Skip to content

feat(spec)!: dashboard 的 header、过滤器和根收紧(#4001 批 6c) - #4532

Merged
os-zhuang merged 1 commit into
mainfrom
claude/strict-schema-authz-surface-s8vnok
Aug 1, 2026
Merged

os-zhuang merged 1 commit into
mainfrom
claude/strict-schema-authz-surface-s8vnok

Conversation

@os-zhuang

Copy link
Copy Markdown
Contributor

#4001 批 6c(清单)。批 1–6b = #4514#4531,均已合并。

widget 三个版本前就被救出来了,它周围的一切没有

DashboardWidgetSchema 从 ADR-0021 切换起就是 .strict()它的错误信息里自己写着理由

未声明的顶层键在 strict 校验之前被静默丢弃,发出去的是惰性元数据

而 widget 周围的一切,保持的正是 widget 当年被救出来的那个姿态——header、header actions、全局过滤器、过滤器的动态选项源、日期范围,以及 dashboard 根本身

这批把它们关上。

三个键给处方,而不是改名——因为改名会是错的

为什么不能改名
dashboard 的 layout 读起来像模板选择器,但不存在。布局是每个 widget 自己{x,y,w,h},没写的会被自动排布
header 的 subtitle header 渲染的是 dashboard 自己的 label/description没有独立的 header 文案,只有 showTitle/showDescription 开关
过滤器的 filterBindings 绑定方向是反的widget 把这个过滤器的 name 映射到自己的字段,或写 false 退出

别名走 dashboard 的词汇表:charts/components/cards/tileswidgetsfiltersglobalFiltersrefresh/autoRefresh/pollIntervalrefreshIntervaldateFilter/timeRangedateRange

刻意不动的两处

DashboardWidgetOptionsSchema 保持 passthrough 它是设计上的渲染器逃生舱——渲染器认识的展示类设置不关 spec 的事——而其中真正影响分析查询的那四个键早已单独声明(framework#3588)。关掉它等于为了修一个已经用对的方式修好的问题,而砸掉逃生舱。

widget 那张 bespoke strictWidgetAnalyticsError 也不动。 它能用、有测试,携带 pre-ADR-0021 内联分析和 objectui 内部属性两族处方。收敛到 strictObject(那样能在处方之上再叠加「你是不是想写」)是后续项,不是前置条件

顺带记下一个噪音

把测试指向 view 时发现:一个未知键在 view 上会报两次——view 是 union(container | ViewItem | overlay),遍历为每个 strip 变体各发一条。

记在测试里,而不是换个非 union 的集合绕开。 view 关闭后自然消失。

进度

注册类型顶层已关闭:23 / 25。仍剥离:action · view —— 最后两个

告警层覆盖的根降到 2。两个都关上之后,这一层在根层面就没有可警告的了——那是战役完成,不是这层坏了;测试会故意断言空集,而不是被删掉(已写在原地)。

验证

  • 284 文件 / 7240 用例通过tsc --noEmit 干净
  • 8 个生成物 up-to-date,10 个 spec check:* 全绿
  • CRM / Todo / showcase / platform-objects 构建通过(showcase 带 3 个真实 dashboard)

授权影响:这些形状没声明的键从「静默丢弃」变成「拒绝」——本来就已经被忽略。

参考

🤖 Generated with Claude Code

https://claude.ai/code/session_01WnqGjQFQMqd5k81LYV8SCY


Generated by Claude Code

`DashboardWidgetSchema` has been strict since the ADR-0021 cutover, and its
error map states the reason in its own words: undeclared keys "were dropped
silently before strict validation, shipping inert metadata". Everything AROUND
the widget kept the posture the widget was rescued from — the header, its
actions, the global filters and their option sources, the date range, and the
dashboard root.

Three keys get a prescription rather than a rename, because a rename would be
wrong:

  - `layout` on the dashboard reads like a template selector; there is none.
    Layout is per-widget, and a widget without one is auto-flowed.
  - `subtitle` on the header: the header renders the dashboard's own
    label/description, with only showTitle/showDescription to toggle them.
  - `filterBindings` on a filter: the binding runs the other way — a WIDGET
    maps this filter's name to one of its own fields, or false to opt out.

Deliberately left open. `DashboardWidgetOptionsSchema` stays passthrough: it is
the renderer-extras escape hatch by design, and the four keys in it that do
reach the analytics query are already declared explicitly (framework#3588).
Closing it would break the escape hatch to fix a problem already fixed the right
way. The widget's bespoke error map also stays — it works and is tested;
converging it onto strictObject is a follow-up, not a prerequisite.

Registered types closed: 23 of 25. Still open: action, view — the last two, so
the warning layer is down to two covered roots. When both close it has nothing
left to warn about at a root, which is the campaign finishing rather than the
layer breaking; the test says so in place rather than being deleted.

Surfaced while re-pointing a test at `view`: one unknown key on a view reports
TWICE, because `view` is a union and the walk emits per strip-mode variant.
Recorded in the test rather than dodged by picking a non-union collection.

