@objectstack/platform-objects 14.3.0 → 14.6.0

package/dist/identity/index.js

@@ -10,6 +10,15 @@ var SysUser = data.ObjectSchema.create({
   icon: "user",
   isSystem: true,
   managedBy: "better-auth",
+  // ADR-0092 D4 — the ONE generic affordance opened on an identity table:
+  // standard row editing. Safe because the plugin-auth identity write guard
+  // (ADR-0092 D2) enforces the profile whitelist server-side — a user-context
+  // update may only touch SYS_USER_PROFILE_EDIT_FIELDS ({name, image});
+  // everything else is stripped/rejected regardless of what a form submits.
+  // The permission layer still decides WHO may edit (platform admins only by
+  // default; member/org-admin sets keep allowEdit: false). create / import /
+  // delete stay bucket-default (off).
+  userActions: { edit: true },
   // ADR-0010 §3.7 — identity table is managed by better-auth; schema must not drift.
   protection: {
     lock: "full",
@@ -57,15 +66,17 @@ var SysUser = data.ObjectSchema.create({
     // These actions hit /api/v1/auth/admin/* endpoints that are only
     // wired when `auth.plugins.admin` is enabled. When the plugin is
     // disabled the actions still render (schema is static) but server
-    // returns 404. UI surfaces them under the row menu so platform
-    // admins can manage accounts without dropping to SQL or
+    // returns 404. UI surfaces them under the row menu AND the
+    // record-detail header (`record_header`, overflowing into the ⋯
+    // "More" menu) so platform admins can manage an account from either
+    // the Users list or an open user record — without dropping to SQL or
     // a custom Setup wizard.
     {
       name: "ban_user",
       label: "Ban User",
       icon: "ban",
       variant: "danger",
-      locations: ["list_item"],
+      locations: ["list_item", "record_header"],
       type: "api",
       target: "/api/v1/auth/admin/ban-user",
       recordIdParam: "userId",
@@ -81,7 +92,7 @@ var SysUser = data.ObjectSchema.create({
       label: "Unban User",
       icon: "check-circle-2",
       variant: "secondary",
-      locations: ["list_item"],
+      locations: ["list_item", "record_header"],
       type: "api",
       target: "/api/v1/auth/admin/unban-user",
       recordIdParam: "userId",
@@ -96,7 +107,7 @@ var SysUser = data.ObjectSchema.create({
       label: "Unlock Account",
       icon: "lock-open",
       variant: "secondary",
-      locations: ["list_item"],
+      locations: ["list_item", "record_header"],
       type: "api",
       target: "/api/v1/auth/admin/unlock-user",
       recordIdParam: "userId",
@@ -130,7 +141,12 @@ var SysUser = data.ObjectSchema.create({
           label: "Phone Number",
           type: "text",
           required: false,
-          helpText: "Sign-in phone number (E.164, e.g. +8613800000000). Required when no email is given."
+          helpText: "Sign-in phone number (E.164, e.g. +8613800000000). Required when no email is given.",
+          // Only offer phone when the opt-in phoneNumber auth plugin is loaded —
+          // otherwise the create-user endpoint rejects a phone with
+          // "Phone numbers require the phoneNumber auth plugin". `features.phoneNumber`
+          // is served in /api/v1/auth/config (getPublicConfig).
+          visible: "features.phoneNumber == true"
         },
         { field: "name", required: false },
         {
@@ -164,7 +180,7 @@ var SysUser = data.ObjectSchema.create({
       label: "Set Password",
       icon: "key-round",
       variant: "secondary",
-      locations: ["list_item"],
+      locations: ["list_item", "record_header"],
       type: "api",
       // #2766 V1 — same path as better-auth's stock route, but served by the
       // plugin-auth wrapper registered ahead of the catch-all: it accepts the
@@ -206,7 +222,7 @@ var SysUser = data.ObjectSchema.create({
       label: "Set Platform Role",
       icon: "shield-check",
       variant: "secondary",
-      locations: ["list_item"],
+      locations: ["list_item", "record_header"],
       type: "api",
       target: "/api/v1/auth/admin/set-role",
       recordIdParam: "userId",
@@ -221,7 +237,7 @@ var SysUser = data.ObjectSchema.create({
       label: "Impersonate User",
       icon: "user-cog",
       variant: "secondary",
-      locations: ["list_item"],
+      locations: ["list_item", "record_header"],
       type: "api",
       target: "/api/v1/auth/admin/impersonate-user",
       recordIdParam: "userId",
@@ -445,20 +461,28 @@ var SysUser = data.ObjectSchema.create({
       maxLength: 255,
       group: "Identity"
     }),
+    // ADR-0092 D4 — with the generic edit affordance open, every non-profile
+    // field is readonly so the standard edit form renders it non-editable.
+    // This is UX only; the server boundary is the plugin-auth identity write
+    // guard (ADR-0092 D2), which strips/rejects these regardless.
     email: data.Field.email({
       label: "Email",
       required: true,
+      readonly: true,
+      // login identity — change flows through better-auth change-email verification
       searchable: true,
       group: "Identity"
     }),
     email_verified: data.Field.boolean({
       label: "Email Verified",
       defaultValue: false,
+      readonly: true,
       group: "Identity"
     }),
     two_factor_enabled: data.Field.boolean({
       label: "Two-Factor Enabled",
       defaultValue: false,
+      readonly: true,
       group: "Identity",
       description: "Whether two-factor authentication is enabled for this user. Maintained by the better-auth `twoFactor` plugin."
