@objectstack/platform-objects 14.3.0 → 14.5.0

package/dist/identity/index.mjs

@@ -8,6 +8,15 @@ var SysUser = ObjectSchema.create({
   icon: "user",
   isSystem: true,
   managedBy: "better-auth",
+  // ADR-0092 D4 — the ONE generic affordance opened on an identity table:
+  // standard row editing. Safe because the plugin-auth identity write guard
+  // (ADR-0092 D2) enforces the profile whitelist server-side — a user-context
+  // update may only touch SYS_USER_PROFILE_EDIT_FIELDS ({name, image});
+  // everything else is stripped/rejected regardless of what a form submits.
+  // The permission layer still decides WHO may edit (platform admins only by
+  // default; member/org-admin sets keep allowEdit: false). create / import /
+  // delete stay bucket-default (off).
+  userActions: { edit: true },
   // ADR-0010 §3.7 — identity table is managed by better-auth; schema must not drift.
   protection: {
     lock: "full",
@@ -55,15 +64,17 @@ var SysUser = ObjectSchema.create({
     // These actions hit /api/v1/auth/admin/* endpoints that are only
     // wired when `auth.plugins.admin` is enabled. When the plugin is
     // disabled the actions still render (schema is static) but server
-    // returns 404. UI surfaces them under the row menu so platform
-    // admins can manage accounts without dropping to SQL or
+    // returns 404. UI surfaces them under the row menu AND the
+    // record-detail header (`record_header`, overflowing into the ⋯
+    // "More" menu) so platform admins can manage an account from either
+    // the Users list or an open user record — without dropping to SQL or
     // a custom Setup wizard.
     {
       name: "ban_user",
       label: "Ban User",
       icon: "ban",
       variant: "danger",
-      locations: ["list_item"],
+      locations: ["list_item", "record_header"],
       type: "api",
       target: "/api/v1/auth/admin/ban-user",
       recordIdParam: "userId",
@@ -79,7 +90,7 @@ var SysUser = ObjectSchema.create({
       label: "Unban User",
       icon: "check-circle-2",
       variant: "secondary",
-      locations: ["list_item"],
+      locations: ["list_item", "record_header"],
       type: "api",
       target: "/api/v1/auth/admin/unban-user",
       recordIdParam: "userId",
@@ -94,7 +105,7 @@ var SysUser = ObjectSchema.create({
       label: "Unlock Account",
       icon: "lock-open",
       variant: "secondary",
-      locations: ["list_item"],
+      locations: ["list_item", "record_header"],
       type: "api",
       target: "/api/v1/auth/admin/unlock-user",
       recordIdParam: "userId",
@@ -162,7 +173,7 @@ var SysUser = ObjectSchema.create({
       label: "Set Password",
       icon: "key-round",
       variant: "secondary",
-      locations: ["list_item"],
+      locations: ["list_item", "record_header"],
       type: "api",
       // #2766 V1 — same path as better-auth's stock route, but served by the
       // plugin-auth wrapper registered ahead of the catch-all: it accepts the
@@ -204,7 +215,7 @@ var SysUser = ObjectSchema.create({
       label: "Set Platform Role",
       icon: "shield-check",
       variant: "secondary",
-      locations: ["list_item"],
+      locations: ["list_item", "record_header"],
       type: "api",
       target: "/api/v1/auth/admin/set-role",
       recordIdParam: "userId",
@@ -219,7 +230,7 @@ var SysUser = ObjectSchema.create({
       label: "Impersonate User",
       icon: "user-cog",
       variant: "secondary",
-      locations: ["list_item"],
+      locations: ["list_item", "record_header"],
       type: "api",
       target: "/api/v1/auth/admin/impersonate-user",
       recordIdParam: "userId",
@@ -443,20 +454,28 @@ var SysUser = ObjectSchema.create({
       maxLength: 255,
       group: "Identity"
     }),
+    // ADR-0092 D4 — with the generic edit affordance open, every non-profile
+    // field is readonly so the standard edit form renders it non-editable.
+    // This is UX only; the server boundary is the plugin-auth identity write
+    // guard (ADR-0092 D2), which strips/rejects these regardless.
     email: Field.email({
       label: "Email",
       required: true,
+      readonly: true,
+      // login identity — change flows through better-auth change-email verification
       searchable: true,
       group: "Identity"
     }),
     email_verified: Field.boolean({
       label: "Email Verified",
       defaultValue: false,
+      readonly: true,
       group: "Identity"
     }),
     two_factor_enabled: Field.boolean({
       label: "Two-Factor Enabled",
       defaultValue: false,
+      readonly: true,
       group: "Identity",
       description: "Whether two-factor authentication is enabled for this user. Maintained by the better-auth `twoFactor` plugin."
     }),
@@ -464,6 +483,8 @@ var SysUser = ObjectSchema.create({
     role: Field.text({
       label: "Platform Role",
       required: false,
+      readonly: true,
+      // ADR-0092 — set via the Set Platform Role action, never the edit form
       maxLength: 64,
       group: "Admin",
       description: "Platform-level role (admin, user, \u2026). Set via the Set Platform Role action."
