From db3e595bd2e220f45eabd9fcd05282b5889b85ac Mon Sep 17 00:00:00 2001 From: os-zhuang Date: Sat, 11 Jul 2026 22:06:17 +0800 Subject: [PATCH 1/2] fix(platform-objects): sys_sso_provider resultDialog paths address the inner data payload MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The console action runtime unwraps the `{ success, data }` response envelope before resolving `resultDialog` field paths (matching create_user, two-factor and OAuth). sys_sso_provider's domain-verification dialog was the only spec written with a `data.` prefix — it compensated for a runtime bug where apiHandler leaked the whole envelope. Once apiHandler unwraps correctly (objectstack-ai/objectui), that prefix double-nests and blanks the DNS-record dialog. Drop the prefix (`data.dnsRecordType` → `dnsRecordType`, …) so the paths are relative to the inner data like every other object. Adds a regression assertion. Release-coupled with the objectui apiHandler fix — ship together. Co-Authored-By: Claude Opus 4.8 --- .../src/identity/sys-sso-provider.object.ts | 16 ++++++++++------ .../src/platform-objects.test.ts | 18 ++++++++++++++++++ 2 files changed, 28 insertions(+), 6 deletions(-) diff --git a/packages/platform-objects/src/identity/sys-sso-provider.object.ts b/packages/platform-objects/src/identity/sys-sso-provider.object.ts index 902590ea32..c51446cc3e 100644 --- a/packages/platform-objects/src/identity/sys-sso-provider.object.ts +++ b/packages/platform-objects/src/identity/sys-sso-provider.object.ts @@ -132,9 +132,13 @@ export const SysSsoProvider = ObjectSchema.create({ // for a one-time DNS-TXT challenge and reveals the ready-to-paste record // ONCE via `resultDialog`. Routed through the env bridge (plugin-auth / // cloud AuthProxyPlugin) which reshapes the `{domainVerificationToken}` - // response into the `{ data: { dnsRecordName, dnsRecordValue } }` envelope - // the dialog reads. When the feature is OFF the bridge returns a clear - // "not enabled for this environment" error instead of a bare 404. + // response into a `{ success, data: { dnsRecordName, dnsRecordValue } }` + // envelope. The console action runtime unwraps that envelope, so the + // `resultDialog` field paths are relative to the inner `data` payload + // (`dnsRecordName`, not `data.dnsRecordName`) — consistent with every + // other object's resultDialog (create_user, two-factor, OAuth). When the + // feature is OFF the bridge returns a clear "not enabled for this + // environment" error instead of a bare 404. target: '/api/v1/auth/admin/sso/request-domain-verification', params: [ { name: 'providerId', field: 'provider_id', defaultFromRow: true, required: true }, @@ -146,9 +150,9 @@ export const SysSsoProvider = ObjectSchema.create({ 'Add the DNS TXT record below at your domain’s DNS provider, then run “Verify Domain”. The token is shown once.', acknowledge: 'Done', fields: [ - { path: 'data.dnsRecordType', label: 'Record type', format: 'text' }, - { path: 'data.dnsRecordName', label: 'Name / Host', format: 'secret' }, - { path: 'data.dnsRecordValue', label: 'Value', format: 'secret' }, + { path: 'dnsRecordType', label: 'Record type', format: 'text' }, + { path: 'dnsRecordName', label: 'Name / Host', format: 'secret' }, + { path: 'dnsRecordValue', label: 'Value', format: 'secret' }, ], }, }, diff --git a/packages/platform-objects/src/platform-objects.test.ts b/packages/platform-objects/src/platform-objects.test.ts index bd14800696..5e7ffb6f58 100644 --- a/packages/platform-objects/src/platform-objects.test.ts +++ b/packages/platform-objects/src/platform-objects.test.ts @@ -14,6 +14,7 @@ import { SysOrganization, SysScimProvider, SysSession, + SysSsoProvider, SysTeam, SysTeamMember, SysTwoFactor, @@ -172,6 +173,23 @@ describe('@objectstack/platform-objects', () => { expect(SysOauthApplication.enable?.apiMethods).not.toContain('update'); expect(SysOauthApplication.enable?.apiMethods).not.toContain('create'); }); + + it('SysSsoProvider request_domain_verification resultDialog paths address the inner data payload (no `data.` prefix)', () => { + // The console action runtime unwraps the `{ success, data }` envelope + // before resolving resultDialog field paths (same as create_user, + // two-factor and OAuth). These paths must therefore be relative to the + // INNER data — a `data.` prefix double-nests and blanks the dialog. + // Regression guard for the "temporary password / DNS record shows empty" + // class of bug. + const action = (SysSsoProvider.actions ?? []).find( + (a) => a.target === '/api/v1/auth/admin/sso/request-domain-verification', + ); + expect(action?.resultDialog?.fields?.map((f) => f.path)).toEqual([ + 'dnsRecordType', + 'dnsRecordName', + 'dnsRecordValue', + ]); + }); }); describe('SETUP_APP (ADR-0029 D7 shell)', () => { From 774d5277b2fc882373f31fade54047d5b20d884f Mon Sep 17 00:00:00 2001 From: os-zhuang Date: Sat, 11 Jul 2026 22:09:29 +0800 Subject: [PATCH 2/2] chore: add changeset Co-Authored-By: Claude Opus 4.8 --- .changeset/sso-resultdialog-inner-data-path.md | 9 +++++++++ 1 file changed, 9 insertions(+) create mode 100644 .changeset/sso-resultdialog-inner-data-path.md diff --git a/.changeset/sso-resultdialog-inner-data-path.md b/.changeset/sso-resultdialog-inner-data-path.md new file mode 100644 index 0000000000..d68e03a2b9 --- /dev/null +++ b/.changeset/sso-resultdialog-inner-data-path.md @@ -0,0 +1,9 @@ +--- +'@objectstack/platform-objects': patch +--- + +`sys_sso_provider` domain-verification `resultDialog` paths now address the +inner `data` payload (`dnsRecordType`, not `data.dnsRecordType`), matching every +other object. Pairs with the objectui `apiHandler` envelope-unwrap fix +(objectui#2396) — the old `data.` prefix compensated for a runtime bug and would +blank the dialog once the runtime unwraps correctly.