Summary
Found while implementing #5153 (the object-list page's "New" / mobile FAB consuming createPredicates), during the entry-point census for the create affordance.
ObjectDataPage — the parameterized bare data surface (ADR-0055, #2251), route /apps/:appName/:objectName/data — renders its own "New" button gated on nothing but the principal's grant:
packages/app-shell/src/views/ObjectDataPage.tsx:447 {can(objectDef.name, 'create') && (
packages/app-shell/src/views/ObjectDataPage.tsx:455 data-testid="object-data-new-button"
Unlike its sibling ObjectView, this file never calls resolveEffectiveCrudAffordances at all — the string does not appear in it. So on this surface:
Note the userActions block that does appear in this file (:342) is the view's toolbar vocabulary (search / sort / filter / rowHeight / group / hideFields, per #2890) — a different key space from the object's CRUD userActions. The object-level one is genuinely absent, not spelled differently.
Why this is not a duplicate of #5153
#5153 is scoped to ObjectView.tsx, a surface that already honoured the bucket and the permission and was missing only the predicate layer on top. This is the layer below that: a surface that honours neither the bucket nor the object-level opt-out. Fixing #5153 does not touch this file, and its PR deliberately does not (radius held to ObjectView.tsx). Searched open issues for this file and for the data-surface create gate before filing; only #5153 came back.
Impact
A user reaching /apps/:app/:object/data for an object whose lifecycle bucket forbids creation is offered a "New" button that navigates to ../new. The server is the enforcement point, so this is a UI-truthfulness defect rather than a privilege escalation — but it is user-reachable today, not dormant, and it contradicts the affordance matrix the rest of the console renders from.
Severity judged at filing time is unreliable in both directions, so this is filed plainly for triage rather than graded here.
Related
Summary
Found while implementing #5153 (the object-list page's "New" / mobile FAB consuming
createPredicates), during the entry-point census for thecreateaffordance.ObjectDataPage— the parameterized bare data surface (ADR-0055, #2251), route/apps/:appName/:objectName/data— renders its own "New" button gated on nothing but the principal's grant:Unlike its sibling
ObjectView, this file never callsresolveEffectiveCrudAffordancesat all — the string does not appear in it. So on this surface:managedBybucket default is ignored.append-only,engine-ownedandbetter-authall resolvecreate: false, yet/dataoffers "New" for them;userActions: { create: false }— the object-level opt-out — does not close the button;{id}被原样发出 #3391 effective API operations intersection is absent, so the toolbar can offer a create the server would 405;createPredicatesare unread here too (the Object-list toolbar's "New" (and its mobile FAB) does not consumecreatePredicates— the create half is honoured on related lists only #5153 defect, but as a consequence of the wider gap rather than the gap itself).Note the
userActionsblock that does appear in this file (:342) is the view's toolbar vocabulary (search/sort/filter/rowHeight/group/hideFields, per #2890) — a different key space from the object's CRUDuserActions. The object-level one is genuinely absent, not spelled differently.Why this is not a duplicate of #5153
#5153 is scoped to
ObjectView.tsx, a surface that already honoured the bucket and the permission and was missing only the predicate layer on top. This is the layer below that: a surface that honours neither the bucket nor the object-level opt-out. Fixing #5153 does not touch this file, and its PR deliberately does not (radius held toObjectView.tsx). Searched open issues for this file and for the data-surface create gate before filing; only #5153 came back.Impact
A user reaching
/apps/:app/:object/datafor an object whose lifecycle bucket forbids creation is offered a "New" button that navigates to../new. The server is the enforcement point, so this is a UI-truthfulness defect rather than a privilege escalation — but it is user-reachable today, not dormant, and it contradicts the affordance matrix the rest of the console renders from.Severity judged at filing time is unreliable in both directions, so this is filed plainly for triage rather than graded here.
Related
createPredicates— the create half is honoured on related lists only #5153 — the object-list page's create half (predicates), the run this was found in.importPredicatesis produced by the spec resolver and consumed nowhere — the same inverse-symmetry gap as #4646, one key over #5142 / Related-list toolbar “+ New” does not consumeuserActions.createpredicates — spec 17.0.0 shipped the declaration half, the renderer half is missing (createPredicatesproduced but never consumed) #4646 — the import and related-list halves of the same family.