `registerMetadataPreview()`. Hidden in
   // create mode (nothing to preview yet) and inside the embedded
@@ -494,7 +510,7 @@ export function MetadataResourceEditPage({
                 : t('engine.edit.hideInspector', locale)}
             </Button>
           )}
-          {!createMode && entry?.allowOrgOverride && (
+          {!createMode && canWrite && layered?.overlay && (
             <Button variant="ghost" size="sm" onClick={doReset} disabled={saving}>
               <RotateCcw className="h-4 w-4 mr-1" />
               {t('engine.edit.reset', locale)}
@@ -517,19 +533,19 @@ export function MetadataResourceEditPage({
                 discard the whole create flow which is awkward; users can
                 navigate away to cancel).
               Truly read-only types (no allowOrgOverride) skip all of this. */}
-          {entry?.allowOrgOverride && !createMode && !editing && (
+          {canWrite && !createMode && !editing && (
             <Button size="sm" onClick={() => setEditing(true)}>
               <Pencil className="h-4 w-4 mr-1" />
               {t('engine.edit.edit', locale)}
             </Button>
           )}
-          {entry?.allowOrgOverride && !createMode && editing && (
+          {canWrite && !createMode && editing && (
             <Button variant="ghost" size="sm" onClick={doCancelEdit} disabled={saving}>
               <X className="h-4 w-4 mr-1" />
               {t('engine.cancel', locale)}
             </Button>
           )}
-          {entry?.allowOrgOverride && (editing || createMode) && (
+          {canWrite && (editing || createMode) && (
             <Button
               size="sm"
               onClick={() => doSave(false)}
@@ -578,20 +594,44 @@ export function MetadataResourceEditPage({
               </div>
             )}
             {readOnly && (
-              <div className="text-xs text-amber-800 border border-amber-300 bg-amber-50 rounded p-3 dark:text-amber-200 dark:border-amber-700/50 dark:bg-amber-950/30">
-                {/* The platform i18n bundle ships `engine.edit.readOnlyTypeBanner`
-                    with `{flag} / {type} / {override}` placeholders so the
-                    monospace tokens are inlined inside the translated sentence
-                    in any locale. Splitting on the three tokens preserves the
-                    sentence order across translations. */}
-                {t('engine.edit.readOnlyTypeBanner', locale)
-                  .split(/(\{flag\}|\{type\}|\{override\})/)
-                  .map((part, i) => {
-                    if (part === '{flag}') return <code key={i} className="font-mono">OBJECTSTACK_METADATA_WRITABLE</code>;
-                    if (part === '{type}') return <code key={i} className="font-mono">{type}</code>;
-                    if (part === '{override}') return <code key={i} className="font-mono">allowOrgOverride</code>;
-                    return <React.Fragment key={i}>{part}</React.Fragment>;
-                  })}
+              <div className="text-xs text-amber-800 border border-amber-300 bg-amber-50 rounded p-3 dark:text-amber-200 dark:border-amber-700/50 dark:bg-amber-950/30 flex items-start gap-3">
+                <div className="flex-1">
+                  {showArtifactLockedBanner ? (
+                    /* Type allows runtime-create but THIS item ships from
+                       a code package. Tell the user clearly and provide
+                       a CTA to author their own. */
+                    t('engine.edit.artifactLockedBanner', locale)
+                      .split(/(\{type\})/)
+                      .map((part, i) => {
+                        if (part === '{type}') return <code key={i} className="font-mono">{type}</code>;
+                        return <React.Fragment key={i}>{part}</React.Fragment>;
+                      })
+                  ) : (
+                    /* The platform i18n bundle ships `engine.edit.readOnlyTypeBanner`
+                       with `{flag} / {type} / {override}` placeholders so the
+                       monospace tokens are inlined inside the translated sentence
+                       in any locale. Splitting on the three tokens preserves the
+                       sentence order across translations. */
+                    t('engine.edit.readOnlyTypeBanner', locale)
+                      .split(/(\{flag\}|\{type\}|\{override\})/)
+                      .map((part, i) => {
+                        if (part === '{flag}') return <code key={i} className="font-mono">OBJECTSTACK_METADATA_WRITABLE</code>;
+                        if (part === '{type}') return <code key={i} className="font-mono">{type}</code>;
