Repository navigation
[Decision] May a rank-and-file member set their OWN sys_user.locale? Ruling B opened the COLUMN; ADR-0092 D5 still answers no to the ROUTE, so today only admins can set it #14959
Description
Activity
Maintainer ruling recorded — A: self-service through the generic data path, in the
sys_api_keyshape, with the ADR-0092 D5 amendment (2026-09-03)Provenance. Ruled by the maintainer (pm@objectstack.ai) in the director seat's live session (
session_01ShyhexkB2d1AeRZ85tgAAe), decision batch #22, 2026-09-03 after 15:35Z. Verbatim reply: 「同意」. The batch was presented with this card's recommendation as A (fallback C; B rejected as a second write path for the same column; D refused on #13881's measurement), so 「同意」 adopts A. Ledger: objectstack#12708, batch #22 ledger comment.What was ruled. A rank-and-file member may edit their own
sys_userrow on the generic data path, bounded on two axes that already exist:- who / which rows —
member_defaultgains an explicitsys_userentry (allowRead/allowEdittrue, create / delete false) inplugin-security/src/objects/default-permission-sets.ts, and thesys_user_selfRLS policy widens fromselectto cover the update, so the caller reaches their own row and no other; - which columns — the identity write guard keeps bounding a user-context update to the ADR-0092 D2 whitelist
{name, image, locale}; nothing else on the row opens. - ADR-0092 D5 is amended to say so: self-service edits of the whitelisted columns route through the generic data path, with the D6
afterUpdatehook as the session-cache refresh.name/imagetherefore also become editable on that path; the mechanism PR feat(platform-objects,plugin-auth): makesys_user.localeuser-writable, with a loud BCP-47 refusal (#14787) #14958 already touches carries it, and the amendment records it as ruled rather than incidental. - ⛔ Not B (a dedicated endpoint under system context — the "second stamping route" [Decision] May a user set their own
sys_user.locale? — the ADR-0092 D2 self-service whitelist stays{name, image}after #13881 (column landsreadonly, system-context writes only) #14787's ruling rejected, one level up). ⛔ Not C (a user-facing setting only an administrator can set). ⛔ Not D.
Execution.
domain:serviceslane. The ADR amendment lives underdocs/adr/**(governed): draft, the maintainer merges by hand; the seat may split it from the code PR, in which case the code PR is not armed before the ADR PR merges. Pins: own-rowlocaleupdate succeeds; another member's row is refused;name/imageon the generic path succeed and the session refresh is observed; a non-whitelisted column is still refused by the guard. Changeset required. Clause-②: yes (permission-set defaults move) —needs:contract-reviewcarrier on the PR. objectui#7501 unblocks when this lands.State.
needs-user-decision→pm:queuein the same stroke;priority:p2,domain:services,i18nkept; unassigned.
Generated by Claude Code
- who / which rows —
Claim —
domain:servicesexecution seat, sessionsession_01AUF1NoViznQK32gqpK8wS8(GitHubos-sales). Branchclaude/issue-14959-member-self-locale. Claim atom written and read back: labels nowdomain:services, i18n, pm:dispatched, priority:p2, assigneeos-sales— matches the expected union exactly.Ruling of record — comments read: 1, to the last page, and it IS the ruling:
issuecomment-5528362189(2026-09-03 15:53:33Z). Reading it mattered: the card body ends by recommending A and saying it "必须由维护者裁", which on its own reads as an undispatched decision card wearing a queue label. It is not — the maintainer ruled A in decision batch #22 (verbatim 「同意」), and the ruling comment recordsneeds-user-decision→pm:queuein the same stroke. Acting on the body alone would have flipped a ruled card back into the decision box.Dispatching to implement A as ruled, not to re-open it.
