test(plugin-sharing,plugin-security): pin the ruled mint matrix beside the service and the owner alternative at the organization wall

Beside the service: the owner mints on an owner-private object, a hierarchy
manager without visibility is refused (and its write scope is never asked),
a non-owner member is refused, Modify-All mints with visibility refused; the
opt-in comes first and eligibility last. Through the real plugin wiring and
the real Layer 0: a member who owns a record in an organization they are not
in is refused under group and isolated.

Claude-Session: https://claude.ai/code/session_01DiCSbmJrkzNhuEAier4VoJ
Co-authored-by: Claude <noreply@anthropic.com>

Author: claude

packages/plugins/plugin-security/src/share-link-tenant-wall.test.ts

@@ -160,14 +160,18 @@ interface MintOptions {
   memberOf: string[];
   /** The record's owning organization. */
   recordOrg?: string;
+  /** The record's `owner_id`; absent ⇒ the row carries none. */
+  recordOwner?: string;
 }
 
 /**
  * Boot the real `SharingServicePlugin` and POST `/api/v1/share-links` for
  * `crm_account/acc_1` as a signed-in member — the exact call a user makes from
  * the record page's "share" button.
  */
-async function groupPostureMint(opts: MintOptions): Promise<{ status: number; body: any }> {
+async function groupPostureMint(
+  opts: MintOptions,
+): Promise<{ status: number; body: any; links: any[] }> {
   const userId = 'u_sharer';
   const activeOrg = opts.memberOf[0];
   const tables: Record<string, any[]> = {
@@ -181,7 +185,12 @@ async function groupPostureMint(opts: MintOptions): Promise<{ status: number; bo
     sys_user_position: [],
     sys_user_permission_set: [],
     sys_permission_set: [],
-    [OBJECT]: [{ id: RECORD, name: 'Acme', organization_id: opts.recordOrg ?? ORG_A }],
+    [OBJECT]: [{
+      id: RECORD,
+      name: 'Acme',
+      organization_id: opts.recordOrg ?? ORG_A,
+      ...(opts.recordOwner ? { owner_id: opts.recordOwner } : {}),
+    }],
     sys_share_link: [],
   };
 
@@ -194,6 +203,9 @@ async function groupPostureMint(opts: MintOptions): Promise<{ status: number; bo
     getService: (name: string) => {
       if (name === 'objectql') return engine;
       if (name === 'http-server') return http;
+      // The posture the sharing service reads (ADR-0105 D1) — the same one the
+      // engine's Layer 0 applies.
+      if (name === 'tenancy') return { posture: opts.posture };
       if (name === 'auth') {
         return {
           api: {
@@ -233,7 +245,8 @@ async function groupPostureMint(opts: MintOptions): Promise<{ status: number; bo
     },
     res,
   );
-  return captured;
+  // The store, read back: a refusal is only a refusal if no row landed.
+  return { ...captured, links: tables.sys_share_link ?? [] };
 }
 
 describe('[#6206] share-link creation under the `group` tenancy posture', () => {
@@ -267,3 +280,49 @@ describe('[#6206] share-link creation under the `group` tenancy posture', () =>
     expect(res.status).toBe(201);
   });
 });
+
+/**
+ * [ADR-0111 D8 rule 1 — ruling 5950188467, A′] The owner may mint on a record
+ * their visibility read refuses — but never across the organization wall.
+ *
+ * The owner alternative reads `owner_id`, and `owner_id` outlives a
+ * membership: a member who left the record's organization still owns the rows
+ * they created there. Under a walled posture the visibility read applies Layer
+ * 0, and that refusal is the only thing standing between such a member and a
+ * capability token on their former organization's record, which
+ * `resolveToken` would then serve anonymously. So where a wall is in force the
+ * owner and Modify-All alternatives are withheld and visibility alone admits.
+ *
+ * Real here, as above: the plugin's own wiring (the link service's
+ * `canMintWithoutVisibility` probe is the one `SharingServicePlugin` composes)
+ * and the real `computeTenantLayer0Filter`.
+ */
+describe('[ADR-0111 D8] the owner alternative does not cross the organization wall', () => {
+  it.each(['group', 'isolated'] as const)(
+    '%s: a member of plant B who OWNS a record in plant A is refused, and nothing lands',
+    async (posture) => {
+      const res = await groupPostureMint({
+        posture,
+        memberOf: [ORG_B],
+        recordOrg: ORG_A,
+        recordOwner: 'u_sharer',
+      });
+
+      expect(res.status).toBe(403);
+      expect(res.body).toMatchObject({ success: false, error: { code: 'FORBIDDEN' } });
+      expect(res.links).toEqual([]);
+    },
+  );
+
+  it('control: the same owner, in the record\'s own organization, mints', async () => {
+    const res = await groupPostureMint({
+      posture: 'isolated',
+      memberOf: [ORG_A],
+      recordOrg: ORG_A,
+      recordOwner: 'u_sharer',
+    });
+    expect(res.status).toBe(201);
+    expect(res.body.data).toMatchObject({ object_name: OBJECT, record_id: RECORD, created_by: 'u_sharer' });
+    expect(res.links.map((l) => l.created_by)).toEqual(['u_sharer']);
+  });
+});

