Narrow the sys_business_unit read to the unit name, now that 18.3 lets a platform admin's View All set vote on fields #188

Found by the #185 upgrade pass on @objectstack 18.3.0 (main ce6fc4b). The report is the project file duly-18.3-browser-check/REPORT.md (the #29106 re-measure, probes P2 and P3).

Background

#180 (PR #183) gave all three Duly sets sys_business_unit: { allowRead: true }, which covers every column. That includes code, unit head, timezone, dates and external_ref (the HRIS id). A name-only field mask was rejected then because, on 18.2, it also blanked Setup → Business Units for any platform admin who held a Duly set (objectstack#29106).

What 18.3 changes

objectstack#29106 shipped (#29387): a View All / Modify All set now votes on every field of its object.

Probe P2, on 18.3.0: all three Duly sets mark the 10 non-name columns readable: false. The results:

• A member reads name only, and sorting by code gets 403.
• The platform admin reads all 16 fields.
• Setup → Business Units keeps Kind, Head and Active.

Probe P3, referenceNameVisible instead of the read: the name renders, but Import as a non-platform duly_admin drops to 0/19, because Import matches by name under the importer's read. So an object read is still needed; it can now be narrowed.

What done looks like

• Decide, with a reason, which columns a member, a manager and a duly_admin need. At least name is needed, for the lookup label and for Import.
• Mask the rest in all three sets and pin it. Re-check the 18.3 lint warning for an inert mask (#29724).
• Browser check in en-US and zh-CN:
  • member task and duty pages show the unit name;
  • non-platform duly_admin Import of samples/duties.csv gets 19/19;
  • platform admin Setup → Business Units is unchanged.
• Update the MEMBER_OBJECTS note and docs/deployment/security.md.

area:security because it changes a read grant. Check it against #130 and #143.

Generated by Claude Code