Setup → Positions editor: no Permission Sets field until the first save, an icon-only Save, Remove holder with no confirm, and a holder picker that offers a user removed from the organization (hotcrm#2194 R2-T2-U02) #13337

Activity

1. objectstack-fleet

   added

   area:accessPermissions that actually hold — RLS/FLS, sharing model, write-path guardsPermissions that actually hold — RLS/FLS, sharing model, write-path guards

   domain:uiobjectui ui stream: fix lands on the published library or apps — objectui execution seatobjectui ui stream: fix lands on the published library or apps — objectui execution seat

   enhancementNew feature or requestNew feature or request

   pm:queue

   priority:p3

   pm:dispatched

   and removed

   pm:queue

   on Oct 23, 2026
2. objectstack-fleet

   assigned

   os-sales

   on Oct 23, 2026
3. objectstack-fleet commented on Oct 23, 2026

   

   objectstack-fleetBot

   on Oct 23, 2026

   ContributorAuthor

   More actions

   Claim: card thread · domain:ui seat 1 (seat post #5560, project run by the Sales account) · 2026-10-23T15:55Z
   Session: session_012CTWKbr29Cs4nGxBaHStPb (a card thread of the project that runs domain:ui seat 1, dispatched by its coordinator; 由Sales账户的项目负责)
   Account: os-sales (the seat's linked user; the card's assignee from this stroke)
   Branch: claude/issue-13337-position-editor
   Worktree: objectui-issue-13337
   Domain: domain:ui
   Seat: domain:ui#1
   File surface: packages/app-shell/src/views/metadata-admin/PositionHoldersSection.tsx (Remove confirm, member-only picker), packages/app-shell/src/views/metadata-admin/ResourceEditPage.tsx (the Save button's visible label), packages/app-shell/src/views/metadata-admin/default-schemas.ts (the position create form's fields), the tests of each, .changeset/ (stop on breach; explain in the report)
   Container & model: M, mode:thread, model: default judgment tier (dispatch-gates --tier --repo objectstack-ai/objectui names no path-derived mandate for this surface), effort: high
   Clause-②: no
   Metadata-protocol: none
   Responsibility: n/a — not a defect card
   Thread-read: none
   Serial constraints cleared: open objectui PRs read at claim time are CI, release and dependency PRs (#13362, #13360, #13358, #13289, #13288, #13028, #11845, #11844); none touches these paths. Open claims in this lane: #13339 (Packages sheet, PackagesPage.tsx), #13384 and #13379 (ActionRunner), #13380 (public form), objectstack-ai/objectstack#25942 (list bulk action); none names these files.

   Plan, stated so the review can hold it to it:

   • Permission Sets on create: the position type declares no create field list, so the create form falls back to the required fields plus label, name and description, and the permissionSets row only appears after the first save. The position resource declares its create fields with permissionSets in them; the picker's catalog already loads in create mode because the served form declares ref-multi:permission.
   • Save labelled: the generic editor's Save shows the word next to the icon. Its accessible name and tooltip stay as they are (the shortcut hint and the refusal reasons ride on them).
   • Remove holder: a confirm that names the person and sends nothing until confirmed; Cancel writes nothing.
   • Holder picker: the server already refuses a position assignment whose user holds no sys_member row in the row's organization (objectstack grant-holder-membership-refusal, ruling A carried by objectstack#22226), but the picker lists every sys_user row the caller may read, and a platform administrator reads them all. The picker's candidates become the users the server's sys_member rows name in the active organization, read from the server when the picker opens and passed as the picker's hard filter. No active organization, or a composition that registers no sys_member, keeps today's list: the server judges no membership there either. No server change is needed.

   ---

   Generated by Claude Code
4. objectstack-fleet commented on Oct 23, 2026

   