Generated by Claude Code
os-dev-report
{ "issue": 14959, "status": "done", "branch": "claude/issue-14959-member-self-locale", "pr": "https://github.com/objectstack-ai/objectstack/pull/15108 (code, draft, needs:contract-review applied) + https://github.com/objectstack-ai/objectstack/pull/15109 (ADR-0092 D5 amendment, draft, governed — merge FIRST; the code PR must not be armed before it lands)", "premise_still_valid": true, "summary": "Implemented ruling A as ruled, split across two draft PRs. Code PR: member_default gains an explicit sys_user entry (allowRead/allowEdit true, create/delete false) and its sys_user_self RLS carve-out widens from select to all so it reaches the by-id write pre-image check; sys_user_org_members deliberately stays select-only (policies OR-combine, so widening the org-peer VISIBILITY scope would have composed 'my id OR every user id in my org' and handed every member their colleagues' rows — pinned in three places). ADR PR: the ADR-0092 D5 amendment alone, original text kept verbatim with an Amendment blockquote in the ADR-0105 house style, plus the Date line and the TL;DR D5 bullet. Verified at the tree rather than assumed, per the dispatch: SYS_USER_PROFILE_EDIT_FIELDS on origin/main already holds {name, image, locale} and sys_user.locale already carries no readonly — PR #14958's column half is in place, so only the route was missing. Also corrected a doc comment in plugin-auth/src/sys-user-writable-fields.ts that asserted member_default still denies allowEdit on sys_user, which this change makes false. Three shipped-set pin suites moved with the behaviour and each was updated with its reasoning rather than re-baselined; the authz matrix one is the most informative reading in the diff — every better_auth write cell moves from CRUD_DENY to EXACTLY the caller's own row (org_admin gets its own id, not the org; no_org_member gets its own id even with no active organization, because sys_user is non-tenant so Layer 0 is inert).", "tests": "All at pushed head d845d564ec, tree clean, exit codes captured by redirect BEFORE any pipe. SUITES: pnpm --filter @objectstack/plugin-security exec vitest run -> 96 files / 1801 tests passed, exit 0. pnpm --filter @objectstack/plugin-auth exec vitest run -> 94 files / 1951 tests passed, exit 0. TYPECHECK: plugin-security exit 0 (check:test-typecheck: OK - 0 file(s) / 0 error(s)). plugin-auth exit 0 AFTER building the package (the first run answered exit 2 on examples/basic-usage.ts TS2307 'Cannot find module @objectstack/plugin-auth' — a prerequisite, its own dist was absent, not a finding). NOT-MEASURED guard: plugin-auth's build tsconfig.json EXCLUDES **/*.test.ts, so `tsc --noEmit` says nothing about the new test file; the leg that covers it is check:test-typecheck against tsconfig.test.json, and I confirmed it actually sees the file — `tsc --listFiles -p tsconfig.test.json` names sys-user-self-service-route.test.ts (1 hit, positive control: the grep pattern matches the file's real name) and the file appears in ZERO entries of the shrink-only test-typecheck-debt.json, so it compiles clean under the strict test config rather than being ledgered. GATES: derived mechanically with `node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack --commands` (no hand-written path list) at d845d564ec after merging origin/main — 52 commands, ALL 52 run. 48 exit 0. FOUR answered exit 3 = NOT MEASURED (not a pass, not a finding), and none is movable by this diff: check-test-completeness (grades a saved turbo test log only CI produces), check:dual-build-cjs-loads (reads built output for every workspace package; most have no dist/ here), check:i18n (runs the built CLI; this diff adds no translatable strings), check:type-check-debt (refuses to re-measure without the full closure built, deliberately — its sibling check:type-check-coverage ran green). An earlier ADR-branch run recorded two exit-1s that were NOT red gates: check-comment-mask-corpus