fix(security,approvals,metadata-core): 补上派生契约漏掉的 8 个对象的 bulk 原语 (#3026) (#3745)

#3391 P1 把 bulk 门禁改成 `bulk ∧ derived(child)`,配套的「补 bulk 原语」只在 platform-objects 包内做了。plugin-security / plugin-approvals / metadata-core 里同样样板白名单的 8 个对象没被扫到,导致 /batch 与 createMany/updateMany/deleteMany 返回 405,而单条写完全开放。

这 8 个都不是刻意收紧:6 个 managedBy:'config'/'system' 带 userActions 全开,D3 调和一个动词都不剥;sys_view_definition 无 managedBy。bulk 不新增权限,只是已开放动词的批量形态,每行仍过同一套行级/字段级检查。

保留显式白名单而非整行删除:reconcileManagedApiMethods 在 apiMethods 非数组时早退,删掉会关掉 7 个 managedBy 对象的 managed-write 兜底。

测试先红后绿,三包 994 条测试全过。

Author: os-zhuang

.changeset/rbac-objects-bulk-primitive.md

@@ -0,0 +1,36 @@
+---
+"@objectstack/plugin-security": patch
+"@objectstack/plugin-approvals": patch
+"@objectstack/metadata-core": patch
+---
+
+fix(security,approvals,metadata-core): restore batch routes on the eight objects the #3391 P1 companion fix missed (#3026)
+
+The #3391 P1 contract made the bulk gate `bulk ∧ derived(child)`: a batch
+request is admitted only when the object grants the `bulk` **primitive** and the
+batched child operation is itself allowed. Before that, the `*Many` routes
+checked only the child verb, so a boilerplate CRUD-five whitelist
+(`['get','list','create','update','delete']`) batched fine.
+
+The companion fix — adding the `bulk` primitive wherever an explicit whitelist
+survived — was applied only inside `platform-objects`. Eight objects carrying
+the same boilerplate live in other packages and kept the gap, so `/batch`,
+`createMany`, `updateMany` and `deleteMany` answered `405
+OBJECT_API_METHOD_NOT_ALLOWED` on objects whose single-record create/update/
+delete were wide open. `data-objectstack` rethrows that 405 without falling back
+to per-row writes, which surfaced as a hard error on multi-select delete in the
+Setup grids.
+
+Objects reclaimed (whitelist now `['get','list','create','update','delete','bulk']`):
+`sys_capability`, `sys_permission_set`, `sys_position`,
+`sys_position_permission_set`, `sys_user_permission_set`, `sys_user_position`
+(plugin-security); `sys_approval_delegation` (plugin-approvals);
+`sys_view_definition` (metadata-core).
+
+No new authority is granted: `bulk` only permits batching verbs each object
+already exposes one record at a time, and every batched row still passes the
+same row- and field-level permission checks. The whitelists stay explicit rather
+than being deleted — seven of the eight are `managedBy`, and
+`reconcileManagedApiMethods` (ADR-0103 D3) early-returns on a non-array
+`apiMethods`, so dropping the line would silently disable the managed-write
+backstop.

