test(app-showcase): B3 cascading-select fixture — server-enforced dynamic options (#2559)#3006
Merged
Merged
Conversation
…hen + role-gated option (#2559) Adds `showcase_cascade`, a served fixture that exercises the B3 server-side option-value enforcement (objectql `evaluateOptionVisibility`, #2915 / #1583): - country → province cascade — `province` declares `dependsOn: ['country']` and each option gates itself with a `visibleWhen` CEL predicate. The client narrows the offered set; the rule-validator rejects an out-of-set submit (`{ field, code: 'invalid_option' }`). - a role-gated `tier.restricted` option (`'admin' in current_user.positions`), enforced server-side the same way. `public_read_write` (no permission set → absent from the ADR-0090 access-matrix), wired into the Showcase app's Data Model nav. Verified live against a fresh backend: POST /api/v1/data/showcase_cascade rejects country=us+province=zj (400 invalid_option) and accepts country=cn+province=zj (201); GET /api/v1/meta/object/showcase_cascade serves the per-option visibleWhen to the client. Drives objectui e2e/live/cascading-options.spec.ts. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01S91NyYJURiQTKmF9q3AXxg
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
os-zhuang
marked this pull request as ready for review
July 16, 2026 04:22
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Context
The remaining framework half of B3 (dynamic field options / cascading selects — objectui#1583). The objectui client (per-option
visibleWhen+dependsOn, #2284 / #2215) and the build-time guardrail + ADR-0058 + browser e2e (objectui#2547) already shipped. This PR delivers the served showcase fixture that exercises the server-side enforcement, per objectui#2559 item 2.What's added
A new showcase object
showcase_cascade(examples/app-showcase/src/data/objects/cascading-select.object.ts), registered inobjects/index.tsand wired into the Showcase app's Data Model nav:country→provincecascade —provincedeclaresdependsOn: ['country']and each option gates itself with a per-optionvisibleWhenCEL predicate (record.country == 'cn'…). The client narrows the offered set; the objectql rule-validator re-evaluates the submitted value and rejects an out-of-set one ({ field, code: 'invalid_option' }).tier.restricted—visibleWhen: "'admin' in current_user.positions", enforced server-side the same way.public_read_writeso the seeded admin (and the live e2e) can create against it without a bespoke permission set; belonging to no permission set, it stays out of the ADR-0090access-matrix.jsonsnapshot. Predicates use theP(CEL) tag — same authoring shape asshowcase_invoice's field-levelvisibleWhen.Verification
pnpm --filter @objectstack/example-showcase test— 55/55 green (coverage, seed, gap-fill, …);tsc --noEmitclean.@objectstack/objectqlrule-validator.option-visibility.test.ts— 15/15 (the server verdict).objectstack dev --seed-admin --fresh):POST /api/v1/data/showcase_cascade{country:'us',province:'zj'}→ 400VALIDATION_FAILED/invalid_option.{country:'cn',province:'zj'}→ 201.{tier:'restricted'}(seeded admin, noadminposition) → 400invalid_option— role gating works.GET /api/v1/meta/object/showcase_cascadeserves the per-optionvisibleWhento the client.Related
e2e/live/cascading-options.spec.ts).🤖 Generated with Claude Code
https://claude.ai/code/session_01S91NyYJURiQTKmF9q3AXxg