ERR_MODULE_NOT_FOUND and check:pm-governed-merges self-test — both were 'node_modules missing' in a fresh worktree; both went green after `pnpm install`, and check:doc-formula-expressions went 3 -> 0 after building @objectstack/formula and @objectstack/lint. ADR BRANCH (head 4807b058b1): every derived gate green except check-test-completeness (exit 3). check-adr-anchors is excluded from the derived family, so it was run explicitly and is green, along with check-adr-links, check-adr-symbol-anchors, check:doc-authoring. CONTROL BYTES: check:nul-bytes green on both branches, plus a direct `grep -naP '[\\x00-\\x08\\x0b\\x0c\\x0e-\\x1f\\x7f]'` over all seven changed files and the ADR — no matches. LAYER ATTRIBUTION (the card's named hazard): the new pin file reports WHICH of the three layers refused, established mechanically — middleware throws with ql.findOne never called = object-gate (the pre-image re-read is the first engine call past the CRUD check); throws with findOne called = row-scope; passes and the guard hook throws = identity-guard. It drives the REAL SecurityPlugin middleware over the REAL shipped permission sets and the REAL SysUser schema, and answers findOne by EVALUATING the filter the middleware actually composed against a two-row fixture, so the row scope is a measurement, not a stub. All four verdicts (allowed + three layers) are produced by the suite, which is its own non-vacuity control. ABLATION — predictions written to a file BEFORE either leg ran; two legs, both matched EXACTLY. No rebuild was needed and none happened: plugin-auth's vitest config aliases ^@objectstack/plugin-security$ to src/index.ts, and plugin-security/dist/index.js was `git hash-object`-compared before and after each leg and was byte-identical (5bec3ebf...), so the redness came from source, not from a stale or refreshed artifact. LEG A (revert the whole permission-set file to origin/main): predicted 9 red / 3 green in the route suite and 6 red across the three shipped-set suites; MEASURED 9 red / 3 green and 6 red. The two discriminating failures are the point: PIN 2 'expected object-gate to be row-scope' and PIN 4 'expected object-gate to be identity-guard' — i.e. before this change both pins would have passed at the wrong layer, which is exactly the phantom-pin hazard the dispatch named. The 3 that stayed green are correct: the whitelist-property pin is a pure column-half assertion, and the two insert/delete cases were already object-gate refusals. LEG B (revert ONLY the RLS widening, keeping the object entry): predicted 9 red / 3 green and 3 red; MEASURED 9 red / 3 green and 3 red, with PIN 4 now reading 'expected row-scope to be identity-guard' — independent evidence that the which-rows half is load-bearing for the guard even being reached. MUTATION/RESTORE DISCIPLINE: each leg proved its mutation landed on disk before measuring (git hash-object differs from the HEAD blob, plus marker grep counts: 0 occurrences of the sys_user entry and 0 of '#14959' in leg A, 1 of the entry in leg B with all three sys_user_self policies reading 'select'), never from an editor exit code; restored with `git checkout HEAD -- \"$REPO_ROOT/THE_PATH\"` (absolute, HEAD-pinned, not a bare checkout) under a trap on EXIT/INT/TERM; and proved the restore by an EMPTY `git diff HEAD` AND a blob hash equal to the HEAD blob (3b91f54b...), both legs.", "mcp_calls": "0 — the session's REST channel probe (repo-scoped GET on the card) returned 200, so every read and write went through container curl on the REST channel: card body, full comment thread, label GET/POST + read-back, both PR creations, the body PATCH, both full-text body read-backs, and this report comment. No MCP GitHub tool was called at any point.", "open_questions": [], "out_of_scope_findings": [ "none filed — the one drift I found was already on the backlog: ADR-0092 D1's tier TABLE still lists two Tier-1 members (`name`, `image`) while the enforced whitelist constant holds three. Filed as #14951 before this card; searched open issues to confirm rather than assuming, and left it alone. The ADR amendment names it explicitly as not-amended-here so a reader of D5 is not misled by D1." ] }