packages/metadata-core/src/objects/sys-view-definition.object.test.ts

@@ -0,0 +1,42 @@
+// Copyright (c) 2026 ObjectStack. Licensed under the Apache-2.0 license.
+
+/**
+ * #3026 follow-up — `sys_view_definition` must expose the BATCH shape of the
+ * write verbs it already grants.
+ *
+ * Since the #3391 P1 contract made the bulk gate `bulk ∧ derived(child)`, a
+ * boilerplate CRUD-five whitelist (`get,list,create,update,delete`) denies
+ * `/batch`, `createMany`, `updateMany` and `deleteMany` while leaving the same
+ * verbs open one record at a time. The companion fix that added the `bulk`
+ * primitive to explicitly-whitelisted objects covered `platform-objects` only,
+ * so this one — the sole object carrying a whitelist in `metadata-core` — kept
+ * the gap.
+ *
+ * Unlike the RBAC objects reclaimed alongside it, this object has no
+ * `managedBy`, so the ADR-0103 D3 reconciliation never applies and deleting the
+ * whitelist would be behaviourally equivalent. It stays explicit on purpose: a
+ * metadata-plane object that is ALSO reachable through the generic data API is
+ * worth naming its exposed surface rather than inheriting whatever the
+ * primitive set grows into.
+ */
+
+import { describe, expect, it } from 'vitest';
+import { resolveEffectiveApiMethods, isApiOperationAllowed } from '@objectstack/spec/data';
+import { SysViewDefinitionObject } from './sys-view-definition.object.js';
+
+describe('sys_view_definition — batch exposure (#3026 / #3391 P1 companion)', () => {
+  it('grants the bulk primitive alongside its single-record write verbs', () => {
+    expect(SysViewDefinitionObject.enable?.apiMethods).toContain('bulk');
+    for (const verb of ['get', 'list', 'create', 'update', 'delete'] as const) {
+      expect(SysViewDefinitionObject.enable?.apiMethods, `must keep ${verb}`).toContain(verb);
+    }
+  });
+
+  it('admits createMany / updateMany / deleteMany and /batch', () => {
+    const eff = resolveEffectiveApiMethods(SysViewDefinitionObject.enable);
+    expect(eff.mode).toBe('restricted');
+    for (const child of ['create', 'update', 'delete'] as const) {
+      expect(isApiOperationAllowed(eff, 'bulk', { bulkChild: child }), `batch ${child}`).toBe(true);
+    }
+  });
+});

packages/metadata-core/src/objects/sys-view-definition.object.ts

@@ -138,6 +138,8 @@ export const SysViewDefinitionObject = ObjectSchema.create({
     trackHistory: true,
     searchable: false,
     apiEnabled: true,
-    apiMethods: ['get', 'list', 'create', 'update', 'delete'],
+    // `bulk` = the batch shape of the verbs above; the gate is `bulk ∧ child`
+    // (#3391 P1), so omitting it 405s /batch and the *Many routes (#3026).
+    apiMethods: ['get', 'list', 'create', 'update', 'delete', 'bulk'],
   },
 });

packages/plugins/plugin-approvals/src/sys-approval-delegation.object.test.ts

@@ -0,0 +1,42 @@
+// Copyright (c) 2026 ObjectStack. Licensed under the Apache-2.0 license.
+
+/**
+ * #3026 follow-up — `sys_approval_delegation` must expose the BATCH shape of
+ * the write verbs it already grants.
+ *
+ * The object is `managedBy: 'system'` but opens generic writes deliberately
+ * (`userActions: { create, edit, delete }` — an out-of-office rule is authored
+ * by its own user through the plain data endpoint), so the ADR-0103 D3
+ * reconciliation strips nothing and its boilerplate CRUD-five whitelist reaches
+ * the REST gate as authored. Since the #3391 P1 contract made bulk
+ * `bulk ∧ derived(child)`, that whitelist — which never named the `bulk`
+ * primitive — 405s every batch route while the single-record verbs stay open.
+ */
+
+import { describe, expect, it } from 'vitest';
+import { resolveEffectiveApiMethods, isApiOperationAllowed } from '@objectstack/spec/data';
+import { SysApprovalDelegation } from './sys-approval-delegation.object';
+
+describe('sys_approval_delegation — batch exposure (#3026 / #3391 P1 companion)', () => {
+  it('grants the bulk primitive alongside its single-record write verbs', () => {
+    expect(SysApprovalDelegation.enable?.apiMethods).toContain('bulk');
+    for (const verb of ['get', 'list', 'create', 'update', 'delete'] as const) {
+      expect(SysApprovalDelegation.enable?.apiMethods, `must keep ${verb}`).toContain(verb);
+    }
+  });
+
+  it('admits createMany / updateMany / deleteMany and /batch', () => {
+    const eff = resolveEffectiveApiMethods(SysApprovalDelegation.enable);
+    expect(eff.mode).toBe('restricted');
+    for (const child of ['create', 'update', 'delete'] as const) {
+      expect(isApiOperationAllowed(eff, 'bulk', { bulkChild: child }), `batch ${child}`).toBe(true);
+    }
+  });
+
+  it('keeps the whitelist explicit so the ADR-0103 D3 backstop still runs', () => {
+    // `reconcileManagedApiMethods` early-returns on a non-array `apiMethods`.
+    // For a `managedBy` object, deleting the whitelist would silently disable
+    // managed-write stripping — it is not an equivalent refactor.
+    expect(Array.isArray(SysApprovalDelegation.enable?.apiMethods)).toBe(true);
+  });
+});

