[parent] HotCRM browser pass (hotcrm#2058): 13 platform / console defect families on 17.7.0 — admin-rescue requests in no queue, FLS not in forms, admin cannot export, timeline [object Object], warnings never returned, … #22722

Filing gate: ④ a coordination parent across layers: the platform-side and console-side defects of the maintainer's HotCRM browser pass (objectstack-ai/hotcrm#2058). Each was measured at a public door (the console in Chromium 141, plus the REST answer behind it) on HotCRM main 1d7148bf with @objectstack/* 17.7.0. Filed by the repo:hotcrm seat, session_012zh91QzFgePbkmuHnugLN3.

Who acts on it: platform triage. Split each item into its own card for the owning layer (server package or console / objectui), or close it against an existing fix. The items are folded here because one seat fire may file at most three cards. The p1 permission finding is filed on its own (see the seat's summary on hotcrm#2058).

Evidence: each item names its finding id. Steps, API excerpts, server-log lines and screenshots are on the never-merged HotCRM branches claude/qa-browser-pass-a|b|c, at qa/2026-10-10-browser-pass/<a|b|c>/REPORT.md with the PNGs beside it: https://github.com/objectstack-ai/hotcrm/tree/claude/qa-browser-pass-a/qa/2026-10-10-browser-pass/a (the -b/.../b and -c/.../c trees likewise). To reproduce on 17.7.0: git clone hotcrm, pnpm install && pnpm build && pnpm dev, then pnpm demo:staff.

Already fixed upstream after 17.7.0, so not re-filed:

• public forms: sharing.publicLink reads as the "Generated public share URL" but is only a slug — the authored path (/forms/contact-us) answers 404, and the real anonymous URL (/_console/f/<slug>) is shown to the author nowhere #22079: the public-form publicLink 404 / login redirect (A-07, B-07, C-03);
• rest(public forms): POST /forms/:slug/submit answers the anonymous submitter with the whole stored record, so any field a hook derives from existing data (a duplicate match, an owner) reaches the internet #22437: anonymous submit echoes the stored record (B-21);
• plugin-approvals (17.7.0): opening an approval step notifies none of its approvers — no inbox message, no email; the docs also still say no product surface writes manager_id #22607: opening an approval step notifies none of its approvers, which is part of C-01.

Items

p2

1. An admin_rescue request is in no one's queue (C-01).
   • On an empty bench (onEmptyApprovers: 'admin_rescue', no holder of the position), the request opens and the server logs "decidable only by a privileged admin".
   • Nobody's My Pending lists it. The admin's reads "You're all caught up" because the console asks approverId=<admin>,…,position:org_owner,… and gets none.
   • The bell reads "0 pending approvals".
   • The admin can override only after finding it under All, or on the record. A locked record (lockRecord: true) stays locked until someone thinks to look.
   • The notification half is plugin-approvals (17.7.0): opening an approval step notifies none of its approvers — no inbox message, no email; the docs also still say no product surface writes manager_id #22607. The queue half, a rescue request surfacing to the admins who can decide it, is not covered.
2. Field-level editable: false is not reflected in console forms (C-02).
   • A sales rep with crm_account.annual_revenue: { readable: true, editable: false } gets an editable input; Save → 403 "Field write denied: not permitted to edit [annual_revenue]".
   • GET /api/v1/meta/object/crm_account as the rep returns annual_revenue.readonly: false and no per-caller permission block.
   • The owner picker is likewise offered without the transfer grant (PATCH → 403 "requires the transfer grant").
   • Related, closed: metadata read: for a platform-admin caller the object read and the sortability projection keep a field that caller's field-level permission marks unreadable, while the data route refuses it #22250 (field readability on the admin metadata read).
3. The administrator cannot export (C-04).
   • As the dev admin: no Export button, and GET /api/v1/data/crm_account/export → 403 EXPORT_NOT_PERMITTED.
   • security/explain names admin_full_access, organization_admin_no_bypass and member_default, with "No resolved permission set grants export".
   • Sales reps with an app permission set export the same object with 200.
   • Related, closed: finding(plugin-hono-server): /auth/me/permissions never seeds an unrestricted object for a wildcard-only principal, so the Console renders Export where the server answers 403 EXPORT_NOT_PERMITTED #18931 (the inverse: Export rendered where the server refuses).
4. A timeline grouped by a lookup renders a single [OBJECT OBJECT] <n> group (A-18, B-06, C-05).
   • Seen in four views: groupByField: 'owner_id' on opportunity, event and task timelines, and 'crm_account' on contracts. The server metadata is correct; the group key stringifies the expanded lookup.
   • Also C-06: a text groupByField (channel) groups adjacent runs (DIGITAL 1, EMAIL 1, DIGITAL 1 …) instead of bucketing by key.
5. A bulk action's field-backed param renders a raw text box (A-10).
   • Add to Campaign declares a crm_campaign param with field + objectOverride. The single-record path renders the record picker; the selection-bar path renders <input id="bulk-param-crm_campaign" type="text">, and the confirm page lists raw ids.
6. The record activity feed drops type: 'completed' milestones (B-05).
   • activityMilestones writes "Case resolved" / "Case closed" rows to sys_activity, and the page's own GET /api/v1/data/sys_activity?… returns them, but the timeline shows only the escalated one.
7. Seeded rows of some objects carry organization_id: null (A-16).
   • On a fresh dev boot, all seeded crm_contact, crm_lead and crm_opportunity rows have organization_id: null, while seeded accounts carry the org. Org-scoped uniqueness and dedupe then miss them: a second contact with a seeded contact's email is accepted.
   • The seed ownership claim stamps owners but not the org on these objects.