Verified: 284 files / 7240 tests, tsc clean, 8 generated artifacts current, all
10 spec gates green, and CRM/Todo/showcase/platform-objects build (showcase
carries three real dashboards).

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WnqGjQFQMqd5k81LYV8SCY
@os-zhuang
os-zhuang marked this pull request as ready for review August 1, 2026 19:13
@vercel

vercel Bot commented Aug 1, 2026

Copy link
Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment
Project Deployment Actions Updated (UTC)
objectstack Ignored Ignored Aug 1, 2026 7:13pm

Request Review

@os-zhuang
os-zhuang enabled auto-merge August 1, 2026 19:13
@github-actions github-actions Bot added size/m documentation Improvements or additions to documentation tests protocol:ui tooling and removed size/m labels Aug 1, 2026
@github-actions

github-actions Bot commented Aug 1, 2026

Copy link
Copy Markdown
Contributor

📓 Docs Drift Check

This PR changes 1 package(s): @objectstack/spec.

107 hand-written doc(s) reference the affected code and may need an implementation-accuracy re-verification:

  • content/docs/ai/agents.mdx (via @objectstack/spec)
  • content/docs/ai/skills-reference.mdx (via @objectstack/spec)
  • content/docs/ai/skills.mdx (via @objectstack/spec)
  • content/docs/api/client-sdk.mdx (via @objectstack/spec)
  • content/docs/api/environment-routing.mdx (via @objectstack/spec)
  • content/docs/api/error-catalog.mdx (via @objectstack/spec)
  • content/docs/api/error-handling-client.mdx (via @objectstack/spec)
  • content/docs/api/error-handling-server.mdx (via @objectstack/spec)
  • content/docs/api/index.mdx (via @objectstack/spec)
  • content/docs/automation/approvals.mdx (via @objectstack/spec)
  • content/docs/automation/connectors.mdx (via @objectstack/spec)
  • content/docs/automation/flows.mdx (via @objectstack/spec)
  • content/docs/automation/hook-bodies.mdx (via packages/spec)
  • content/docs/automation/hooks.mdx (via @objectstack/spec)
  • content/docs/automation/index.mdx (via @objectstack/spec)
  • content/docs/automation/webhooks.mdx (via @objectstack/spec)
  • content/docs/automation/workflows.mdx (via @objectstack/spec)
  • content/docs/concepts/architecture.mdx (via @objectstack/spec)
  • content/docs/concepts/design-principles.mdx (via packages/spec)
  • content/docs/concepts/index.mdx (via @objectstack/spec)
  • content/docs/concepts/metadata-driven.mdx (via @objectstack/spec)
  • content/docs/concepts/metadata-lifecycle.mdx (via packages/spec)
  • content/docs/concepts/north-star.mdx (via packages/spec)
  • content/docs/data-modeling/analytics.mdx (via @objectstack/spec)
  • content/docs/data-modeling/drivers.mdx (via @objectstack/spec)
  • content/docs/data-modeling/external-datasources.mdx (via @objectstack/spec)
  • content/docs/data-modeling/field-types.mdx (via @objectstack/spec)
  • content/docs/data-modeling/fields.mdx (via @objectstack/spec)
  • content/docs/data-modeling/formulas.mdx (via @objectstack/spec)
  • content/docs/data-modeling/index.mdx (via @objectstack/spec)
  • content/docs/data-modeling/objects.mdx (via @objectstack/spec)
  • content/docs/data-modeling/queries.mdx (via @objectstack/spec)
  • content/docs/data-modeling/schema-design.mdx (via @objectstack/spec)
  • content/docs/data-modeling/seed-data.mdx (via @objectstack/spec)
  • content/docs/data-modeling/validation-rules.mdx (via @objectstack/spec)
  • content/docs/data-modeling/validation.mdx (via @objectstack/spec)
  • content/docs/deployment/cli.mdx (via @objectstack/spec)
  • content/docs/deployment/troubleshooting.mdx (via @objectstack/spec)
  • content/docs/deployment/validating-metadata.mdx (via @objectstack/spec)
  • content/docs/getting-started/build-with-claude-code.mdx (via @objectstack/spec)
  • content/docs/getting-started/common-patterns.mdx (via @objectstack/spec)
  • content/docs/getting-started/examples.mdx (via @objectstack/spec)
  • content/docs/getting-started/quick-reference.mdx (via @objectstack/spec)
  • content/docs/getting-started/quick-start.mdx (via @objectstack/spec)
  • content/docs/getting-started/your-first-project.mdx (via @objectstack/spec)
  • content/docs/kernel/cluster.mdx (via @objectstack/spec)
  • content/docs/kernel/contracts/auth-service.mdx (via packages/spec)
  • content/docs/kernel/contracts/cache-service.mdx (via packages/spec)
  • content/docs/kernel/contracts/data-engine.mdx (via @objectstack/spec)
  • content/docs/kernel/contracts/index.mdx (via @objectstack/spec)
