fix(platform-objects): allow import/export on sys_business_unit_member (#3025 / #3391 P0)

Completes the #3025 point-fix. #3392 added import/export to sys_business_unit
but left the sibling membership table on a CRUD-only whitelist, so the HRIS
org-tree sync scenario (units + memberships imported together) still 405'd on
the membership import/export path. #3391's P0 checklist pairs both tables; this
is the half #3392 missed.

- sys_business_unit_member enable.apiMethods gains 'import','export'.
- Reconcile-safe: import/export are not in MANAGED_WRITE_VERB_AFFORDANCE, so
  reconcileManagedApiMethods (managedBy:'platform') never strips them — the
  declared whitelist reaches apiAccessDenialFromEnable intact.
- Regression test locks import/export + CRUD, proven red-before-green.

Transitional per #3391 P2 (derived import/export mapping reclaims both objects).

Refs #3025, #3391.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: os-zhuang

.changeset/business-unit-member-import-export.md

@@ -0,0 +1,32 @@
+---
+"@objectstack/platform-objects": patch
+---
+
+fix(platform-objects): allow import/export on sys_business_unit_member (#3025 / #3391 P0)
+
+Completes the #3025 point-fix. #3392 unblocked `sys_business_unit`'s Import/Export
+buttons (405 `OBJECT_API_METHOD_NOT_ALLOWED`) by adding `'import'`/`'export'` to its
+`enable.apiMethods` whitelist, but the HRIS org-tree sync scenario imports **two
+tables together** — the units *and* their memberships — and the sibling
+`sys_business_unit_member` was left on the CRUD-only whitelist, so the membership
+Import/Export path still 405'd. #3391's P0 checklist pairs both tables; this is the
+half #3392 missed.
+
+- `packages/platform-objects/src/identity/sys-business-unit-member.object.ts`:
+  `apiMethods` gains `'import'`, `'export'`. Import reuses the object's
+  already-granted create/update affordances; export is a bulk read.
+- Reconcile-safe: the object is `managedBy:'platform'`, but
+  `reconcileManagedApiMethods` only strips generic write verbs
+  (`create/update/upsert/delete/purge` — `MANAGED_WRITE_VERB_AFFORDANCE`). It never
+  touches `import`/`export`, so the declared whitelist reaches the REST gate intact
+  (no false-green: the static whitelist the regression test asserts IS what
+  `apiAccessDenialFromEnable` enforces at runtime).
+- Regression test (`platform-objects.test.ts`) locks `import`/`export` presence and
+  CRUD retention. Proven red-before-green: reverting the object edit fails with
+  `expected [...] to include 'import'`.
+
+Transitional: #3391 P2 replaces per-object `import`/`export` declarations with a
+single derived mapping (import ⊆ create/update, export ⊆ list) and reclaims the
+explicit entries on both business-unit objects together.
+
+Refs #3025, #3391.

packages/platform-objects/src/identity/sys-business-unit-member.object.ts

@@ -101,7 +101,14 @@ export const SysBusinessUnitMember = ObjectSchema.create({
     trackHistory: true,
     searchable: true,
     apiEnabled: true,
-    apiMethods: ['get', 'list', 'create', 'update', 'delete'],
+    // import/export complete the HRIS org-tree sync scenario: the units
+    // (sys_business_unit, #3025/#3392) and their memberships are imported
+    // together as one bulk operation. Import reuses the already-granted
+    // create/update affordances; export is a bulk read. Transitional — #3391
+    // P2 derives these from create/update|list and reclaims the explicit
+    // entries. Reconcile-safe: import/export are not generic write verbs, so
+    // reconcileManagedApiMethods (managedBy:'platform') never strips them.
+    apiMethods: ['get', 'list', 'create', 'update', 'delete', 'import', 'export'],
     trash: true,
     mru: false,
   },

packages/platform-objects/src/platform-objects.test.ts

@@ -4,6 +4,7 @@ import { describe, expect, it } from 'vitest';
 import {
   SysAccount,
   SysApiKey,
+  SysBusinessUnitMember,
   SysDeviceCode,
   SysInvitation,
   SysJwks,
@@ -128,6 +129,37 @@ describe('@objectstack/platform-objects', () => {
     });
   });
 
+  describe('data-portability api whitelist (#3025 / #3391 P0)', () => {
+    // HRIS org-tree sync imports TWO tables together: the units
+    // (sys_business_unit) AND the memberships (sys_business_unit_member).
+    // #3025/#3392 unblocked the unit table; this locks the sibling membership
+    // table, which #3391's P0 checklist pairs with it. Both carry a restrictive
+    // apiMethods whitelist, so import/export must be listed explicitly or the
+    // REST data face 405s (`OBJECT_API_METHOD_NOT_ALLOWED`, via
+    // apiAccessDenialFromEnable in rest-server.ts).
+    //
+    // Transitional: #3391 P2 replaces per-object import/export declarations with
+    // a single derived mapping (import ⊆ create/update, export ⊆ list). When
+    // that lands, the explicit entries — and this guard — are reclaimed together.
+    //
+    // Reconcile-safe: sys_business_unit_member is managedBy:'platform', but
+    // reconcileManagedApiMethods only strips generic WRITE verbs
+    // (create/update/upsert/delete/purge — MANAGED_WRITE_VERB_AFFORDANCE) whose
+    // affordance is absent. It never touches import/export, so the declared
+    // whitelist reaches the runtime gate intact (no false-green: the static
+    // whitelist here IS what the gate enforces).
+    it('sys_business_unit_member allows import/export and keeps CRUD', () => {
+      const methods = SysBusinessUnitMember.enable?.apiMethods ?? [];
+      expect(methods).toContain('import');
+      expect(methods).toContain('export');
+      // The data-portability additions must not drop the CRUD affordances the
+      // membership grid + HRIS upsert depend on.
+      for (const verb of ['get', 'list', 'create', 'update', 'delete']) {
+        expect(methods).toContain(verb);
+      }
+    });
+  });
+
   describe('sysadmin row actions', () => {
     // Setup-App admins must be able to drive the access-control lifecycle
     // without dropping to SQL. These assertions lock in the high-traffic