     }),
@@ -466,6 +490,8 @@ var SysUser = data.ObjectSchema.create({
     role: data.Field.text({
       label: "Platform Role",
       required: false,
+      readonly: true,
+      // ADR-0092 — set via the Set Platform Role action, never the edit form
       maxLength: 64,
       group: "Admin",
       description: "Platform-level role (admin, user, \u2026). Set via the Set Platform Role action."
@@ -473,18 +499,24 @@ var SysUser = data.ObjectSchema.create({
     banned: data.Field.boolean({
       label: "Banned",
       defaultValue: false,
+      readonly: true,
+      // ADR-0092 — toggled via Ban/Unban actions (session side effects)
       group: "Admin",
       description: "When true, the user cannot sign in. Toggle via Ban User / Unban User actions."
     }),
     ban_reason: data.Field.text({
       label: "Ban Reason",
       required: false,
+      readonly: true,
+      // ADR-0092 — written by the Ban User action
       maxLength: 255,
       group: "Admin"
     }),
     ban_expires: data.Field.datetime({
       label: "Ban Expires",
       required: false,
+      readonly: true,
+      // ADR-0092 — written by the Ban User action
       group: "Admin",
       description: "When set, the ban auto-clears at this time."
     }),
@@ -580,6 +612,8 @@ var SysUser = data.ObjectSchema.create({
     ai_access: data.Field.boolean({
       label: "AI Access",
       defaultValue: false,
+      readonly: true,
+      // ADR-0092 — a licensed-seat grant; flows through the AiSeatPlugin enforcement path
       group: "Admin",
       description: "Whether this user holds an AI seat \u2014 grants access to the in-UI AI agents (build / ask). The framework synthesizes the `ai_seat` capability from this flag (plugin-hono-server resolveCtx). Assignment is capped by the licensed / purchased seat count (enforced by @objectstack/security-enterprise AiSeatPlugin). Owned by objectql (better-auth is oblivious to this column)."
     }),
@@ -593,12 +627,16 @@ var SysUser = data.ObjectSchema.create({
     manager_id: data.Field.lookup("sys_user", {
       label: "Manager",
       required: false,
+      readonly: true,
+      // ADR-0092 — drives own_and_reports RLS scope; org-structure maintenance is its own surface
       group: "Organization",
       description: "This user's direct manager. Forms the reporting chain the `own_and_reports` hierarchy scope walks (ADR-0057 / @objectstack/security-enterprise)."
     }),
     primary_business_unit_id: data.Field.lookup("sys_business_unit", {
       label: "Primary Business Unit",
       required: false,
+      readonly: true,
+      // ADR-0092 — denormalised projection maintained by plugin-sharing; never hand-edited
       group: "Organization",
       description: "The user's primary business unit \u2014 a denormalised projection of sys_business_unit_member.is_primary, maintained by plugin-sharing (ADR-0057 addendum D12). Lets a user-lookup filter candidates by business unit without traversing the membership junction. Do not edit directly; set it via business-unit membership."
     }),
@@ -2618,6 +2656,12 @@ var SysDeviceCode = data.ObjectSchema.create({
   icon: "key-round",
   isSystem: true,
   managedBy: "better-auth",
+  // ADR-0057: device codes are dead the moment `expires_at` passes — keep a
+  // 1d grace for post-mortem, then reap.
+  lifecycle: {
+    class: "transient",
+    ttl: { field: "expires_at", expireAfter: "1d" }
+  },
   // [ADR-0066 D2/④] Secure-by-default: rows are LIVE pending device-grant
   // codes — reading `user_code`/`device_code` lets an attacker hijack a
   // pending CLI login. Not covered by the wildcard `'*'` grant; admins retain
@@ -3636,9 +3680,13 @@ var SysSsoProvider = data.ObjectSchema.create({
       // for a one-time DNS-TXT challenge and reveals the ready-to-paste record
       // ONCE via `resultDialog`. Routed through the env bridge (plugin-auth /
       // cloud AuthProxyPlugin) which reshapes the `{domainVerificationToken}`
-      // response into the `{ data: { dnsRecordName, dnsRecordValue } }` envelope
-      // the dialog reads. When the feature is OFF the bridge returns a clear
-      // "not enabled for this environment" error instead of a bare 404.
+      // response into a `{ success, data: { dnsRecordName, dnsRecordValue } }`
+      // envelope. The console action runtime unwraps that envelope, so the
+      // `resultDialog` field paths are relative to the inner `data` payload
+      // (`dnsRecordName`, not `data.dnsRecordName`) — consistent with every
+      // other object's resultDialog (create_user, two-factor, OAuth). When the
+      // feature is OFF the bridge returns a clear "not enabled for this
+      // environment" error instead of a bare 404.
       target: "/api/v1/auth/admin/sso/request-domain-verification",
       params: [
         { name: "providerId", field: "provider_id", defaultFromRow: true, required: true },
@@ -3649,9 +3697,9 @@ var SysSsoProvider = data.ObjectSchema.create({
         description: "Add the DNS TXT record below at your domain\u2019s DNS provider, then run \u201CVerify Domain\u201D. The token is shown once.",
         acknowledge: "Done",
         fields: [
-          { path: "data.dnsRecordType", label: "Record type", format: "text" },
-          { path: "data.dnsRecordName", label: "Name / Host", format: "secret" },
-          { path: "data.dnsRecordValue", label: "Value", format: "secret" }
+          { path: "dnsRecordType", label: "Record type", format: "text" },
+          { path: "dnsRecordName", label: "Name / Host", format: "secret" },
+          { path: "dnsRecordValue", label: "Value", format: "secret" }
         ]
       }
     },