fix: use information-hiding for cross-user provider resolution

Non-admin callers who try to resolve a provider name owned by another
user (via suffix scan) now get NotFound rather than PermissionDenied.
This prevents leaking resource existence to unauthorized callers and
ensures consistent behavior when a user deletes their own provider
while another user has the same name.

The PermissionDenied path remains active for the shared/legacy
fallback (Step 2) where the record's owner label is directly checked
— this covers providers stored under raw names with explicit ownership.

Admin callers continue to resolve any user's provider via suffix scan.

Assisted-By: Claude (Anthropic AI) <noreply@anthropic.com>
Signed-off-by: Paolo Dettori <dettori@us.ibm.com>

Author: pdettori

crates/openshell-server/src/auth/ownership.rs

@@ -291,19 +291,18 @@ pub async fn resolve_scoped_name(
         return Ok(shared);
     }
 
-    // Step 3: Both missed — suffix scan for cross-user detection
+    // Step 3: Both missed — suffix scan for cross-user detection.
+    // Admin callers get access to any user's provider. Non-admin callers
+    // get None (surfaced as NotFound) for information-hiding security.
     let candidates = store
         .find_by_name_suffix(object_type, name)
         .await
         .map_err(|e| Status::internal(format!("suffix search failed: {e}")))?;
 
-    if let Some(record) = candidates.into_iter().next() {
-        if is_admin {
+    if is_admin {
+        if let Some(record) = candidates.into_iter().next() {
             return Ok(Some(record));
         }
-        return Err(Status::permission_denied(
-            "provider is owned by another user",
-        ));
     }
 
     Ok(None)

crates/openshell-server/src/grpc/provider.rs

@@ -5078,11 +5078,12 @@ mod tests {
                 .await
                 .unwrap();
 
+            // Information-hiding: non-owner sees NotFound, not PermissionDenied
             let err =
                 handle_get_provider(&state, get_request_with_principal("alice-provider", &bob))
                     .await
                     .unwrap_err();
-            assert_eq!(err.code(), Code::PermissionDenied);
+            assert_eq!(err.code(), Code::NotFound);
         }
 
         #[tokio::test]
@@ -5250,10 +5251,11 @@ mod tests {
                 credential_expires_at_ms: HashMap::new(),
             };
 
+            // Information-hiding: non-owner sees NotFound, not PermissionDenied
             let err = handle_update_provider(&state, update_request_with_principal(update, &bob))
                 .await
                 .unwrap_err();
-            assert_eq!(err.code(), Code::PermissionDenied);
+            assert_eq!(err.code(), Code::NotFound);
         }
 
         #[tokio::test]
@@ -5286,13 +5288,14 @@ mod tests {
                 .await
                 .unwrap();
 
+            // Information-hiding: non-owner sees NotFound, not PermissionDenied
             let err = handle_delete_provider(
                 &state,
                 delete_request_with_principal("alice-provider", &bob),
             )
             .await
             .unwrap_err();
-            assert_eq!(err.code(), Code::PermissionDenied);
+            assert_eq!(err.code(), Code::NotFound);
         }
 
         #[tokio::test]