Generated by Claude Code
PM ACCEPT — PRs #15108 (code) + #15109 (ADR), head
d845d564ec. Verified against the tree, not the report.domain:servicesexecution seat, sessionsession_01AUF1NoViznQK32gqpK8wS8. Ruling A implemented as ruled; ⛔ nothing about its substance reopened.Verified independently at the PR head
claim reading member_defaultgains the ruledsys_userentrydefault-permission-sets.ts:529—{ allowRead: true, allowCreate: false, allowEdit: true, allowDelete: false }. Exactly the ruled shape.sys_user_selfwidened:636-638—operation: 'all'⭐ sys_user_org_membersNOT widened:650-652—operation: 'select', unchangedthe ADR link placeholder ADR_PR_URLnow appears 0 times in #15108's body; #15109 is linked explicitly⭐ The dev found a security distinction this dispatch did not name
The dispatch ordered the
sys_user_selfwidening. It said nothing about the sibling policy. The dev worked out that applicable policies OR-combine, so widening the org-peer visibility policy alongside it would have composed an update filter ofid == me OR id IN <every user in my organization>— handing every rank-and-file member write access to their colleagues' rows, while looking like the same one-line change. It left
sys_user_org_membersatselect, pinned the distinction in three places, and wrote the hazard into the source at:629-631so the next reader (or the next agent) does not "tidy up" the asymmetry.That is the same shape as the asymmetric-pair hazard this lane hit on #14949/#15030 two rounds ago, caught this time before it shipped rather than after.
The phantom-pin hazard the dispatch DID name is closed, and measured
The dispatch warned that pin 4 could pass because the object gate refuses before the identity guard is ever reached. The dev made layer attribution mechanical rather than asserted: middleware throws with
ql.findOnenever called ⇒ object-gate; throws withfindOnecalled ⇒ row-scope; passes and the guard hook throws ⇒ identity-guard. It drives the real SecurityPlugin middleware over the real shipped permission sets and the realSysUserschema, answeringfindOneby evaluating the filter the middleware actually composed against a two-row fixture — so the row scope is a measurement, not a stub. All four verdicts are produced by the suite, which is its own non-vacuity control.Predictions were written to a file before either ablation leg ran. Both matched exactly:
- Leg A (revert the whole permission-set file): predicted 9 red / 3 green + 6 red; measured the same. The two discriminating failures are the point — "expected object-gate to be row-scope" and "expected object-gate to be identity-guard". ⇒ before this change, both pins would have passed at the wrong layer. The hazard was real.
- Leg B (revert only the RLS widening, keeping the object entry): predicted 9 red / 3 green + 3 red; measured the same, with pin 4 now reading "expected row-scope to be identity-guard" — independent evidence that the which-rows half is load-bearing for the guard being reached at all.
Mutation and restore were both proved on disk by blob hash rather than by an editor's exit code.
Four gates answered exit 3 = NOT MEASURED, each named with why the diff cannot move it. That is the correct reading; ⛔ exit 3 is not a pass.
Landing order — unchanged
⛔ #15108 is not armed until #15109 merges.
docs/adr/**is governed; the maintainer merges it by hand.needs:contract-reviewstays on #15108 (Clause-② yes — permission-set defaults move) and ⛔ is not cleared here.#14951(ADR-0092 D1's tier table still listing two members against an enforced three) was already on the backlog; the dev confirmed by search rather than assuming, left it alone, and the amendment names it as not-amended-here so a D5 reader is not misled.
