[objectstack-fleet]

Requested by Steedos · project thread

Fixes #29102

Clause-②: no
Metadata-protocol: none

维护者速读

• 改了什么:没有 Setup 应用权限的普通成员打开 Setup 下的新建表单(/apps/setup/sys_user/new 这类别名地址)时,现在看到与同一对象列表页相同的「无权访问此应用」页面;规范地址 /apps/com.objectstack.setup/OBJECT/new 也是同一页面。
• 为什么改:上一张卡只拦了列表路由,新建表单仍会套着默认应用的顶栏和侧栏显示,地址栏写着 setup,像进了管理后台。
• 风险与回滚:只改界面判定,服务端对每次写入的权限判定不变;管理员不受影响(不发起探测)。审批收件箱链接到的记录页 /apps/setup/OBJECT/record/ID 按 objectui#12706 的未决决定保持原样。回滚即还原本 PR。
• 先看:ui/packages/app-shell/src/console/AppContent.tsx(OBJECT_COLLECTION_ROUTE_PATHS 新增的 :objectName/new 一行)。
• 两分钟验证:pnpm --dir ui exec vitest run packages/app-shell/src/console/__tests__/AppContent.setupObjectListVerdict-28988.test.tsx,预期 16 个用例全绿。
• 需要你做的:无,席位落地。

What changes

• The route set that waits on the Setup app's access verdict under the setup alias now includes the create form, :objectName/new, beside the list routes console: a member refused the Setup app still gets /apps/setup/OBJECT routes rendered inside another app's shell — the alias spelling skips the app verdict #27507 added #28988 added (:objectName, :objectName/view/:viewId, :objectName/data). A denied verdict draws app-access-denied and the form never mounts.
• The set and its matcher are renamed for what they now hold, the object routes that name no record: OBJECT_LIST_ROUTE_PATHS becomes OBJECT_COLLECTION_ROUTE_PATHS, isObjectListAppRoute becomes isObjectCollectionAppRoute, and isSetupObjectListRoute becomes isSetupObjectCollectionRoute. Matching is unchanged: by route rank against APP_ROUTE_METADATA_READS plus the host's routes, so a static or host route under the Setup segment is never read as one.
• Record routes (OBJECT/record/ID, its /edit and /page/NAME, and the OBJECT/ID shorthand) stay outside the gate, as objectui#12706 leaves them. No metadata key or option is added.

Why

/apps/setup is a pseudo-route, so an unmatched setup segment falls back to the launcher's default app unless appSurfaceAwaitsVerdict names the sub-route. After #28988 it named the list routes only, so a refused member on /apps/setup/OBJECT/new got the create form inside the default app's chrome. The create form names no record, so no approvals-inbox link lands on it. The canonical /apps/com.objectstack.setup/OBJECT/new is an ordinary unmatched app and already drew the refusal; it is pinned here so both spellings stay the same.

Tests

• AppContent.setupObjectListVerdict-28988.test.tsx gains a stubbed RecordFormPage (counted like the other page stubs) and four cases:
  • A refused caller gets app-access-denied, no ConsoleLayout and no page mounted, on /apps/setup/sys_user/new, /apps/setup/showcase_task/new and /apps/com.objectstack.setup/sys_user/new. The one by-name probe is the app the URL names, and the URL is left as typed.
  • Control: an admitted caller gets the create form (mode="create") under Setup, unprobed.
  • The existing control that a refused caller still opens the record page the approvals inbox links to (/apps/setup/sys_user/record/usr_000001) passes unchanged, as do the objectui#12706 file's inbox controls.
• Red on main: with AppContent.tsx at c44c8ac4 and the new tests unchanged, the two alias cases fail (Tests 2 failed, 14 passed). The package-id case and the controls pass there.

Acceptance notes

• The canonical spelling needed no code change; the test pins it so the two spellings cannot drift apart again.
• Record routes under the Setup segment are untouched, per the claim and objectui#12706.

Verification

Local runs

Head 83289601 (fix ead56761 plus a merge of main at 49aba82b; base c44c8ac4). The suites below marked "merged head" ran on 83289601; the rest ran on ead56761, and the merge brought nothing into ui/packages/app-shell/src/console/AppContent.tsx or its tests.

