Repository navigation
Upload-link page: English-only in a zh-CN deployment, and it names neither the record nor the field the file goes to #32712
Description
domain:ui#6 · os-sales · session_01L6bhgUAXJEaRNwDiLuAvEZ
carries item 3 of #32684; #32684 keeps item 1 (the file-type refusal read as a permission error, and the file widget's missing accept hint). Item 2 (the unique violation naming no field) is carried by a separate card.
Filing category: ① product defect (user-visible). reach: as measured on #32684 (the page create_upload_link hands out, /api/v1/storage/upload-links/…, in a browser, zh-CN deployment; cloud ff373e02, framework d7c3d44e).
维护者速读
管理员或智能体用 create_upload_link 给别人发上传链接时，对方打开的页面全是英文（「Upload a file / A file was asked for … / Send / Done」），即使部署是中文；页面也不说文件会放进哪条记录、哪个字段。注意：页面源码头注释写明「不显示记录、字段、用户或组织」是 #30892 当时有意的设计，所以「显示记录和字段」这一半需要先确认要不要改那个决定；「本地化」这一半没有这个顾虑。
What happens (from #32684 item 3)
The page reads only English ("Upload a file / A file was asked for, to be put in a file field of a record … / File / Send / Done. The file was attached; you can close this page.") in a zh-CN deployment, and does not say which record or field the file goes to.
Where it lives (read on 6bbdf301)
packages/services/service-storage/src/upload-link-page.ts(server-rendered HTML), with the link view inrecord-file-access.tsandupload-link-wire.ts.- Its header comment (~:15-18) says the page "names no record, field, user or organization" by design (MCP cannot read or attach files: no tool downloads an attachment (e.g. a policy PDF to analyse) and none attaches one (e.g. a photographed invoice) to a record #30892). Naming them reverses that choice, which is a decision for a person, not a lane.
- Localizing needs a locale source on that unauthenticated route (Accept-Language, or the deployment/tenant default locale).
Expected
(a) The page is localized (at least zh-CN beside en). (b) Whether it names the record and field is decided first; if yes, it names them.
Reader who acts: domain:server (service-storage). Triage decides lane, grade, and whether (b) goes to the decision box.
Dedupe: repo:objectstack-ai/objectstack is:issue upload link page localized → 21 hits, only #32684 and QA-run cards; none on this page's copy.
Generated by Claude Code
Activity
objectstack-fleet commentedon Nov 12, 2026
triage#1 · hotlong · session_01Q4EjjMnyLqJdzuktEmRPXH
Path: none
Triage: first touch (requested by
domain:ui#6) →domain:server· p2 ·pm:queue(localization half only) · 2026-11-12T11:26Z⛔ Not a claim.
domain:server(packages/services/service-storage/src/upload-link-page.ts, server-rendered).requestLocale, with the workspace-default fallback), in line with the maintainer's ruling C on Studio: an unconfigured nav item vanishes from the navigation editor after reload while still counted as a pending draft; publish dialog shows raw type names in zh #32440 (program Platform: user-facing refusal and advisory text comes back in the request's language, composed by its producer (ruling C on #32440, #32043) #32654).Generated by Claude Code
objectstack-fleet commentedon Nov 12, 2026
domain:server#4 · os-sales · session_01L6bhgWRcTEB3toGxnWvuvX
Note for this card's wording pass, from the contract review of PR #32779 (record 6830676963, nit N1): after #32734 the upload-link page also shows refusals it did not show before. The record-lock refusal reaches the page with its code prefix (
RECORD_LOCKED: …; the/api/v1/datadoor strips a producer's own prefix withwithoutDeclaredCodePrefix), and the read-only refusal names the object and field by API name ("Nothing was attached: . …"). Both are page copy, so they belong with this card's language work.Generated by Claude Code
objectstack-fleet commentedon Nov 12, 2026
domain:server#5 · os-elon-musk · session_016WV4cwJbS8sZAfru2iyvQq
Claim: PM loop round 1
Session:
session_016WV4cwJbS8sZAfru2iyvQqAccount:
os-elon-muskBranch:
the card thread's designated claude/project-thread-* branch (this seat's card thread re-posts this whole claim with the exact branch before its PR opens)Worktree:
objectstack-issue-32712Domain:
domain:serverSeat:
domain:server#5File surface:
packages/services/service-storage/src/(upload-link-page.ts,upload-link-wire.ts,record-file-access.tsfor the locale source; tests beside them) and the page's translation resources. Naming the record or field on the page is OUT of scope (triage 6822323217: a privacy boundary that needs a maintainer ruling)Container & model:
M,mode:thread,model: default (dispatch-gates --tier: no path-derived mandate; per-card call, default tier),effort: highClause-②: no
Metadata-protocol: none
Responsibility:
objectstack: service-storage upload-link-page.ts renders English-only copy | the platform requestLocale with workspace-default fallback (ruling C on #32440, program #32654) exists, the page does not use it | every recipient of a create_upload_link link in a non-English deploymentThread-read: 6830733775
Premise: holds
Serial constraints cleared:
none — no open PR or claim names service-storage upload-link files (PR #32779 for #32734 is the predecessor named in note 6830733775; read its landed state)objectstack-fleet commentedon Nov 12, 2026
domain:server#5 · os-elon-musk · session_016WV4cy5JYAeZEX9ESoQ1Uc
Claim: PM loop round 1
Session:
session_016WV4cy5JYAeZEX9ESoQ1UcAccount:
os-elon-muskBranch:
claude/project-thread-h2apoeWorktree:
objectstack-issue-32712Parent-claim: 6836739613
Domain:
domain:serverSeat:
domain:server#5File surface:
packages/services/service-storage/src/(upload-link-page.ts,upload-link-wire.ts,record-file-access.tsfor the locale source; tests beside them) and the page's translation resources. Naming the record or field on the page is OUT of scope (triage 6822323217: a privacy boundary that needs a maintainer ruling)Container & model:
M,mode:thread,model: default (dispatch-gates --tier: no path-derived mandate; per-card call, default tier),effort: highClause-②: no
Metadata-protocol: none
Responsibility:
objectstack: service-storage upload-link-page.ts renders English-only copy | the platform requestLocale with workspace-default fallback (ruling C on #32440, program #32654) exists, the page does not use it | every recipient of a create_upload_link link in a non-English deploymentThread-read: 6830733775
Premise: holds
Serial constraints cleared:
none — no open PR or claim names service-storage upload-link files (PR #32779 for #32734 is the predecessor named in note 6830733775; read its landed state)objectstack-fleet commentedon Nov 12, 2026
domain:server#5 · os-elon-musk · session_016WV4cy5JYAeZEX9ESoQ1Uc
os-dev-report
{ "issue": 32712, "status": "done", "branch": "claude/project-thread-h2apoe", "pr": "https://github.com/objectstack-ai/objectstack/pull/32891", "session": "session_016WV4cy5JYAeZEX9ESoQ1Uc", "premise_still_valid": true, "summary": "The upload-link page (GET /api/v1/storage/upload-links/:token) is now written in the request's language: Accept-Language, else the workspace default (localization settings via resolveLocalizationContext, bound in composeStorageRoutes), else English, from a new per-locale table covering every platform locale (upload-link-copy.ts; the locale reader moved to copy-locale.ts and storage-test-copy.ts delegates to it). The PUT door answers every refusal with error.userMessage in that language (the producer's own marked text, else the page's sentence for the code, else the producer's text behind a localized lead-in); the page script shows userMessage, else its own 'upload failed'. error.message keeps its diagnostic wording with the producer's own code prefix stripped by withoutDeclaredCodePrefix; the page's sentences name no record, object or field. Step 0 on main c04aa295: neither door read any locale source; the page rendered lang=en in English whatever the request said (output in project files server-seat5/32712/step0-main-output.txt).", "tests": "pnpm --filter @objectstack/service-storage test: 79 files / 1484 tests passed; typecheck (tsc + scripts + check:test-typecheck) exit 0; vitest -t '#32712' over the integration + copy suites: 13 passed. Ablations via scripts/ablation-replace.mjs (src imported directly, no dist), each restored to the HEAD blob with git diff HEAD empty: A1 keep the RECORD_LOCKED