+                        if (part === '{override}') return <code key={i} className="font-mono">allowOrgOverride</code>;
+                        return <React.Fragment key={i}>{part}</React.Fragment>;
+                      })
+                  )}
+                </div>
+                {showArtifactLockedBanner && (
+                  <Button
+                    size="sm"
+                    variant="outline"
+                    className="shrink-0"
+                    onClick={() => navigate(`../new`)}
+                  >
+                    {t('engine.list.create', locale)}
+                  </Button>
+                )}
               </div>
             )}
           </div>
@@ -660,7 +700,7 @@ export function MetadataResourceEditPage({
                 "可写" badge in the header plus the Edit button in the
                 action bar already convey both signal and call-to-action,
                 and saving every vertical pixel for the canvas matters. */}
-            {!PreviewComponent && formReadOnly && !readOnly && entry?.allowOrgOverride && !createMode && (
+            {!PreviewComponent && formReadOnly && !readOnly && canWrite && !createMode && (
               <div className="flex items-center justify-between gap-3 text-xs text-muted-foreground border rounded p-2.5 bg-muted/30">
                 <span>
                   {t('engine.edit.readOnlyBanner', locale).split(/\{edit\}/).map((part, i, arr) => (
diff --git a/packages/app-shell/src/views/metadata-admin/ResourceListPage.tsx b/packages/app-shell/src/views/metadata-admin/ResourceListPage.tsx
@@ -157,7 +157,7 @@ function DefaultMetadataList({ type }: { type: string }) {
           >
             <RefreshCw className="h-4 w-4" />
           </Button>
-          {entry?.allowOrgOverride && (
+          {(entry?.allowOrgOverride || entry?.allowRuntimeCreate) && (
             <Button
               size="sm"
               onClick={() => navigate(`./new`)}
@@ -212,7 +212,7 @@ function DefaultMetadataList({ type }: { type: string }) {
             </EmptyTitle>
             <EmptyDescription>
               {config.emptyStateHint ??
-                (entry?.allowOrgOverride
+                (entry?.allowOrgOverride || entry?.allowRuntimeCreate
                   ? tFormat('engine.list.createHint', locale, { type: typeLabel })
                   : t('engine.list.readOnlyHint', locale))}
             </EmptyDescription>
diff --git a/packages/app-shell/src/views/metadata-admin/i18n.ts b/packages/app-shell/src/views/metadata-admin/i18n.ts
@@ -171,6 +171,9 @@ const ENGINE_STRINGS_EN: Record<string, string> = {
   'engine.edit.readOnlyBanner': 'Viewing in read-only mode. Click {edit} to make changes.',
   'engine.edit.readOnlyTypeBanner':
     'This metadata type is read-only for safety: it ships executable code or sensitive configuration and cannot be overlaid at runtime. Edit the source in your package and redeploy. To override this lock (use with caution), set {flag} to include {type}, or flip {override} in the registry.',
+  'engine.edit.artifactLockedBanner':
+    'This item is shipped by a code package and cannot be modified at runtime. You can still create your own {type} from scratch and freely edit or delete it.',
+  'engine.badge.createOnly': 'create-only',
   'engine.repeater.empty': 'No items. Click + to add.',
   'engine.badge.writable': 'writable',
   'engine.badge.readOnly': 'read-only',
@@ -285,6 +288,9 @@ const ENGINE_STRINGS_ZH: Record<string, string> = {
   'engine.edit.readOnlyBanner': '当前为只读模式。点击 {edit} 进行修改。',
   'engine.edit.readOnlyTypeBanner':
     '出于安全考虑，此元数据类型为只读：它包含可执行代码或敏感配置，不允许在运行时通过覆盖层修改。请编辑包内源代码后重新部署。如需临时解除限制（请谨慎使用），可将 {flag} 设置为包含 {type}，或在注册表中开启 {override}。',
+  'engine.edit.artifactLockedBanner':
+    '此条目由代码包提供，无法在运行时修改。但您可以新建自己的 {type}，并自由地编辑或删除。',
+  'engine.badge.createOnly': '仅可新建',
   'engine.repeater.empty': '暂无条目。点击 + 添加。',
   'engine.badge.writable': '可写',
   'engine.badge.readOnly': '只读',
diff --git a/packages/app-shell/src/views/metadata-admin/useMetadata.ts b/packages/app-shell/src/views/metadata-admin/useMetadata.ts
@@ -24,6 +24,13 @@ export interface RichMetadataTypeEntry {
   description?: string;
   domain?: string;
   allowOrgOverride?: boolean;
+  /**
+   * Two-tier model (PR-10d.7): brand-new items of this type can be
+   * authored at runtime even when `allowOrgOverride` is false. UI
+   * affordances ("+ New", Save, Delete on DB-only items) should
+   * activate when either flag is true.
+   */
+  allowRuntimeCreate?: boolean;
   /** 'registry' = ADR opt-in; 'env' = unlocked via OBJECTSTACK_METADATA_WRITABLE. */
   overrideSource?: 'registry' | 'env';
   supportsOverlay?: boolean;