packages/plugins/plugin-sharing/src/share-link-service.test.ts

@@ -2,6 +2,7 @@
 
 import { describe, it, expect, beforeEach } from 'vitest';
 import { ShareLinkService } from './share-link-service.js';
+import { SharingService } from './sharing-service.js';
 
 interface FakeRow { [k: string]: any }
 
@@ -1170,3 +1171,228 @@ describe('[#12981] a refused usage stamp is reported ONCE as a durability degrad
     await expect(service.resolveToken(link.token)).resolves.not.toBeNull();
   });
 });
+
+// ── [ADR-0111 D8 rule 1 — ruling 5950188467, A′] who may mint ────────────────
+//
+// "`createLink` admits `visibility OR owner OR Modify-All bypass`, still behind
+// the `publicSharing` opt-in and before its `eligibility` check. … A hierarchy
+// manager still needs visibility to mint." The owner and bypass halves are
+// `canManageShares`' own first two branches, so the link service here is wired
+// to a REAL `SharingService` exactly as `SharingServicePlugin` wires it; only
+// its probes (the security service, the enterprise hierarchy resolver, the
+// tenancy posture) are doubles.
+//
+// The object is OWNER-PRIVATE: the double below refuses every non-system read
+// of it the way the CRUD gate does on an `access.default: 'private'` object
+// (`PERMISSION_DENIED` with `statusCode` 403), except for `u_reader`, the one
+// principal who can see it. So on the visibility rule alone nobody else —
+// the owner included — could ever mint.
+describe('[ADR-0111 D8 rule 1 / ruling A′] mint authority: visibility, or the record owner, or Modify-All', () => {
+  const OWNER = 'u_owner';
+  const STRANGER = 'u_stranger';
+  const ADMIN = 'u_admin';
+  const MANAGER = 'u_manager';
+  const READER = 'u_reader';
+
+  const SCHEMAS = {
+    sys_share_link: { name: 'sys_share_link', fields: {} },
+    conversations: {
+      name: 'conversations',
+      access: { default: 'private' },
+      publicSharing: { enabled: true, allowedAudiences: ['link_only'], allowedPermissions: ['view'] },
+      fields: { id: {}, title: {}, owner_id: {} },
+    },
+    // The same object shape with an eligibility predicate, for the ordering pins.
+    briefs: {
+      name: 'briefs',
+      access: { default: 'private' },
+      publicSharing: { enabled: true, eligibility: "record.status == 'published'" },
+      fields: { id: {}, title: {}, status: {}, owner_id: {} },
+    },
+    // Never opted in.
+    notes: { name: 'notes', access: { default: 'private' }, fields: { id: {}, owner_id: {} } },
+  };
+  const PRIVATE_OBJECTS = new Set(['conversations', 'briefs', 'notes']);
+
+  const denial = () =>
+    Object.assign(new Error('You do not have permission to perform this action.'), {
+      code: 'PERMISSION_DENIED',
+      statusCode: 403,
+    });
+
+  let engine: ReturnType<typeof makeFakeEngine>;
+  let posture: string | undefined;
+  let writeScopeCalls: number;
+  let sharing: SharingService;
+  let service: ShareLinkService;
+  let mintProbeCalls: Array<[string, string, string | undefined]>;
+
+  const mintIn = (object: string, recordId: string) =>
+    ({ object, recordId, audience: 'link_only', permission: 'view' }) as const;
+  const conversation = () => mintIn('conversations', 'c1');
+  const as = (userId: string) => ({ userId }) as any;
+  const minted = () => (engine._tables.sys_share_link ?? []).map((r) => r.created_by);
+
+  beforeEach(() => {
+    engine = makeFakeEngine(SCHEMAS);
+    engine._tables.conversations = [{ id: 'c1', title: 'My chat', owner_id: OWNER }];
+    engine._tables.briefs = [
+      { id: 'b_draft', title: 'Draft', status: 'draft', owner_id: OWNER },
+      { id: 'b_pub', title: 'Published', status: 'published', owner_id: OWNER },
+    ];
+    engine._tables.notes = [{ id: 'n1', owner_id: OWNER }];
+    const plainFind = engine.find.bind(engine);
+    engine.find = async (object: string, options?: any) => {
+      const ctx = options?.context ?? {};
+      if (PRIVATE_OBJECTS.has(object) && ctx.isSystem !== true && ctx.userId !== READER) throw denial();
+      return plainFind(object, options);
+    };
+
+    posture = 'single';
+    writeScopeCalls = 0;
+    mintProbeCalls = [];
+    sharing = new SharingService({