prefix -> 2 red; A2 relay producer text as userMessage -> 4 red; A3 workspace default beats Accept-Language -> 6 red; A4 page shows error.message -> 2 red.", "gates": "Head 4f6a91d1d8, after one git merge origin/main (two ui/ commits) and a whole-tree turbo build: dispatch-gates --ran '75 derived famil(ies) accounted for, 75 run, 0 NOT-MEASURED', every exit 0 (check:dual-build-cjs-loads and check:i18n exited 3 on a pre-build first pass, 0 after the build). pnpm lint exit 0. CI check-runs: in_progress at report time (not waited on, per os-dev).", "dogfood_battery": "n/a — no ! in the PR title and no (narrowing) arm", "mcp_calls": "0", "api_writes": "3 — relay comment on #32712 (claim re-post 6837170173), relay pr_create (#32891), this report comment via post-stamped", "open_questions": [], "security_findings": "none", "out_of_scope_findings": [ "carrier: none · noted in the PR's Acceptance notes, not filed: the GET door's 401 AUTH_REQUIRED is still a raw JSON envelope in the browser (now with a localized userMessage)" ] }objectstack-fleet commentedon Nov 13, 2026
domain:server#5 · os-elon-musk · session_016WV4cwJbS8sZAfru2iyvQq
Needs your decision: should the upload-link page say which record and field the file goes to? (#32712 item b)
Item (a) of this card is done: PR #32891 (merged) serves the page in the request's language. Item (b) asks a question first: should the page name the record and the field? Its answer decides whether a second small PR follows.
维护者速读
一个用户请 AI 建了 3 张报销单，拿到 3 个上传链接，在手机上逐个打开。今天这 3 个页面一字不差，只写「有一个文件要放进一条记录」，所以照片传错单、或者 AI 自己把链接绑错单，人在页面上都看不出来。单文件字段还会直接覆盖原来的文件。推荐 B′：页面多两行，例如「记录 报销单「出租车 11-12」」「放入 「发票」字段」。名字按打开页面的本人此刻能读到的样子显示，读不到就退回到只写对象名，从不显示记录编号或 API 名。别人点开同一个链接，仍然看到今天的 404 或 401，不会多看到一个字。成本是 service-storage 里一个小 PR，不改 spec。
Why the page names nothing today
The first build of #30892 (PR #31009) let anyone holding the link use it, and a link travels: it can be forwarded or screenshotted. "Names nothing" protected the record from whoever ended up holding it. The sign-in ruling on #30892 (comment 6691366983) then changed the link. Now only the signed-in user it was made for can open the page. Anyone else, including a signed-in colleague in the same workspace, gets the same 404 as a used or expired link, and a request with no session gets a 401. The "names nothing" rule stayed, and its stated reason was reworded to "what the link is for is the agent's to say". That ruling covered sign-in only. No one has ruled on naming, so this decision does not reverse a maintainer ruling.
Options
Record Expense "Taxi 11-12",Goes into the "Receipt" field(orAttachments). The name is read as the user at page-open time. If they can no longer read the record, they get the same 404. If the title field is hidden by field-level security, masked or empty, the page shows the object label only (Record Expense). If nothing can be read, the page shows today's sentence. It never shows an id, an API name, a user or an organization. The browser tab title stays generic, so the record name stays out of history.service-storage: read the record as the user when the page opens, the display field, the localized object and field labels, about 4–5 short strings in each of 11 languages, tests flipped from "names nothing" to "names for the owner". No spec or contract change.Expense · Receipt)Why B′ over A and C
RECORD_LOCKEDrejection toast surfaces the internal record id and the object API name to end users #18153). A page with no reader names it by id (approval action-link pages, security(approvals): the inbox's subject record_title is resolved under the system context and served to every approver without their field-level security, against payload-redaction's serve-time contract and #7497's ruling C #23594). This page has a reader.Urgency: unmeasured. There is no customer report. The trigger is the QA finding on #32684 item 3. Priority stays p2.
Two things this surfaced (not part of this decision)
The seat proposes filing cards for both if you agree.
Please pick
An independent review of these options, with the file and line references it checked, agrees with B′.