  • content/docs/kernel/contracts/metadata-service.mdx (via packages/spec)
  • content/docs/kernel/contracts/storage-service.mdx (via packages/spec)
  • content/docs/kernel/index.mdx (via packages/spec)
  • content/docs/kernel/runtime-services/email-service.mdx (via packages/spec)
  • content/docs/kernel/runtime-services/index.mdx (via packages/spec)
  • content/docs/kernel/runtime-services/queue-service.mdx (via packages/spec)
  • content/docs/kernel/runtime-services/sharing-service.mdx (via packages/spec)
  • content/docs/kernel/runtime-services/sms-service.mdx (via packages/spec)
  • content/docs/kernel/runtime-services/storage-service.mdx (via packages/spec)
  • content/docs/kernel/services-checklist.mdx (via @objectstack/spec)
  • content/docs/kernel/services.mdx (via @objectstack/spec)
  • content/docs/permissions/authorization.mdx (via @objectstack/spec)
  • content/docs/permissions/permission-sets.mdx (via @objectstack/spec)
  • content/docs/permissions/permissions-matrix.mdx (via @objectstack/spec)
  • content/docs/permissions/positions.mdx (via @objectstack/spec)
  • content/docs/permissions/rls.mdx (via @objectstack/spec)
  • content/docs/permissions/sharing-rules.mdx (via @objectstack/spec)
  • content/docs/plugins/adding-a-metadata-type.mdx (via @objectstack/spec)
  • content/docs/plugins/development.mdx (via @objectstack/spec)
  • content/docs/plugins/index.mdx (via @objectstack/spec)
  • content/docs/plugins/packages.mdx (via @objectstack/spec)
  • content/docs/protocol/backward-compatibility.mdx (via @objectstack/spec)
  • content/docs/protocol/diagram.mdx (via packages/spec)
  • content/docs/protocol/kernel/config-resolution.mdx (via @objectstack/spec)
  • content/docs/protocol/kernel/i18n-standard.mdx (via @objectstack/spec)
  • content/docs/protocol/kernel/index.mdx (via @objectstack/spec)
  • content/docs/protocol/kernel/lifecycle.mdx (via @objectstack/spec)
  • content/docs/protocol/kernel/plugin-spec.mdx (via @objectstack/spec)
  • content/docs/protocol/kernel/runtime-capabilities.mdx (via @objectstack/spec)
  • content/docs/protocol/knowledge.mdx (via @objectstack/spec)
  • content/docs/protocol/objectql/index.mdx (via @objectstack/spec)
  • content/docs/protocol/objectql/query-syntax.mdx (via @objectstack/spec)
  • content/docs/protocol/objectql/schema.mdx (via @objectstack/spec)
  • content/docs/protocol/objectql/security.mdx (via packages/spec)
  • content/docs/protocol/objectql/state-machine.mdx (via @objectstack/spec)
  • content/docs/protocol/objectui/actions.mdx (via @objectstack/spec)
  • content/docs/protocol/objectui/concept.mdx (via @objectstack/spec)
  • content/docs/protocol/objectui/index.mdx (via @objectstack/spec)
  • content/docs/protocol/objectui/layout-dsl.mdx (via @objectstack/spec)
  • content/docs/protocol/objectui/record-alert.mdx (via @objectstack/spec)
  • content/docs/protocol/objectui/widget-contract.mdx (via @objectstack/spec)
  • content/docs/releases/implementation-status.mdx (via @objectstack/spec)
  • content/docs/releases/index.mdx (via @objectstack/spec)
  • content/docs/releases/v12.mdx (via @objectstack/spec)
  • content/docs/releases/v13.mdx (via @objectstack/spec)
  • content/docs/releases/v16.mdx (via @objectstack/spec)
  • content/docs/releases/v17.mdx (via @objectstack/spec)
  • content/docs/releases/v9.mdx (via @objectstack/spec)
  • content/docs/ui/actions.mdx (via @objectstack/spec)
  • content/docs/ui/create-vs-edit-form.mdx (via @objectstack/spec)
  • content/docs/ui/dashboards.mdx (via @objectstack/spec)
  • content/docs/ui/forms.mdx (via @objectstack/spec)
  • content/docs/ui/index.mdx (via @objectstack/spec)
  • content/docs/ui/public-data-collection.mdx (via @objectstack/spec)
  • content/docs/ui/setup-app.mdx (via @objectstack/spec)
  • content/docs/ui/translations.mdx (via @objectstack/spec)
  • content/docs/ui/views.mdx (via @objectstack/spec)

Advisory only. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs origin/main → pass the list as args.docs.

@os-zhuang
os-zhuang added this pull request to the merge queue Aug 1, 2026
Merged via the queue into main with commit 67bf2e2 Aug 1, 2026
21 checks passed
@os-zhuang
os-zhuang deleted the claude/strict-schema-authz-surface-s8vnok branch August 1, 2026 19:35
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

documentation Improvements or additions to documentation tests tooling

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants