fix(grid): evaluate a bulk action's visible per selected record (#3067) (#3070)

os-zhuang · claude · web-flow · commit d61efd1ee6e2 · 2026-07-30T23:47:45.000+08:00
The bar evaluated `visible` against the ambient scope with no record bound.
That does not fail open — the lenient evaluator returned `true` for EVERY
row-scoped predicate, including ones that should be false: `${record.done}`
and `${record.owner == user.id}` both came back `true` with no record in
scope. The authored gate was inverted for half its inputs, indistinguishable
from a real verdict.

`visible` is now evaluated once per selected record with that record in scope,
fail-closed per record and warning once on a fault — the row kebab's contract.
One evaluation answers both questions: the button is offered when at least one
selected record passes, and the run acts only on those. A record-free predicate
answers identically for every row, so a plain feature/permission gate still
behaves as a button-level gate with no syntactic sniffing for `record`.

The confirm step reports how many records were skipped, so a run narrower than
the user's selection says so. Eligibility is re-applied to the expanded set
after "select all N matching", not just the page selection the button saw.

Reverse-control: with only BulkActionBar.tsx + ObjectGrid.tsx reverted, the two
new positive assertions fail (all selected records dispatched instead of the
eligible one; button rendered when nothing qualifies).

Co-authored-by: Jack Zhuang &lt;277994282+os-zhuang@users.noreply.github.com&gt;
Co-authored-by: Claude Opus 5 &lt;noreply@anthropic.com&gt;
diff --git a/.changeset/bulk-visible-per-record.md b/.changeset/bulk-visible-per-record.md
@@ -0,0 +1,35 @@
+---
+"@object-ui/plugin-grid": patch
+"@object-ui/i18n": patch
+---
+
+fix(grid): a bulk action's `visible` is evaluated per selected record — objectui#3067
+
+The selection bar evaluated a def's `visible` against the ambient scope with no
+record bound. That does not fail open, it answers wrongly: with no `record` in
+scope the lenient evaluator returned `true` for **every** row-scoped predicate,
+including the ones that should be false — `${record.done}` and
+`${record.owner == user.id}` both came back `true`. An authored gate was not
+weakened, it was inverted for half its inputs, and nothing distinguished that
+from a real verdict.
+
+`visible` is now evaluated **once per selected record, with that record in
+scope**, fail-closed per record and warning once on a fault — the same contract
+the row kebab uses. One evaluation answers both questions:
+
+- **Is the button offered?** When at least one selected record passes. A
+  record-free predicate (`features.x`, `current_user.y`) returns the same
+  verdict for every row, so it still behaves as a plain button-level gate — no
+  syntactic sniffing for `record` references is involved.
+- **Which records does it run on?** The ones that passed. The confirm step
+  states how many were skipped, so a run over fewer records than the user
+  ticked says so instead of quietly shrinking the selection.
+
+Eligibility is re-applied to the EXPANDED set after "select all N matching",
+not just the page selection the button could see.
+
+The mechanism predates objectui#3002, but only inline-authored
+`bulkActionDefs[].visible` used to reach it — written by authors who knew there
+was no record. #3031 began promoting object actions into the bar, and their
+`visible` is typically written for a row/record surface, which is what put
+row-scoped predicates in front of a record-free evaluation.
