feat(operations): add a `put` operation, and fix the target-database authorization mismatch - #2347

Open

dawsontoth wants to merge 11 commits into

mainfrom

security/ops-api-default-database-authz

Commits on Aug 26, 2026

feat(operations): add `full_record` for a full-replace write

dawsontoth
and
claude
committed
56afc99
feat(operations): add `__unset__` to remove attributes from a merge

dawsontoth
and
claude
committed
4c8fa90
fix(operations): scope the attribute-permission denials to the ops they apply to

dawsontoth
and
claude
committed
70fd3d7
fix(security): resolve the target database identically in authorization and handlers

dawsontoth
and
claude
committed
7923bd8
fix(operations): make takeUnsetAttributes self-safeguarding

dawsontoth
and
claude
committed
2c6c7f5
fix(operations): don't write req.schema in transformReq when it wouldn't change

dawsontoth
and
claude
committed
2849bb6
fix(operations): close three findings from the cross-model review

dawsontoth
and
claude
committed
a3bab5c
fix(operations): refuse `__unset__` whenever there is no record to remove from

dawsontoth
and
claude
committed
14f9dca
fix(operations): latch the malformed-`__unset__` warning per table, not per process

dawsontoth
and
claude
committed
038e3de
fix(security): stop a caller-supplied `action` from skipping attribute permissions

dawsontoth
and
claude
committed
341be57

Commits on Aug 27, 2026

feat(operations): replace `full_record` and `__unset__` with a `put` operation

dawsontoth
and
claude
committed
1ac8d30