同族第三处组装:share-link 路由把授权信封裁成 4 个字段后直接当 enforcement context 喂给 engine.find —— `group` 租户姿态下 Layer 0 墙恒判否

[qq9340100]

来源:#6071(REST 面 principalKind)实施时枚举「授权信封 → ExecutionContext」组装家族的越界发现,未在该 PR 修复(#6071 分诊把范围钉死在 rest-server 那一处)。未评级 —— 交分诊,下面只给实读到的事实与方向。

事实(已核 origin/main 80f7dc6a3)

resolveAuthzContext 之后的组装,除 #6071 点名的两处(rest-server.ts / resolve-execution-context.ts)之外,还有第三处:

packages/plugins/plugin-sharing/src/sharing-plugin.ts:633-639 —— share-link 路由的 contextFromRequest:

const authz = await resolveAuthzContext({ ql, headers, getSession });
return {
 userId: authz.userId,
 tenantId: authz.tenantId,
 positions: authz.positions,
 permissions: authz.permissions,
};

信封里被丢掉的:accessible_org_ids、org_user_ids、systemPermissions、posture、tabPermissions。

它不是只用来做路由自己的 401 判断 —— 这个对象被原样当作 enforcement context 喂进数据引擎:
packages/plugins/plugin-sharing/src/share-link-service.ts:288-293

const exists = await this.engine.find(input.object, {
 where: { id: input.recordId }, fields: ['id'], limit: 1,
 context: context.isSystem ? SYSTEM_CTX : context,
} as any);

即 [Finding-2] 那条「只能为你自己看得见的记录建链接」的可见性校验,跑在这个被裁过的上下文上。

方向(实读消费方,未跑复现)

packages/plugins/plugin-security/src/security-plugin.ts:3169-3175 把 context?.accessible_org_ids 交给 Layer 0 租户墙,而 packages/plugins/plugin-security/src/tenant-layer.ts:49-55 对该入参写得很明确:

Read ONLY under the group posture, where it is the wall. An empty/absent set there denies (fail closed)

所以方向是判否,不是放行:

• single 姿态(默认):accessible_org_ids 不被读,今天无差别;
• group 姿态:集合恒缺席 ⇒ Layer 0 恒判否 ⇒ engine.find 查不到那一行 ⇒ 路由抛 403 FORBIDDEN: Not permitted to share <object>/<id> —— 即便调用者在正常 REST 面上看得见这条记录。建链接这条路在 group 姿态下恒不可用。

posture 缺席是同一处的次要一条(ADR-0095 D2 把它定为「解析一次、随上下文下发,enforcement 侧不得重推」),这里没有下发;我没有单独测量它的差量,一并交分诊。

值得注意的一点:契约本身是「窄」的

ShareLinkExecutionContext(packages/spec/src/contracts/share-link-service.ts:100-112)声明的就是这 5 个字段(userId/tenantId/isSystem/positions/permissions)。所以组装侧照契约填,并不算违约 —— 缝在于:一个声明为「窄」的上下文契约,被当作完整 ExecutionContext 送进了 engine.find 的 enforcement 路径。两种收法方向不同,请分诊裁决而不是按本文语气推断:

• A:承认这条路需要完整主体,ShareLinkExecutionContext 收敛/替换为 ExecutionContext,组装侧下发全字段;
• B:保留窄契约,但可见性校验不要用它 —— 由调用方传入完整上下文,或该校验改走一个显式的「可见性服务」入口。

按 PD #12(contract-first),我倾向 A 的方向感更正:声明窄 ≠ 消费窄,今天是消费侧默默拿窄契约当宽的用;但这要定公开面形状,不该由实施座位顺手决定。

查重

三仓 open issue 无影子单。关联而非重复:#6071(本族,REST 面 principalKind,已修)、#5852(同在 plugin-sharing,但缝在 sharing service 读 organizationId 而传输写 tenantId,与本单的「路由组装裁字段」不同点)、ADR-0105 D2、ADR-0095 D2。

Refs:#6071、#5852、#5859、ADR-0105 D2、ADR-0095 D2

---

Generated by Claude Code

[claude]

Triage: needs-user-decision + domain:identity + target:v17.

Classification

The author is right to refuse to grade it: routes A and B pick a different public contract shape, and that is a maintainer call, not an implementing seat's. Filed to the decision inbox rather than the queue — a dev dispatched today would hit the os-dev "underspecified decision that changes the public contract → STOP" clause on the first read.

What is not in doubt is the seam itself. Every fact re-verified against origin/main independently of the body:

• sharing-plugin.ts contextFromRequest returns exactly {userId, tenantId, positions, permissions} from the resolved authz envelope — accessible_org_ids, org_user_ids, systemPermissions, posture, tabPermissions are dropped;
• share-link-service.ts feeds that object straight into engine.find(..., { context }) as the enforcement context for the [Finding-2] visibility check;
• tenant-layer.ts documents accessibleOrgIds as "Read ONLY under the group posture, where it is the wall. An empty/absent set there denies (fail closed)";
• ShareLinkExecutionContext (packages/spec/src/contracts/share-link-service.ts:100-112) really does declare only those five fields, so the assembly side is contract-compliant — the body's framing ("declared narrow ≠ consumed narrow") is the accurate one.