diff --git a/packages/i18n/src/locales/ar.ts b/packages/i18n/src/locales/ar.ts
@@ -245,6 +245,7 @@ const ar = {
       confirmDefault: "سيُطبَّق هذا على {{count}} من السجلات.",
       overLimit: "التحديد ({{count}}) يتجاوز حد الإجراء ({{limit}}). قلّل التحديد للمتابعة.",
       affectedRecords: "السجلات المتأثرة ({{count}}):",
+      skippedIneligible: '{{count}} من السجلات المحددة غير مؤهلة لهذا الإجراء وسيتم تخطيها.',
       rowFallback: "الصف {{index}}",
       andMore: "… و{{count}} أخرى",
       processed: "تمت معالجة {{count}} / {{total}}",
diff --git a/packages/i18n/src/locales/de.ts b/packages/i18n/src/locales/de.ts
@@ -245,6 +245,7 @@ const de = {
       confirmDefault: "Dies wird auf {{count}} Datensätze angewendet.",
       overLimit: "Die Auswahl ({{count}}) überschreitet das Aktionslimit ({{limit}}). Verkleinern Sie die Auswahl, um fortzufahren.",
       affectedRecords: "Betroffene Datensätze ({{count}}):",
+      skippedIneligible: '{{count}} der ausgewählten Datensätze sind für diese Aktion nicht zulässig und werden übersprungen.',
       rowFallback: "Zeile {{index}}",
       andMore: "… und {{count}} weitere",
       processed: "{{count}} / {{total}} verarbeitet",
diff --git a/packages/i18n/src/locales/en.ts b/packages/i18n/src/locales/en.ts
@@ -420,6 +420,7 @@ const en = {
       confirmDefault: 'This will apply to {{count}} record(s).',
       overLimit: 'Selection ({{count}}) exceeds the action limit ({{limit}}). Reduce the selection to proceed.',
       affectedRecords: 'Affected records ({{count}}):',
+      skippedIneligible: '{{count}} selected record(s) are not eligible for this action and will be skipped.',
       rowFallback: 'Row {{index}}',
       andMore: '\u2026 and {{count}} more',
       processed: '{{count}} / {{total}} processed',
diff --git a/packages/i18n/src/locales/es.ts b/packages/i18n/src/locales/es.ts
@@ -245,6 +245,7 @@ const es = {
       confirmDefault: "Esto se aplicará a {{count}} registro(s).",
       overLimit: "La selección ({{count}}) supera el límite de la acción ({{limit}}). Reduzca la selección para continuar.",
       affectedRecords: "Registros afectados ({{count}}):",
+      skippedIneligible: '{{count}} de los registros seleccionados no son aptos para esta acción y se omitirán.',
       rowFallback: "Fila {{index}}",
       andMore: "… y {{count}} más",
       processed: "{{count}} / {{total}} procesados",
diff --git a/packages/i18n/src/locales/fr.ts b/packages/i18n/src/locales/fr.ts
@@ -245,6 +245,7 @@ const fr = {
       confirmDefault: "Ceci s'appliquera à {{count}} enregistrement(s).",
       overLimit: "La sélection ({{count}}) dépasse la limite de l'action ({{limit}}). Réduisez la sélection pour continuer.",
       affectedRecords: "Enregistrements concernés ({{count}}) :",
+      skippedIneligible: '{{count}} des enregistrements sélectionnés ne sont pas éligibles à cette action et seront ignorés.',
       rowFallback: "Ligne {{index}}",
       andMore: "… et {{count}} de plus",
       processed: "{{count}} / {{total}} traités",
diff --git a/packages/i18n/src/locales/ja.ts b/packages/i18n/src/locales/ja.ts
@@ -245,6 +245,7 @@ const ja = {
       confirmDefault: "{{count}} 件のレコードに適用されます。",
       overLimit: "選択件数（{{count}}）がアクションの上限（{{limit}}）を超えています。選択を減らしてください。",
       affectedRecords: "対象レコード（{{count}}）:",
+      skippedIneligible: "選択したレコードのうち {{count}} 件はこのアクションの対象外のため、スキップされます。",
       rowFallback: "{{index}} 行目",
       andMore: "… 他 {{count}} 件",
       processed: "{{count}} / {{total}} 件を処理",
diff --git a/packages/i18n/src/locales/ko.ts b/packages/i18n/src/locales/ko.ts
@@ -245,6 +245,7 @@ const ko = {
       confirmDefault: "레코드 {{count}}건에 적용됩니다.",
       overLimit: "선택 건수({{count}})가 작업 한도({{limit}})를 초과합니다. 선택을 줄여 주세요.",
       affectedRecords: "영향을 받는 레코드({{count}}):",
+      skippedIneligible: "선택한 레코드 중 {{count}}건은 이 작업의 대상이 아니므로 건너뜁니다.",
       rowFallback: "{{index}}행",
       andMore: "… 외 {{count}}건",
       processed: "{{count}} / {{total}} 처리됨",
diff --git a/packages/i18n/src/locales/pt.ts b/packages/i18n/src/locales/pt.ts
@@ -245,6 +245,7 @@ const pt = {
       confirmDefault: "Isto será aplicado a {{count}} registro(s).",
       overLimit: "A seleção ({{count}}) excede o limite da ação ({{limit}}). Reduza a seleção para prosseguir.",
       affectedRecords: "Registros afetados ({{count}}):",