   objectstack-fleetBot

   on Oct 23, 2026

   ContributorAuthor

   More actions

   os-dev-report

   {
     "issue": 13337,
     "status": "done",
     "branch": "claude/issue-13337-position-editor",
     "pr": "https://github.com/objectstack-ai/objectui/pull/13398",
     "session": "session_012CTWKbr29Cs4nGxBaHStPb",
     "premise_still_valid": true,
     "summary": "All four items, one PR, head c1fd0fc. (1) The position type registers createFields label, name, description, permissionSets, so New Position shows the served form's ref-multi:permission picker before the first save. (2) The shared metadata editor's Save draws its word beside the icon; aria-label and title stay the shortcut hint or the reason Save is withheld, so the existing pins that find Save by that name read the same button. (3) Remove holder opens an AlertDialog naming the person; nothing is sent until confirmed, Cancel writes nothing. (4) Add holder reads the active organization's sys_member rows (paged by 500) and hands their user ids to RecordPickerDialog as baseFilter; a refused read is said in the server's words and the picker stays shut; no active organization or no sys_member registered keeps today's list. No server change: objectstack's grant-holder-membership-refusal already refuses a non-member assignment and stands down in exactly those two cases. File surface: as claimed plus content/docs/guide/console.md (the Setup Positions row, AGENTS objectstack-ai/objectui#2), told to the seat before the push.",
     "tests": "New: PositionHoldersSection.confirmAndMembers-13337.test.tsx (8 tests: confirm names holder, Cancel writes nothing, confirm deletes, membership read + filter, paging 0/500, refused read, empty org, no active org, no sys_member registered) and ResourceEditPage.positionCreate-13337.test.tsx (3 tests: Permission Sets on New Position with the registry read, CONTROL delegatable not in the create form, Save word + unchanged name and title). Moved pin: PositionHoldersSection.test.tsx remove test now confirms first. Ablation: createFields registration replaced by undefined on disk, the two create-form tests fail (2 failed, 1 passed), file restored. pnpm exec vitest run packages/app-shell/src/views/metadata-admin/ :: exit 0 (590 files, 6498 passed, 1 skipped).",
     "gates": "Local: NODE_OPTIONS=--max-old-space-size=8192 pnpm exec turbo run type-check --filter=@object-ui/app-shell :: exit 0 (30 tasks); pnpm exec eslint on the 6 changed source and test files :: exit 0 (0 errors, warnings are the files' existing any style); control-byte grep over the diff :: no hits. CI on c1fd0fc: every check success (Build & E2E, Build Docs, Bundle Analysis, Changeset Bump Policy, Changeset Claim Re-read, Changeset Declaration, Changeset Fixed Group Check, Changeset Overwrite Report, Governed Surface Queue Guard, Line Citation Gate, Lint, Live E2E (informational), Repo Gates, Test, Test (dist pins), Test shards 1-16, Type Check, label); skipped: dependabot, Test (coverage), Test (coverage shard).",
     "dogfood_battery": "n/a — objectui; no `!` in the PR title and Clause-② no",
     "mcp_calls": "4 — github issue_read (get, get_comments) on objectui#13337; claude-code-remote add_repo, register_repo_root, subscribe_pr_activity (session tools, not GitHub writes). No MCP write tool.",
     "api_writes": "4 relay writes via scripts/pm on objectstack-ai/objectui — labels and assignee on objectstack-ai/objectui#13337 (label-write), claim comment 6369018114 (post-stamped), pr_create objectstack-ai/objectui#13398 with assignee os-sales (fleet-write dispatch), this report (post-stamped); plus git push of the branch",
     "open_questions": [],
     "out_of_scope_findings": ["carrier: none · noted, not filed — the permission set's Assigned Users section (AssignedUsersSection) has the same unconfirmed Remove and the same all-users picker; the server's membership refusal covers its writes too. Not in this card's scope; dedupe words: assigned users remove confirm, permission set holder picker members"]
   }

   ---

   Generated by Claude Code
5. objectstack-fleet

   closed this as completedin #13398on Oct 23, 2026
6. objectstack-fleet commented on Oct 23, 2026

   

   objectstack-fleetBot

   on Oct 23, 2026

   ContributorAuthor

   More actions

   LANDED

   objectui#13337 由 PR objectui#13398 合入 main，合并提交 3ec84bee506533b3ad95569f065d151032b120d4（2026-10-23T16:44Z，经合并队列）。记录于 2026-10-23T16:45Z。

   Seat: domain:ui#1

   落地内容：Setup → Positions 新建岗位时就能选权限集，一次保存即建好并绑定；编辑页的 Save 按钮带文字；移除持有人前先确认并写明是谁；添加持有人只列当前组织的成员。合并时 Fixes 已关本卡。

   撤下 pm:dispatched。席位核对见 PR comment 6369695227。
7. objectstack-fleet

   removed

   pm:dispatched

   on Oct 23, 2026