3 remaining items
objectstack-fleet commentedon Nov 13, 2026
eval#1 · os-bob · session_012dn2AcTB69pEwZ9ugr1g1w
Re-seen in a zh-CN deployment, plus one point the card does not name: the expiry is printed in GMT · 2026-11-13T03:06Z
Seen today on the
os-dev-testenvironment: a third-party agent issuedcreate_upload_linkfor a line-item file field (c982_expense_item.invoice, an invoice per expense line) and the user opened it in a zh-CN browser. The page is still English throughout ("Upload a file / A file was asked for, to be put in a file field of a record. Pick one and send it. This link works once. / File / Send / Uploading…"), and it does not say which claim or which line the invoice goes to — with two links for two lines open side by side, nothing on either page tells them apart.New point: the expiry line reads "It stops working at Fri, 13 Nov 2026 03:05:58 GMT." For a user in UTC+8 that is 11:05 local time; printed in GMT it reads as a time hours in the past, in a language they did not choose. The localized page should state the expiry in the reader's own time zone (or as "in N minutes"), not as an RFC-1123 GMT string.
Generated by Claude Code
objectstack-fleet commentedon Nov 13, 2026
eval#1 · os-bob · session_012dn2AcTB69pEwZ9ugr1g1w
Follow-up: both links expired before the user got to them, and the page only said so after the upload · 2026-11-13T03:07Z
Continuing the case in my previous comment (an agent issued two upload links for two expense lines). The user opened the second link, picked the PDF and pressed Send; the page answered with the one shared refusal:
The page had itself printed "It stops working at … 03:06:03 GMT" when it was opened, and Send was pressed after that moment — so it was the expiry, but the user could not tell which of the four it was.
Two points, neither asking to weaken the deliberate one-answer refusal on the server (
upload-link-wire.ts, so a link reveals nothing about which case applies):expiresAt(upload-link-page.ts:101). A client-side check of that same timestamp before sending — "This link expired at 11:06 (your time). Ask for a new one." — tells the reader nothing the page had not already shown, and saves picking and uploading a file into a dead link. Same for disabling Send once the printed time has passed.UPLOAD_LINK_TTL_SECONDS = 10 * 60(record-file-access.ts:105). In the agent flow the agent mints the links in one turn and the person acts on them later; here both links (issued a second apart, one per line item) had expired by the time the user switched to the browser. Whether the lifetime should be longer, or configurable per deployment, is a call for the owner of this card — noting the measured case.Generated by Claude Code
objectstack-fleet commentedon Nov 13, 2026
domain:server#7 · os-tesla · session_01L9qibzuZJBQY4wUQFJbkfx
Claim: PM loop round 12, card thread · 2026-11-13T23:42Z · item (b) under ruling B′ 6842088322 (2026-11-13T02:32Z); MCP p2 under 「mcp 相关 p2 任务也可以派发处理」 (2026-11-13T15:50:52Z); item (a) landed in #32891
Session:
session_01L9qibx5D96ejKtJ5SFjgkRAccount:
os-teslaBranch:
claude/project-thread-ddgmfcWorktree:
objectstack-issue-32712Domain:
domain:serverSeat:
domain:server#7File surface:
packages/services/service-storage/src/upload-link-page.ts,upload-link-copy.ts,record-file-access.ts(the link view only),upload-link-wire.ts(only if the view's shape needs it),storage-routes.ts(only the page route's read-as-owner wiring), their tests, one root changeset. Stop on breach.Container & model:
M,mode:thread,model: default (dispatch-gates --tier: no path-derived mandate; PM default),effort: mediumClause-②: yes (widening) — the page names the record and field for the link's own user (B′) and prints the expiry in the reader's time; no new refusal, the server's single unusable-link answer unchanged
Metadata-protocol: none
Responsibility: the page and link view are
service-storage's, objectstack | the localized page (#32891) and the link's owner binding already exist | every recipient of an MCP upload link today, two links side by side read the sameThread-read: 6842606859
Premise: re-measure — the dev renders the page at
origin/main(≥5e250a65, after #32747) in en and zh-CN first; eval 6842586067 saw English on a deployed buildSerial constraints cleared: #32747 (PR #33151) merged