+      skippedIneligible: '{{count}} dos registros selecionados não são elegíveis para esta ação e serão ignorados.',
       rowFallback: "Linha {{index}}",
       andMore: "… e mais {{count}}",
       processed: "{{count}} / {{total}} processados",
diff --git a/packages/i18n/src/locales/ru.ts b/packages/i18n/src/locales/ru.ts
@@ -245,6 +245,7 @@ const ru = {
       confirmDefault: "Будет применено к записям: {{count}}.",
       overLimit: "Выбрано ({{count}}) больше лимита действия ({{limit}}). Уменьшите выбор, чтобы продолжить.",
       affectedRecords: "Затрагиваемые записи ({{count}}):",
+      skippedIneligible: '{{count}} из выбранных записей не подходят для этого действия и будут пропущены.',
       rowFallback: "Строка {{index}}",
       andMore: "… и ещё {{count}}",
       processed: "Обработано {{count}} / {{total}}",
diff --git a/packages/i18n/src/locales/zh.ts b/packages/i18n/src/locales/zh.ts
@@ -428,6 +428,7 @@ const zh = {
       confirmDefault: '此操作将应用于 {{count}} 条记录。',
       overLimit: '所选记录（{{count}}）超过该动作的上限（{{limit}}）。请减少选择后再继续。',
       affectedRecords: '受影响的记录（{{count}}）：',
+      skippedIneligible: '{{count}} 条所选记录不符合该动作的条件，将被跳过。',
       rowFallback: '第 {{index}} 行',
       andMore: '……以及另外 {{count}} 条',
       processed: '已处理 {{count}} / {{total}}',
diff --git a/packages/plugin-grid/src/ObjectGrid.tsx b/packages/plugin-grid/src/ObjectGrid.tsx
@@ -46,6 +46,7 @@ import { useColumnSummary } from './useColumnSummary';
 import { resolveRowCrudAffordances } from './rowCrudAffordances';
 import { resolveLegacyRowActions } from './resolveLegacyRowActions';
 import { resolveBulkActions } from './resolveBulkActions';
+import { partitionBulkRows } from './bulkEligibility';
 import { RowActionMenu, formatActionLabel } from './components/RowActionMenu';
 import { BulkActionBar } from './components/BulkActionBar';
 import { BulkActionDialog } from './components/BulkActionDialog';
@@ -254,6 +255,9 @@ export const ObjectGrid: React.FC<ObjectGridProps> = ({
   const [totalMatching, setTotalMatching] = useState<number | undefined>(undefined);
   const [activeBulkDef, setActiveBulkDef] = useState<BulkActionDef | null>(null);
   const [activeBulkRows, setActiveBulkRows] = useState<any[]>([]);
+  // Selected records the def's `visible` excluded (#3067) — shown in the
+  // dialog so a run over fewer records than the user picked says so.
+  const [activeBulkSkipped, setActiveBulkSkipped] = useState(0);
   const lastFindParamsRef = React.useRef<Record<string, unknown> | null>(null);
   // Grouped view paginates whole groups (groups stay intact, never split across
   // pages). Defaults to the schema page size, falling back to 10 groups/page.
@@ -1751,8 +1755,14 @@ export const ObjectGrid: React.FC<ObjectGridProps> = ({
   const dispatchBulkActionDef = (def: BulkActionDef, rows: any[]) => {
     void (async () => {
       const expanded = await resolveBulkRows(rows);
+      // [#3067] Re-apply `visible` to the EXPANDED set, not just the page
+      // selection the bar could see: "select all N matching" pulls in records
+      // the button's own eligibility check never evaluated, and running the
+      // action on those would defeat the gate the author wrote.
+      const { eligible, skipped } = partitionBulkRows(def, expanded, { scope: predicateScope });
       setActiveBulkDef(def);
-      setActiveBulkRows(expanded);
+      setActiveBulkRows(eligible);
+      setActiveBulkSkipped(skipped);
     })();
   };
 
@@ -1799,6 +1809,7 @@ export const ObjectGrid: React.FC<ObjectGridProps> = ({
   const handleBulkDialogClose = (result?: BulkResult | null) => {
     setActiveBulkDef(null);
     setActiveBulkRows([]);
+    setActiveBulkSkipped(0);
     // Only reset selection when the run actually changed something. A total
     // failure (0 succeeded — e.g. a "推计划" precondition error) leaves the data
     // untouched, so we keep the selection *and* the toolbar so the user can fix
@@ -2603,6 +2614,7 @@ export const ObjectGrid: React.FC<ObjectGridProps> = ({
     <BulkActionDialog
       def={activeBulkDef}
       rows={activeBulkRows}
+      skippedCount={activeBulkSkipped}
       open={!!activeBulkDef}
       onClose={handleBulkDialogClose}
       dataSource={dataSource as any}
diff --git a/packages/plugin-grid/src/__tests__/bulkEligibility.test.ts b/packages/plugin-grid/src/__tests__/bulkEligibility.test.ts
@@ -0,0 +1,99 @@
+/**
+ * ObjectUI
+ * Copyright (c) 2024-present ObjectStack Inc.