@@ -471,18 +492,24 @@ var SysUser = ObjectSchema.create({
     banned: Field.boolean({
       label: "Banned",
       defaultValue: false,
+      readonly: true,
+      // ADR-0092 — toggled via Ban/Unban actions (session side effects)
       group: "Admin",
       description: "When true, the user cannot sign in. Toggle via Ban User / Unban User actions."
     }),
     ban_reason: Field.text({
       label: "Ban Reason",
       required: false,
+      readonly: true,
+      // ADR-0092 — written by the Ban User action
       maxLength: 255,
       group: "Admin"
     }),
     ban_expires: Field.datetime({
       label: "Ban Expires",
       required: false,
+      readonly: true,
+      // ADR-0092 — written by the Ban User action
       group: "Admin",
       description: "When set, the ban auto-clears at this time."
     }),
@@ -578,6 +605,8 @@ var SysUser = ObjectSchema.create({
     ai_access: Field.boolean({
       label: "AI Access",
       defaultValue: false,
+      readonly: true,
+      // ADR-0092 — a licensed-seat grant; flows through the AiSeatPlugin enforcement path
       group: "Admin",
       description: "Whether this user holds an AI seat \u2014 grants access to the in-UI AI agents (build / ask). The framework synthesizes the `ai_seat` capability from this flag (plugin-hono-server resolveCtx). Assignment is capped by the licensed / purchased seat count (enforced by @objectstack/security-enterprise AiSeatPlugin). Owned by objectql (better-auth is oblivious to this column)."
     }),
@@ -591,12 +620,16 @@ var SysUser = ObjectSchema.create({
     manager_id: Field.lookup("sys_user", {
       label: "Manager",
       required: false,
+      readonly: true,
+      // ADR-0092 — drives own_and_reports RLS scope; org-structure maintenance is its own surface
       group: "Organization",
       description: "This user's direct manager. Forms the reporting chain the `own_and_reports` hierarchy scope walks (ADR-0057 / @objectstack/security-enterprise)."
     }),
     primary_business_unit_id: Field.lookup("sys_business_unit", {
       label: "Primary Business Unit",
       required: false,
+      readonly: true,
+      // ADR-0092 — denormalised projection maintained by plugin-sharing; never hand-edited
       group: "Organization",
       description: "The user's primary business unit \u2014 a denormalised projection of sys_business_unit_member.is_primary, maintained by plugin-sharing (ADR-0057 addendum D12). Lets a user-lookup filter candidates by business unit without traversing the membership junction. Do not edit directly; set it via business-unit membership."
     }),
@@ -2616,6 +2649,12 @@ var SysDeviceCode = ObjectSchema.create({
   icon: "key-round",
   isSystem: true,
   managedBy: "better-auth",
+  // ADR-0057: device codes are dead the moment `expires_at` passes — keep a
+  // 1d grace for post-mortem, then reap.
+  lifecycle: {
+    class: "transient",
+    ttl: { field: "expires_at", expireAfter: "1d" }
+  },
   // [ADR-0066 D2/④] Secure-by-default: rows are LIVE pending device-grant
   // codes — reading `user_code`/`device_code` lets an attacker hijack a
   // pending CLI login. Not covered by the wildcard `'*'` grant; admins retain
@@ -3634,9 +3673,13 @@ var SysSsoProvider = ObjectSchema.create({
       // for a one-time DNS-TXT challenge and reveals the ready-to-paste record
       // ONCE via `resultDialog`. Routed through the env bridge (plugin-auth /
       // cloud AuthProxyPlugin) which reshapes the `{domainVerificationToken}`
-      // response into the `{ data: { dnsRecordName, dnsRecordValue } }` envelope
-      // the dialog reads. When the feature is OFF the bridge returns a clear
-      // "not enabled for this environment" error instead of a bare 404.
+      // response into a `{ success, data: { dnsRecordName, dnsRecordValue } }`
+      // envelope. The console action runtime unwraps that envelope, so the
+      // `resultDialog` field paths are relative to the inner `data` payload
+      // (`dnsRecordName`, not `data.dnsRecordName`) — consistent with every
+      // other object's resultDialog (create_user, two-factor, OAuth). When the
+      // feature is OFF the bridge returns a clear "not enabled for this
+      // environment" error instead of a bare 404.
       target: "/api/v1/auth/admin/sso/request-domain-verification",
       params: [
         { name: "providerId", field: "provider_id", defaultFromRow: true, required: true },
@@ -3647,9 +3690,9 @@ var SysSsoProvider = ObjectSchema.create({
         description: "Add the DNS TXT record below at your domain\u2019s DNS provider, then run \u201CVerify Domain\u201D. The token is shown once.",
         acknowledge: "Done",
         fields: [
-          { path: "data.dnsRecordType", label: "Record type", format: "text" },
-          { path: "data.dnsRecordName", label: "Name / Host", format: "secret" },
-          { path: "data.dnsRecordValue", label: "Value", format: "secret" }
+          { path: "dnsRecordType", label: "Record type", format: "text" },
+          { path: "dnsRecordName", label: "Name / Host", format: "secret" },
+          { path: "dnsRecordValue", label: "Value", format: "secret" }
         ]
       }
     },