5e250a65; no open seat-7 PR touches service-storageobjectstack-fleet commentedon Nov 13, 2026
domain:server#7 · os-tesla · session_01L9qibzuZJBQY4wUQFJbkfx
Claim amendment to this seat's claim 6867767971 on #32712 · 2026-11-13T23:45Z: the file surface adds
packages/services/service-storage/src/storage-service-plugin.ts: one binding, an i18n getter, so the page can translate object and field labels throughtranslateObject. Nothing else in that file changes.The shape is in
out/32712b-proposed-shape.mdand the seat accepts it:openLinkchecks, so a stranger, an expired link or a used link keeps today's 404 byte for byte.resolveUserContextandengine.findOneunder that context. There is no system read.objectstack-fleet commentedon Nov 13, 2026
domain:server#7 · os-tesla · session_01L9qibzuZJBQY4wUQFJbkfx
Second claim amendment to this seat's claim 6867767971 on #32712 · 2026-11-13T23:50Z: the file surface adds
packages/services/service-storage/src/file-attachment-service.ts, the registered upload-link door that delegates toRecordFileAccess. Pass-through only:inspectUploadLinkforwards the new optional options argument;getSecuritytype gainsgetReadableFieldsandgetQueryableFields;getI18njoins itsrecordFilesPick.No behaviour of its own changes. That file was last touched by storage + mcp: one upload link on a multiple: true file field accepts several files (same user, record, field, one use, same expiry) — ruled A #32747 (merged
5e250a65); no open seat-7 PR touches it.objectstack-fleet commentedon Nov 14, 2026
domain:server#7 · os-tesla · session_01L9qibx5D96ejKtJ5SFjgkR
os-dev-report
{ "issue": 32712, "status": "done", "branch": "claude/project-thread-ddgmfc", "pr": "https://github.com/objectstack-ai/objectstack/pull/33185", "session": "session_01L9qibx5D96ejKtJ5SFjgkR", "premise_still_valid": true, "summary": "Item (b), ruling B′ (6842088322). The upload-link page GET now shows two rows to the link's own user: Record (object label + record title) and Goes into (field label, or Attachments); a not-yet-created record shows the object label as 'a new …, not created yet'. Names are read only after openLink has found the link open, unexpired and the caller's, as that user: resolveUserContext then engine.findOne with the user's context (no system read). An unreadable record (no row, 403/404) or a user no longer in the org gets the existing unusable-link 404; other failures degrade to today's page. The title (resolveDisplayField) shows only when getQueryableFields lists it for that user (readable and unmasked), the field label only when getReadableFields lists it; a security service lacking either method fails closed. Labels go through translateObject over the i18n service bundle in the page's language; a missing label is dropped, never replaced by an API name. Names are HTML text only: not in script data, attributes or the tab title. Expiry: the server keeps the UTC text inside <time datetime>; the script rewrites it in the reader's time zone and, on the server's clock (skew from the sent now), disables picker and Send once passed, at load, before pick/send and on a timer. The PUT door and its refusal are byte-unchanged. Item (a) holds on main 5e250a65 (measured); the eval saw a pre-#32891 build (inference, stated as such in the PR body). Wiring: storage-routes passes { names: { lang } }; storage-service-plugin binds getI18n; file-attachment-service is pass-through (claim amendment 6867825002).", "tests": "New describe '#32712 (b) — ruling B′' in record-file-access.integration.test.ts, 10 cases, covering the seat's three checks: (1) a record the owner can no longer read gets the 404 byte-identical (nonce aside) to a stranger's and an unknown token's, en and zh-CN; (2) masked, hidden and no-getQueryableFields titles show the object label only and the title's words appear in no byte of HTML or headers; (3) opening the page three times writes nothing (sys_file count, link row, record unchanged) and the link then takes its upload. Also: owner rows en/zh with no id/API name/user/org and a generic tab title, i18n labels, attachments/multi-file/not-yet-created links, unreadable field drops its row, CONTROL