+ *
+ * This source code is licensed under the MIT license found in the
+ * LICENSE file in the root directory of this source tree.
+ */
+
+import { describe, it, expect, vi, afterEach } from 'vitest';
+import { partitionBulkRows } from '../bulkEligibility';
+
+const ROWS = [
+  { id: 'r1', done: false, owner: 'u1' },
+  { id: 'r2', done: true, owner: 'u2' },
+  { id: 'r3', done: false, owner: 'u2' },
+];
+
+afterEach(() => vi.restoreAllMocks());
+
+describe('partitionBulkRows', () => {
+  it('passes everything through when the def declares no visible', () => {
+    const { eligible, skipped } = partitionBulkRows({ name: 'push' }, ROWS);
+
+    // By reference — the ungated case must not bust downstream memos.
+    expect(eligible).toBe(ROWS);
+    expect(skipped).toBe(0);
+  });
+
+  it('evaluates a row-scoped predicate PER RECORD', () => {
+    const { eligible, skipped } = partitionBulkRows({ name: 'mark_done', visible: '!record.done' }, ROWS);
+
+    expect(eligible.map(r => r.id)).toEqual(['r1', 'r3']);
+    expect(skipped).toBe(1);
+  });
+
+  it('answers the inverse predicate correctly too', () => {
+    // The regression this exists for: with no record in scope BOTH
+    // `!record.done` and `record.done` evaluated `true`, so one of them was
+    // necessarily wrong and nothing could tell which.
+    const { eligible } = partitionBulkRows({ name: 'reopen', visible: 'record.done' }, ROWS);
+
+    expect(eligible.map(r => r.id)).toEqual(['r2']);
+  });
+
+  it('binds the host scope alongside the record', () => {
+    const { eligible } = partitionBulkRows(
+      { name: 'mine', visible: 'record.owner == current_user.id' },
+      ROWS,
+      { scope: { current_user: { id: 'u2' } } },
+    );
+
+    expect(eligible.map(r => r.id)).toEqual(['r2', 'r3']);
+  });
+
+  it('gives a record-free predicate the same verdict for every row', () => {
+    // This is what makes a plain feature/permission gate keep behaving as a
+    // BUTTON-level gate without the fold having to detect record references.
+    const on = partitionBulkRows({ name: 'x', visible: 'features.bulk_ops' }, ROWS, {
+      scope: { features: { bulk_ops: true } },
+    });
+    const off = partitionBulkRows({ name: 'x', visible: 'features.bulk_ops' }, ROWS, {
+      scope: { features: { bulk_ops: false } },
+    });
+
+    expect(on.eligible).toHaveLength(3);
+    expect(off.eligible).toHaveLength(0);
+    expect(off.skipped).toBe(3);
+  });
+
+  it('fails CLOSED and warns when a predicate faults', () => {
+    const warn = vi.spyOn(console, 'warn').mockImplementation(() => {});
+
+    const { eligible, skipped } = partitionBulkRows(
+      { name: 'broken', visible: 'record.missing.deep == 1' },
+      ROWS,
+    );
+
+    expect(eligible).toEqual([]);
+    expect(skipped).toBe(3);
+    // Diagnosable rather than a silent hide.