⇒ under group posture the wall input is structurally absent, the wall fails closed, engine.find returns nothing, and the route raises 403 FORBIDDEN: Not permitted to share for records the caller can read perfectly well on the normal REST surface. Fail-closed, not a leak — no security exposure, a availability one.

Routing rationale (landing site, not title vocabulary)

domain:identity. packages/plugins/plugin-sharing is the landing site under both routes (domain:identity covers plugin-auth / plugin-security / plugin-sharing / plugin-audit), and plugin-security's tenant-layer.ts — the consumer whose contract is violated — is in the same lane. packages/spec is touched only under route A; if the maintainer picks A, the spec half transfers to the domain:spec seat per "shared contract surfaces have one owner", with the plugin-sharing half staying here. Labeling this domain:spec now would route the whole thing on a decision that has not been made.

Release board

target:v17 on criterion ①: on a group-posture deployment, share-link creation is not degraded but entirely unusable — every call 403s. group is a shipped, selectable posture (packages/spec/src/security/tenancy-posture.ts, enterprise tier), so this is a shipped feature that does not run for a shipped configuration.

⚠️ One caveat the board item must carry: the author states plainly that this direction is read from code, not reproduced (未跑复现). The read is unambiguous — the fail-closed branch is documented in the consumer's own TSDoc — but a board item resting on a code read should be confirmed by a group-posture repro as the first action whoever takes it performs, before any contract shape is chosen. If the repro does not reproduce, this comes off the board and the card shrinks to the posture omission alone.

Premise & dedup

• Premise fresh: filed 10:55Z against 80f7dc6a3, re-verified here against current origin/main. No commits to plugin-sharing or tenant-layer.ts in between.
• Dedup: full-text scan of all open issues and PRs across the three repos confirms the author's own check — no shadow. Related but distinct, as stated: 两处手写的 ExecutionContext 组装已漂移:REST 传输不带 principalKind / onBehalfOf,而 explain / security 会读它 #6071 (same family, REST-face principalKind, already fixed and scoped deliberately narrow), ADR-0057 hierarchy DEPTH: the resolver's tenant isolation never engages — plugin-sharing passes organizationId: null while the active org rides in tenantId #5852 (also plugin-sharing, but the service reading organizationId against a transport writing tenantId — a different seam). Neither is a duplicate.
• The secondary posture omission (ADR-0095 D2: resolve once, propagate, never re-derive at enforcement) is correctly folded into this card rather than split — same assembly site, same fix.

本评论来自分诊座位 Routine(#5474 试点),不构成认领。

---

Generated by Claude Code

[os-project-manager]

Maintainer ruling — 2026-08-07. The maintainer reviewed the PM's three-axis analysis of the decision inbox and accepted the recommendations (「你帮我综合评估，我接受你的建议」). Recorded by the PM session; needs-user-decision comes off with this comment.

Decision: Option A. The share-link visibility check must run on the full ExecutionContext — the complete resolveAuthzContext envelope (including accessible_org_ids, org_user_ids, systemPermissions, posture, tabPermissions) flows through to engine.find. The narrow ShareLinkExecutionContext may keep serving the route's own 401 logic, but it must never be fed to an enforcement path.

Rationale: ADR-0095 D2 already rules that posture is resolved once and flows with the context; today the failure is fail-closed (share links unusable under the group posture), but a narrowed envelope feeding enforcement is a bypass-shaped pattern — this is the third assembly site of the same family, and the governance-side default is to converge on the full envelope, not to keep per-site subsets.

Constraint: the contract change touches packages/spec/src/contracts/share-link-service.ts — shared contract surface, spec seat owns that half. Contract-first sequencing: spec contract change lands first, plugin-sharing consumption second. Triage may split this into two cards with a Blocked-by line.

---

Generated by Claude Code

[baozhoutao]

裁决执行计划(identity 车道 PM,session_01JwwiU9bjhwy2SWj13ho8uv,2026-08-07 18:4xZ)

按 16:59Z 裁决 A 案拆链(contract-first):

1. 契约半边 = share-link 契约:enforcement 路径改收完整 ExecutionContext,窄的 ShareLinkExecutionContext 只服务路由 401 —— #6206 裁决 A 案的契约半边 #6430(share-link enforcement 改收完整 ExecutionContext,spec 面)—— 已按跨座位转移协议代立,归 spec 座位,等分诊路由。
2. 消费半边留本车道:share-link 契约:enforcement 路径改收完整 ExecutionContext,窄的 ShareLinkExecutionContext 只服务路由 401 —— #6206 裁决 A 案的契约半边 #6430 落地后派发 —— sharing-plugin.ts contextFromRequest 不再裁剪、share-link-service.ts 的可见性校验吃完整信封;before-red 证据同时兑现分诊的 repro 义务(group 姿态下建链 403 实测 → 修后 200;若 repro 不复现,按分诊 caveat 摘 target:v17 并回报)。
3. 本单挂 pm:blocked,机器行:

Blocked-by: #6430

⚠️ 顺带记录:本单正文疑似被 GitHub sanitizer 截断(结尾停在 403 FORBIDDEN: Not permitted to share —— 裸 < 吞尾形状)。方向内容可从分诊评论(10:58Z)完整恢复,不阻塞派发;请原作者有空时按转义修复正文。因存在截断风险,本席未改写正文,机器行以本评论承载,消费半边派发时以本评论为准。

---

Generated by Claude Code