refusals byte-identical to main, local-time expiry and the client expired state (vm with injected Date/setTimeout). upload-link-copy.test.ts holds all 11 languages to the 8 new entries. pnpm --filter @objectstack/service-storage test 83 files / 1583 tests and typecheck, VERDICT command-exit 0 (before the main merge); the two touched suites 86/86 after it. 11 ablations via scripts/ablation-replace.mjs, all red, every restore proven (blob == HEAD): system read, unreadable-record degrade, no masked check, fail-open without getQueryableFields, no field readability check, tab title naming the record, names in script data, no client expiry, browser clock only, no local-time rewrite, untranslated label.", "gates": "dispatch-gates --commands: 75 families, stdin closed, exits recorded before any pipe. 72 exit 0 first pass; 3 exit 3 on prerequisites, rerun exit 0 after meeting them: check-plugin-teardown-shape --self-test (git fetch --unshallow), check:i18n (its named build closure; 10 packages in sync), check:dual-build-cjs-loads (full turbo build; 123 entries / 72 packages load). --ran reconciles 75 derived, 75 run, 0 NOT-MEASURED, 0 UNRUN. pnpm lint exit 0. origin/main merged once at 68972cd2 (3 ui-only commits). List: server-seat-7/r2026-11-13/out/32712b-evidence/gates-ran-d7916e2f.list.", "dogfood_battery": "n/a — no ! in the PR title and Clause-② is yes (widening)", "mcp_calls": "0", "api_writes": "2 — relay pr_create (#33185, assignee os-tesla, body read back identical 16199 bytes), and this os-dev-report comment via post-stamped", "open_questions": [ "UPLOAD_LINK_TTL_SECONDS stays 10 minutes, untouched. Eval 6842606859 measured two agent-minted links expiring before the user reached them; whether to lengthen it or make it configurable is the card owner's call." ], "security_findings": "withheld|none", "out_of_scope_findings": [ "carrier: none · noted, not filed: packages/qa/dogfood/test/showcase-mcp-record-files.dogfood.test.ts:548 still says the pre-record page 'names nothing'; its assertions (no API name, no email) still hold, so the comment is stale only, and the file is outside this card's surface.", "carrier: none · noted, not filed: an object that declares no label drops the Record row rather than show an API name; not pinned because every fixture object declares a label." ] }objectstack-fleet commentedon Nov 14, 2026
domain:server#7 · os-tesla · session_01L9qibx5D96ejKtJ5SFjgkR
os-dev-report (round 2, follow-up to 6868561765)
{ "issue": 32712, "status": "done", "pr": "https://github.com/objectstack-ai/objectstack/pull/33185", "head": "8cad649c97cac01493b98ede4c87a20d396b5725", "answers_review": "6868703934", "summary": "MF1: the title is shown only from a title-typed column (isTitleEligible, or the autonumber primary) that declares no maskingRule, the same gate as the engine's own title disclosure. A lookup, user or select nameField shows the object's label only. MF2: Send stops the expiry timer, and from then on the status line belongs to the send. A landed file is never followed by 'expired', a running send is not talked over, and a failed send re-arms the timer. SF1: the user-left-the-organization 404 and the read-refused 403/404 paths are pinned; a 500 degrades. N1 (read-audit row) and N4 (the GET's new 404) are scoped in the PR body. N2 and N3 are left as they are, per the review.", "tests": "14 B′ cases (4 new). Package suite 83 files / 1587 tests plus typecheck: VERDICT command-exit 0. 6 new ablations (title-type gate, left-org degrade, 403/404 degrade, expiry over a send, timer not stopped, failed send not re-armed), all red, restores proven. A3 and A5 rerun at the new head, still red.", "gates": "75 derived, 75 run, 0 NOT-MEASURED, all exit 0 on the first pass at 8cad649c. dual-build-cjs-loads and check:i18n were also rerun after rebuilding service-storage, both exit 0. pnpm lint exit 0.", "mcp_calls": "1 read (issue_read get_comments #33185 for the review record); 0 writes", "api_writes": "2 this round: a relay issue_patch of the #33185 body (19062 bytes read back identical) and this comment", "security_findings": "none", "open_questions": ["UPLOAD_LINK_TTL_SECONDS (10 minutes) is unchanged; the card owner decides, per eval 6842606859."] }