fix(plugin-security): mask read-protected fields on write responses (FLS leak)

[os-zhuang]

What

Field-level security masking ran only on find/findOne results. The record echoed back by a write (insert/update) was never masked, so a caller with edit-but-not-field-read could PATCH/POST a record and read a read-protected field back out of the mutation response.

Field writes to protected fields were already denied (detectForbiddenWrites), so this is purely a read leak on the response image. The mask now covers insert/update results too — matching read behavior.

packages/plugins/plugin-security/src/security-plugin.ts — extend the op allow-list on the post-next() masking block from ['find','findOne'] to ['find','findOne','insert','update'].

How it was found

Dogfooding the permission stack end-to-end as an admin, in the browser:

1. Studio → built a leave_request object + 请假中心 app in a writable package.
2. Access pillar → 员工请假权限 (CRU, hr_note readable:false) and 人事请假权限 (full CRUD + view/modify-all, hr_note readable).
3. Setup → created real users, assigned the permission sets.
4. Drove the REST API as each identity.

Employee 张三 (hr_note not readable):

• GET list / by-id → hr_note correctly stripped ✅
• PATCH (editing an allowed field) → response included hr_note with the sensitive value ❌

Verification

• New regression tests (update + insert echoed record) — fail without the fix, pass with it.
• Full plugin-security suite: 129 passed.
• Live end-to-end on a running showcase app after rebuild+restart:
  • 张三 PATCH response no longer contains hr_note ✅
  • 李四 (hr_note readable) PATCH response still contains hr_note — no regression for authorized readers ✅
  • 张三 writing hr_note still 403 — write-protection intact ✅

🤖 Generated with Claude Code

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
spec	Ready	Preview, Comment	Jul 8, 2026 4:05pm

[github-actions]

📓 Docs Drift Check

This PR changes 1 package(s): @objectstack/plugin-security.

11 hand-written doc(s) reference the affected code and may need an implementation-accuracy re-verification:

• content/docs/getting-started/cli.mdx (via @objectstack/plugin-security)
• content/docs/permissions/access-recipes.mdx (via packages/plugins/plugin-security)
• content/docs/permissions/authorization.mdx (via packages/plugins/plugin-security)
• content/docs/permissions/permission-sets.mdx (via packages/plugins/plugin-security)
• content/docs/permissions/permissions-matrix.mdx (via packages/plugins/plugin-security)
• content/docs/permissions/sharing-rules.mdx (via @objectstack/plugin-security)
• content/docs/plugins/index.mdx (via @objectstack/plugin-security)
• content/docs/plugins/packages.mdx (via @objectstack/plugin-security)
• content/docs/releases/implementation-status.mdx (via @objectstack/plugin-security)
• content/docs/ui/dashboards.mdx (via @objectstack/plugin-security)
• content/docs/ui/role-based-interfaces.mdx (via packages/plugins/plugin-security)

Advisory only. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs origin/main → pass the list as args.docs.