Generated by Claude Code
Contract review — PASS, landing held (director seat, summon 13, session_01WXyGTWPbbreqXow7Z2pZCk). Tier fuse read 2026-09-04T01:26Z:
get_sessionservedclaude-fable-5-1, equal toCONTRACT_REVIEW_TIER. Subject: PR #15108 at headd845d564e.Implemented-by: claude/issue-14959-member-self-locale (mode:subagent dev under session_01AUF1NoViznQK32gqpK8wS8)
Reviewed-by: session_01WXyGTWPbbreqXow7Z2pZCk① Derived judgments
member_defaultgains an explicitsys_userentry with read and edit allowed, create and delete refused; correct, and being explicit is what survivesapplyManagedWriteDenies.sys_user_selfwidens fromselecttoallwhilesys_user_org_membersstaysselect: correct, and the OR-composition hazard is pinned in three places.- The column bound is unchanged (
SYS_USER_PROFILE_EDIT_FIELDS), and the layer-attributed pins prove the identity guard is now reached rather than shadowed by the object gate. The permission-boundary decision itself was the maintainer's (batch 22, 「同意」); the implementation matches it and thesys_api_keyprecedent.
② Semver
@objectstack/plugin-securityminor accepted: a shipped default permission set widens.
③ Boundary flags
- Sequencing: the ADR-0092 D5 amendment ships as PR docs(adr): amend ADR-0092 D5 — self-service edits route through the generic data path #15109 (governed, human merge). Respected: this PR stays draft with its carriers on until docs(adr): amend ADR-0092 D5 — self-service edits route through the generic data path #15109 is merged; the dispatching seat or this seat lands it afterwards, on this PASS.
- ADR-0092 D1's tier table (ADR-0092 D1's tier table still records Tier 1 as
{name, image}— the 2026-09-03 ruling made the shipped set{name, image, locale}#14951) stays out of scope, as the PR says.
Generated by Claude Code
Landing (director seat, summon 13, session_01WXyGTWPbbreqXow7Z2pZCk). The sequencing condition in the PASS above (comment 5534395446) is met: ADR PR #15109 was merged by the maintainer's own account at 03:21Z on the verbatim ruling 「15109 同意 其他不处理」 (squash
1876d5dfd, audit comment 5535190198).PR #15108 at head
d845d564e: 40 check runs, all completed with conclusion success or skipped; not a governed surface.needs:contract-reviewstripped from the PR and from this card (read-modify-write, read back), PR marked ready, auto-merge (squash) armed. Provenance: 2026-08-31 ruling, PASS means clear-and-land.
Generated by Claude Code
Landing record — the ADR half is in, the code half is armed. Posted by the
domain:servicesseat (session_01AUF1NoViznQK32gqpK8wS8).Ordering constraint discharged
PR #15108 carried an explicit ⛔ "Do not arm this PR for merge before the ADR PR lands." That constraint is now satisfied, not waived:
- PR docs(adr): amend ADR-0092 D5 — self-service edits route through the generic data path #15109 (the ADR-0092 D5 amendment) MERGED at
2026-09-04T03:21:43Z, merged byhotlong. Read offmerged_at— notauto_merge(GitHub clears it on enqueue) and notmerge_commit_sha(that is the test-merge commit and is populated whilemergedis still false). - Only then was feat(plugin-security): a rank-and-file member may edit their OWN sys_user row #15108 taken out of draft and armed.
Order of operations was undraft first, then arm — auto-merge does not survive a draft→ready conversion, so arming a draft PR silently buys nothing.
Carrier state, verified rather than assumed
needs:contract-reviewis absent from both PR #15108 and this card, which is the correct end state: the contract review PASSED at tier via the director seat at01:32:23Z(14959#issuecomment-5534395446, verdict "PASS, landing held", with landing explicitly delegated to this seat once the ADR PR was in).⚠️ Stated precisely because the evidence does not distinguish it: a gate-carrier label that has been stripped is indistinguishable from one that was never applied — a missing gate label reads as green light, not as red. What makes the clearance sound here is the PASS comment above, not the absent label.Checks at the armed head
d845d564ec44 check runs, zero
failureconclusions; combined statussuccess. Two runs were re-triggered at03:22:0xZwhen the base moved under the #15109 merge —Governed Surface Queue GuardandCheck Changeset— and were stillin_progressat arm time. That is not a reason to hold the arm: auto-merge waits on required checks by construction. If either comes back red the PR simply will not merge, and this seat handles it.What remains
On MERGED: strip
pm:dispatchedfrom this card and post the landing record. This card stays open until then.Downstream: objectui#7501 (the account-settings "my language" form item) is the consumer this route unblocks — that is a separate repo and lane, so it is named here rather than acted on, and the follow-up belongs to whichever seat accepts this PR's product into
objectui.Still deliberately untouched: ADR-0092 D1's tier table lists two Tier-1 members while the enforced whitelist constant holds three. That is #14951 and is not a rider on this work.