+      engine: engine as any,
+      securityService: () => ({
+        hasWriteBypass: async (_object: string, ctx: any) => ctx?.userId === ADMIN,
+        resolveWriteScope: async (_object: string, ctx: any) => {
+          writeScopeCalls += 1;
+          return ctx?.userId === MANAGER ? 'unit' : 'own';
+        },
+      }),
+      // The enterprise seam: the manager's `unit` covers the owner.
+      hierarchyResolver: () =>
+        ({
+          resolveOwnerIds: async (ctx: any, scope: string) =>
+            ctx?.userId === MANAGER && scope === 'unit' ? [MANAGER, OWNER] : [String(ctx?.userId)],
+        }) as any,
+      tenancy: () => (posture === undefined ? null : { posture }),
+    });
+    // Wired the way `SharingServicePlugin` wires it.
+    service = new ShareLinkService({
+      engine: engine as any,
+      canManageShares: (o, r, c) => sharing.canManageShares(o, r, c),
+      canMintWithoutVisibility: (o, r, c) => {
+        mintProbeCalls.push([o, r, (c as any)?.userId]);
+        return sharing.canMintWithoutVisibility(o, r, c);
+      },
+    });
+  });
+
+  it('[persona] nobody but the reader sees the record: the owner\'s own read is refused', async () => {
+    await expect(engine.find('conversations', { where: { id: 'c1' }, context: as(OWNER) }))
+      .rejects.toMatchObject({ code: 'PERMISSION_DENIED', statusCode: 403 });
+    expect(await engine.find('conversations', { where: { id: 'c1' }, context: as(READER) })).toHaveLength(1);
+  });
+
+  it('the owner mints on an owner-private object, and the link resolves', async () => {
+    const link = await service.createLink(conversation(), as(OWNER));
+    expect(link).toMatchObject({ object_name: 'conversations', record_id: 'c1', created_by: OWNER });
+    expect(minted()).toEqual([OWNER]);
+    await expect(service.resolveToken(link.token)).resolves.toMatchObject({ link: { id: link.id } });
+  });
+
+  it('a hierarchy manager without visibility is refused, though they ARE a share-manager of the record', async () => {
+    // The control: ADR-0111 D1 DEPTH admits this principal to manage shares.
+    expect(await sharing.canManageShares('conversations', 'c1', as(MANAGER))).toBe(true);
+    const callsBefore = writeScopeCalls;
+
+    await expect(service.createLink(conversation(), as(MANAGER)))
+      .rejects.toMatchObject({ code: 'PERMISSION_DENIED', statusCode: 403 });
+    expect(minted()).toEqual([]);
+    // Minting never asked for the caller's write scope: the DEPTH branch is not
+    // part of mint authority, rather than a branch that happened to say no.
+    expect(writeScopeCalls, 'the mint consulted the hierarchy-depth probe').toBe(callsBefore);
+  });
+
+  it('a non-owner member is refused with the visibility read\'s own refusal', async () => {
+    await expect(service.createLink(conversation(), as(STRANGER)))
+      .rejects.toMatchObject({ code: 'PERMISSION_DENIED', statusCode: 403 });
+    expect(minted()).toEqual([]);
+  });
+
+  it('Modify-All mints, with the visibility read refused (the bypass branch alone admits)', async () => {
+    await expect(engine.find('conversations', { where: { id: 'c1' }, context: as(ADMIN) }))
+      .rejects.toMatchObject({ code: 'PERMISSION_DENIED' });
+    const link = await service.createLink(conversation(), as(ADMIN));
+    expect(link).toMatchObject({ record_id: 'c1', created_by: ADMIN });
+  });
+
+  it('visibility still admits on its own, without asking the owner/bypass probe', async () => {
+    const link = await service.createLink(conversation(), as(READER));
+    expect(link.created_by).toBe(READER);
+    expect(mintProbeCalls).toEqual([]);
+  });
+
+  it('an empty visibility read stays 403 FORBIDDEN for a caller no alternative admits', async () => {
+    // A row filter, not a CRUD refusal: the read answers nothing.
+    engine.find = (async (object: string, options?: any) =>
+      options?.context?.isSystem === true ? engine._tables[object] ?? [] : []) as any;
+    await expect(service.createLink(conversation(), as(STRANGER)))
+      .rejects.toMatchObject({ status: 403, code: 'FORBIDDEN' });
+    // ...and the owner of the same row mints past it.
