fix(spec)!: an object permission that edits or deletes a record also reads it by objectstack-fleet[bot] · Pull Request #30180 · objectstack-ai/objectstack

wip(spec): an object permission that edits or deletes a record also reads it

claude

committed

12cbd65

wip(plugin-security): edit and delete as read ∧ grant over the merged entry; a refused read answers every addressed by-id write

claude

committed

eaa4afe

test(plugin-security): an object permission that edits or deletes a record also reads it — stored rows, cross-set read, and the read-refused caller's by-id writes

claude

committed

8012aba

chore(spec): regenerate the reference docs for the allowEdit / allowDelete descriptions

claude

committed

269736c

feat(app-shell): the permission set editor ticks Read with Edit or Delete and clears them with Read; dogfood pins at the HTTP door

claude

committed

d1ee68c

test(lint): the access matrix's reference fold reads edit and delete as read ∧ grant

claude

committed

666c8bb

test(runtime): stored write grants without read write nothing at the data door

claude

committed

6cf6455

test(dogfood): an object permission that edits or deletes a record also reads it, at the HTTP doors; stored edit-without-read personas

claude

committed

d01cc53

Merge remote-tracking branch 'origin/main' into claude/sec-hardening-u

claude

committed

403f77c

docs(plugin-security): state the by-id write rule for a caller the read door refuses

claude

committed

d7bf39c

fix(app-shell): unticking View All or Modify All clears Edit and Delete once nothing reads; the upgrade report's edit cell reads through the fold

claude

committed

f4a273b

docs: unticking any bit that reads clears Edit and Delete once none remains

claude

committed

58698ca

Navigation Menu

Repository navigation

fix(spec)!: an object permission that edits or deletes a record also reads it - #30180

fix(spec)!: an object permission that edits or deletes a record also reads it#30180
objectstack-fleet[bot] merged 12 commits into
mainfrom
claude/sec-hardening-u

Commits on Nov 4, 2026

wip(spec): an object permission that edits or deletes a record also reads it

wip(plugin-security): edit and delete as read ∧ grant over the merged entry; a refused read answers every addressed by-id write

test(plugin-security): an object permission that edits or deletes a record also reads it — stored rows, cross-set read, and the read-refused caller's by-id writes

chore(spec): regenerate the reference docs for the allowEdit / allowDelete descriptions

feat(app-shell): the permission set editor ticks Read with Edit or Delete and clears them with Read; dogfood pins at the HTTP door

test(lint): the access matrix's reference fold reads edit and delete as read ∧ grant

test(runtime): stored write grants without read write nothing at the data door

test(dogfood): an object permission that edits or deletes a record also reads it, at the HTTP doors; stored edit-without-read personas

Merge remote-tracking branch 'origin/main' into claude/sec-hardening-u

docs(plugin-security): state the by-id write rule for a caller the read door refuses

fix(app-shell): unticking View All or Modify All clears Edit and Delete once nothing reads; the upgrade report's edit cell reads through the fold

docs: unticking any bit that reads clears Edit and Delete once none remains