Generated by Claude Code
- PR docs(adr): amend ADR-0092 D5 — self-service edits route through the generic data path #15109 (the ADR-0092 D5 amendment) MERGED at
LANDED. Both halves are in.
PR What merged_at#15109 ADR-0092 D5 amendment (governed surface) 2026-09-04T03:21:43Z#15108 member_defaultentry +sys_user_selfRLS widening + the layer-attributed pins2026-09-04T03:43:13ZOrdering held as the PR body required — the ADR landed first, and the code PR was undrafted and armed only after. Read off
merged_at, the only field that establishes a merge.This card auto-closed
completedat03:43:15Zvia theFixes #14959keyword.pm:dispatchedstripped in the same round; labels read back aspriority:p2/domain:services/i18n, diffed against the union of the pre-write set and the intended change, so nothing a concurrent writer added was silently dropped.What the maintainer's 「同意」 now buys, concretely
A rank-and-file member can set their own
sys_user.localeon the generic data path — bounded on which rows by thesys_user_selfRLS carve-out and on which columns by ADR-0092 D2's identity write guard.#14788's ruling that the stored locale outranksAccept-Languagebecause it is a user-stated preference is now true rather than aspirational: the user can state it.The org-peer scope
sys_user_org_membersdeliberately stayedselect-only. That was the load-bearing restraint in the whole change — RLS policies OR-combine, so widening it would have composed "my id OR every user id in my org" and handed every member their colleagues' profile rows.Downstream, named not acted on
- objectui#7501 (account-settings "my language" form item) now has a route to post to. Different repo, different lane — the follow-up belongs to whichever seat accepts this into
objectui, not to this one. - ADR-0092 D1's tier table still records Tier 1 as
{name, image}— the 2026-09-03 ruling made the shipped set{name, image, locale}#14951 stays open: ADR-0092 D1's tier table still lists two Tier-1 members while the enforced whitelist constant holds three. Deliberately not ridden on either PR.
Generated by Claude Code
- objectui#7501 (account-settings "my language" form item) now has a route to post to. Different repo, different lane — the follow-up belongs to whichever seat accepts this into
Filed by the
domain:servicesexecution seat from a measured gap in PR #14958 (#14787), reported by the dev rather than acted on — correctly, because closing it is a second security-boundary decision the maintainer's ruling did not take.What is already ruled, and is not being reopened
Maintainer ruling B on #14787 (comment 5522882528, verbatim 「同意」): the ADR-0092 D2 self-service whitelist becomes
{name, image, locale}and the column'sreadonlygoes. PR #14958 implements exactly that. ⛔ This card does not revisit it.The gap, measured
After that PR:
localeon a user-context update tosys_user;member_defaultstill declaresallowEdit: falseonsys_user(plugin-security/src/objects/default-permission-sets.ts, viadenyWritesOnManagedObjects()), so an ordinary member'sPATCHto their own row is refused by the permission layer before the guard is ever consulted;/update-user— what the existingupdate_my_profileaction posts to — cannot carry the field, becauselocaleis deliberately not a better-authadditionalFieldsentry ([Decision] Per-user notification locale —— 2026-08-13 裁决所等的「实测拉力」已到(hotcrm:4 个已发布语言 × 16 个 notify 节点 × 0 可本地化) #13881 measured why: it would makegetSessionSELECT a column an environment that has not run schema-sync does not have).⇒ Today a platform admin can set any user's locale, and a rank-and-file member cannot set their own.
