permission-matrix-edit-loop: the field-level half of the permission matrix is dead for every object (MetadataClient.get() does not unwrap the envelope)

[huangyiirene]

Symptom

The object-verb permission loop works, but the field-level half is dead for every object. Open /_console/apps/<app>/metadata/permission/<set> and expand any object row.

• Expected a field sub-table listing that object's fields with a readable/editable checkbox pair each.
• Actual "No fields registered for this object." and zero field checkboxes — for every object. Reproduced twice on fresh loads for two objects.

Not a data problem: the network shows GET /api/v1/meta/object/showcase_project → 200 carrying 21 fields.

Root cause

Located by the run. PermissionMatrixEditor.tsx ensureFields() does const obj = await client.get('object', objectName); const raw = obj?.fields; — but MetadataClient.get() (packages/data-objectstack/src/metadata-client.ts, ~L495-512) returns the raw server envelope with no unwrapping, and the framework answers {type, name, item:{…fields}}. So obj.fields is always undefined and every object reports zero fields. The client's own docblock (~metadata-client.ts:522) asserts the opposite ("the legacy get() returns the unwrapped body") — that is where the two sides disagree.

Not a stale bundle — the same code is on objectui origin/main (6d01319dd); the files live at packages/app-shell/src/views/metadata-admin/PermissionMatrixEditor.tsx and packages/data-objectstack/src/metadata-client.ts, both present on the default branch.

Collateral: the RLS CEL editor's field lint/autocomplete (loadObjectFields) is empty for the same reason.

Reproduction

1. Boot showcase + console; open /_console/apps/<app>/metadata/permission/<set>.
2. Expand any object row (e.g. showcase_project).
3. Observe "No fields registered for this object." with zero checkboxes, while the underlying GET /api/v1/meta/object/showcase_project returns 21 fields.

Suggested fix

Unwrap the envelope in ensureFields() (read obj.item.fields) or have MetadataClient.get() unwrap {type,name,item} to the body as its docblock at :522 already claims. Fix loadObjectFields in the RLS CEL editor the same way.

Source

Extracted from the QA run objectstack-ai/objectstack#7637 (framework 92f26f75, console 09987b6).

[huangyiirene]

New evidence from a later QA run — objectstack-ai/objectstack#7695 (permission-matrix-editor-ux, framework 92f26f75, console 09987b6). Not re-filed; it removes one candidate explanation for this defect.

The dead field sub-table is not the read-only gate. The runner rebooted with OS_METADATA_WRITABLE=permission and the editor became fully writable — Save present, all 864 checkboxes enabled — and the field sub-table still said "No fields registered for this object."

That matters because the read-only gate was the obvious alternative hypothesis, and it is now excluded by measurement: with writability proven on the same screen, the field half stays empty. The envelope-unwrapping root cause this card locates (MetadataClient.get() returning {type, name, item:{…}} while ensureFields() reads obj?.fields) is the remaining explanation, and it predicts exactly this — writability has no bearing on a read that resolves undefined.

Consequence for the checklist: four clauses of permission-matrix-editor-ux remain unexercisable live (the >6-field filter, the filter-scoped bulk, and Clear), since none of them has a field row to act on. They should be re-run as part of verifying this fix rather than treated as separately blocked.

Two neighbouring results from the same run, so they are not re-investigated:

• The read-only badge tracks the real writable computation, proven both ways — it is honest on this build/pin.
• The B3 responsive clause genuinely passes: measured at a 720px viewport the matrix is a 960px min-width table inside an overflow-x: auto container (scrollWidth 960 > clientWidth 720), and the Bulk column becomes fully visible after scrolling rather than being clipped.

---

Generated by Claude Code

[yinlianghui]

CLAIM — session_017Qqyix2QcnpUC9XeYVDzx3, branch claude/issue-4271-metadata-get-unwrap. Dispatching a dev agent now.

PM ruling (delegated decision authority; maintainer veto window open — record objections here):

1. Census first, then fix the CONTRACT side, not the consumers. MetadataClient.get()'s own docblock (:522) declares the unwrapped-body contract; the implementation broke it. Default direction: make get() honor its documented contract (unwrap {type,name,item} → the body), and in the SAME PR migrate every existing call site the census shows compensating by reading .item (they are currently correct-by-accident against a wrong implementation). Consumer-side unwrapping in ensureFields() alone is the lenient-consumer patch this repo keeps rejecting — it would leave a client whose docblock and behavior disagree for the next reader. If the census shows the envelope behavior is widely load-bearing (many deliberate .item readers, or external-package consumers that pin the envelope), STOP and report with the census — that inverts the economics and the docblock becomes the thing to fix.
2. Preserve non-envelope passthrough semantics measured: whatever get() does today for error shapes / already-unwrapped responses must be pinned unchanged; unwrap only the {type,name,item} envelope shape.
3. Fix both named consumers through the repaired contract: ensureFields() (the field sub-table — the card's headline) and the RLS CEL editor's loadObjectFields (the collateral). Red-first with the card's repro shape: a mocked {type,name,item:{fields:[…21]}} answer currently yields "No fields registered for this object." and zero checkboxes.
4. Changeset by precedent: get()'s published behavior moves for existing callers ⇒ MINOR for @object-ui/data-objectstack (the fix(list): OBJECT_API_DISABLED renders an honest cannot-work state instead of the empty state (#4408) #4495 find() resolve→reject precedent — behavior move, minor, fixed group allows it). app-shell per its own .d.ts diff (expected patch).
5. Pins: the object-verb half of the matrix unchanged; fix(app-shell): the permission matrix models the artifact tier — no Save that 403s on multi-env kernels (#4518) #4525's artifact-tier pins and fix(app-shell): package-door permission save carries every editor-authorable facet (#4302) #4534's facet-carry pins stay green; every migrated call site pinned at its new read.

Mutual exclusion: ⛔ #4306 is IN FLIGHT and owns inspector-registry.ts, ObjectFieldInspector.tsx, StudioDesignSurface.tsx, ResourceEditPage.tsx — if the census requires editing ANY of those four files, STOP and report rather than touching them. No gate needed otherwise: #4534 (armed) touched only permission-slice.ts, zero file overlap. Disjoint from #4272 (fields/plugin-grid/plugin-gantt), #4006 (fields/plugin-editor config), #4529 (plugin-charts).

---

Generated by Claude Code

---

Generated by Claude Code