+    expect(warn).toHaveBeenCalled();
+  });
+
+  it('accepts the { dialect, source } envelope', () => {
+    const { eligible } = partitionBulkRows(
+      { name: 'mark_done', visible: { dialect: 'cel', source: '!record.done' } },
+      ROWS,
+    );
+
+    expect(eligible.map(r => r.id)).toEqual(['r1', 'r3']);
+  });
+
+  it('handles an empty selection without faulting', () => {
+    const { eligible, skipped } = partitionBulkRows({ name: 'x', visible: '!record.done' }, []);
+
+    expect(eligible).toEqual([]);
+    expect(skipped).toBe(0);
+  });
+});
diff --git a/packages/plugin-grid/src/__tests__/objectBulkActionDispatch.test.tsx b/packages/plugin-grid/src/__tests__/objectBulkActionDispatch.test.tsx
@@ -74,12 +74,15 @@ function renderGrid(opts: {
   objectActions?: unknown[];
   schema?: Record<string, unknown>;
   handlers?: Record<string, any>;
+  /** Override the seed records — e.g. to give a `visible` predicate something to bite on. */
+  rows?: Array<Record<string, unknown>>;
 }) {
+  const rows = opts.rows ?? ROWS;
   const dataSource: any = {
-    find: vi.fn(async () => ({ data: ROWS.map(r => ({ ...r })), total: ROWS.length, hasMore: false, pageSize: 50 })),
+    find: vi.fn(async () => ({ data: rows.map(r => ({ ...r })), total: rows.length, hasMore: false, pageSize: 50 })),
     getObjectSchema: async (name: string) => ({
       name,
-      fields: { id: { type: 'text' }, name: { type: 'text', label: 'Name' } },
+      fields: { id: { type: 'text' }, name: { type: 'text', label: 'Name' }, done: { type: 'boolean' } },
       ...(opts.objectActions ? { actions: opts.objectActions } : {}),
     }),
   };
@@ -220,3 +223,67 @@ describe('view-declared bulk actions (objectui#3002)', () => {
     await waitFor(() => expect(handler).toHaveBeenCalledTimes(1));
   });
 });
+
+/**
+ * `visible` is evaluated per selected record, with that record in scope
+ * (objectui#3067). Before this the bar evaluated it with NO record bound, and
+ * the lenient path returned `true` for every row-scoped predicate — so an
+ * authored gate was not weakened but inverted for half its inputs.
+ */
+describe('per-record `visible` on a bulk action (objectui#3067)', () => {
+  /** Row-scoped gate: only r1 is un-done, so only r1 may be acted on. */
+  const GATED = { ...PUSH_DOWN, visible: '!record.done' };
+
+  it('runs on the eligible records only, and says how many it skipped', async () => {
+    await renderAndSelectAll({
+      objectActions: [GATED],
+      schema: { bulkActions: ['push_down'] },
+      rows: [
+        { id: 'r1', name: 'Plan A', done: false },
+        { id: 'r2', name: 'Plan B', done: true },
+      ],
+    });
+
+    fireEvent.click(await screen.findByTestId('bulk-action-push_down'));
+    // The confirm step owns up to the shrunken selection.
+    expect(await screen.findByTestId('bulk-skipped-notice')).toBeInTheDocument();
+
+    fireEvent.click(await screen.findByRole('button', { name: 'Run' }));
+
+    // One request, for the one eligible record — not two.
+    await waitFor(() => expect(fetchMock).toHaveBeenCalledTimes(1));
+    expect(JSON.parse((fetchMock.mock.calls[0][1] as any).body)._rowRecord.id).toBe('r1');
+  });
+
+  it('hides the button when no selected record qualifies', async () => {
+    await renderAndSelectAll({
+      objectActions: [GATED],
+      schema: { bulkActions: ['push_down'] },
+      rows: [
+        { id: 'r1', name: 'Plan A', done: true },
+        { id: 'r2', name: 'Plan B', done: true },
+      ],
+    });
+
+    // The bar is up (rows are selected) but this action has nothing to act on.
+    expect(await screen.findByTestId('bulk-actions-bar')).toBeInTheDocument();
+    expect(screen.queryByTestId('bulk-action-push_down')).not.toBeInTheDocument();
+  });
+
+  it('leaves an ungated action acting on the whole selection', async () => {
+    await renderAndSelectAll({
+      objectActions: [PUSH_DOWN],
+      schema: { bulkActions: ['push_down'] },
+      rows: [
+        { id: 'r1', name: 'Plan A', done: true },
+        { id: 'r2', name: 'Plan B', done: true },
+      ],
+    });
+
+    fireEvent.click(await screen.findByTestId('bulk-action-push_down'));
+    expect(screen.queryByTestId('bulk-skipped-notice')).not.toBeInTheDocument();
+    fireEvent.click(await screen.findByRole('button', { name: 'Run' }));
+
+    await waitFor(() => expect(fetchMock).toHaveBeenCalledTimes(2));
+  });
+});
diff --git a/packages/plugin-grid/src/bulkEligibility.ts b/packages/plugin-grid/src/bulkEligibility.ts
diff --git a/packages/plugin-grid/src/components/BulkActionBar.tsx b/packages/plugin-grid/src/components/BulkActionBar.tsx
diff --git a/packages/plugin-grid/src/components/BulkActionDialog.tsx b/packages/plugin-grid/src/components/BulkActionDialog.tsx