ADR-0092 D5 is explicit that this split is intended — the guard decides which columns any permitted actor may touch; permission sets decide who. So PR #14958 is faithful to the ruling as written. The ruling simply did not reach the route.
Accept-Languagebecause it is a user-stated preference — which is only true if the user can state it. Shipping the column without the route leaves a user-facing setting only an administrator can set.Options
sys_api_keyshape. An explicitmember_defaultentry forsys_user(allowRead/allowEdittrue, create/delete false) plus asys_user_selfRLS policy widened fromselectto cover writes. The identity write guard then bounds which fields to{name, image, locale}and the RLS bounds which rows to the caller's own.POST /api/v1/me/locale, or extending theupdate_my_profileaction) writing under system context after checking the caller is the subject, leavingmember_defaultuntouched.localea better-authadditionalFieldsentry so/update-usercarries it. ⛔ Named only to be refused: [Decision] Per-user notification locale —— 2026-08-13 裁决所等的「实测拉力」已到(hotcrm:4 个已发布语言 × 16 个 notify 节点 × 0 可本地化) #13881 already measured that this breaksgetSessionon any environment that has not run schema-sync.A also opens
name/imageself-editing through the generic data path, which ADR-0092 D5 currently routes through better-auth/update-userfor its session-cache refresh. That refresh is already mirrored by the D6afterUpdatehook PR #14958 touches — so the mechanism exists — but exists is not ruled, and D5 is an accepted ADR. A is a maintainer decision with an ADR-0092 amendment, not an implementation detail. That is why it is here.四棱分析
长期健全性(权重最高)。 只有 A 保住一套契约。平台已经有「某个行为者可以编辑自己那一行的这些列」的通用机制 —— 权限集 +
_selfRLS + ADR-0092 的列白名单 —— 而sys_api_key就是这个形状的已出货先例:better-auth 托管表上的、按属主限定的、只开一列的写入。B 会为同一列建第二条写路径,而这正是裁定 B 当初在 #14787 上否掉选项 A 时给的理由(「它会让每个应用自己去造一条 stamping 路线」)—— 一个平台自建的专用端点是同一个缺陷上移了一层。C 不稳定:它出货一个除管理员外没人能设的用户面设置,这是 ADR-0049 禁止的「declared-not-enforced」形状,只隔了一步。D 已被测量否决。真实业务需求。 是实测的,不是设想的:hotcrm 为这个列本身测出了拉力(4 个已发布语言 × 16 个 notify 节点 × 0 个可本地化);#14788 在同一批里被裁定让该列压过⚠️ 这三处读的都是「用户自己的选择」;没有任何一处描述的是管理员去设别人的语言。 拉力指向的恰恰是自助。
Accept-Language;objectui#7501 是已立的表单项卡。AI 编写元数据的安全性。 A 是把「拒绝」留在它已经在的地方的那个选项。列上的形状规则在每条路径上同样地拒绝畸形 tag,所以放宽谁可写,并不放宽什么可写;B 需要在第二条路由上把这条规则重新证明一遍,而一个跑在系统上下文里的专用端点,正是这类检查最容易被跳过的位置。
创业公司范围。 A 是三个可行选项里 diff 最小的 —— 一条权限集条目 + 一处 RLS operation 放宽,两者所在的文件都已经带着
sys_api_key的同款写法。不加新端点、不加新概念、不加新的待文档化面。推荐 A,但它带 ADR-0092 D5 修订,因此必须由维护者裁。
Refs: #14787 / PR #14958(开列的那一半)· ADR-0092 D5(路由归权限集)· #13881(为何 D 被否)· #14788(读侧优先级,同批裁定)· objectui#7501(等这条路由的表单项)· #14951(ADR-0092 D1 的 tier 表仍写着旧的两字段)