feat(spec)!: 审批授权 schema 拒绝未知键（#4001 第 3 步） - #4119
Merged
Merged
Conversation
…4001 step 3) Third click of the unknown-key strictness ratchet (flow + permission in #4071, RLS / sharing / position in #4099). Approval is a v17-new authoring surface — tightened while young, before stored volume exists: - ApprovalNodeConfigSchema, ApprovalNodeApproverSchema, ApprovalEscalationSchema and DecisionOutputDefSchema are .strict() with fixable errors via the shared strictUnknownKeyError factory. - ApprovalNodeConfig's guidance is the ADR-0019 re-home map: steps -> successive approval nodes on the canvas, entryCriteria -> the entering edge's condition, onApprove/onReject -> the approve/reject out-edges, rejectionBehavior -> a declared back-edge (ADR-0044) with maxRevisions. - The published JSON schema (getApprovalNodeConfigJsonSchema) now carries additionalProperties:false into the Studio property form AND registerFlow's per-node config validation (#4027/#4040) — deliberate: an approval gate that quietly ignores half its config is the worst ADR-0078 instance. Verified the #3746 hazard: z.toJSONSchema on the strict lazySchema does not throw and emits additionalProperties:false at both nesting levels (asserted in approval.test.ts). Verified: spec 6995 tests + tsc clean; all 12 check gates; plugin-approvals 326 / service-automation 457; dogfood 72 files / 418 tests; showcase / crm / todo validate clean. Refs #4001 Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0147tNF4Snk7Ry1KGt4a5PY4
|
The latest updates on your projects. Learn more about Vercel for GitHub. 1 Skipped Deployment
|
github-actions
Bot
added
documentation
Contributor
📓 Docs Drift CheckThis PR changes 1 package(s): 106 hand-written doc(s) reference the affected code and may need an implementation-accuracy re-verification:
|
os-zhuang
marked this pull request as ready for review
July 30, 2026 10:44
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
#4001 棘轮第三格（第一格 flow + permission #4071，第二格 rls / sharing / position #4099）。审批是 v17 新增授权面（#3447 动态审批路由）——趁存量为零时收紧，成本最低。
做了什么
.strict()：ApprovalNodeConfigSchema/ApprovalNodeApproverSchema/ApprovalEscalationSchema/DecisionOutputDefSchema（比账本预估多一个——DecisionOutputDefSchema是 审批流无法在「运行中」动态确定审批人——审批人在提交时即被 $trigger 快照锁定（动态路由 / 动态会签受阻） #3447 P2 的类型化决策输出声明）。审批闸门静默忽略一半配置是 ADR-0078 陷阱的最坏实例：请求照样路由，只是不按作者声明的方式。steps→画布上连续的 approval 节点、entryCriteria→入边condition、onApprove/onReject→approve/reject出边、rejectionBehavior→声明式 back-edge（ADR-0044）+maxRevisions。mode/approvalMode→behavior、quorum→minApprovals、statusField→approvalStatusField、org→organization、expandAs→resolveAs、timeout/hours/sla→timeoutHours、to/target→escalateTo、name→key、widget→type。影响面比 spec parse 更宽（有意为之）
getApprovalNodeConfigJsonSchema()发布的 JSON schema 同时喂 Studio 属性表单和registerFlow()的逐节点 config 校验（#4027/#4040）。strict 后它携带additionalProperties: false，所以 approval 节点config里的未知键在注册时也会被拒——这正是想要的：其他节点类型的config因插件开放命名空间必须保持开放，approval 的 config 契约由本 schema 独占，能收就收。#3746 隐患区已实测：
z.toJSONSchema在 strict + lazySchema 上不抛异常，内外两层都正确产出additionalProperties: false（approval.test.ts断言固定）。零破坏实证
@objectstack/spec：269 文件 / 6995 用例全过，tsc干净check:*闸门一次全过（api-surface / authorable-surface 无漂移——本步没有新键、没有新导出，纯收紧）objectstack validate全过后续（不在本 PR）
账本 next-targets：
ui/app.zod.ts（导航递归 union 需单独设计错误呈现，建议独立立项）→data/hook.zod.ts+datasource.zod.ts；长尾走 v17 后的 lint 告警层，v18 收口。Refs #4001
🤖 Generated with Claude Code
https://claude.ai/code/session_0147tNF4Snk7Ry1KGt4a5PY4
Generated by Claude Code