From b8f02fccd613587ea6c4c626b144441a59055467 Mon Sep 17 00:00:00 2001 From: Claude Date: Tue, 11 Aug 2026 15:15:36 +0000 Subject: [PATCH] test(spec): register sys_api_key in SINGLE_RECORD_WRITE_ONLY PR #7769 opened `update` on sys_api_key's enable.apiMethods to give API-key revoke/restore a working PATCH route, without registering the object in api-methods-batch-conformance.test.ts's SINGLE_RECORD_WRITE_ONLY exemption list. That left main red on the "grants bulk wherever it grants create / update / delete" check for every merge-queue full-suite build, since the file-scan test isn't exercised by PR-side affected-subset CI for a platform-objects-only diff. This records the decision #7769's own commit message already made (revoke/restore are single-record row actions; create/delete stay off since minting is POST /api/v1/keys; batch revoke is not a declared product route) rather than widening the API surface by adding `bulk`. Fixes #7793 Claude-Session: https://claude.ai/code/session_013ZU38vNzLXCscgdFZjKd53 --- .../src/data/api-methods-batch-conformance.test.ts | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-) diff --git a/packages/spec/src/data/api-methods-batch-conformance.test.ts b/packages/spec/src/data/api-methods-batch-conformance.test.ts index a89dae0300..d4d283e4ba 100644 --- a/packages/spec/src/data/api-methods-batch-conformance.test.ts +++ b/packages/spec/src/data/api-methods-batch-conformance.test.ts @@ -42,14 +42,20 @@ const WRITE_PRIMITIVES = ['create', 'update', 'delete'] as const; /** * Objects that deliberately expose single-record writes but NO batch route, - * keyed by object name with the reason. Empty today: every tightened whitelist - * in the monorepo either grants `bulk` or grants no write verb at all. + * keyed by object name with the reason. * * Adding an entry is a real decision — batch denial is invisible until a user * multi-selects rows and `data-objectstack` rethrows the 405 without falling * back to per-row writes. Write down why the object is worth that. */ -const SINGLE_RECORD_WRITE_ONLY: Record = {}; +const SINGLE_RECORD_WRITE_ONLY: Record = { + sys_api_key: + "row actions revoke/restore (#7769/#7727) opened 'update' for a working " + + "PATCH /api/v1/data/sys_api_key/{id} route; 'create'/'delete' deliberately " + + "stay off apiMethods (minting is POST /api/v1/keys, retirement is revoking " + + 'rather than deleting) — and batch revoke is not a declared product route, ' + + "so 'bulk' is intentionally withheld too. See #7769's commit message for the ruling.", +}; /** Every `*.object.ts` under `packages/`, skipping build output and deps. */ function walkObjectFiles(dir: string, out: string[] = []): string[] {