From 96574ba46702c2bb2581ae917ff4e50d56978c90 Mon Sep 17 00:00:00 2001 From: Claude Date: Wed, 2 Sep 2026 23:29:39 +0000 Subject: [PATCH] docs(security): add publicSharing.enabled standing-policy paragraph MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Item 2 of #14582 (follow-up to #14033 / PR #14580, split from #14033's docs surfaces that PR #14580 could not touch). The "Public Share Links" section documented the child predicate (eligibility, #13608) as a standing policy held at every redemption, but not the parent switch publicSharing.enabled — #14033 made that switch the same shape: held at every redemption, not only at mint. Adds the sibling paragraph plus its upgrade-note callout, placed after the eligibility paragraph so a reader who has already understood the child predicate recognises the parent's paragraph as the same shape one level up. Co-Authored-By: Claude Fable 5.1 Claude-Session: https://claude.ai/code/session_01WLJQhde67SeTccsmnBVarV --- content/docs/protocol/objectql/security.mdx | 25 +++++++++++++++++++++ 1 file changed, 25 insertions(+) diff --git a/content/docs/protocol/objectql/security.mdx b/content/docs/protocol/objectql/security.mdx index 3d3231d6de..6907dec760 100644 --- a/content/docs/protocol/objectql/security.mdx +++ b/content/docs/protocol/objectql/security.mdx @@ -467,6 +467,31 @@ reclassification, widen the predicate rather than relying on the old behaviour. +**When `publicSharing.enabled` is off** (#14033). The block's own switch is +the same standing-policy shape as `eligibility` above, one level up: it too +is held at every redemption, not only at mint. Turning it off stops every +existing link on the object immediately, with no revocation step to +remember; turning it back on restores them, with no link needing to be +re-minted. Turning the block off silences everything inside it — +`eligibility` is not evaluated, `redactFields` is not computed — so the +bypass some callers have at mint (a late schema scan, or a system context) +buys only the mint: it still succeeds while the block is off, but what it +mints does not resolve until the block is enabled. What an anonymous holder +sees is the same "invalid or expired" answer `eligibility` already gives; +the readable reason is written to the server log, never to the response. + + +**Upgrade note.** Before this, `publicSharing.enabled` gated only the mint — +once a link was issued it kept resolving after the object's switch was +turned off. Deployments upgrading across that change can feel it: links +that used to keep serving after `enabled` was flipped off now stop +immediately, and resume as soon as it is flipped back on. That is the +intent — the alternative was a declared switch the platform did not hold — +but there is no way to keep an already-minted link serving through the +object being switched off; the object must stay opted in for its links to +serve. + + --- ## 6. Field-Level Encryption