packages/plugins/plugin-approvals/src/sys-approval-delegation.object.ts

@@ -135,6 +135,8 @@ export const SysApprovalDelegation = ObjectSchema.create({
     trackHistory: true,
     searchable: true,
     apiEnabled: true,
-    apiMethods: ['get', 'list', 'create', 'update', 'delete'],
+    // `bulk` = the batch shape of the verbs above; the gate is `bulk ∧ child`
+    // (#3391 P1), so omitting it 405s /batch and the *Many routes (#3026).
+    apiMethods: ['get', 'list', 'create', 'update', 'delete', 'bulk'],
   },
 });

packages/plugins/plugin-security/src/objects/sys-capability.object.ts

@@ -214,6 +214,8 @@ export const SysCapability = ObjectSchema.create({
     trackHistory: true,
     searchable: true,
     apiEnabled: true,
-    apiMethods: ['get', 'list', 'create', 'update', 'delete'],
+    // `bulk` = the batch shape of the verbs above; the gate is `bulk ∧ child`
+    // (#3391 P1), so omitting it 405s /batch and the *Many routes (#3026).
+    apiMethods: ['get', 'list', 'create', 'update', 'delete', 'bulk'],
   },
 });

packages/plugins/plugin-security/src/objects/sys-permission-set.object.ts

@@ -299,6 +299,8 @@ export const SysPermissionSet = ObjectSchema.create({
     trackHistory: true,
     searchable: true,
     apiEnabled: true,
-    apiMethods: ['get', 'list', 'create', 'update', 'delete'],
+    // `bulk` = the batch shape of the verbs above; the gate is `bulk ∧ child`
+    // (#3391 P1), so omitting it 405s /batch and the *Many routes (#3026).
+    apiMethods: ['get', 'list', 'create', 'update', 'delete', 'bulk'],
   },
 });

packages/plugins/plugin-security/src/objects/sys-position-permission-set.object.ts

@@ -77,6 +77,8 @@ export const SysPositionPermissionSet = ObjectSchema.create({
     trackHistory: true,
     searchable: true,
     apiEnabled: true,
-    apiMethods: ['get', 'list', 'create', 'update', 'delete'],
+    // `bulk` = the batch shape of the verbs above; the gate is `bulk ∧ child`
+    // (#3391 P1), so omitting it 405s /batch and the *Many routes (#3026).
+    apiMethods: ['get', 'list', 'create', 'update', 'delete', 'bulk'],
   },
 });

packages/plugins/plugin-security/src/objects/sys-position.object.ts

@@ -275,6 +275,8 @@ export const SysPosition = ObjectSchema.create({
     trackHistory: true,
     searchable: true,
     apiEnabled: true,
-    apiMethods: ['get', 'list', 'create', 'update', 'delete'],
+    // `bulk` = the batch shape of the verbs above; the gate is `bulk ∧ child`
+    // (#3391 P1), so omitting it 405s /batch and the *Many routes (#3026).
+    apiMethods: ['get', 'list', 'create', 'update', 'delete', 'bulk'],
   },
 });

packages/plugins/plugin-security/src/objects/sys-user-permission-set.object.ts

@@ -135,6 +135,8 @@ export const SysUserPermissionSet = ObjectSchema.create({
     trackHistory: true,
     searchable: true,
     apiEnabled: true,
-    apiMethods: ['get', 'list', 'create', 'update', 'delete'],
+    // `bulk` = the batch shape of the verbs above; the gate is `bulk ∧ child`
+    // (#3391 P1), so omitting it 405s /batch and the *Many routes (#3026).
+    apiMethods: ['get', 'list', 'create', 'update', 'delete', 'bulk'],
   },
 });