fix(objectql): enforce per-option visibleWhen on checkboxes + string-match option values (objectui#2729)

[os-zhuang]

Addresses objectstack-ai/objectui#2729 (server-side enforcement of role-gated / dependent option values).

Context

Server-side per-option visibleWhen enforcement already exists (packages/objectql/src/validation/rule-validator.ts → evaluateOptionVisibility, wired into insert / single-update / bulk-update). Investigating objectui#2729 surfaced that it covered select / multiselect / radio but left two holes that let gated values through on write — the exact "client hides it, server must reject it" boundary the issue is about.

Fixes

1. checkboxes was not enforced. CHOICE_FIELD_TYPES omitted checkboxes, so fieldHasOptionVisibility returned false for it and its options were never re-evaluated. Since objectui#2735 shipped client-side checkboxes cascading, a gated checkboxes option was hidden in the UI yet accepted from a crafted write. Added checkboxes to the enforced set — picked values are now checked element-wise against each option's visibleWhen (record + current_user), like multiselect. (checkboxes is already treated as a multi-value option field by the enum validator, so this closes an inconsistency between the two validators.)

2. Numeric option values could slip the gate. Option matching used strict ===, but the enum-membership validator (record-validator.ts) compares by String(...). A numeric option value submitted as a string (a normal REST/JSON round-trip) passed the enum check but its visibleWhen gate found no matching option and fail-opened. Matching now coerces both sides with String(...), so the enum and visibility validators agree on which option a written value denotes.

Not changed / by design

• select / multiselect / radio behavior is unchanged.
• Fail-open on unbound current_user (system writes) or unevaluable predicates is preserved — a broken cascade predicate must never brick a write; authorization gating depends on the engine binding current_user, as before.
• dependsOn remains a client form-gating hint only; server enforcement keys off each option's visibleWhen (a cascade parent is expressed inside the child's predicate, e.g. record.country == 'cn'), matching the existing design.

Tests

• Extended rule-validator.option-visibility.test.ts: checkboxes element-wise gating (+ needsPriorRecord), and numeric-value coercion (both are real regression guards — they fail on the pre-fix code).
• Verified green: objectql src/validation/ + engine.test.ts (206 passed) and plugin.integration.test.ts real-registry path (36 passed). tsc --noEmit clean; eslint 0 errors (one pre-existing unrelated no-new warning).

🤖 Generated with Claude Code

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
spec	Ready	Preview, Comment	Jul 20, 2026 6:03am

[github-actions]

📓 Docs Drift Check

This PR changes 1 package(s): @objectstack/objectql.

13 hand-written doc(s) reference the affected code and may need an implementation-accuracy re-verification:

• content/docs/concepts/metadata-lifecycle.mdx (via @objectstack/objectql)
• content/docs/data-modeling/formulas.mdx (via packages/objectql)
• content/docs/deployment/migration-from-objectql.mdx (via @objectstack/objectql)
• content/docs/deployment/vercel.mdx (via @objectstack/objectql)
• content/docs/kernel/services-checklist.mdx (via @objectstack/objectql)
• content/docs/kernel/services.mdx (via @objectstack/objectql)
• content/docs/permissions/authentication.mdx (via @objectstack/objectql)
• content/docs/plugins/index.mdx (via @objectstack/objectql)
• content/docs/plugins/packages.mdx (via @objectstack/objectql)
• content/docs/protocol/kernel/index.mdx (via @objectstack/objectql)
• content/docs/protocol/objectql/state-machine.mdx (via @objectstack/objectql)
• content/docs/releases/implementation-status.mdx (via @objectstack/objectql)
• content/docs/releases/v9.mdx (via @objectstack/objectql)

Advisory only. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs origin/main → pass the list as args.docs.