+    await expect(service.createLink(conversation(), as(OWNER))).resolves.toMatchObject({ created_by: OWNER });
+  });
+
+  describe('the order: opt-in, then authority, then eligibility', () => {
+    it('the opt-in comes first — the owner of a record on an object that never opted in is refused 422', async () => {
+      await expect(service.createLink(mintIn('notes', 'n1'), as(OWNER)))
+        .rejects.toMatchObject({ status: 422, code: 'SHARING_NOT_ENABLED' });
+      expect(mintProbeCalls).toEqual([]);
+    });
+
+    it('eligibility is judged after the owner is admitted: an ineligible record is refused 422, an eligible one mints', async () => {
+      await expect(service.createLink(mintIn('briefs', 'b_draft'), as(OWNER)))
+        .rejects.toMatchObject({ status: 422, code: 'RECORD_NOT_ELIGIBLE' });
+      await expect(service.createLink(mintIn('briefs', 'b_pub'), as(OWNER)))
+        .resolves.toMatchObject({ record_id: 'b_pub', created_by: OWNER });
+    });
+
+    it('a caller with no authority is refused BEFORE eligibility, learning nothing about the record', async () => {
+      // The draft would draw RECORD_NOT_ELIGIBLE; the stranger never reaches it.
+      await expect(service.createLink(mintIn('briefs', 'b_draft'), as(STRANGER)))
+        .rejects.toMatchObject({ code: 'PERMISSION_DENIED', statusCode: 403 });
+    });
+  });
+
+  describe('where the alternatives are withheld', () => {
+    it.each(['isolated', 'group'])(
+      'an organization wall (%s): visibility alone admits, so the owner and Modify-All are refused',
+      async (walled) => {
+        posture = walled;
+        for (const who of [OWNER, ADMIN]) {
+          await expect(service.createLink(conversation(), as(who)))
+            .rejects.toMatchObject({ code: 'PERMISSION_DENIED', statusCode: 403 });
+        }
+        expect(minted()).toEqual([]);
+        // Revoke authority is untouched by the wall: the owner still manages the record.
+        expect(await sharing.canManageShares('conversations', 'c1', as(OWNER))).toBe(true);
+      },
+    );
+
+    it('an unresolvable posture counts as walled (fail closed)', async () => {
+      posture = undefined;
+      await expect(service.createLink(conversation(), as(OWNER)))
+        .rejects.toMatchObject({ code: 'PERMISSION_DENIED' });
+    });
+
+    it('a deployment without the probe keeps visibility alone (the pre-A′ rule)', async () => {
+      const probeless = new ShareLinkService({
+        engine: engine as any,
+        canManageShares: (o, r, c) => sharing.canManageShares(o, r, c),
+      });
+      await expect(probeless.createLink(conversation(), as(OWNER)))
+        .rejects.toMatchObject({ code: 'PERMISSION_DENIED' });
+    });
+
+    it('a throwing probe is a refusal, answered with the visibility read\'s own envelope', async () => {
+      const broken = new ShareLinkService({
+        engine: engine as any,
+        canMintWithoutVisibility: async () => { throw new Error('probe down'); },
+      });
+      await expect(broken.createLink(conversation(), as(OWNER)))
+        .rejects.toMatchObject({ code: 'PERMISSION_DENIED', statusCode: 403 });
+      expect(minted()).toEqual([]);
+    });
+  });
+});

packages/runtime/src/domains/share-links-enforcement-context.test.ts

@@ -951,11 +951,12 @@ describe('[#14637] the dispatcher probe reads the standing policy before it answ
  * not a hand-assembled copy of it. DOUBLES: storage (`makeEngine` above) and
  * the enterprise hierarchy resolver, which this open edition does not ship.
  *
- * ## Why the route door is not pinned here
+ * ## The other door
  *
- * The plugin's own route door reads `err.status` alone, and the CRUD gate's
- * refusal carries `statusCode`, so on that door the refusals below answer 500
- * until #21405 lands. Its 201s are the same service call.
+ * The plugin's own route door calls the same service, so every admission and
+ * refusal below is the same verdict there. How that door maps the CRUD gate's
+ * refusal to a status is a property of that door, pinned with it; this block
+ * reads the status this door answers.
  */
 describe('[#21329] mint authority on an owner-private object (dispatcher door, ruling A′)', () => {
     const CONV = 'ai_conversations';