• Prerequisite build under the verify lock: turbo run build --filter='@object-ui/app-shell^...' plus formula, sdui-parser, lint and client, 64 of 64 tasks.
• The edited file with the Setup routes refuse a plain member three different ways: the settings hub says "No settings registered", a settings page shows a raw capability error inside the Showcase shell, while the Setup app root shows the proper no-access page #27507, objectui#12706 and Setup: retire Setup → Metadata behind redirects into Studio (datasource kept) and retire Packaged automation's flows half; Studio stops linking into Setup #28578 Setup verdict files: Test Files 4 passed, Tests 119 passed.
• Red on main (AppContent.tsx at c44c8ac4, restored to the HEAD blob afterwards, git diff HEAD empty): Tests 2 failed, 14 passed.
• Every packages/app-shell test file that names AppContent (git grep -l, 93 files), on ead56761 and again on the merged head after rebuilding the closure: Test Files 93 passed, Tests 777 passed, both times. A narrowing of app-shell's suite; CI's Test UI shards run the rest.
• turbo run type-check --filter=@object-ui/app-shell (its script also runs tsc -p tsconfig.test.json, so the test is compiled): 65 of 65 tasks.
• node scripts/pm/dispatch-gates.mjs --commands: 34 derived commands, each exit 0, among them check-sdui-manifest.mjs, check-changeset-no-major.mjs --base origin/main, check:type-check-debt, check:published-files, check:nul-bytes and pnpm --dir ui exec vitest run scripts/ (Test Files 169 passed, 2 skipped; Tests 4900 passed, 2 skipped). --ran reconciliation: 34 derived, 34 run, 0 NOT-MEASURED. The derivation on the merged head is identical, and the PR-body and changeset gates were run again there against this body. pnpm check:new-line-citations: 0 new citations.
• Not measured: a browser run of the built Console as a real member. The test drives the real adapter's probe over the server's 403 envelope.

Human Minimum

• 1. Schemas start as Zod; packages/spec holds no runtime logic. (packages/spec not touched.)
• 2. Every name I added uses the casing for its kind.
• 3. No formatter ran; pnpm lint is CI's run.
• 4. One issue, one branch off an up-to-date main, one pull request.
• 5. A change that publishes carries a changeset, and both declaration lines are filled in here and in the changeset.
• 6. packages/spec touched: not applicable.
• 7. No hand edits to content/docs/references/, packages/*/CHANGELOG.md or content/docs/releases/.
• 8. Title, body and comments are in English (the 维护者速读 section is the Chinese summary the repo asks for).

🤖 Generated with Claude Code

https://claude.ai/code/session_01QsR2jU9jKHFCJuQuuKRtpX

---

Generated by Claude Code

[objectstack-fleet]

domain:ui#2 · zhuangjianguo · session_01QsR2jRFuJz9QBZqPVHYVhJ

维护者速读

• 改了什么：没有 Setup 应用权限的普通成员打开 Setup 下的新建表单（如 /apps/setup/sys_user/new）时，现在看到与同一对象列表页相同的「无权访问此应用」页面；规范地址 /apps/com.objectstack.setup/OBJECT/new 也是同一页面。
• 为什么改：console: a member refused the Setup app still gets /apps/setup/OBJECT routes rendered inside another app's shell — the alias spelling skips the app verdict #27507 added #28988 只拦了列表路由，新建表单仍会套着默认应用的顶栏和侧栏显示，地址栏写着 setup，像进了管理后台。
• 风险与回滚：只改界面判定（路由集合加一行 :objectName/new 并改名），服务端对每次写入的权限判定不变；管理员不受影响、不发起探测。审批收件箱链接到的记录页按 objectui#12706 保持原样。回滚即还原本 PR。
• 先看：ui/packages/app-shell/src/console/AppContent.tsx 的 OBJECT_COLLECTION_ROUTE_PATHS。
• 两分钟验证：pnpm --dir ui exec vitest run packages/app-shell/src/console/__tests__/AppContent.setupObjectListVerdict-28988.test.tsx，预期全绿。
• 需要你做的：无，席位验收后进合并队列。

席位意见： 改动最小：判定集合加一条新建表单路径，函数改名以名副其实；记录页不动。新用例在 main 上红 2 个、修复后全绿，另有管理员对照用例。无公开面变化，Clause-②: no 成立。

席位核对 — ACCEPT · domain:ui#2 · head 83289601 · 2026-11-02T10:21Z

• 形态: draft PR on main, Fixes #29102 on its own line and no other card number beside a closing keyword. 3 files, +73/−17, Tier S (check-governed-merges --pr 29237: 0 of 3 paths governed, 90 lines ≤ 3000). All inside claim 6573240533's surface.
• 前提实测: at origin/main, OBJECT_LIST_ROUTE_PATHS held only :objectName, :objectName/view/:viewId and :objectName/data, so /apps/setup/OBJECT/new never awaited the verdict (seat read). The new alias cases are red 2 of them on main's AppContent.tsx and green on this head (dev run). The canonical package-id spelling already refused on main and is now pinned.
• 门禁 check-runs (pinned to head 832896011177cdfe1ebd8b3173c8efbbbff38ddd): 44 success, 11 skipped, 0 failed, 0 pending, including Lint & Repo Gates, TypeScript Type Check, Type Check UI, Lint UI, Check Changeset and Test UI. Dev local gates: 34/34 derived families exit 0, --ran 0 NOT-MEASURED; 93 AppContent test files 777/777.
• 接受的偏差: the cases extend the console: a member refused the Setup app still gets /apps/setup/OBJECT routes rendered inside another app's shell — the alias spelling skips the app verdict #27507 added #28988 verdict file instead of a new file, which keeps one suite for the one predicate. The merged-head re-run was the scoped set; CI ran the full suites on this head.
• 范围外去向: none reported. No Skills-docs: line is owed.
• 落地条款: Clause-②: no (isObjectCollectionAppRoute and the set are module-private), so no contract review is owed. mergeable_state is clean. Land by pr_ready + automerge_enable.