p3

8. Warning-severity validation results are logged and never returned (A-05, B-10, C-10).
   • severity: 'warning' rules (state machines, actual_cost_within_budget, published_requires_summary) appear only as WARN Validation rule … (warning) in the server log.
   • The REST write answers {object,id,record} with no warnings key, so no client can show the declared warning.
9. Kanban summarizeField is not drawn (A-19, B-12). Column headers show counts only. Seen on opportunity, quote and lead boards.
10. Forms ignore option-level default: true and a CEL defaultValue (A-20, B-11). Quote status, quote date, article status and opportunity stage open on "Select an option" or empty, although REST inserts default them.
11. Approval writes and the actor shown in the feed (A-14, C-17):
    • an approval decision leaves updated_by as the submitter;
    • the record activity feed shows "System" for user actions whose sys_activity.actor_id is the user.
12. Navigation and list actions are not filtered by the caller's object permissions (A-22, C-14). A service agent with no read on crm_opportunity sees Opportunities, My Deals and Update Stage, each ending in "You don't have access". HotCRM will gate its own nav with requiredPermissions; this item is about the default.
13. Console rendering:
    • a view's explicit column label is ignored in favour of the field label (A-02);
    • type: rating with widget: 'star_rating' renders as a number or text box (A-03);
    • the reference rail ignores nameField and lists raw ids (B-13);
    • refreshAfter: true does not refresh the reference rail (B-14);
    • gantt dates show without the year (B-20);
    • the approval request drawer shows raw option values, a truncated "positi…ager" approver, and a "Child Account Revenue 0" headline (C-18);
    • a completed task's due date shows red "Overdue 3d" (C-19);
    • a public form with no label falls back to the object API name as its heading, and shows the editor hints "Format: markdown" / "Rich text editor (basic)" to visitors (A-09, B-08);
    • formula fields have no currency return type or formatting (B-15).

Duplicate check

objectstack-ai/objectstack searched (semantic issue search, repo-scoped), one query per family:

• admin rescue / My Pending → 7 hits: approvals: "My Pending" never lists a request routed to a position — the console filters with approverId=role:<p>, the request stores position:<p>, and the list filter matches literally #21350, plugin-approvals (17.7.0): opening an approval step notifies none of its approvers — no inbox message, no email; the docs also still say no product surface writes manager_id #22607, lint: the approval-approvers-may-resolve-empty remedy tells authors the admin bulk import does not write sys_user.manager_id; it has since PR #18046 #22683, finding(plugin-approvals): Setup → Approvals → Requests opens sys_approval_request's caller-scoped first view my_pending, so an administrator sees only requests pending on themselves (#21972's eighth family member) #21984, approvals: the approval_recall action hides the #3424 admin-override recall — the service admits it, the visible predicate never shows it #12716, finding: an approver routed a request can be unable to open the record it concerns — the inbox's record link dead-ends on "Record not found" #7345, all closed. plugin-approvals (17.7.0): opening an approval step notifies none of its approvers — no inbox message, no email; the docs also still say no product surface writes manager_id #22607 covers the notification half of item 1.
• timeline lookup [object Object] → 2 hits: record:details: the #13855 sections[].group reference form crashes the renderer, and the enumerated fields form renders raw field keys instead of declared labels #16695, List-view grouping is server-side: group set and per-group counts come from an aggregate query, rows within a group are paged (objectui#7189 ruling A) #14556, both closed and not this.
• warning validation not returned → 1 hit: validation: a script rule's violation is reported on "_record" with no way to name the field it is about #22105, closed and not this.
• kanban summarizeField → 2 hits: Kanban view has no fallback lane for records with an empty group-field value — a board grouped by a new field shows "no cards" in every lane while the footer counts 20 records #13692, Console: percent display renderer's fixed-width progress bar clips the value in a record-highlights chip (33% renders as 3) #5066, both closed and not this.
• public form /forms/ route → 4 hits, including public forms: sharing.publicLink reads as the "Generated public share URL" but is only a slug — the authored path (/forms/contact-us) answers 404, and the real anonymous URL (/_console/f/<slug>) is shown to the author nowhere #22079 and rest(public forms): POST /forms/:slug/submit answers the anonymous submitter with the whole stored record, so any field a hook derives from existing data (a duplicate match, an owner) reaches the internet #22437 (fixed after 17.7.0, listed above).
• FLS editable in forms → 7 hits; the nearest is metadata read: for a platform-admin caller the object read and the sortability projection keep a field that caller's field-level permission marks unreadable, while the data route refuses it #22250 (readability, admin), closed.
• admin export → 3 hits; the nearest is finding(plugin-hono-server): /auth/me/permissions never seeds an unrestricted object for a wildcard-only principal, so the Console renders Export where the server answers 403 EXPORT_NOT_PERMITTED #18931 (the inverse), closed.
• seed organization_id null → 16 hits, none about seeded app rows lacking the org.
• nav not filtered by permission → 7 hits: spec (17.7.0): a list view or dashboard cannot be limited to an audience, and requiredPermissions has no any-of form — an app cannot show each audience only its own views and boards #22611, [finding] GET /meta/app/:name/layers, /published, /history and /diff serve the app document with no nav filter, so entries pruned by requiredPermissions and the docs audience reach every member #20130, nav-object-ungranted prescribes gating the nav entry, but validateNavAccess never reads requiredPermissions / visible — one of its three remedies does not clear the finding #16065 (requiredPermissions on nav), all closed.

The objectui repository is outside this seat's reach and was not searched.

Generated by Claude Code